# Flog Txt Version 1 # Analyzer Version: 3.2.1 # Analyzer Build Date: Feb 5 2020 10:35:20 # Log Creation Date: 12.02.2020 20:39:18.761 Process: id = "1" image_name = "ef3ff3f0.exe" filename = "c:\\users\\fd1hvy\\desktop\\ef3ff3f0.exe" page_root = "0x7fc2000" os_pid = "0x13ac" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x7d0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\ef3ff3f0.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x13b0 [0039.222] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x254) returned 0xeee678 [0039.310] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x6) returned 0xee2b48 [0039.310] RtlInitAnsiString (in: DestinationString=0xb3fbf0, SourceString="NTDLL" | out: DestinationString="NTDLL") [0039.310] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fbf8, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0039.310] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0xc) returned 0xef1a50 [0039.310] RtlFreeAnsiString (AnsiString="N") [0039.310] RtlInitUnicodeString (in: DestinationString=0xb3fbfc, SourceString="NTDLL" | out: DestinationString="NTDLL") [0039.310] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0xb3fc08 | out: BaseAddress=0xb3fc08*=0x77850000) returned 0x0 [0039.311] RtlFreeHeap (HeapHandle=0xee0000, Flags=0x0, BaseAddress=0xef1a50) returned 1 [0039.311] RtlFreeHeap (HeapHandle=0xee0000, Flags=0x0, BaseAddress=0xee2b48) returned 1 [0039.312] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x6) returned 0xee2b48 [0039.312] RtlInitAnsiString (in: DestinationString=0xb3fbf0, SourceString="NTDLL" | out: DestinationString="NTDLL") [0039.312] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fbf8, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0039.312] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0xc) returned 0xef1948 [0039.312] RtlFreeAnsiString (AnsiString="N") [0039.312] RtlInitUnicodeString (in: DestinationString=0xb3fbfc, SourceString="NTDLL" | out: DestinationString="NTDLL") [0039.312] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0xb3fc08 | out: BaseAddress=0xb3fc08*=0x77850000) returned 0x0 [0039.312] RtlFreeHeap (HeapHandle=0xee0000, Flags=0x0, BaseAddress=0xef1948) returned 1 [0039.313] RtlFreeHeap (HeapHandle=0xee0000, Flags=0x0, BaseAddress=0xee2b48) returned 1 [0039.313] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x6) returned 0xee2b48 [0039.313] RtlInitAnsiString (in: DestinationString=0xb3fbf0, SourceString="NTDLL" | out: DestinationString="NTDLL") [0039.313] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fbf8, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0039.313] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0xc) returned 0xef1b58 [0039.313] RtlFreeAnsiString (AnsiString="N") [0039.313] RtlInitUnicodeString (in: DestinationString=0xb3fbfc, SourceString="NTDLL" | out: DestinationString="NTDLL") [0039.313] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0xb3fc08 | out: BaseAddress=0xb3fc08*=0x77850000) returned 0x0 [0039.314] RtlFreeHeap (HeapHandle=0xee0000, Flags=0x0, BaseAddress=0xef1b58) returned 1 [0039.314] RtlFreeHeap (HeapHandle=0xee0000, Flags=0x0, BaseAddress=0xee2b48) returned 1 [0039.317] RtlInitUnicodeString (in: DestinationString=0xb3fc68, SourceString="advapi32.dll" | out: DestinationString="advapi32.dll") [0039.317] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="advapi32.dll", BaseAddress=0xb3fc74 | out: BaseAddress=0xb3fc74*=0x76390000) returned 0x0 [0041.144] RtlInitUnicodeString (in: DestinationString=0xb3fc68, SourceString="mpr.dll" | out: DestinationString="mpr.dll") [0041.144] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="mpr.dll", BaseAddress=0xb3fc74 | out: BaseAddress=0xb3fc74*=0x741a0000) returned 0x0 [0041.359] RtlInitUnicodeString (in: DestinationString=0xb3fc68, SourceString="shell32.dll" | out: DestinationString="shell32.dll") [0041.359] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="shell32.dll", BaseAddress=0xb3fc74 | out: BaseAddress=0xb3fc74*=0x74e50000) returned 0x0 [0051.706] RtlInitUnicodeString (in: DestinationString=0xb3fc68, SourceString="netapi32.dll" | out: DestinationString="netapi32.dll") [0051.707] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="netapi32.dll", BaseAddress=0xb3fc74 | out: BaseAddress=0xb3fc74*=0x74180000) returned 0x0 [0051.860] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x7) returned 0xef87e0 [0051.860] RtlInitAnsiString (in: DestinationString=0xb3fbf0, SourceString="SRVCLI" | out: DestinationString="SRVCLI") [0051.860] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fbf8, SourceString="SRVCLI", AllocateDestinationString=1 | out: DestinationString="SRVCLI") returned 0x0 [0051.860] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0xe) returned 0xef5230 [0051.860] RtlFreeAnsiString (AnsiString="S") [0051.860] RtlInitUnicodeString (in: DestinationString=0xb3fbfc, SourceString="SRVCLI" | out: DestinationString="SRVCLI") [0051.860] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="SRVCLI", BaseAddress=0xb3fc08 | out: BaseAddress=0xb3fc08*=0x74160000) returned 0x0 [0052.013] RtlFreeHeap (HeapHandle=0xee0000, Flags=0x0, BaseAddress=0xef5230) returned 1 [0052.013] RtlFreeHeap (HeapHandle=0xee0000, Flags=0x0, BaseAddress=0xef87e0) returned 1 [0052.013] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x9) returned 0xef4fd8 [0052.013] RtlInitAnsiString (in: DestinationString=0xb3fbf0, SourceString="NETUTILS" | out: DestinationString="NETUTILS") [0052.013] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fbf8, SourceString="NETUTILS", AllocateDestinationString=1 | out: DestinationString="NETUTILS") returned 0x0 [0052.013] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x12) returned 0xef9030 [0052.013] RtlFreeAnsiString (AnsiString="N") [0052.013] RtlInitUnicodeString (in: DestinationString=0xb3fbfc, SourceString="NETUTILS" | out: DestinationString="NETUTILS") [0052.013] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NETUTILS", BaseAddress=0xb3fc08 | out: BaseAddress=0xb3fc08*=0x74150000) returned 0x0 [0052.319] RtlFreeHeap (HeapHandle=0xee0000, Flags=0x0, BaseAddress=0xef9030) returned 1 [0052.319] RtlFreeHeap (HeapHandle=0xee0000, Flags=0x0, BaseAddress=0xef4fd8) returned 1 [0052.319] RtlInitUnicodeString (in: DestinationString=0xb3fc68, SourceString="ole32.dll" | out: DestinationString="ole32.dll") [0052.319] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="ole32.dll", BaseAddress=0xb3fc74 | out: BaseAddress=0xb3fc74*=0x76470000) returned 0x0 [0053.354] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x1b) returned 0xefec78 [0053.354] RtlInitAnsiString (in: DestinationString=0xb3fbf0, SourceString="api-ms-win-core-com-l1-1-0" | out: DestinationString="api-ms-win-core-com-l1-1-0") [0053.354] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fbf8, SourceString="api-ms-win-core-com-l1-1-0", AllocateDestinationString=1 | out: DestinationString="api-ms-win-core-com-l1-1-0") returned 0x0 [0053.354] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x36) returned 0xefba48 [0053.354] RtlFreeAnsiString (AnsiString="a") [0053.354] RtlInitUnicodeString (in: DestinationString=0xb3fbfc, SourceString="api-ms-win-core-com-l1-1-0" | out: DestinationString="api-ms-win-core-com-l1-1-0") [0053.354] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="api-ms-win-core-com-l1-1-0", BaseAddress=0xb3fc08 | out: BaseAddress=0xb3fc08*=0x77130000) returned 0x0 [0053.354] RtlFreeHeap (HeapHandle=0xee0000, Flags=0x0, BaseAddress=0xefba48) returned 1 [0053.354] RtlFreeHeap (HeapHandle=0xee0000, Flags=0x0, BaseAddress=0xefec78) returned 1 [0053.354] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x1b) returned 0xefedb8 [0053.354] RtlInitAnsiString (in: DestinationString=0xb3fbf0, SourceString="api-ms-win-core-com-l1-1-0" | out: DestinationString="api-ms-win-core-com-l1-1-0") [0053.354] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fbf8, SourceString="api-ms-win-core-com-l1-1-0", AllocateDestinationString=1 | out: DestinationString="api-ms-win-core-com-l1-1-0") returned 0x0 [0053.354] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x36) returned 0xefbf08 [0053.354] RtlFreeAnsiString (AnsiString="a") [0053.354] RtlInitUnicodeString (in: DestinationString=0xb3fbfc, SourceString="api-ms-win-core-com-l1-1-0" | out: DestinationString="api-ms-win-core-com-l1-1-0") [0053.355] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="api-ms-win-core-com-l1-1-0", BaseAddress=0xb3fc08 | out: BaseAddress=0xb3fc08*=0x77130000) returned 0x0 [0053.355] RtlFreeHeap (HeapHandle=0xee0000, Flags=0x0, BaseAddress=0xefbf08) returned 1 [0053.355] RtlFreeHeap (HeapHandle=0xee0000, Flags=0x0, BaseAddress=0xefedb8) returned 1 [0053.355] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x1b) returned 0xefef48 [0053.355] RtlInitAnsiString (in: DestinationString=0xb3fbf0, SourceString="api-ms-win-core-com-l1-1-0" | out: DestinationString="api-ms-win-core-com-l1-1-0") [0053.355] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fbf8, SourceString="api-ms-win-core-com-l1-1-0", AllocateDestinationString=1 | out: DestinationString="api-ms-win-core-com-l1-1-0") returned 0x0 [0053.355] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x36) returned 0xefb848 [0053.355] RtlFreeAnsiString (AnsiString="a") [0053.355] RtlInitUnicodeString (in: DestinationString=0xb3fbfc, SourceString="api-ms-win-core-com-l1-1-0" | out: DestinationString="api-ms-win-core-com-l1-1-0") [0053.355] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="api-ms-win-core-com-l1-1-0", BaseAddress=0xb3fc08 | out: BaseAddress=0xb3fc08*=0x77130000) returned 0x0 [0053.355] RtlFreeHeap (HeapHandle=0xee0000, Flags=0x0, BaseAddress=0xefb848) returned 1 [0053.355] RtlFreeHeap (HeapHandle=0xee0000, Flags=0x0, BaseAddress=0xefef48) returned 1 [0053.355] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x1b) returned 0xefef20 [0053.355] RtlInitAnsiString (in: DestinationString=0xb3fbf0, SourceString="api-ms-win-core-com-l1-1-0" | out: DestinationString="api-ms-win-core-com-l1-1-0") [0053.355] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fbf8, SourceString="api-ms-win-core-com-l1-1-0", AllocateDestinationString=1 | out: DestinationString="api-ms-win-core-com-l1-1-0") returned 0x0 [0053.355] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x36) returned 0xefbd48 [0053.355] RtlFreeAnsiString (AnsiString="a") [0053.355] RtlInitUnicodeString (in: DestinationString=0xb3fbfc, SourceString="api-ms-win-core-com-l1-1-0" | out: DestinationString="api-ms-win-core-com-l1-1-0") [0053.356] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="api-ms-win-core-com-l1-1-0", BaseAddress=0xb3fc08 | out: BaseAddress=0xb3fc08*=0x77130000) returned 0x0 [0053.356] RtlFreeHeap (HeapHandle=0xee0000, Flags=0x0, BaseAddress=0xefbd48) returned 1 [0053.356] RtlFreeHeap (HeapHandle=0xee0000, Flags=0x0, BaseAddress=0xefef20) returned 1 [0053.356] RtlInitUnicodeString (in: DestinationString=0xb3fc68, SourceString="oleaut32.dll" | out: DestinationString="oleaut32.dll") [0053.356] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="oleaut32.dll", BaseAddress=0xb3fc74 | out: BaseAddress=0xb3fc74*=0x76950000) returned 0x0 [0053.620] RtlInitUnicodeString (in: DestinationString=0xb3fc68, SourceString="psapi.dll" | out: DestinationString="psapi.dll") [0053.620] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="psapi.dll", BaseAddress=0xb3fc74 | out: BaseAddress=0xb3fc74*=0x77830000) returned 0x0 [0053.675] FindResourceA (hModule=0xd40000, lpName=0x7a69, lpType=0x539) returned 0xd58048 [0053.676] LoadResource (hModule=0xd40000, hResInfo=0xd58048) returned 0xd58058 [0053.676] LockResource (hResData=0xd58058) returned 0xd58058 [0053.676] SizeofResource (hModule=0xd40000, hResInfo=0xd58048) returned 0x14fb [0053.676] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x14fb) returned 0xeffc08 [0053.676] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x5) returned 0xef86f0 [0053.676] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x100) returned 0xef4b68 [0053.676] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x100) returned 0xef4c70 [0053.676] RtlFreeHeap (HeapHandle=0xee0000, Flags=0x0, BaseAddress=0xef4c70) returned 1 [0053.676] RtlFreeHeap (HeapHandle=0xee0000, Flags=0x0, BaseAddress=0xef4b68) returned 1 [0053.676] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef9050 [0053.676] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x4) returned 0xef8700 [0053.676] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef8d90 [0053.676] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x4) returned 0xef8740 [0053.676] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef8e30 [0053.676] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef8740, Size=0x8) returned 0xef8750 [0053.676] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef8fb0 [0053.676] strtol (in: _Str="0,\"thr\":1500,\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"knoocknoo@cock.li\",\"eeeooppaaaxxx@tuta.io\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\", \"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\", \"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft\\\\provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\x09\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\x09\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\x09\"*\\\\program file*\\\\windowspowershell\",\x09\"*\\\\program file*\\\\cuass*\", \x09\"*\\\\program file*\\\\microsoft games\", \"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\x09\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\", \"*media player\",\x09\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\x09\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"]}\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}", _EndPtr=0xb3fb80, _Radix=0 | out: _EndPtr=0xb3fb80*=",\"thr\":1500,\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"knoocknoo@cock.li\",\"eeeooppaaaxxx@tuta.io\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\", \"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\", \"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft\\\\provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\x09\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\x09\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\x09\"*\\\\program file*\\\\windowspowershell\",\x09\"*\\\\program file*\\\\cuass*\", \x09\"*\\\\program file*\\\\microsoft games\", \"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\x09\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\", \"*media player\",\x09\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\x09\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"]}\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}") returned 0 [0053.677] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef8750, Size=0xc) returned 0xef52c0 [0053.677] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef8f10 [0053.677] strtol (in: _Str="1500,\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"knoocknoo@cock.li\",\"eeeooppaaaxxx@tuta.io\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\", \"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\", \"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft\\\\provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\x09\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\x09\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\x09\"*\\\\program file*\\\\windowspowershell\",\x09\"*\\\\program file*\\\\cuass*\", \x09\"*\\\\program file*\\\\microsoft games\", \"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\x09\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\", \"*media player\",\x09\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\x09\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"]}\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}", _EndPtr=0xb3fb80, _Radix=0 | out: _EndPtr=0xb3fb80*=",\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"knoocknoo@cock.li\",\"eeeooppaaaxxx@tuta.io\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\", \"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\", \"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft\\\\provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\x09\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\x09\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\x09\"*\\\\program file*\\\\windowspowershell\",\x09\"*\\\\program file*\\\\cuass*\", \x09\"*\\\\program file*\\\\microsoft games\", \"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\x09\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\", \"*media player\",\x09\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\x09\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"]}\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}") returned 1500 [0053.677] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef52c0, Size=0x10) returned 0xef52d8 [0053.677] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef8db0 [0053.677] strtol (in: _Str="51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"knoocknoo@cock.li\",\"eeeooppaaaxxx@tuta.io\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\", \"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\", \"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft\\\\provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\x09\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\x09\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\x09\"*\\\\program file*\\\\windowspowershell\",\x09\"*\\\\program file*\\\\cuass*\", \x09\"*\\\\program file*\\\\microsoft games\", \"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\x09\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\", \"*media player\",\x09\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\x09\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"]}\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}", _EndPtr=0xb3fb80, _Radix=0 | out: _EndPtr=0xb3fb80*=",\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"knoocknoo@cock.li\",\"eeeooppaaaxxx@tuta.io\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\", \"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\", \"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft\\\\provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\x09\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\x09\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\x09\"*\\\\program file*\\\\windowspowershell\",\x09\"*\\\\program file*\\\\cuass*\", \x09\"*\\\\program file*\\\\microsoft games\", \"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\x09\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\", \"*media player\",\x09\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\x09\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"]}\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}") returned 51200 [0053.677] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef52d8, Size=0x14) returned 0xef90f0 [0053.677] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef8e50 [0053.677] strtol (in: _Str="8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"knoocknoo@cock.li\",\"eeeooppaaaxxx@tuta.io\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\", \"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\", \"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft\\\\provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\x09\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\x09\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\x09\"*\\\\program file*\\\\windowspowershell\",\x09\"*\\\\program file*\\\\cuass*\", \x09\"*\\\\program file*\\\\microsoft games\", \"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\x09\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\", \"*media player\",\x09\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\x09\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"]}\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}", _EndPtr=0xb3fb80, _Radix=0 | out: _EndPtr=0xb3fb80*=",\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"knoocknoo@cock.li\",\"eeeooppaaaxxx@tuta.io\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\", \"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\", \"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft\\\\provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\x09\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\x09\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\x09\"*\\\\program file*\\\\windowspowershell\",\x09\"*\\\\program file*\\\\cuass*\", \x09\"*\\\\program file*\\\\microsoft games\", \"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\x09\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\", \"*media player\",\x09\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\x09\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"]}\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}") returned 8 [0053.677] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef90f0, Size=0x18) returned 0xef8d30 [0053.677] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef8ef0 [0053.677] strtol (in: _Str="5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"knoocknoo@cock.li\",\"eeeooppaaaxxx@tuta.io\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\", \"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\", \"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft\\\\provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\x09\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\x09\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\x09\"*\\\\program file*\\\\windowspowershell\",\x09\"*\\\\program file*\\\\cuass*\", \x09\"*\\\\program file*\\\\microsoft games\", \"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\x09\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\", \"*media player\",\x09\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\x09\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"]}\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}", _EndPtr=0xb3fb80, _Radix=0 | out: _EndPtr=0xb3fb80*=", \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"knoocknoo@cock.li\",\"eeeooppaaaxxx@tuta.io\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\", \"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\", \"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft\\\\provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\x09\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\x09\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\x09\"*\\\\program file*\\\\windowspowershell\",\x09\"*\\\\program file*\\\\cuass*\", \x09\"*\\\\program file*\\\\microsoft games\", \"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\x09\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\", \"*media player\",\x09\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\x09\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"]}\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}") returned 5 [0053.677] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef8d30, Size=0x1c) returned 0xeff0b0 [0053.677] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef8f70 [0053.677] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeff0b0, Size=0x20) returned 0xeff0d8 [0053.677] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef8ff0 [0053.677] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x4) returned 0xef8740 [0053.677] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef8f30 [0053.677] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef8740, Size=0x8) returned 0xef8750 [0053.677] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef9090 [0053.677] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeff0d8, Size=0x24) returned 0xef79a8 [0053.677] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef8e90 [0053.677] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef79a8, Size=0x28) returned 0xef7c78 [0053.677] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef90f0 [0053.677] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef7c78, Size=0x2c) returned 0xefe420 [0053.677] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef9030 [0053.677] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x4) returned 0xef8760 [0053.677] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef8f50 [0053.678] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x4) returned 0xef8740 [0053.678] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef9070 [0053.678] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef8740, Size=0x8) returned 0xef8780 [0053.678] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef90b0 [0053.678] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef8780, Size=0xc) returned 0xef52a8 [0053.678] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef90d0 [0053.678] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef52a8, Size=0x10) returned 0xef52c0 [0053.678] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef8d10 [0053.678] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef52c0, Size=0x14) returned 0xef8d30 [0053.678] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef8d70 [0053.678] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef8d30, Size=0x18) returned 0xef8dd0 [0053.678] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef8d30 [0053.678] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef8dd0, Size=0x1c) returned 0xefed90 [0053.678] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef8dd0 [0053.678] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefed90, Size=0x20) returned 0xefee30 [0053.678] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef91f0 [0053.678] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefee30, Size=0x24) returned 0xef7ac8 [0053.678] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef92f0 [0053.678] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef7ac8, Size=0x28) returned 0xef7be8 [0053.678] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef9250 [0053.678] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef7be8, Size=0x2c) returned 0xefe7d8 [0053.678] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef91d0 [0053.678] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefe7d8, Size=0x30) returned 0xefe6f8 [0053.678] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef9370 [0053.678] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefe6f8, Size=0x34) returned 0xefbbc8 [0053.678] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef9270 [0053.678] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefbbc8, Size=0x38) returned 0xefbc88 [0053.678] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef9210 [0053.678] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefbc88, Size=0x3c) returned 0xef5c00 [0053.678] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef9170 [0053.678] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5c00, Size=0x40) returned 0xef5c48 [0053.678] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef93b0 [0053.678] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5c48, Size=0x44) returned 0xeff8d8 [0053.678] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef9290 [0053.678] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeff8d8, Size=0x48) returned 0xeffab8 [0053.678] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef9230 [0053.678] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeffab8, Size=0x4c) returned 0xef5930 [0053.678] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef9490 [0053.678] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5930, Size=0x50) returned 0xef5930 [0053.679] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef9330 [0053.679] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5930, Size=0x54) returned 0xef5930 [0053.679] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef9410 [0053.679] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5930, Size=0x58) returned 0xef5930 [0053.679] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef93d0 [0053.679] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5930, Size=0x5c) returned 0xef5930 [0053.679] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef9350 [0053.679] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5930, Size=0x60) returned 0xef5930 [0053.679] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef93f0 [0053.679] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5930, Size=0x64) returned 0xeee8d8 [0053.679] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef9470 [0053.679] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeee8d8, Size=0x68) returned 0xeee8d8 [0053.679] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef9310 [0053.679] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeee8d8, Size=0x6c) returned 0xeee8d8 [0053.679] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef9190 [0053.679] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeee8d8, Size=0x70) returned 0xeee8d8 [0053.679] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef9390 [0053.679] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeee8d8, Size=0x74) returned 0xeee8d8 [0053.679] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef9430 [0053.679] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeee8d8, Size=0x78) returned 0xeee8d8 [0053.679] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef91b0 [0053.679] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeee8d8, Size=0x7c) returned 0xef5460 [0053.679] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef9450 [0053.679] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5460, Size=0x80) returned 0xef5460 [0053.679] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef94b0 [0053.679] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5460, Size=0x84) returned 0xef5460 [0053.679] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef9110 [0053.679] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5460, Size=0x88) returned 0xef5460 [0053.679] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef9130 [0053.679] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5460, Size=0x8c) returned 0xef5460 [0053.679] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef92b0 [0053.679] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5460, Size=0x90) returned 0xef5460 [0053.679] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef9150 [0053.679] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5460, Size=0x94) returned 0xef2a00 [0053.679] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xef92d0 [0053.679] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef2a00, Size=0x98) returned 0xef2a00 [0053.679] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf011a0 [0053.679] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef2a00, Size=0x9c) returned 0xef2a00 [0053.679] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf011e0 [0053.680] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef8760, Size=0x8) returned 0xef8740 [0053.680] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01280 [0053.680] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x4) returned 0xef8760 [0053.680] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01360 [0053.680] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef8760, Size=0x8) returned 0xef87e0 [0053.680] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01220 [0053.680] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef87e0, Size=0xc) returned 0xef52a8 [0053.680] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01140 [0053.680] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef52a8, Size=0x10) returned 0xef5320 [0053.680] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01180 [0053.680] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5320, Size=0x14) returned 0xf012a0 [0053.680] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf013e0 [0053.680] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xf012a0, Size=0x18) returned 0xf011c0 [0053.680] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01200 [0053.680] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xf011c0, Size=0x1c) returned 0xefede0 [0053.680] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf013a0 [0053.680] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefede0, Size=0x20) returned 0xefec78 [0053.680] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf011c0 [0053.680] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefec78, Size=0x24) returned 0xef79d8 [0053.680] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01400 [0053.680] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef79d8, Size=0x28) returned 0xef7be8 [0053.680] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01240 [0053.680] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef7be8, Size=0x2c) returned 0xefe650 [0053.680] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01260 [0053.680] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefe650, Size=0x30) returned 0xefe490 [0053.680] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf012a0 [0053.680] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefe490, Size=0x34) returned 0xefbe08 [0053.680] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01420 [0053.680] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefbe08, Size=0x38) returned 0xefb848 [0053.680] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01480 [0053.680] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefb848, Size=0x3c) returned 0xef5c00 [0053.680] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf013c0 [0053.680] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5c00, Size=0x40) returned 0xef5c48 [0053.680] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf012c0 [0053.680] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef8740, Size=0xc) returned 0xef5320 [0053.680] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf012e0 [0053.680] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x4) returned 0xef8740 [0053.680] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01300 [0053.681] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef8740, Size=0x8) returned 0xef8760 [0053.681] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01320 [0053.681] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef8760, Size=0xc) returned 0xef52a8 [0053.681] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01440 [0053.681] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef52a8, Size=0x10) returned 0xef52c0 [0053.681] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01340 [0053.681] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef52c0, Size=0x14) returned 0xf01380 [0053.681] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01460 [0053.681] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xf01380, Size=0x18) returned 0xf014a0 [0053.681] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01380 [0053.681] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xf014a0, Size=0x1c) returned 0xefefc0 [0053.681] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf014a0 [0053.681] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefefc0, Size=0x20) returned 0xeff0d8 [0053.681] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf014c0 [0053.681] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeff0d8, Size=0x24) returned 0xef7bb8 [0053.681] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf014e0 [0053.681] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef7bb8, Size=0x28) returned 0xef7b88 [0053.681] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01500 [0053.681] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef7b88, Size=0x2c) returned 0xefe9d0 [0053.681] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01520 [0053.681] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefe9d0, Size=0x30) returned 0xefe650 [0053.681] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01160 [0053.681] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefe650, Size=0x34) returned 0xefbd48 [0053.681] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01660 [0053.681] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefbd48, Size=0x38) returned 0xefbd88 [0053.681] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01680 [0053.681] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefbd88, Size=0x3c) returned 0xef5e88 [0053.681] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01760 [0053.681] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5e88, Size=0x40) returned 0xef5db0 [0053.681] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf016a0 [0053.681] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5db0, Size=0x44) returned 0xeff7e8 [0053.681] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01560 [0053.681] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeff7e8, Size=0x48) returned 0xeff658 [0053.681] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01820 [0053.681] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeff658, Size=0x4c) returned 0xef5930 [0053.681] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01640 [0053.681] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5930, Size=0x50) returned 0xef5930 [0053.682] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf018c0 [0053.682] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5930, Size=0x54) returned 0xef5930 [0053.682] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01720 [0053.682] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5930, Size=0x58) returned 0xef5930 [0053.682] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01800 [0053.682] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5930, Size=0x5c) returned 0xef5930 [0053.682] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01860 [0053.682] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5930, Size=0x60) returned 0xef5930 [0053.682] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01620 [0053.682] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5930, Size=0x64) returned 0xeee8d8 [0053.682] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01880 [0053.682] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeee8d8, Size=0x68) returned 0xeee8d8 [0053.682] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf015a0 [0053.682] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeee8d8, Size=0x6c) returned 0xeee8d8 [0053.682] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf016c0 [0053.682] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeee8d8, Size=0x70) returned 0xeee8d8 [0053.682] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf016e0 [0053.682] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeee8d8, Size=0x74) returned 0xeee8d8 [0053.682] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01740 [0053.682] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeee8d8, Size=0x78) returned 0xeee8d8 [0053.682] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf018e0 [0053.682] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeee8d8, Size=0x7c) returned 0xef5460 [0053.682] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf015c0 [0053.682] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5460, Size=0x80) returned 0xef5460 [0053.682] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01780 [0053.682] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5460, Size=0x84) returned 0xef5460 [0053.682] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf015e0 [0053.682] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5460, Size=0x88) returned 0xef5460 [0053.682] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf017a0 [0053.682] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5460, Size=0x8c) returned 0xef5460 [0053.682] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01600 [0053.682] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5460, Size=0x90) returned 0xef5460 [0053.682] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01840 [0053.682] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5460, Size=0x94) returned 0xef28a8 [0053.682] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01700 [0053.682] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef28a8, Size=0x98) returned 0xef28a8 [0053.682] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01540 [0053.683] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef28a8, Size=0x9c) returned 0xef28a8 [0053.683] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01580 [0053.683] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef28a8, Size=0xa0) returned 0xef28a8 [0053.683] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf017c0 [0053.683] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef28a8, Size=0xa4) returned 0xef56d8 [0053.683] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf017e0 [0053.683] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef56d8, Size=0xa8) returned 0xef56d8 [0053.683] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf018a0 [0053.683] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef56d8, Size=0xac) returned 0xef56d8 [0053.683] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01c28 [0053.683] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef56d8, Size=0xb0) returned 0xef56d8 [0053.683] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01be8 [0053.683] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef56d8, Size=0xb4) returned 0xef4b68 [0053.683] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01ae8 [0053.683] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef4b68, Size=0xb8) returned 0xef4b68 [0053.683] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01a68 [0053.683] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef4b68, Size=0xbc) returned 0xef4b68 [0053.683] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01b48 [0053.683] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef4b68, Size=0xc0) returned 0xef4b68 [0053.683] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01d28 [0053.683] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef4b68, Size=0xc4) returned 0xef4b68 [0053.683] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01b68 [0053.683] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef4b68, Size=0xc8) returned 0xef4b68 [0053.683] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01aa8 [0053.683] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef4b68, Size=0xcc) returned 0xef4b68 [0053.683] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01ca8 [0053.683] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef4b68, Size=0xd0) returned 0xef4b68 [0053.683] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01ac8 [0053.683] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefe420, Size=0x30) returned 0xefe768 [0053.683] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01b28 [0053.684] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x4) returned 0xef8790 [0053.684] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf019e8 [0053.684] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef8790, Size=0x8) returned 0xef87e0 [0053.684] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf019c8 [0053.684] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x4) returned 0xef8740 [0053.684] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01c08 [0053.684] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef8740, Size=0x8) returned 0xef8760 [0053.684] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01948 [0053.684] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef8760, Size=0xc) returned 0xef52a8 [0053.684] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01a08 [0053.684] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef52a8, Size=0x10) returned 0xef52d8 [0053.684] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01968 [0053.684] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef52d8, Size=0x14) returned 0xf01c48 [0053.684] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01b88 [0053.684] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xf01c48, Size=0x18) returned 0xf01988 [0053.684] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01b08 [0053.684] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xf01988, Size=0x1c) returned 0xefede0 [0053.684] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01a88 [0053.684] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefede0, Size=0x20) returned 0xefef98 [0053.684] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01988 [0053.684] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefef98, Size=0x24) returned 0xef7be8 [0053.684] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01ba8 [0053.684] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef7be8, Size=0x28) returned 0xef7a08 [0053.684] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01bc8 [0053.684] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef7a08, Size=0x2c) returned 0xefe9d0 [0053.684] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01c48 [0053.684] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefe9d0, Size=0x30) returned 0xefe7d8 [0053.684] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01a48 [0053.684] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefe7d8, Size=0x34) returned 0xefb8c8 [0053.684] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01a28 [0053.684] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefb8c8, Size=0x38) returned 0xefbf08 [0053.684] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01c68 [0053.684] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefbf08, Size=0x3c) returned 0xef5c00 [0053.684] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf019a8 [0053.684] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5c00, Size=0x40) returned 0xef5cd8 [0053.684] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01c88 [0053.685] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5cd8, Size=0x44) returned 0xeff608 [0053.685] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01cc8 [0053.685] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeff608, Size=0x48) returned 0xeffb08 [0053.685] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01ce8 [0053.685] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeffb08, Size=0x4c) returned 0xef5930 [0053.685] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01d08 [0053.685] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5930, Size=0x50) returned 0xef5930 [0053.685] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01ee8 [0053.685] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5930, Size=0x54) returned 0xef5930 [0053.685] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01f28 [0053.685] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5930, Size=0x58) returned 0xef5930 [0053.685] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01fe8 [0053.685] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5930, Size=0x5c) returned 0xef5930 [0053.685] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01e28 [0053.685] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5930, Size=0x60) returned 0xef5930 [0053.685] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01f68 [0053.685] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5930, Size=0x64) returned 0xeee8d8 [0053.685] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02068 [0053.685] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeee8d8, Size=0x68) returned 0xeee8d8 [0053.685] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf020a8 [0053.685] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeee8d8, Size=0x6c) returned 0xeee8d8 [0053.685] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02088 [0053.685] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeee8d8, Size=0x70) returned 0xeee8d8 [0053.685] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01f88 [0053.686] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeee8d8, Size=0x74) returned 0xeee8d8 [0053.686] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02008 [0053.686] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeee8d8, Size=0x78) returned 0xeee8d8 [0053.686] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01da8 [0053.686] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeee8d8, Size=0x7c) returned 0xef5460 [0053.686] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01f48 [0053.686] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5460, Size=0x80) returned 0xef5460 [0053.686] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01fa8 [0053.686] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5460, Size=0x84) returned 0xef5460 [0053.686] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01fc8 [0053.686] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5460, Size=0x88) returned 0xef5460 [0053.686] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02028 [0053.686] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5460, Size=0x8c) returned 0xef5460 [0053.686] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02048 [0053.686] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5460, Size=0x90) returned 0xef5460 [0053.686] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf020c8 [0053.686] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5460, Size=0x94) returned 0xef28a8 [0053.686] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01dc8 [0053.686] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef28a8, Size=0x98) returned 0xef28a8 [0053.686] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf020e8 [0053.686] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef28a8, Size=0x9c) returned 0xef28a8 [0053.686] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01e48 [0053.686] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef28a8, Size=0xa0) returned 0xef28a8 [0053.686] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01d48 [0053.686] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef28a8, Size=0xa4) returned 0xef56d8 [0053.686] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01d68 [0053.686] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef56d8, Size=0xa8) returned 0xef56d8 [0053.686] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01de8 [0053.686] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef56d8, Size=0xac) returned 0xef56d8 [0053.686] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01d88 [0053.686] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef56d8, Size=0xb0) returned 0xef56d8 [0053.686] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01ec8 [0053.686] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef56d8, Size=0xb4) returned 0xef4c40 [0053.686] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01e88 [0053.686] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef4c40, Size=0xb8) returned 0xef4c40 [0053.686] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01e08 [0053.687] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef4c40, Size=0xbc) returned 0xef4c40 [0053.687] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01e68 [0053.687] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef4c40, Size=0xc0) returned 0xef4c40 [0053.687] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01f08 [0053.687] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef4c40, Size=0xc4) returned 0xef4c40 [0053.687] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf01ea8 [0053.687] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef4c40, Size=0xc8) returned 0xef4c40 [0053.687] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02730 [0053.687] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef4c40, Size=0xcc) returned 0xef4c40 [0053.687] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf027d0 [0053.687] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef4c40, Size=0xd0) returned 0xef4c40 [0053.687] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02670 [0053.687] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef4c40, Size=0xd4) returned 0xef4c40 [0053.687] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf027f0 [0053.687] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef4c40, Size=0xd8) returned 0xef4c40 [0053.687] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02890 [0053.687] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef4c40, Size=0xdc) returned 0xef4c40 [0053.687] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02610 [0053.687] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef4c40, Size=0xe0) returned 0xef4c40 [0053.687] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf028b0 [0053.687] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef4c40, Size=0xe4) returned 0xef4c40 [0053.687] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02650 [0053.687] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef4c40, Size=0xe8) returned 0xef4c40 [0053.687] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02810 [0053.687] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef4c40, Size=0xec) returned 0xef4c40 [0053.687] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf028f0 [0053.687] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef4c40, Size=0xf0) returned 0xef4c40 [0053.687] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02550 [0053.687] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef4c40, Size=0xf4) returned 0xef4c40 [0053.687] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02850 [0053.687] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef4c40, Size=0xf8) returned 0xef4c40 [0053.687] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02590 [0053.687] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef4c40, Size=0xfc) returned 0xef4c40 [0053.687] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02690 [0053.687] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef4c40, Size=0x100) returned 0xef4c40 [0053.687] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02570 [0053.687] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef4c40, Size=0x104) returned 0xef4c40 [0053.688] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02830 [0053.688] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef4c40, Size=0x108) returned 0xef4c40 [0053.688] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf026b0 [0053.688] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef87e0, Size=0xc) returned 0xef52a8 [0053.688] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02870 [0053.688] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x4) returned 0xef8740 [0053.688] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf025d0 [0053.688] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef8740, Size=0x8) returned 0xef8760 [0053.688] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf028d0 [0053.688] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef8760, Size=0xc) returned 0xef5308 [0053.688] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02790 [0053.688] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5308, Size=0x10) returned 0xef52c0 [0053.688] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf026d0 [0053.688] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef52c0, Size=0x14) returned 0xf02710 [0053.688] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02750 [0053.688] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xf02710, Size=0x18) returned 0xf026f0 [0053.688] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02710 [0053.688] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xf026f0, Size=0x1c) returned 0xefeea8 [0053.688] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf025b0 [0053.688] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefeea8, Size=0x20) returned 0xefedb8 [0053.688] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf025f0 [0053.688] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefedb8, Size=0x24) returned 0xef7a68 [0053.688] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf027b0 [0053.688] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef7a68, Size=0x28) returned 0xef7c18 [0053.688] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02630 [0053.688] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef7c18, Size=0x2c) returned 0xefe688 [0053.688] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf026f0 [0053.688] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefe688, Size=0x30) returned 0xefe5a8 [0053.688] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02770 [0053.688] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefe5a8, Size=0x34) returned 0xefb848 [0053.688] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02430 [0053.688] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefb848, Size=0x38) returned 0xefbd48 [0053.688] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02390 [0053.688] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefbd48, Size=0x3c) returned 0xef5f18 [0053.688] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf024b0 [0053.688] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5f18, Size=0x40) returned 0xef5e88 [0053.688] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02510 [0053.688] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5e88, Size=0x44) returned 0xeff8d8 [0053.688] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02470 [0053.689] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeff8d8, Size=0x48) returned 0xeff9c8 [0053.689] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf023b0 [0053.689] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeff9c8, Size=0x4c) returned 0xef5930 [0053.689] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02450 [0053.689] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5930, Size=0x50) returned 0xef5930 [0053.689] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf024f0 [0053.689] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5930, Size=0x54) returned 0xef5930 [0053.689] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02350 [0053.689] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5930, Size=0x58) returned 0xef5930 [0053.689] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf021b0 [0053.689] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5930, Size=0x5c) returned 0xef5930 [0053.689] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf023d0 [0053.689] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5930, Size=0x60) returned 0xef5930 [0053.689] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf024d0 [0053.689] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5930, Size=0x64) returned 0xeee8d8 [0053.689] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02210 [0053.689] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeee8d8, Size=0x68) returned 0xeee8d8 [0053.689] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02530 [0053.689] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeee8d8, Size=0x6c) returned 0xeee8d8 [0053.689] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02490 [0053.689] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeee8d8, Size=0x70) returned 0xeee8d8 [0053.689] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02150 [0053.689] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeee8d8, Size=0x74) returned 0xeee8d8 [0053.689] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02170 [0053.689] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeee8d8, Size=0x78) returned 0xeee8d8 [0053.689] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf022d0 [0053.689] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xeee8d8, Size=0x7c) returned 0xef5460 [0053.689] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02310 [0053.689] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5460, Size=0x80) returned 0xef5460 [0053.689] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02190 [0053.689] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5460, Size=0x84) returned 0xef5460 [0053.689] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf021d0 [0053.689] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5460, Size=0x88) returned 0xef5460 [0053.689] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02370 [0053.689] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5460, Size=0x8c) returned 0xef5460 [0053.689] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf021f0 [0053.689] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5460, Size=0x90) returned 0xef5460 [0053.689] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02230 [0053.689] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef52a8, Size=0x10) returned 0xef52c0 [0053.690] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02290 [0053.690] strtol (in: _Str="30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}", _EndPtr=0xb3fb5c, _Radix=0 | out: _EndPtr=0xb3fb5c*=",\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}") returned 30 [0053.690] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef52c0, Size=0x14) returned 0xf02250 [0053.690] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf023f0 [0053.690] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x4) returned 0xef8790 [0053.690] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x18) returned 0xf02270 [0053.690] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef8790, Size=0x8) returned 0xef8740 [0053.690] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef8740, Size=0xc) returned 0xef5308 [0053.690] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef5308, Size=0x10) returned 0xef52d8 [0053.690] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef52d8, Size=0x14) returned 0xf02330 [0053.690] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefe768, Size=0x34) returned 0xefbd48 [0053.691] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef8740, Size=0x8) returned 0xef87b0 [0053.691] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef87c0, Size=0x8) returned 0xef8740 [0053.691] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef8740, Size=0xc) returned 0xef52a8 [0053.691] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef8780, Size=0x8) returned 0xef8740 [0053.691] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xefbd48, Size=0x38) returned 0xefbe08 [0053.691] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef8760, Size=0x8) returned 0xef8780 [0053.691] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef8760, Size=0x8) returned 0xef8790 [0053.691] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef8760, Size=0x8) returned 0xef87c0 [0053.691] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef87c0, Size=0xc) returned 0xef5308 [0053.691] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef8790, Size=0xc) returned 0xef52c0 [0053.691] RtlReAllocateHeap (Heap=0xee0000, Flags=0x8, Ptr=0xef8760, Size=0x8) returned 0xef8790 [0053.691] RtlFreeHeap (HeapHandle=0xee0000, Flags=0x0, BaseAddress=0xef8700) returned 1 [0053.691] RtlFreeHeap (HeapHandle=0xee0000, Flags=0x0, BaseAddress=0xef9050) returned 1 [0053.693] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="ntuser.dat*" | out: DestinationString="ntuser.dat*") [0053.693] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="ntuser.dat*", AllocateDestinationString=1 | out: DestinationString="ntuser.dat*") returned 0x0 [0053.693] RtlFreeAnsiString (AnsiString="n") [0053.693] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="iconcache.db" | out: DestinationString="iconcache.db") [0053.693] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="iconcache.db", AllocateDestinationString=1 | out: DestinationString="iconcache.db") returned 0x0 [0053.693] RtlFreeAnsiString (AnsiString="i") [0053.693] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="gdipfont*.dat" | out: DestinationString="gdipfont*.dat") [0053.693] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="gdipfont*.dat", AllocateDestinationString=1 | out: DestinationString="gdipfont*.dat") returned 0x0 [0053.693] RtlFreeAnsiString (AnsiString="g") [0053.693] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="ntuser.ini" | out: DestinationString="ntuser.ini") [0053.693] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="ntuser.ini", AllocateDestinationString=1 | out: DestinationString="ntuser.ini") returned 0x0 [0053.693] RtlFreeAnsiString (AnsiString="n") [0053.693] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="usrclass.dat" | out: DestinationString="usrclass.dat") [0053.693] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="usrclass.dat", AllocateDestinationString=1 | out: DestinationString="usrclass.dat") returned 0x0 [0053.693] RtlFreeAnsiString (AnsiString="u") [0053.693] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="usrclass.dat*" | out: DestinationString="usrclass.dat*") [0053.693] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="usrclass.dat*", AllocateDestinationString=1 | out: DestinationString="usrclass.dat*") returned 0x0 [0053.693] RtlFreeAnsiString (AnsiString="u") [0053.693] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="boot.ini" | out: DestinationString="boot.ini") [0053.693] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="boot.ini", AllocateDestinationString=1 | out: DestinationString="boot.ini") returned 0x0 [0053.694] RtlFreeAnsiString (AnsiString="b") [0053.694] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="bootmgr" | out: DestinationString="bootmgr") [0053.694] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="bootmgr", AllocateDestinationString=1 | out: DestinationString="bootmgr") returned 0x0 [0053.694] RtlFreeAnsiString (AnsiString="b") [0053.694] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="bootnxt" | out: DestinationString="bootnxt") [0053.694] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="bootnxt", AllocateDestinationString=1 | out: DestinationString="bootnxt") returned 0x0 [0053.694] RtlFreeAnsiString (AnsiString="b") [0053.694] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="desktop.ini" | out: DestinationString="desktop.ini") [0053.694] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="desktop.ini", AllocateDestinationString=1 | out: DestinationString="desktop.ini") returned 0x0 [0053.694] RtlFreeAnsiString (AnsiString="d") [0053.694] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="ntuser.dat" | out: DestinationString="ntuser.dat") [0053.694] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="ntuser.dat", AllocateDestinationString=1 | out: DestinationString="ntuser.dat") returned 0x0 [0053.694] RtlFreeAnsiString (AnsiString="n") [0053.694] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="autorun.inf" | out: DestinationString="autorun.inf") [0053.694] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="autorun.inf", AllocateDestinationString=1 | out: DestinationString="autorun.inf") returned 0x0 [0053.694] RtlFreeAnsiString (AnsiString="a") [0053.694] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="ntldr" | out: DestinationString="ntldr") [0053.694] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="ntldr", AllocateDestinationString=1 | out: DestinationString="ntldr") returned 0x0 [0053.694] RtlFreeAnsiString (AnsiString="n") [0053.694] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="thumbs.db" | out: DestinationString="thumbs.db") [0053.694] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="thumbs.db", AllocateDestinationString=1 | out: DestinationString="thumbs.db") returned 0x0 [0053.694] RtlFreeAnsiString (AnsiString="t") [0053.694] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="bootsect.bak" | out: DestinationString="bootsect.bak") [0053.694] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="bootsect.bak", AllocateDestinationString=1 | out: DestinationString="bootsect.bak") returned 0x0 [0053.694] RtlFreeAnsiString (AnsiString="b") [0053.694] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="bootfont.bin" | out: DestinationString="bootfont.bin") [0053.694] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="bootfont.bin", AllocateDestinationString=1 | out: DestinationString="bootfont.bin") returned 0x0 [0053.695] RtlFreeAnsiString (AnsiString="b") [0053.695] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*system volume information" | out: DestinationString="*system volume information") [0053.695] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*system volume information", AllocateDestinationString=1 | out: DestinationString="*system volume information") returned 0x0 [0053.695] RtlFreeAnsiString (AnsiString="*") [0053.695] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*windows.old" | out: DestinationString="*windows.old") [0053.695] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*windows.old", AllocateDestinationString=1 | out: DestinationString="*windows.old") returned 0x0 [0053.695] RtlFreeAnsiString (AnsiString="*") [0053.695] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*:\\users\\*\\*temp" | out: DestinationString="*:\\users\\*\\*temp") [0053.695] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*:\\users\\*\\*temp", AllocateDestinationString=1 | out: DestinationString="*:\\users\\*\\*temp") returned 0x0 [0053.695] RtlFreeAnsiString (AnsiString="*") [0053.695] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*msocache" | out: DestinationString="*msocache") [0053.695] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*msocache", AllocateDestinationString=1 | out: DestinationString="*msocache") returned 0x0 [0053.695] RtlFreeAnsiString (AnsiString="*") [0053.695] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*:\\winnt" | out: DestinationString="*:\\winnt") [0053.695] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*:\\winnt", AllocateDestinationString=1 | out: DestinationString="*:\\winnt") returned 0x0 [0053.695] RtlFreeAnsiString (AnsiString="*") [0053.695] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*$windows.~ws" | out: DestinationString="*$windows.~ws") [0053.695] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*$windows.~ws", AllocateDestinationString=1 | out: DestinationString="*$windows.~ws") returned 0x0 [0053.695] RtlFreeAnsiString (AnsiString="*") [0053.695] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*perflogs" | out: DestinationString="*perflogs") [0053.695] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*perflogs", AllocateDestinationString=1 | out: DestinationString="*perflogs") returned 0x0 [0053.695] RtlFreeAnsiString (AnsiString="*") [0053.695] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*boot" | out: DestinationString="*boot") [0053.695] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*boot", AllocateDestinationString=1 | out: DestinationString="*boot") returned 0x0 [0053.695] RtlFreeAnsiString (AnsiString="*") [0053.696] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*:\\windows" | out: DestinationString="*:\\windows") [0053.696] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*:\\windows", AllocateDestinationString=1 | out: DestinationString="*:\\windows") returned 0x0 [0053.696] RtlFreeAnsiString (AnsiString="*") [0053.696] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*:\\program file*\\vmware" | out: DestinationString="*:\\program file*\\vmware") [0053.696] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*:\\program file*\\vmware", AllocateDestinationString=1 | out: DestinationString="*:\\program file*\\vmware") returned 0x0 [0053.696] RtlFreeAnsiString (AnsiString="*") [0053.696] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="\\\\*\\users\\*\\*temp" | out: DestinationString="\\\\*\\users\\*\\*temp") [0053.696] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="\\\\*\\users\\*\\*temp", AllocateDestinationString=1 | out: DestinationString="\\\\*\\users\\*\\*temp") returned 0x0 [0053.696] RtlFreeAnsiString (AnsiString="\\") [0053.696] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="\\\\*\\winnt" | out: DestinationString="\\\\*\\winnt") [0053.696] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="\\\\*\\winnt", AllocateDestinationString=1 | out: DestinationString="\\\\*\\winnt") returned 0x0 [0053.696] RtlFreeAnsiString (AnsiString="\\") [0053.696] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="\\\\*\\windows" | out: DestinationString="\\\\*\\windows") [0053.696] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="\\\\*\\windows", AllocateDestinationString=1 | out: DestinationString="\\\\*\\windows") returned 0x0 [0053.696] RtlFreeAnsiString (AnsiString="\\") [0053.696] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*\\program file*\\vmware" | out: DestinationString="*\\program file*\\vmware") [0053.696] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*\\program file*\\vmware", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\vmware") returned 0x0 [0053.696] RtlFreeAnsiString (AnsiString="*") [0053.696] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*appdata*microsoft" | out: DestinationString="*appdata*microsoft") [0053.696] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*appdata*microsoft", AllocateDestinationString=1 | out: DestinationString="*appdata*microsoft") returned 0x0 [0053.696] RtlFreeAnsiString (AnsiString="*") [0053.696] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*appdata*packages" | out: DestinationString="*appdata*packages") [0053.696] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*appdata*packages", AllocateDestinationString=1 | out: DestinationString="*appdata*packages") returned 0x0 [0053.696] RtlFreeAnsiString (AnsiString="*") [0053.696] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*microsoft\\provisioning" | out: DestinationString="*microsoft\\provisioning") [0053.696] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*microsoft\\provisioning", AllocateDestinationString=1 | out: DestinationString="*microsoft\\provisioning") returned 0x0 [0053.697] RtlFreeAnsiString (AnsiString="*") [0053.697] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*dvd maker" | out: DestinationString="*dvd maker") [0053.697] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*dvd maker", AllocateDestinationString=1 | out: DestinationString="*dvd maker") returned 0x0 [0053.697] RtlFreeAnsiString (AnsiString="*") [0053.697] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*Internet Explorer" | out: DestinationString="*Internet Explorer") [0053.697] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*Internet Explorer", AllocateDestinationString=1 | out: DestinationString="*Internet Explorer") returned 0x0 [0053.697] RtlFreeAnsiString (AnsiString="*") [0053.697] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*Mozilla" | out: DestinationString="*Mozilla") [0053.697] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*Mozilla", AllocateDestinationString=1 | out: DestinationString="*Mozilla") returned 0x0 [0053.697] RtlFreeAnsiString (AnsiString="*") [0053.697] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*Mozilla*" | out: DestinationString="*Mozilla*") [0053.697] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*Mozilla*", AllocateDestinationString=1 | out: DestinationString="*Mozilla*") returned 0x0 [0053.697] RtlFreeAnsiString (AnsiString="*") [0053.697] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*Old Firefox data" | out: DestinationString="*Old Firefox data") [0053.697] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*Old Firefox data", AllocateDestinationString=1 | out: DestinationString="*Old Firefox data") returned 0x0 [0053.697] RtlFreeAnsiString (AnsiString="*") [0053.697] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*\\program file*\\windows media*" | out: DestinationString="*\\program file*\\windows media*") [0053.697] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*\\program file*\\windows media*", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\windows media*") returned 0x0 [0053.697] RtlFreeAnsiString (AnsiString="*") [0053.697] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*\\program file*\\windows portable*" | out: DestinationString="*\\program file*\\windows portable*") [0053.697] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*\\program file*\\windows portable*", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\windows portable*") returned 0x0 [0053.697] RtlFreeAnsiString (AnsiString="*") [0053.697] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*windows defender" | out: DestinationString="*windows defender") [0053.697] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*windows defender", AllocateDestinationString=1 | out: DestinationString="*windows defender") returned 0x0 [0053.698] RtlFreeAnsiString (AnsiString="*") [0053.698] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*\\program file*\\windows nt" | out: DestinationString="*\\program file*\\windows nt") [0053.698] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*\\program file*\\windows nt", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\windows nt") returned 0x0 [0053.698] RtlFreeAnsiString (AnsiString="*") [0053.698] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*\\program file*\\windows photo*" | out: DestinationString="*\\program file*\\windows photo*") [0053.698] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*\\program file*\\windows photo*", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\windows photo*") returned 0x0 [0053.698] RtlFreeAnsiString (AnsiString="*") [0053.698] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*\\program file*\\windows side*" | out: DestinationString="*\\program file*\\windows side*") [0053.698] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*\\program file*\\windows side*", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\windows side*") returned 0x0 [0053.698] RtlFreeAnsiString (AnsiString="*") [0053.698] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*\\program file*\\windowspowershell" | out: DestinationString="*\\program file*\\windowspowershell") [0053.698] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*\\program file*\\windowspowershell", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\windowspowershell") returned 0x0 [0053.698] RtlFreeAnsiString (AnsiString="*") [0053.698] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*\\program file*\\cuass*" | out: DestinationString="*\\program file*\\cuass*") [0053.698] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*\\program file*\\cuass*", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\cuass*") returned 0x0 [0053.698] RtlFreeAnsiString (AnsiString="*") [0053.698] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*\\program file*\\microsoft games" | out: DestinationString="*\\program file*\\microsoft games") [0053.698] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*\\program file*\\microsoft games", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\microsoft games") returned 0x0 [0053.698] RtlFreeAnsiString (AnsiString="*") [0053.698] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*\\program file*\\common files\\system" | out: DestinationString="*\\program file*\\common files\\system") [0053.698] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*\\program file*\\common files\\system", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\common files\\system") returned 0x0 [0053.698] RtlFreeAnsiString (AnsiString="*") [0053.698] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*\\program file*\\common files\\*shared" | out: DestinationString="*\\program file*\\common files\\*shared") [0053.698] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*\\program file*\\common files\\*shared", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\common files\\*shared") returned 0x0 [0053.699] RtlFreeAnsiString (AnsiString="*") [0053.699] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*\\program file*\\common files\\reference ass*" | out: DestinationString="*\\program file*\\common files\\reference ass*") [0053.699] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*\\program file*\\common files\\reference ass*", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\common files\\reference ass*") returned 0x0 [0053.699] RtlFreeAnsiString (AnsiString="*") [0053.699] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*\\windows\\cache*" | out: DestinationString="*\\windows\\cache*") [0053.699] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*\\windows\\cache*", AllocateDestinationString=1 | out: DestinationString="*\\windows\\cache*") returned 0x0 [0053.699] RtlFreeAnsiString (AnsiString="*") [0053.699] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*temporary internet*" | out: DestinationString="*temporary internet*") [0053.699] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*temporary internet*", AllocateDestinationString=1 | out: DestinationString="*temporary internet*") returned 0x0 [0053.699] RtlFreeAnsiString (AnsiString="*") [0053.699] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*media player" | out: DestinationString="*media player") [0053.699] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*media player", AllocateDestinationString=1 | out: DestinationString="*media player") returned 0x0 [0053.699] RtlFreeAnsiString (AnsiString="*") [0053.699] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*:\\users\\*\\appdata\\*\\microsoft" | out: DestinationString="*:\\users\\*\\appdata\\*\\microsoft") [0053.699] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*:\\users\\*\\appdata\\*\\microsoft", AllocateDestinationString=1 | out: DestinationString="*:\\users\\*\\appdata\\*\\microsoft") returned 0x0 [0053.699] RtlFreeAnsiString (AnsiString="*") [0053.699] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="\\\\*\\users\\*\\appdata\\*\\microsoft" | out: DestinationString="\\\\*\\users\\*\\appdata\\*\\microsoft") [0053.699] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="\\\\*\\users\\*\\appdata\\*\\microsoft", AllocateDestinationString=1 | out: DestinationString="\\\\*\\users\\*\\appdata\\*\\microsoft") returned 0x0 [0053.699] RtlFreeAnsiString (AnsiString="\\") [0053.699] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="msp" | out: DestinationString="msp") [0053.699] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="msp", AllocateDestinationString=1 | out: DestinationString="msp") returned 0x0 [0053.699] RtlFreeAnsiString (AnsiString="m") [0053.699] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="exe" | out: DestinationString="exe") [0053.700] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="exe", AllocateDestinationString=1 | out: DestinationString="exe") returned 0x0 [0053.700] RtlFreeAnsiString (AnsiString="e") [0053.700] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="sys" | out: DestinationString="sys") [0053.700] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="sys", AllocateDestinationString=1 | out: DestinationString="sys") returned 0x0 [0053.700] RtlFreeAnsiString (AnsiString="s") [0053.700] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="msc" | out: DestinationString="msc") [0053.700] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="msc", AllocateDestinationString=1 | out: DestinationString="msc") returned 0x0 [0053.700] RtlFreeAnsiString (AnsiString="m") [0053.700] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="mod" | out: DestinationString="mod") [0053.700] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="mod", AllocateDestinationString=1 | out: DestinationString="mod") returned 0x0 [0053.700] RtlFreeAnsiString (AnsiString="m") [0053.700] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="clb" | out: DestinationString="clb") [0053.700] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="clb", AllocateDestinationString=1 | out: DestinationString="clb") returned 0x0 [0053.700] RtlFreeAnsiString (AnsiString="c") [0053.700] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="mui" | out: DestinationString="mui") [0053.700] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="mui", AllocateDestinationString=1 | out: DestinationString="mui") returned 0x0 [0053.700] RtlFreeAnsiString (AnsiString="m") [0053.700] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="regtrans-ms" | out: DestinationString="regtrans-ms") [0053.700] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="regtrans-ms", AllocateDestinationString=1 | out: DestinationString="regtrans-ms") returned 0x0 [0053.700] RtlFreeAnsiString (AnsiString="r") [0053.700] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="theme" | out: DestinationString="theme") [0053.700] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="theme", AllocateDestinationString=1 | out: DestinationString="theme") returned 0x0 [0053.700] RtlFreeAnsiString (AnsiString="t") [0053.700] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="hta" | out: DestinationString="hta") [0053.700] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="hta", AllocateDestinationString=1 | out: DestinationString="hta") returned 0x0 [0053.701] RtlFreeAnsiString (AnsiString="h") [0053.701] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="shs" | out: DestinationString="shs") [0053.701] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="shs", AllocateDestinationString=1 | out: DestinationString="shs") returned 0x0 [0053.701] RtlFreeAnsiString (AnsiString="s") [0053.701] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="nomedia" | out: DestinationString="nomedia") [0053.701] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="nomedia", AllocateDestinationString=1 | out: DestinationString="nomedia") returned 0x0 [0053.702] RtlFreeAnsiString (AnsiString="n") [0053.702] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="diagpkg" | out: DestinationString="diagpkg") [0053.702] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="diagpkg", AllocateDestinationString=1 | out: DestinationString="diagpkg") returned 0x0 [0053.702] RtlFreeAnsiString (AnsiString="d") [0053.702] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="cab" | out: DestinationString="cab") [0053.702] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="cab", AllocateDestinationString=1 | out: DestinationString="cab") returned 0x0 [0053.702] RtlFreeAnsiString (AnsiString="c") [0053.702] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="ics" | out: DestinationString="ics") [0053.702] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="ics", AllocateDestinationString=1 | out: DestinationString="ics") returned 0x0 [0053.703] RtlFreeAnsiString (AnsiString="i") [0053.703] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="msstyles" | out: DestinationString="msstyles") [0053.703] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="msstyles", AllocateDestinationString=1 | out: DestinationString="msstyles") returned 0x0 [0053.703] RtlFreeAnsiString (AnsiString="m") [0053.703] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="cur" | out: DestinationString="cur") [0053.703] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="cur", AllocateDestinationString=1 | out: DestinationString="cur") returned 0x0 [0053.703] RtlFreeAnsiString (AnsiString="c") [0053.703] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="drv" | out: DestinationString="drv") [0053.703] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="drv", AllocateDestinationString=1 | out: DestinationString="drv") returned 0x0 [0053.703] RtlFreeAnsiString (AnsiString="d") [0053.703] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="icns" | out: DestinationString="icns") [0053.703] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="icns", AllocateDestinationString=1 | out: DestinationString="icns") returned 0x0 [0053.703] RtlFreeAnsiString (AnsiString="i") [0053.703] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="diagcfg" | out: DestinationString="diagcfg") [0053.703] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="diagcfg", AllocateDestinationString=1 | out: DestinationString="diagcfg") returned 0x0 [0053.703] RtlFreeAnsiString (AnsiString="d") [0053.703] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="dll" | out: DestinationString="dll") [0053.703] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="dll", AllocateDestinationString=1 | out: DestinationString="dll") returned 0x0 [0053.703] RtlFreeAnsiString (AnsiString="d") [0053.703] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="ocx" | out: DestinationString="ocx") [0053.703] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="ocx", AllocateDestinationString=1 | out: DestinationString="ocx") returned 0x0 [0053.703] RtlFreeAnsiString (AnsiString="o") [0053.703] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="lnk" | out: DestinationString="lnk") [0053.703] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="lnk", AllocateDestinationString=1 | out: DestinationString="lnk") returned 0x0 [0053.703] RtlFreeAnsiString (AnsiString="l") [0053.703] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="ico" | out: DestinationString="ico") [0053.703] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="ico", AllocateDestinationString=1 | out: DestinationString="ico") returned 0x0 [0053.704] RtlFreeAnsiString (AnsiString="i") [0053.704] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="idx" | out: DestinationString="idx") [0053.704] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="idx", AllocateDestinationString=1 | out: DestinationString="idx") returned 0x0 [0053.704] RtlFreeAnsiString (AnsiString="i") [0053.704] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="ps1" | out: DestinationString="ps1") [0053.704] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="ps1", AllocateDestinationString=1 | out: DestinationString="ps1") returned 0x0 [0053.704] RtlFreeAnsiString (AnsiString="p") [0053.704] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="mpa" | out: DestinationString="mpa") [0053.704] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="mpa", AllocateDestinationString=1 | out: DestinationString="mpa") returned 0x0 [0053.704] RtlFreeAnsiString (AnsiString="m") [0053.704] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="cpl" | out: DestinationString="cpl") [0053.704] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="cpl", AllocateDestinationString=1 | out: DestinationString="cpl") returned 0x0 [0053.704] RtlFreeAnsiString (AnsiString="c") [0053.704] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="icl" | out: DestinationString="icl") [0053.704] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="icl", AllocateDestinationString=1 | out: DestinationString="icl") returned 0x0 [0053.704] RtlFreeAnsiString (AnsiString="i") [0053.704] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="msu" | out: DestinationString="msu") [0053.704] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="msu", AllocateDestinationString=1 | out: DestinationString="msu") returned 0x0 [0053.704] RtlFreeAnsiString (AnsiString="m") [0053.704] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="msi" | out: DestinationString="msi") [0053.704] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="msi", AllocateDestinationString=1 | out: DestinationString="msi") returned 0x0 [0053.704] RtlFreeAnsiString (AnsiString="m") [0053.704] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="nls" | out: DestinationString="nls") [0053.704] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="nls", AllocateDestinationString=1 | out: DestinationString="nls") returned 0x0 [0053.704] RtlFreeAnsiString (AnsiString="n") [0053.704] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="scr" | out: DestinationString="scr") [0053.704] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="scr", AllocateDestinationString=1 | out: DestinationString="scr") returned 0x0 [0053.705] RtlFreeAnsiString (AnsiString="s") [0053.705] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="adv" | out: DestinationString="adv") [0053.705] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="adv", AllocateDestinationString=1 | out: DestinationString="adv") returned 0x0 [0053.705] RtlFreeAnsiString (AnsiString="a") [0053.705] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="386" | out: DestinationString="386") [0053.705] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="386", AllocateDestinationString=1 | out: DestinationString="386") returned 0x0 [0053.705] RtlFreeAnsiString (AnsiString="3") [0053.705] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="com" | out: DestinationString="com") [0053.705] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="com", AllocateDestinationString=1 | out: DestinationString="com") returned 0x0 [0053.705] RtlFreeAnsiString (AnsiString="c") [0053.705] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="hlp" | out: DestinationString="hlp") [0053.705] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="hlp", AllocateDestinationString=1 | out: DestinationString="hlp") returned 0x0 [0053.705] RtlFreeAnsiString (AnsiString="h") [0053.705] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="rom" | out: DestinationString="rom") [0053.705] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="rom", AllocateDestinationString=1 | out: DestinationString="rom") returned 0x0 [0053.705] RtlFreeAnsiString (AnsiString="r") [0053.705] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="lock" | out: DestinationString="lock") [0053.705] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="lock", AllocateDestinationString=1 | out: DestinationString="lock") returned 0x0 [0053.705] RtlFreeAnsiString (AnsiString="l") [0053.705] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="386" | out: DestinationString="386") [0053.705] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="386", AllocateDestinationString=1 | out: DestinationString="386") returned 0x0 [0053.705] RtlFreeAnsiString (AnsiString="3") [0053.705] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="wpx" | out: DestinationString="wpx") [0053.705] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="wpx", AllocateDestinationString=1 | out: DestinationString="wpx") returned 0x0 [0053.705] RtlFreeAnsiString (AnsiString="w") [0053.705] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="ani" | out: DestinationString="ani") [0053.705] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="ani", AllocateDestinationString=1 | out: DestinationString="ani") returned 0x0 [0053.706] RtlFreeAnsiString (AnsiString="a") [0053.706] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="prf" | out: DestinationString="prf") [0053.706] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="prf", AllocateDestinationString=1 | out: DestinationString="prf") returned 0x0 [0053.706] RtlFreeAnsiString (AnsiString="p") [0053.706] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="rtp" | out: DestinationString="rtp") [0053.706] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="rtp", AllocateDestinationString=1 | out: DestinationString="rtp") returned 0x0 [0053.706] RtlFreeAnsiString (AnsiString="r") [0053.706] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="ldf" | out: DestinationString="ldf") [0053.706] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="ldf", AllocateDestinationString=1 | out: DestinationString="ldf") returned 0x0 [0053.706] RtlFreeAnsiString (AnsiString="l") [0053.706] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="key" | out: DestinationString="key") [0053.706] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="key", AllocateDestinationString=1 | out: DestinationString="key") returned 0x0 [0053.706] RtlFreeAnsiString (AnsiString="k") [0053.706] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="diagcab" | out: DestinationString="diagcab") [0053.706] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="diagcab", AllocateDestinationString=1 | out: DestinationString="diagcab") returned 0x0 [0053.706] RtlFreeAnsiString (AnsiString="d") [0053.706] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="cmd" | out: DestinationString="cmd") [0053.706] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="cmd", AllocateDestinationString=1 | out: DestinationString="cmd") returned 0x0 [0053.706] RtlFreeAnsiString (AnsiString="c") [0053.706] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="spl" | out: DestinationString="spl") [0053.706] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="spl", AllocateDestinationString=1 | out: DestinationString="spl") returned 0x0 [0053.706] RtlFreeAnsiString (AnsiString="s") [0053.706] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="deskthemepack" | out: DestinationString="deskthemepack") [0053.706] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="deskthemepack", AllocateDestinationString=1 | out: DestinationString="deskthemepack") returned 0x0 [0053.706] RtlFreeAnsiString (AnsiString="d") [0053.706] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="bat" | out: DestinationString="bat") [0053.706] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="bat", AllocateDestinationString=1 | out: DestinationString="bat") returned 0x0 [0053.707] RtlFreeAnsiString (AnsiString="b") [0053.707] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="themepack" | out: DestinationString="themepack") [0053.707] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="themepack", AllocateDestinationString=1 | out: DestinationString="themepack") returned 0x0 [0053.707] RtlFreeAnsiString (AnsiString="t") [0053.707] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="nslsvice.exe" | out: DestinationString="nslsvice.exe") [0053.707] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="nslsvice.exe", AllocateDestinationString=1 | out: DestinationString="nslsvice.exe") returned 0x0 [0053.707] RtlFreeAnsiString (AnsiString="n") [0053.707] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="pg*" | out: DestinationString="pg*") [0053.707] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="pg*", AllocateDestinationString=1 | out: DestinationString="pg*") returned 0x0 [0053.707] RtlFreeAnsiString (AnsiString="p") [0053.707] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="nservice.exe" | out: DestinationString="nservice.exe") [0053.707] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="nservice.exe", AllocateDestinationString=1 | out: DestinationString="nservice.exe") returned 0x0 [0053.707] RtlFreeAnsiString (AnsiString="n") [0053.707] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="cbvscserv*" | out: DestinationString="cbvscserv*") [0053.707] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="cbvscserv*", AllocateDestinationString=1 | out: DestinationString="cbvscserv*") returned 0x0 [0053.707] RtlFreeAnsiString (AnsiString="c") [0053.707] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="ntrtscan.exe" | out: DestinationString="ntrtscan.exe") [0053.707] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="ntrtscan.exe", AllocateDestinationString=1 | out: DestinationString="ntrtscan.exe") returned 0x0 [0053.708] RtlFreeAnsiString (AnsiString="n") [0053.708] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="cbservi*" | out: DestinationString="cbservi*") [0053.708] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="cbservi*", AllocateDestinationString=1 | out: DestinationString="cbservi*") returned 0x0 [0053.708] RtlFreeAnsiString (AnsiString="c") [0053.708] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="hMailServer*" | out: DestinationString="hMailServer*") [0053.708] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="hMailServer*", AllocateDestinationString=1 | out: DestinationString="hMailServer*") returned 0x0 [0053.708] RtlFreeAnsiString (AnsiString="h") [0053.708] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="IBM*" | out: DestinationString="IBM*") [0053.708] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="IBM*", AllocateDestinationString=1 | out: DestinationString="IBM*") returned 0x0 [0053.708] RtlFreeAnsiString (AnsiString="I") [0053.708] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="bes10*" | out: DestinationString="bes10*") [0053.708] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="bes10*", AllocateDestinationString=1 | out: DestinationString="bes10*") returned 0x0 [0053.708] RtlFreeAnsiString (AnsiString="b") [0053.708] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="black*" | out: DestinationString="black*") [0053.708] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="black*", AllocateDestinationString=1 | out: DestinationString="black*") returned 0x0 [0053.708] RtlFreeAnsiString (AnsiString="b") [0053.708] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="apach*" | out: DestinationString="apach*") [0053.708] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="apach*", AllocateDestinationString=1 | out: DestinationString="apach*") returned 0x0 [0053.708] RtlFreeAnsiString (AnsiString="a") [0053.708] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="bd2*" | out: DestinationString="bd2*") [0053.708] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="bd2*", AllocateDestinationString=1 | out: DestinationString="bd2*") returned 0x0 [0053.708] RtlFreeAnsiString (AnsiString="b") [0053.708] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="db*" | out: DestinationString="db*") [0053.708] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="db*", AllocateDestinationString=1 | out: DestinationString="db*") returned 0x0 [0053.708] RtlFreeAnsiString (AnsiString="d") [0053.708] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="ba*" | out: DestinationString="ba*") [0053.708] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="ba*", AllocateDestinationString=1 | out: DestinationString="ba*") returned 0x0 [0053.709] RtlFreeAnsiString (AnsiString="b") [0053.709] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="be*" | out: DestinationString="be*") [0053.709] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="be*", AllocateDestinationString=1 | out: DestinationString="be*") returned 0x0 [0053.709] RtlFreeAnsiString (AnsiString="b") [0053.709] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="QB*" | out: DestinationString="QB*") [0053.709] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="QB*", AllocateDestinationString=1 | out: DestinationString="QB*") returned 0x0 [0053.709] RtlFreeAnsiString (AnsiString="Q") [0053.709] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="oracle*" | out: DestinationString="oracle*") [0053.709] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="oracle*", AllocateDestinationString=1 | out: DestinationString="oracle*") returned 0x0 [0053.709] RtlFreeAnsiString (AnsiString="o") [0053.709] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="wbengine*" | out: DestinationString="wbengine*") [0053.709] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="wbengine*", AllocateDestinationString=1 | out: DestinationString="wbengine*") returned 0x0 [0053.709] RtlFreeAnsiString (AnsiString="w") [0053.709] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="vee*" | out: DestinationString="vee*") [0053.709] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="vee*", AllocateDestinationString=1 | out: DestinationString="vee*") returned 0x0 [0053.709] RtlFreeAnsiString (AnsiString="v") [0053.709] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="postg*" | out: DestinationString="postg*") [0053.709] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="postg*", AllocateDestinationString=1 | out: DestinationString="postg*") returned 0x0 [0053.709] RtlFreeAnsiString (AnsiString="p") [0053.709] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="sage*" | out: DestinationString="sage*") [0053.709] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="sage*", AllocateDestinationString=1 | out: DestinationString="sage*") returned 0x0 [0053.709] RtlFreeAnsiString (AnsiString="s") [0053.709] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="sap*" | out: DestinationString="sap*") [0053.709] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="sap*", AllocateDestinationString=1 | out: DestinationString="sap*") returned 0x0 [0053.709] RtlFreeAnsiString (AnsiString="s") [0053.709] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="b1*" | out: DestinationString="b1*") [0053.709] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="b1*", AllocateDestinationString=1 | out: DestinationString="b1*") returned 0x0 [0053.710] RtlFreeAnsiString (AnsiString="b") [0053.710] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="fdlaunch*" | out: DestinationString="fdlaunch*") [0053.710] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="fdlaunch*", AllocateDestinationString=1 | out: DestinationString="fdlaunch*") returned 0x0 [0053.710] RtlFreeAnsiString (AnsiString="f") [0053.710] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="msmdsrv*" | out: DestinationString="msmdsrv*") [0053.710] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="msmdsrv*", AllocateDestinationString=1 | out: DestinationString="msmdsrv*") returned 0x0 [0053.710] RtlFreeAnsiString (AnsiString="m") [0053.710] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="report*" | out: DestinationString="report*") [0053.710] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="report*", AllocateDestinationString=1 | out: DestinationString="report*") returned 0x0 [0053.710] RtlFreeAnsiString (AnsiString="r") [0053.710] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="msdtssr*" | out: DestinationString="msdtssr*") [0053.710] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="msdtssr*", AllocateDestinationString=1 | out: DestinationString="msdtssr*") returned 0x0 [0053.710] RtlFreeAnsiString (AnsiString="m") [0053.710] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="coldfus*" | out: DestinationString="coldfus*") [0053.710] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="coldfus*", AllocateDestinationString=1 | out: DestinationString="coldfus*") returned 0x0 [0053.710] RtlFreeAnsiString (AnsiString="c") [0053.710] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="cfdot*" | out: DestinationString="cfdot*") [0053.710] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="cfdot*", AllocateDestinationString=1 | out: DestinationString="cfdot*") returned 0x0 [0053.710] RtlFreeAnsiString (AnsiString="c") [0053.710] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="swag*" | out: DestinationString="swag*") [0053.710] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="swag*", AllocateDestinationString=1 | out: DestinationString="swag*") returned 0x0 [0053.710] RtlFreeAnsiString (AnsiString="s") [0053.710] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="swstrtr*" | out: DestinationString="swstrtr*") [0053.710] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="swstrtr*", AllocateDestinationString=1 | out: DestinationString="swstrtr*") returned 0x0 [0053.710] RtlFreeAnsiString (AnsiString="s") [0053.710] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="jetty.exe" | out: DestinationString="jetty.exe") [0053.710] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="jetty.exe", AllocateDestinationString=1 | out: DestinationString="jetty.exe") returned 0x0 [0053.711] RtlFreeAnsiString (AnsiString="j") [0053.711] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="wrsa.exe" | out: DestinationString="wrsa.exe") [0053.711] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="wrsa.exe", AllocateDestinationString=1 | out: DestinationString="wrsa.exe") returned 0x0 [0053.711] RtlFreeAnsiString (AnsiString="w") [0053.711] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="team*" | out: DestinationString="team*") [0053.711] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="team*", AllocateDestinationString=1 | out: DestinationString="team*") returned 0x0 [0053.711] RtlFreeAnsiString (AnsiString="t") [0053.711] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="agent*" | out: DestinationString="agent*") [0053.711] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="agent*", AllocateDestinationString=1 | out: DestinationString="agent*") returned 0x0 [0053.711] RtlFreeAnsiString (AnsiString="a") [0053.711] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="store.exe" | out: DestinationString="store.exe") [0053.711] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="store.exe", AllocateDestinationString=1 | out: DestinationString="store.exe") returned 0x0 [0053.711] RtlFreeAnsiString (AnsiString="s") [0053.711] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="sql*" | out: DestinationString="sql*") [0053.711] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="sql*", AllocateDestinationString=1 | out: DestinationString="sql*") returned 0x0 [0053.711] RtlFreeAnsiString (AnsiString="s") [0053.711] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="sqbcoreservice.exe" | out: DestinationString="sqbcoreservice.exe") [0053.711] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="sqbcoreservice.exe", AllocateDestinationString=1 | out: DestinationString="sqbcoreservice.exe") returned 0x0 [0053.711] RtlFreeAnsiString (AnsiString="s") [0053.711] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="thunderbird.exe" | out: DestinationString="thunderbird.exe") [0053.711] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="thunderbird.exe", AllocateDestinationString=1 | out: DestinationString="thunderbird.exe") returned 0x0 [0053.711] RtlFreeAnsiString (AnsiString="t") [0053.711] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="ocssd.exe" | out: DestinationString="ocssd.exe") [0053.711] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="ocssd.exe", AllocateDestinationString=1 | out: DestinationString="ocssd.exe") returned 0x0 [0053.711] RtlFreeAnsiString (AnsiString="o") [0053.711] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="encsvc.exe" | out: DestinationString="encsvc.exe") [0053.711] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="encsvc.exe", AllocateDestinationString=1 | out: DestinationString="encsvc.exe") returned 0x0 [0053.712] RtlFreeAnsiString (AnsiString="e") [0053.712] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="excel.exe" | out: DestinationString="excel.exe") [0053.712] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="excel.exe", AllocateDestinationString=1 | out: DestinationString="excel.exe") returned 0x0 [0053.712] RtlFreeAnsiString (AnsiString="e") [0053.712] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="synctime.exe" | out: DestinationString="synctime.exe") [0053.712] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="synctime.exe", AllocateDestinationString=1 | out: DestinationString="synctime.exe") returned 0x0 [0053.712] RtlFreeAnsiString (AnsiString="s") [0053.712] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="mspub.exe" | out: DestinationString="mspub.exe") [0053.712] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="mspub.exe", AllocateDestinationString=1 | out: DestinationString="mspub.exe") returned 0x0 [0053.712] RtlFreeAnsiString (AnsiString="m") [0053.712] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="ocautoupds.exe" | out: DestinationString="ocautoupds.exe") [0053.712] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="ocautoupds.exe", AllocateDestinationString=1 | out: DestinationString="ocautoupds.exe") returned 0x0 [0053.712] RtlFreeAnsiString (AnsiString="o") [0053.712] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="thebat.exe" | out: DestinationString="thebat.exe") [0053.712] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="thebat.exe", AllocateDestinationString=1 | out: DestinationString="thebat.exe") returned 0x0 [0053.712] RtlFreeAnsiString (AnsiString="t") [0053.712] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="dbeng50.exe" | out: DestinationString="dbeng50.exe") [0053.712] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="dbeng50.exe", AllocateDestinationString=1 | out: DestinationString="dbeng50.exe") returned 0x0 [0053.712] RtlFreeAnsiString (AnsiString="d") [0053.712] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*sql*" | out: DestinationString="*sql*") [0053.712] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*sql*", AllocateDestinationString=1 | out: DestinationString="*sql*") returned 0x0 [0053.712] RtlFreeAnsiString (AnsiString="*") [0053.712] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="mydesktopservice.exe" | out: DestinationString="mydesktopservice.exe") [0053.712] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="mydesktopservice.exe", AllocateDestinationString=1 | out: DestinationString="mydesktopservice.exe") returned 0x0 [0053.712] RtlFreeAnsiString (AnsiString="m") [0053.712] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="onenote.exe" | out: DestinationString="onenote.exe") [0053.713] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="onenote.exe", AllocateDestinationString=1 | out: DestinationString="onenote.exe") returned 0x0 [0053.713] RtlFreeAnsiString (AnsiString="o") [0053.713] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="outlook.exe" | out: DestinationString="outlook.exe") [0053.713] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="outlook.exe", AllocateDestinationString=1 | out: DestinationString="outlook.exe") returned 0x0 [0053.713] RtlFreeAnsiString (AnsiString="o") [0053.713] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="powerpnt.exe" | out: DestinationString="powerpnt.exe") [0053.713] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="powerpnt.exe", AllocateDestinationString=1 | out: DestinationString="powerpnt.exe") returned 0x0 [0053.713] RtlFreeAnsiString (AnsiString="p") [0053.713] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="msaccess.exe" | out: DestinationString="msaccess.exe") [0053.713] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="msaccess.exe", AllocateDestinationString=1 | out: DestinationString="msaccess.exe") returned 0x0 [0053.713] RtlFreeAnsiString (AnsiString="m") [0053.713] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="tbirdconfig.exe" | out: DestinationString="tbirdconfig.exe") [0053.713] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="tbirdconfig.exe", AllocateDestinationString=1 | out: DestinationString="tbirdconfig.exe") returned 0x0 [0053.713] RtlFreeAnsiString (AnsiString="t") [0053.713] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="wordpad.exe" | out: DestinationString="wordpad.exe") [0053.713] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="wordpad.exe", AllocateDestinationString=1 | out: DestinationString="wordpad.exe") returned 0x0 [0053.713] RtlFreeAnsiString (AnsiString="w") [0053.713] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="ocomm.exe" | out: DestinationString="ocomm.exe") [0053.713] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="ocomm.exe", AllocateDestinationString=1 | out: DestinationString="ocomm.exe") returned 0x0 [0053.713] RtlFreeAnsiString (AnsiString="o") [0053.713] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="dbsnmp.exe" | out: DestinationString="dbsnmp.exe") [0053.713] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="dbsnmp.exe", AllocateDestinationString=1 | out: DestinationString="dbsnmp.exe") returned 0x0 [0053.713] RtlFreeAnsiString (AnsiString="d") [0053.713] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="thebat64.exe" | out: DestinationString="thebat64.exe") [0053.713] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="thebat64.exe", AllocateDestinationString=1 | out: DestinationString="thebat64.exe") returned 0x0 [0053.713] RtlFreeAnsiString (AnsiString="t") [0053.714] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="winword.exe" | out: DestinationString="winword.exe") [0053.714] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="winword.exe", AllocateDestinationString=1 | out: DestinationString="winword.exe") returned 0x0 [0053.714] RtlFreeAnsiString (AnsiString="w") [0053.714] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="oracle.exe" | out: DestinationString="oracle.exe") [0053.714] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="oracle.exe", AllocateDestinationString=1 | out: DestinationString="oracle.exe") returned 0x0 [0053.714] RtlFreeAnsiString (AnsiString="o") [0053.714] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="xfssvccon.exe" | out: DestinationString="xfssvccon.exe") [0053.714] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="xfssvccon.exe", AllocateDestinationString=1 | out: DestinationString="xfssvccon.exe") returned 0x0 [0053.714] RtlFreeAnsiString (AnsiString="x") [0053.714] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="firefoxconfig.exe" | out: DestinationString="firefoxconfig.exe") [0053.714] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="firefoxconfig.exe", AllocateDestinationString=1 | out: DestinationString="firefoxconfig.exe") returned 0x0 [0053.714] RtlFreeAnsiString (AnsiString="f") [0053.714] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="visio.exe" | out: DestinationString="visio.exe") [0053.714] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="visio.exe", AllocateDestinationString=1 | out: DestinationString="visio.exe") returned 0x0 [0053.714] RtlFreeAnsiString (AnsiString="v") [0053.714] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="mydesktopqos.exe" | out: DestinationString="mydesktopqos.exe") [0053.714] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="mydesktopqos.exe", AllocateDestinationString=1 | out: DestinationString="mydesktopqos.exe") returned 0x0 [0053.714] RtlFreeAnsiString (AnsiString="m") [0053.714] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="infopath.exe" | out: DestinationString="infopath.exe") [0053.714] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="infopath.exe", AllocateDestinationString=1 | out: DestinationString="infopath.exe") returned 0x0 [0053.714] RtlFreeAnsiString (AnsiString="i") [0053.714] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="agntsvc.exe" | out: DestinationString="agntsvc.exe") [0053.714] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="agntsvc.exe", AllocateDestinationString=1 | out: DestinationString="agntsvc.exe") returned 0x0 [0053.714] RtlFreeAnsiString (AnsiString="a") [0053.715] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="Lotus*" | out: DestinationString="Lotus*") [0053.715] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="Lotus*", AllocateDestinationString=1 | out: DestinationString="Lotus*") returned 0x0 [0053.715] RtlFreeAnsiString (AnsiString="L") [0053.715] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="veeam*" | out: DestinationString="veeam*") [0053.715] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="veeam*", AllocateDestinationString=1 | out: DestinationString="veeam*") returned 0x0 [0053.715] RtlFreeAnsiString (AnsiString="v") [0053.715] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="cbvscserv*" | out: DestinationString="cbvscserv*") [0053.715] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="cbvscserv*", AllocateDestinationString=1 | out: DestinationString="cbvscserv*") returned 0x0 [0053.715] RtlFreeAnsiString (AnsiString="c") [0053.715] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="hMailServer" | out: DestinationString="hMailServer") [0053.715] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="hMailServer", AllocateDestinationString=1 | out: DestinationString="hMailServer") returned 0x0 [0053.715] RtlFreeAnsiString (AnsiString="h") [0053.715] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="backup*" | out: DestinationString="backup*") [0053.715] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="backup*", AllocateDestinationString=1 | out: DestinationString="backup*") returned 0x0 [0053.715] RtlFreeAnsiString (AnsiString="b") [0053.715] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*backup*" | out: DestinationString="*backup*") [0053.715] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*backup*", AllocateDestinationString=1 | out: DestinationString="*backup*") returned 0x0 [0053.715] RtlFreeAnsiString (AnsiString="*") [0053.715] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="apach*" | out: DestinationString="apach*") [0053.715] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="apach*", AllocateDestinationString=1 | out: DestinationString="apach*") returned 0x0 [0053.715] RtlFreeAnsiString (AnsiString="a") [0053.715] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="firebird*" | out: DestinationString="firebird*") [0053.715] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="firebird*", AllocateDestinationString=1 | out: DestinationString="firebird*") returned 0x0 [0053.715] RtlFreeAnsiString (AnsiString="f") [0053.715] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="ibmiasrw" | out: DestinationString="ibmiasrw") [0053.715] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="ibmiasrw", AllocateDestinationString=1 | out: DestinationString="ibmiasrw") returned 0x0 [0053.716] RtlFreeAnsiString (AnsiString="i") [0053.716] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="IBM Domino*" | out: DestinationString="IBM Domino*") [0053.716] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="IBM Domino*", AllocateDestinationString=1 | out: DestinationString="IBM Domino*") returned 0x0 [0053.716] RtlFreeAnsiString (AnsiString="I") [0053.716] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="Simply Accounting Database Connection Manager" | out: DestinationString="Simply Accounting Database Connection Manager") [0053.716] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="Simply Accounting Database Connection Manager", AllocateDestinationString=1 | out: DestinationString="Simply Accounting Database Connection Manager") returned 0x0 [0053.716] RtlFreeAnsiString (AnsiString="S") [0053.716] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="IASJet" | out: DestinationString="IASJet") [0053.716] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="IASJet", AllocateDestinationString=1 | out: DestinationString="IASJet") returned 0x0 [0053.716] RtlFreeAnsiString (AnsiString="I") [0053.716] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="QB*" | out: DestinationString="QB*") [0053.716] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="QB*", AllocateDestinationString=1 | out: DestinationString="QB*") returned 0x0 [0053.716] RtlFreeAnsiString (AnsiString="Q") [0053.716] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*sql*" | out: DestinationString="*sql*") [0053.716] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*sql*", AllocateDestinationString=1 | out: DestinationString="*sql*") returned 0x0 [0053.716] RtlFreeAnsiString (AnsiString="*") [0053.716] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="sql*" | out: DestinationString="sql*") [0053.716] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="sql*", AllocateDestinationString=1 | out: DestinationString="sql*") returned 0x0 [0053.716] RtlFreeAnsiString (AnsiString="s") [0053.716] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="QuickBooksDB*" | out: DestinationString="QuickBooksDB*") [0053.716] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="QuickBooksDB*", AllocateDestinationString=1 | out: DestinationString="QuickBooksDB*") returned 0x0 [0053.716] RtlFreeAnsiString (AnsiString="Q") [0053.716] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="IISADMIN" | out: DestinationString="IISADMIN") [0053.831] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="IISADMIN", AllocateDestinationString=1 | out: DestinationString="IISADMIN") returned 0x0 [0053.831] RtlFreeAnsiString (AnsiString="I") [0053.831] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="omsad" | out: DestinationString="omsad") [0053.831] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="omsad", AllocateDestinationString=1 | out: DestinationString="omsad") returned 0x0 [0053.831] RtlFreeAnsiString (AnsiString="o") [0053.831] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="dc*32" | out: DestinationString="dc*32") [0053.831] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="dc*32", AllocateDestinationString=1 | out: DestinationString="dc*32") returned 0x0 [0053.831] RtlFreeAnsiString (AnsiString="d") [0053.831] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="server Administrator" | out: DestinationString="server Administrator") [0053.831] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="server Administrator", AllocateDestinationString=1 | out: DestinationString="server Administrator") returned 0x0 [0053.831] RtlFreeAnsiString (AnsiString="s") [0053.831] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="wbengine" | out: DestinationString="wbengine") [0053.831] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="wbengine", AllocateDestinationString=1 | out: DestinationString="wbengine") returned 0x0 [0053.831] RtlFreeAnsiString (AnsiString="w") [0053.831] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="mr2kserv" | out: DestinationString="mr2kserv") [0053.832] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="mr2kserv", AllocateDestinationString=1 | out: DestinationString="mr2kserv") returned 0x0 [0053.832] RtlFreeAnsiString (AnsiString="m") [0053.832] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="MSExchange*" | out: DestinationString="MSExchange*") [0053.833] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="MSExchange*", AllocateDestinationString=1 | out: DestinationString="MSExchange*") returned 0x0 [0053.834] RtlFreeAnsiString (AnsiString="M") [0053.834] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="ShadowProtectSvc" | out: DestinationString="ShadowProtectSvc") [0053.834] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="ShadowProtectSvc", AllocateDestinationString=1 | out: DestinationString="ShadowProtectSvc") returned 0x0 [0053.834] RtlFreeAnsiString (AnsiString="S") [0053.834] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="SP*4" | out: DestinationString="SP*4") [0053.834] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="SP*4", AllocateDestinationString=1 | out: DestinationString="SP*4") returned 0x0 [0053.834] RtlFreeAnsiString (AnsiString="S") [0053.834] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="teamviewer" | out: DestinationString="teamviewer") [0053.834] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="teamviewer", AllocateDestinationString=1 | out: DestinationString="teamviewer") returned 0x0 [0053.834] RtlFreeAnsiString (AnsiString="t") [0053.834] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="MMS" | out: DestinationString="MMS") [0053.834] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="MMS", AllocateDestinationString=1 | out: DestinationString="MMS") returned 0x0 [0053.834] RtlFreeAnsiString (AnsiString="M") [0053.834] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="AcronisAgent" | out: DestinationString="AcronisAgent") [0053.834] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="AcronisAgent", AllocateDestinationString=1 | out: DestinationString="AcronisAgent") returned 0x0 [0053.834] RtlFreeAnsiString (AnsiString="A") [0053.835] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="ARSM" | out: DestinationString="ARSM") [0053.835] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="ARSM", AllocateDestinationString=1 | out: DestinationString="ARSM") returned 0x0 [0053.835] RtlFreeAnsiString (AnsiString="A") [0053.835] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="AcrSch2Svc" | out: DestinationString="AcrSch2Svc") [0053.835] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="AcrSch2Svc", AllocateDestinationString=1 | out: DestinationString="AcrSch2Svc") returned 0x0 [0053.835] RtlFreeAnsiString (AnsiString="A") [0053.835] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="vsnapvss" | out: DestinationString="vsnapvss") [0053.835] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="vsnapvss", AllocateDestinationString=1 | out: DestinationString="vsnapvss") returned 0x0 [0053.835] RtlFreeAnsiString (AnsiString="v") [0053.835] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="SPXService" | out: DestinationString="SPXService") [0053.835] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="SPXService", AllocateDestinationString=1 | out: DestinationString="SPXService") returned 0x0 [0053.835] RtlFreeAnsiString (AnsiString="S") [0053.835] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="StorageCraft ImageManager" | out: DestinationString="StorageCraft ImageManager") [0053.835] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="StorageCraft ImageManager", AllocateDestinationString=1 | out: DestinationString="StorageCraft ImageManager") returned 0x0 [0053.835] RtlFreeAnsiString (AnsiString="S") [0053.835] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="wrsvc" | out: DestinationString="wrsvc") [0053.835] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="wrsvc", AllocateDestinationString=1 | out: DestinationString="wrsvc") returned 0x0 [0053.835] RtlFreeAnsiString (AnsiString="w") [0053.836] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="stc_endpt_svc" | out: DestinationString="stc_endpt_svc") [0053.836] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="stc_endpt_svc", AllocateDestinationString=1 | out: DestinationString="stc_endpt_svc") returned 0x0 [0053.836] RtlFreeAnsiString (AnsiString="s") [0053.836] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="acrsch2svc" | out: DestinationString="acrsch2svc") [0053.836] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="acrsch2svc", AllocateDestinationString=1 | out: DestinationString="acrsch2svc") returned 0x0 [0053.836] RtlFreeAnsiString (AnsiString="a") [0053.836] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="reboot" | out: DestinationString="reboot") [0053.836] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="reboot", AllocateDestinationString=1 | out: DestinationString="reboot") returned 0x0 [0053.836] RtlFreeAnsiString (AnsiString="r") [0053.836] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="restart" | out: DestinationString="restart") [0053.836] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="restart", AllocateDestinationString=1 | out: DestinationString="restart") returned 0x0 [0053.836] RtlFreeAnsiString (AnsiString="r") [0053.836] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="shutdown" | out: DestinationString="shutdown") [0053.837] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="shutdown", AllocateDestinationString=1 | out: DestinationString="shutdown") returned 0x0 [0053.837] RtlFreeAnsiString (AnsiString="s") [0053.837] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="logoff" | out: DestinationString="logoff") [0053.837] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="logoff", AllocateDestinationString=1 | out: DestinationString="logoff") returned 0x0 [0053.837] RtlFreeAnsiString (AnsiString="l") [0053.837] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="back" | out: DestinationString="back") [0053.837] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="back", AllocateDestinationString=1 | out: DestinationString="back") returned 0x0 [0053.837] RtlFreeAnsiString (AnsiString="b") [0053.838] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="ipc$" | out: DestinationString="ipc$") [0053.838] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="ipc$", AllocateDestinationString=1 | out: DestinationString="ipc$") returned 0x0 [0053.838] RtlFreeAnsiString (AnsiString="i") [0053.838] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="admin$" | out: DestinationString="admin$") [0053.838] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="admin$", AllocateDestinationString=1 | out: DestinationString="admin$") returned 0x0 [0053.838] RtlFreeAnsiString (AnsiString="a") [0053.839] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="psexec.exe" | out: DestinationString="psexec.exe") [0053.839] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="psexec.exe", AllocateDestinationString=1 | out: DestinationString="psexec.exe") returned 0x0 [0053.839] RtlFreeAnsiString (AnsiString="p") [0053.839] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="system" | out: DestinationString="system") [0053.839] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="system", AllocateDestinationString=1 | out: DestinationString="system") returned 0x0 [0053.839] RtlFreeAnsiString (AnsiString="s") [0053.839] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*:\\windows*" | out: DestinationString="*:\\windows*") [0053.840] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*:\\windows*", AllocateDestinationString=1 | out: DestinationString="*:\\windows*") returned 0x0 [0053.840] RtlFreeAnsiString (AnsiString="*") [0053.840] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*:\\winnt*" | out: DestinationString="*:\\winnt*") [0053.840] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*:\\winnt*", AllocateDestinationString=1 | out: DestinationString="*:\\winnt*") returned 0x0 [0053.840] RtlFreeAnsiString (AnsiString="*") [0053.840] RtlInitAnsiString (in: DestinationString=0xb3fb84, SourceString="*:\\program file*\\vmwar*" | out: DestinationString="*:\\program file*\\vmwar*") [0053.840] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fb8c, SourceString="*:\\program file*\\vmwar*", AllocateDestinationString=1 | out: DestinationString="*:\\program file*\\vmwar*") returned 0x0 [0053.840] RtlFreeAnsiString (AnsiString="*") [0053.840] RtlFreeHeap (HeapHandle=0xee0000, Flags=0x0, BaseAddress=0xef86f0) returned 1 [0053.840] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xd57198, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\ef3ff3f0.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ef3ff3f0.exe")) returned 0x24 [0053.840] GetVersion () returned 0x23f00206 [0053.840] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0xef4e68 | out: Wow64Process=0xef4e68) returned 1 [0053.840] GetCurrentProcessId () returned 0x13ac [0053.840] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0xb3fc00 | out: TokenHandle=0xb3fc00*=0x200) returned 0x0 [0053.840] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x100) returned 0xf06310 [0053.841] GetTokenInformation (in: TokenHandle=0x200, TokenInformationClass=0x1, TokenInformation=0xf06310, TokenInformationLength=0x100, ReturnLength=0xb3fc38 | out: TokenInformation=0xf06310, ReturnLength=0xb3fc38) returned 1 [0053.841] IsWellKnownSid (pSid=0xf06318*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xb4)), WellKnownSidType=0x16) returned 0 [0053.841] RtlFreeHeap (HeapHandle=0xee0000, Flags=0x0, BaseAddress=0xf06310) returned 1 [0053.841] GetTokenInformation (in: TokenHandle=0x200, TokenInformationClass=0x12, TokenInformation=0xb3fc14, TokenInformationLength=0x4, ReturnLength=0xb3fc38 | out: TokenInformation=0xb3fc14, ReturnLength=0xb3fc38) returned 1 [0053.841] NtClose (Handle=0x200) returned 0x0 [0053.841] GetComputerNameExW (in: NameType=0x0, lpBuffer=0x0, nSize=0xb3fbfc | out: lpBuffer=0x0, nSize=0xb3fbfc) returned 0 [0053.841] GetLastError () returned 0xea [0053.841] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x10) returned 0xf05eb0 [0053.841] GetComputerNameExW (in: NameType=0x0, lpBuffer=0xf05eb0, nSize=0xb3fbfc | out: lpBuffer="NQDPDE", nSize=0xb3fbfc) returned 1 [0053.842] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0xf4) returned 0xf06310 [0053.842] GetCurrentHwProfileW (in: lpHwProfileInfo=0xf06310 | out: lpHwProfileInfo=0xf06310) returned 1 [0053.843] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x70) returned 0xee6f80 [0053.843] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x20) returned 0xefef70 [0053.843] RtlFreeHeap (HeapHandle=0xee0000, Flags=0x0, BaseAddress=0xefef70) returned 1 [0053.843] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x20) returned 0xeff0b0 [0053.843] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x20) returned 0xefef70 [0053.843] RtlFreeHeap (HeapHandle=0xee0000, Flags=0x0, BaseAddress=0xefef70) returned 1 [0053.844] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x41) returned 0xeff568 [0053.844] sprintf (in: _Dest=0xeff568, _Format="%0.2x" | out: _Dest="a0") returned 2 [0053.844] sprintf (in: _Dest=0xeff56a, _Format="%0.2x" | out: _Dest="a7") returned 2 [0053.844] sprintf (in: _Dest=0xeff56c, _Format="%0.2x" | out: _Dest="02") returned 2 [0053.844] sprintf (in: _Dest=0xeff56e, _Format="%0.2x" | out: _Dest="90") returned 2 [0053.844] sprintf (in: _Dest=0xeff570, _Format="%0.2x" | out: _Dest="71") returned 2 [0053.844] sprintf (in: _Dest=0xeff572, _Format="%0.2x" | out: _Dest="28") returned 2 [0053.844] sprintf (in: _Dest=0xeff574, _Format="%0.2x" | out: _Dest="eb") returned 2 [0053.844] sprintf (in: _Dest=0xeff576, _Format="%0.2x" | out: _Dest="03") returned 2 [0053.844] sprintf (in: _Dest=0xeff578, _Format="%0.2x" | out: _Dest="0e") returned 2 [0053.844] sprintf (in: _Dest=0xeff57a, _Format="%0.2x" | out: _Dest="de") returned 2 [0053.844] sprintf (in: _Dest=0xeff57c, _Format="%0.2x" | out: _Dest="23") returned 2 [0053.844] sprintf (in: _Dest=0xeff57e, _Format="%0.2x" | out: _Dest="a3") returned 2 [0053.844] sprintf (in: _Dest=0xeff580, _Format="%0.2x" | out: _Dest="fb") returned 2 [0053.844] sprintf (in: _Dest=0xeff582, _Format="%0.2x" | out: _Dest="75") returned 2 [0053.844] sprintf (in: _Dest=0xeff584, _Format="%0.2x" | out: _Dest="38") returned 2 [0053.844] sprintf (in: _Dest=0xeff586, _Format="%0.2x" | out: _Dest="23") returned 2 [0053.844] sprintf (in: _Dest=0xeff588, _Format="%0.2x" | out: _Dest="a7") returned 2 [0053.844] sprintf (in: _Dest=0xeff58a, _Format="%0.2x" | out: _Dest="54") returned 2 [0053.844] sprintf (in: _Dest=0xeff58c, _Format="%0.2x" | out: _Dest="3f") returned 2 [0053.844] sprintf (in: _Dest=0xeff58e, _Format="%0.2x" | out: _Dest="21") returned 2 [0053.844] sprintf (in: _Dest=0xeff590, _Format="%0.2x" | out: _Dest="9d") returned 2 [0053.845] sprintf (in: _Dest=0xeff592, _Format="%0.2x" | out: _Dest="cb") returned 2 [0053.845] sprintf (in: _Dest=0xeff594, _Format="%0.2x" | out: _Dest="b5") returned 2 [0053.845] sprintf (in: _Dest=0xeff596, _Format="%0.2x" | out: _Dest="8a") returned 2 [0053.845] sprintf (in: _Dest=0xeff598, _Format="%0.2x" | out: _Dest="fe") returned 2 [0053.845] sprintf (in: _Dest=0xeff59a, _Format="%0.2x" | out: _Dest="a5") returned 2 [0053.845] sprintf (in: _Dest=0xeff59c, _Format="%0.2x" | out: _Dest="56") returned 2 [0053.845] sprintf (in: _Dest=0xeff59e, _Format="%0.2x" | out: _Dest="c2") returned 2 [0053.845] sprintf (in: _Dest=0xeff5a0, _Format="%0.2x" | out: _Dest="4f") returned 2 [0053.845] sprintf (in: _Dest=0xeff5a2, _Format="%0.2x" | out: _Dest="58") returned 2 [0053.845] sprintf (in: _Dest=0xeff5a4, _Format="%0.2x" | out: _Dest="4f") returned 2 [0053.845] sprintf (in: _Dest=0xeff5a6, _Format="%0.2x" | out: _Dest="2d") returned 2 [0053.845] RtlInitAnsiString (in: DestinationString=0xb3fbac, SourceString="a0a702907128eb030ede23a3fb753823a7543f219dcbb58afea556c24f584f2d" | out: DestinationString="a0a702907128eb030ede23a3fb753823a7543f219dcbb58afea556c24f584f2d") [0053.845] RtlAnsiStringToUnicodeString (in: DestinationString=0xb3fbb4, SourceString="a0a702907128eb030ede23a3fb753823a7543f219dcbb58afea556c24f584f2d", AllocateDestinationString=1 | out: DestinationString="a0a702907128eb030ede23a3fb753823a7543f219dcbb58afea556c24f584f2d") returned 0x0 [0053.845] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x82) returned 0xf064a0 [0053.845] RtlFreeAnsiString (AnsiString="a") [0053.845] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x12) returned 0xf050e8 [0053.845] wcscpy (in: _Dest=0xf050e8, _Source="\\\\" | out: _Dest="\\\\") returned="\\\\" [0053.845] wcscat (in: _Dest=0xf050e8, _Source="NQDPDE" | out: _Dest="\\\\NQDPDE") returned="\\\\NQDPDE" [0053.845] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x4) returned 0xf048e0 [0053.845] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x12) returned 0xf04f28 [0053.845] wcscpy (in: _Dest=0xf04f28, _Source="\\\\NQDPDE" | out: _Dest="\\\\NQDPDE") returned="\\\\NQDPDE" [0053.845] RtlFreeHeap (HeapHandle=0xee0000, Flags=0x0, BaseAddress=0xf050e8) returned 1 [0053.846] RtlFreeHeap (HeapHandle=0xee0000, Flags=0x0, BaseAddress=0xeff0b0) returned 1 [0053.846] RtlFreeHeap (HeapHandle=0xee0000, Flags=0x0, BaseAddress=0xee6f80) returned 1 [0053.846] RtlFreeHeap (HeapHandle=0xee0000, Flags=0x0, BaseAddress=0xf06310) returned 1 [0053.846] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x12) returned 0xf050e8 [0053.846] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x20a) returned 0xf06530 [0053.846] GetSystemDirectoryW (in: lpBuffer=0xf06530, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0053.846] wcscat (in: _Dest=0xf06530, _Source="\\" | out: _Dest="C:\\WINDOWS\\system32\\") returned="C:\\WINDOWS\\system32\\" [0053.846] wcscat (in: _Dest=0xf06530, _Source="explorer.exe" | out: _Dest="C:\\WINDOWS\\system32\\explorer.exe") returned="C:\\WINDOWS\\system32\\explorer.exe" [0053.846] RtlAllocateHeap (HeapHandle=0xee0000, Flags=0x8, Size=0x28) returned 0xf05390 [0053.846] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\explorer.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4000022, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0xb3fb94*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xb3fc3c | out: lpCommandLine=0x0, lpProcessInformation=0xb3fc3c*(hProcess=0x200, hThread=0x204, dwProcessId=0x10dc, dwThreadId=0x10d8)) returned 1 [0054.928] WaitForDebugEvent (in: lpDebugEvent=0xb3fbd8, dwMilliseconds=0xffffffff | out: lpDebugEvent=0xb3fbd8) returned 1 [0054.958] NtCreateSection (in: SectionHandle=0xb3f8a0, DesiredAccess=0xf001f, ObjectAttributes=0x0, MaximumSize=0xb3f880, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0xb3f8a0*=0x220) returned 0x0 [0054.958] NtMapViewOfSection (in: SectionHandle=0x220, ProcessHandle=0xffffffff, BaseAddress=0xb3f8a4*=0x0, ZeroBits=0x0, CommitSize=0x1b000, SectionOffset=0x0, ViewSize=0xb3f894*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4 | out: BaseAddress=0xb3f8a4*=0xc80000, SectionOffset=0x0, ViewSize=0xb3f894*=0x1b000) returned 0x0 [0054.959] NtMapViewOfSection (in: SectionHandle=0x220, ProcessHandle=0x200, BaseAddress=0xb3f89c*=0x0, ZeroBits=0x0, CommitSize=0x1b000, SectionOffset=0x0, ViewSize=0xb3f894*=0x1b000, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0xb3f89c*=0x3650000, SectionOffset=0x0, ViewSize=0xb3f894*=0x1b000) returned 0x0 [0054.960] NtUnmapViewOfSection (ProcessHandle=0xffffffff, BaseAddress=0xc80000) returned 0x0 [0056.798] NtClose (Handle=0x220) returned 0x0 [0056.798] NtGetContextThread (in: ThreadHandle=0x204, Context=0xb3f8c8 | out: Context=0xb3f8c8*(ContextFlags=0x1003f, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x27f, FloatSave.StatusWord=0x0, FloatSave.TagWord=0xffff, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x35da000, Edx=0x0, Ecx=0x0, Eax=0xfcb5c0, Ebp=0x0, Eip=0x778c4210, SegCs=0x23, EFlags=0x202, Esp=0x363ff2c, SegSs=0x2b, ExtendedRegisters=([0]=0x7f, [1]=0x2, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x80, [25]=0x1f, [26]=0x0, [27]=0x0, [28]=0xff, [29]=0xff, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0xe8, [289]=0x7, [290]=0x7c, [291]=0x0, [292]=0x1, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x28, [297]=0x4f, [298]=0xf0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0xd7, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x12, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0xee, [315]=0x0, [316]=0x14, [317]=0x3, [318]=0xee, [319]=0x0, [320]=0x1, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x70, [325]=0xfb, [326]=0xb3, [327]=0x0, [328]=0x12, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x80, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x20, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x14, [345]=0x1, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0xee, [355]=0x0, [356]=0xf8, [357]=0x4a, [358]=0xf0, [359]=0x0, [360]=0x30, [361]=0x65, [362]=0xf0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0xc8, [369]=0x1, [370]=0x1, [371]=0x1, [372]=0xff, [373]=0x7, [374]=0x0, [375]=0x0, [376]=0x57, [377]=0x1, [378]=0x0, [379]=0x0, [380]=0xc0, [381]=0x0, [382]=0xee, [383]=0x0, [384]=0xe4, [385]=0x84, [386]=0xee, [387]=0x0, [388]=0xf5, [389]=0x32, [390]=0x89, [391]=0x77, [392]=0xe8, [393]=0x50, [394]=0xf0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x18, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x12, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x18, [409]=0x2, [410]=0x0, [411]=0x0, [412]=0xc8, [413]=0xfb, [414]=0xb3, [415]=0x0, [416]=0x32, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0xd7, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x1, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x60, [433]=0x2, [434]=0xee, [435]=0x0, [436]=0x20, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x57, [441]=0x1, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x10, [449]=0x2a, [450]=0xf0, [451]=0x0, [452]=0x80, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x14, [457]=0x1, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x7c, [463]=0x0, [464]=0x1, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x1, [474]=0x0, [475]=0x1, [476]=0x20, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0xff, [485]=0xff, [486]=0xff, [487]=0x3f, [488]=0xc0, [489]=0x0, [490]=0xee, [491]=0x0, [492]=0x28, [493]=0x65, [494]=0xf0, [495]=0x0, [496]=0x28, [497]=0x65, [498]=0xf0, [499]=0x0, [500]=0xa, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x30, [505]=0x65, [506]=0xf0, [507]=0x0, [508]=0x12, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0056.799] NtSetContextThread (ThreadHandle=0x204, Context=0xb3f8c8*(ContextFlags=0x1003f, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x27f, FloatSave.StatusWord=0x0, FloatSave.TagWord=0xffff, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x35da000, Edx=0x0, Ecx=0x0, Eax=0xfcb5c0, Ebp=0x0, Eip=0x3663a10, SegCs=0x23, EFlags=0x202, Esp=0x363ff2c, SegSs=0x2b, ExtendedRegisters=([0]=0x7f, [1]=0x2, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x80, [25]=0x1f, [26]=0x0, [27]=0x0, [28]=0xff, [29]=0xff, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0xe8, [289]=0x7, [290]=0x7c, [291]=0x0, [292]=0x1, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x28, [297]=0x4f, [298]=0xf0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0xd7, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x12, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0xee, [315]=0x0, [316]=0x14, [317]=0x3, [318]=0xee, [319]=0x0, [320]=0x1, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x70, [325]=0xfb, [326]=0xb3, [327]=0x0, [328]=0x12, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x80, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x20, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x14, [345]=0x1, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0xee, [355]=0x0, [356]=0xf8, [357]=0x4a, [358]=0xf0, [359]=0x0, [360]=0x30, [361]=0x65, [362]=0xf0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0xc8, [369]=0x1, [370]=0x1, [371]=0x1, [372]=0xff, [373]=0x7, [374]=0x0, [375]=0x0, [376]=0x57, [377]=0x1, [378]=0x0, [379]=0x0, [380]=0xc0, [381]=0x0, [382]=0xee, [383]=0x0, [384]=0xe4, [385]=0x84, [386]=0xee, [387]=0x0, [388]=0xf5, [389]=0x32, [390]=0x89, [391]=0x77, [392]=0xe8, [393]=0x50, [394]=0xf0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x18, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x12, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x18, [409]=0x2, [410]=0x0, [411]=0x0, [412]=0xc8, [413]=0xfb, [414]=0xb3, [415]=0x0, [416]=0x32, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0xd7, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x1, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x60, [433]=0x2, [434]=0xee, [435]=0x0, [436]=0x20, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x57, [441]=0x1, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x10, [449]=0x2a, [450]=0xf0, [451]=0x0, [452]=0x80, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x14, [457]=0x1, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x7c, [463]=0x0, [464]=0x1, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x1, [474]=0x0, [475]=0x1, [476]=0x20, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0xff, [485]=0xff, [486]=0xff, [487]=0x3f, [488]=0xc0, [489]=0x0, [490]=0xee, [491]=0x0, [492]=0x28, [493]=0x65, [494]=0xf0, [495]=0x0, [496]=0x28, [497]=0x65, [498]=0xf0, [499]=0x0, [500]=0xa, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x30, [505]=0x65, [506]=0xf0, [507]=0x0, [508]=0x12, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0056.799] ContinueDebugEvent (dwProcessId=0x10dc, dwThreadId=0x10d8, dwContinueStatus=0x80010001) returned 1 [0056.799] DebugActiveProcessStop (dwProcessId=0x10dc) returned 1 [0056.872] RtlFreeHeap (HeapHandle=0xee0000, Flags=0x0, BaseAddress=0xf06530) returned 1 [0056.872] ExitProcess (uExitCode=0x1) Thread: id = 2 os_tid = 0x13c8 Process: id = "2" image_name = "explorer.exe" filename = "c:\\windows\\syswow64\\explorer.exe" page_root = "0x78586000" os_pid = "0x10dc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x13ac" cmd_line = "\"C:\\WINDOWS\\system32\\explorer.exe\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0x10d8 [0057.729] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x254) returned 0x388b4a8 [0057.868] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6) returned 0x38968d0 [0057.868] RtlInitAnsiString (in: DestinationString=0x363fe60, SourceString="NTDLL" | out: DestinationString="NTDLL") [0057.868] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fe68, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0057.868] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc) returned 0x3892398 [0057.868] RtlFreeAnsiString (AnsiString="N") [0057.868] RtlInitUnicodeString (in: DestinationString=0x363fe6c, SourceString="NTDLL" | out: DestinationString="NTDLL") [0057.868] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x363fe78 | out: BaseAddress=0x363fe78*=0x77850000) returned 0x0 [0057.869] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3892398) returned 1 [0057.870] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38968d0) returned 1 [0057.870] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6) returned 0x38968d0 [0057.870] RtlInitAnsiString (in: DestinationString=0x363fe60, SourceString="NTDLL" | out: DestinationString="NTDLL") [0057.870] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fe68, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0057.870] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc) returned 0x3892350 [0057.870] RtlFreeAnsiString (AnsiString="N") [0057.870] RtlInitUnicodeString (in: DestinationString=0x363fe6c, SourceString="NTDLL" | out: DestinationString="NTDLL") [0057.870] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x363fe78 | out: BaseAddress=0x363fe78*=0x77850000) returned 0x0 [0057.871] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3892350) returned 1 [0057.871] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38968d0) returned 1 [0057.872] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6) returned 0x38968d0 [0057.872] RtlInitAnsiString (in: DestinationString=0x363fe60, SourceString="NTDLL" | out: DestinationString="NTDLL") [0057.872] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fe68, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0057.872] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc) returned 0x38923e0 [0057.872] RtlFreeAnsiString (AnsiString="N") [0057.872] RtlInitUnicodeString (in: DestinationString=0x363fe6c, SourceString="NTDLL" | out: DestinationString="NTDLL") [0057.872] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x363fe78 | out: BaseAddress=0x363fe78*=0x77850000) returned 0x0 [0057.872] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38923e0) returned 1 [0057.873] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38968d0) returned 1 [0057.883] RtlInitUnicodeString (in: DestinationString=0x363fed8, SourceString="mpr.dll" | out: DestinationString="mpr.dll") [0057.883] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="mpr.dll", BaseAddress=0x363fee4 | out: BaseAddress=0x363fee4*=0x74160000) returned 0x0 [0057.890] RtlInitUnicodeString (in: DestinationString=0x363fed8, SourceString="netapi32.dll" | out: DestinationString="netapi32.dll") [0057.890] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="netapi32.dll", BaseAddress=0x363fee4 | out: BaseAddress=0x363fee4*=0x73750000) returned 0x0 [0057.894] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7) returned 0x38968d0 [0057.894] RtlInitAnsiString (in: DestinationString=0x363fe60, SourceString="SRVCLI" | out: DestinationString="SRVCLI") [0057.894] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fe68, SourceString="SRVCLI", AllocateDestinationString=1 | out: DestinationString="SRVCLI") returned 0x0 [0057.894] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe) returned 0x3892368 [0057.894] RtlFreeAnsiString (AnsiString="S") [0057.894] RtlInitUnicodeString (in: DestinationString=0x363fe6c, SourceString="SRVCLI" | out: DestinationString="SRVCLI") [0057.894] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="SRVCLI", BaseAddress=0x363fe78 | out: BaseAddress=0x363fe78*=0x73730000) returned 0x0 [0057.899] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3892368) returned 1 [0057.899] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38968d0) returned 1 [0057.899] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9) returned 0x3892500 [0057.899] RtlInitAnsiString (in: DestinationString=0x363fe60, SourceString="NETUTILS" | out: DestinationString="NETUTILS") [0057.899] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fe68, SourceString="NETUTILS", AllocateDestinationString=1 | out: DestinationString="NETUTILS") returned 0x0 [0057.899] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12) returned 0x3898950 [0057.899] RtlFreeAnsiString (AnsiString="N") [0057.899] RtlInitUnicodeString (in: DestinationString=0x363fe6c, SourceString="NETUTILS" | out: DestinationString="NETUTILS") [0057.899] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NETUTILS", BaseAddress=0x363fe78 | out: BaseAddress=0x363fe78*=0x74150000) returned 0x0 [0057.905] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3898950) returned 1 [0057.905] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3892500) returned 1 [0057.905] RtlInitUnicodeString (in: DestinationString=0x363fed8, SourceString="ole32.dll" | out: DestinationString="ole32.dll") [0057.905] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="ole32.dll", BaseAddress=0x363fee4 | out: BaseAddress=0x363fee4*=0x76470000) returned 0x0 [0057.909] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1b) returned 0x389c3d8 [0057.909] RtlInitAnsiString (in: DestinationString=0x363fe60, SourceString="api-ms-win-core-com-l1-1-0" | out: DestinationString="api-ms-win-core-com-l1-1-0") [0057.909] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fe68, SourceString="api-ms-win-core-com-l1-1-0", AllocateDestinationString=1 | out: DestinationString="api-ms-win-core-com-l1-1-0") returned 0x0 [0057.909] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389f280 [0057.909] RtlFreeAnsiString (AnsiString="a") [0057.909] RtlInitUnicodeString (in: DestinationString=0x363fe6c, SourceString="api-ms-win-core-com-l1-1-0" | out: DestinationString="api-ms-win-core-com-l1-1-0") [0057.909] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="api-ms-win-core-com-l1-1-0", BaseAddress=0x363fe78 | out: BaseAddress=0x363fe78*=0x77130000) returned 0x0 [0057.910] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f280) returned 1 [0057.910] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389c3d8) returned 1 [0057.910] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1b) returned 0x389c180 [0057.910] RtlInitAnsiString (in: DestinationString=0x363fe60, SourceString="api-ms-win-core-com-l1-1-0" | out: DestinationString="api-ms-win-core-com-l1-1-0") [0057.910] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fe68, SourceString="api-ms-win-core-com-l1-1-0", AllocateDestinationString=1 | out: DestinationString="api-ms-win-core-com-l1-1-0") returned 0x0 [0057.910] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389f100 [0057.910] RtlFreeAnsiString (AnsiString="a") [0057.910] RtlInitUnicodeString (in: DestinationString=0x363fe6c, SourceString="api-ms-win-core-com-l1-1-0" | out: DestinationString="api-ms-win-core-com-l1-1-0") [0057.910] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="api-ms-win-core-com-l1-1-0", BaseAddress=0x363fe78 | out: BaseAddress=0x363fe78*=0x77130000) returned 0x0 [0057.910] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f100) returned 1 [0057.910] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389c180) returned 1 [0057.910] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1b) returned 0x389c180 [0057.910] RtlInitAnsiString (in: DestinationString=0x363fe60, SourceString="api-ms-win-core-com-l1-1-0" | out: DestinationString="api-ms-win-core-com-l1-1-0") [0057.910] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fe68, SourceString="api-ms-win-core-com-l1-1-0", AllocateDestinationString=1 | out: DestinationString="api-ms-win-core-com-l1-1-0") returned 0x0 [0057.910] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389f280 [0057.910] RtlFreeAnsiString (AnsiString="a") [0057.910] RtlInitUnicodeString (in: DestinationString=0x363fe6c, SourceString="api-ms-win-core-com-l1-1-0" | out: DestinationString="api-ms-win-core-com-l1-1-0") [0057.910] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="api-ms-win-core-com-l1-1-0", BaseAddress=0x363fe78 | out: BaseAddress=0x363fe78*=0x77130000) returned 0x0 [0057.911] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f280) returned 1 [0057.911] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389c180) returned 1 [0057.911] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1b) returned 0x389c180 [0057.911] RtlInitAnsiString (in: DestinationString=0x363fe60, SourceString="api-ms-win-core-com-l1-1-0" | out: DestinationString="api-ms-win-core-com-l1-1-0") [0057.911] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fe68, SourceString="api-ms-win-core-com-l1-1-0", AllocateDestinationString=1 | out: DestinationString="api-ms-win-core-com-l1-1-0") returned 0x0 [0057.911] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389f680 [0057.911] RtlFreeAnsiString (AnsiString="a") [0057.911] RtlInitUnicodeString (in: DestinationString=0x363fe6c, SourceString="api-ms-win-core-com-l1-1-0" | out: DestinationString="api-ms-win-core-com-l1-1-0") [0057.911] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="api-ms-win-core-com-l1-1-0", BaseAddress=0x363fe78 | out: BaseAddress=0x363fe78*=0x77130000) returned 0x0 [0057.911] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f680) returned 1 [0057.911] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389c180) returned 1 [0057.911] RtlInitUnicodeString (in: DestinationString=0x363fed8, SourceString="psapi.dll" | out: DestinationString="psapi.dll") [0057.911] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="psapi.dll", BaseAddress=0x363fee4 | out: BaseAddress=0x363fee4*=0x77830000) returned 0x0 [0057.916] FindResourceA (hModule=0x3650000, lpName=0x7a69, lpType=0x539) returned 0x3668048 [0057.916] LoadResource (hModule=0x3650000, hResInfo=0x3668048) returned 0x3668058 [0057.916] LockResource (hResData=0x3668058) returned 0x3668058 [0057.916] SizeofResource (hModule=0x3650000, hResInfo=0x3668048) returned 0x14fb [0057.916] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x14fb) returned 0x389f6d8 [0057.917] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5) returned 0x38968d0 [0057.919] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100) returned 0x3888960 [0057.919] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100) returned 0x38840f0 [0057.919] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38840f0) returned 1 [0057.919] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3888960) returned 1 [0057.919] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38986b0 [0057.919] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4) returned 0x38967b0 [0057.919] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38988b0 [0057.919] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4) returned 0x38968e0 [0057.919] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x3898730 [0057.919] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38968e0, Size=0x8) returned 0x38968f0 [0057.919] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x3898770 [0057.919] strtol (in: _Str="0,\"thr\":1500,\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"knoocknoo@cock.li\",\"eeeooppaaaxxx@tuta.io\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\", \"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\", \"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft\\\\provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\x09\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\x09\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\x09\"*\\\\program file*\\\\windowspowershell\",\x09\"*\\\\program file*\\\\cuass*\", \x09\"*\\\\program file*\\\\microsoft games\", \"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\x09\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\", \"*media player\",\x09\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\x09\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"]}\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}", _EndPtr=0x363fdf0, _Radix=0 | out: _EndPtr=0x363fdf0*=",\"thr\":1500,\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"knoocknoo@cock.li\",\"eeeooppaaaxxx@tuta.io\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\", \"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\", \"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft\\\\provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\x09\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\x09\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\x09\"*\\\\program file*\\\\windowspowershell\",\x09\"*\\\\program file*\\\\cuass*\", \x09\"*\\\\program file*\\\\microsoft games\", \"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\x09\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\", \"*media player\",\x09\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\x09\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"]}\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}") returned 0 [0057.920] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38968f0, Size=0xc) returned 0x3892488 [0057.920] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x3898650 [0057.920] strtol (in: _Str="1500,\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"knoocknoo@cock.li\",\"eeeooppaaaxxx@tuta.io\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\", \"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\", \"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft\\\\provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\x09\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\x09\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\x09\"*\\\\program file*\\\\windowspowershell\",\x09\"*\\\\program file*\\\\cuass*\", \x09\"*\\\\program file*\\\\microsoft games\", \"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\x09\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\", \"*media player\",\x09\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\x09\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"]}\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}", _EndPtr=0x363fdf0, _Radix=0 | out: _EndPtr=0x363fdf0*=",\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"knoocknoo@cock.li\",\"eeeooppaaaxxx@tuta.io\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\", \"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\", \"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft\\\\provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\x09\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\x09\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\x09\"*\\\\program file*\\\\windowspowershell\",\x09\"*\\\\program file*\\\\cuass*\", \x09\"*\\\\program file*\\\\microsoft games\", \"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\x09\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\", \"*media player\",\x09\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\x09\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"]}\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}") returned 1500 [0057.920] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3892488, Size=0x10) returned 0x38924b8 [0057.920] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x3898690 [0057.920] strtol (in: _Str="51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"knoocknoo@cock.li\",\"eeeooppaaaxxx@tuta.io\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\", \"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\", \"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft\\\\provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\x09\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\x09\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\x09\"*\\\\program file*\\\\windowspowershell\",\x09\"*\\\\program file*\\\\cuass*\", \x09\"*\\\\program file*\\\\microsoft games\", \"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\x09\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\", \"*media player\",\x09\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\x09\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"]}\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}", _EndPtr=0x363fdf0, _Radix=0 | out: _EndPtr=0x363fdf0*=",\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"knoocknoo@cock.li\",\"eeeooppaaaxxx@tuta.io\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\", \"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\", \"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft\\\\provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\x09\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\x09\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\x09\"*\\\\program file*\\\\windowspowershell\",\x09\"*\\\\program file*\\\\cuass*\", \x09\"*\\\\program file*\\\\microsoft games\", \"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\x09\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\", \"*media player\",\x09\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\x09\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"]}\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}") returned 51200 [0057.920] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38924b8, Size=0x14) returned 0x3898670 [0057.920] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38986d0 [0057.920] strtol (in: _Str="8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"knoocknoo@cock.li\",\"eeeooppaaaxxx@tuta.io\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\", \"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\", \"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft\\\\provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\x09\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\x09\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\x09\"*\\\\program file*\\\\windowspowershell\",\x09\"*\\\\program file*\\\\cuass*\", \x09\"*\\\\program file*\\\\microsoft games\", \"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\x09\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\", \"*media player\",\x09\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\x09\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"]}\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}", _EndPtr=0x363fdf0, _Radix=0 | out: _EndPtr=0x363fdf0*=",\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"knoocknoo@cock.li\",\"eeeooppaaaxxx@tuta.io\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\", \"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\", \"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft\\\\provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\x09\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\x09\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\x09\"*\\\\program file*\\\\windowspowershell\",\x09\"*\\\\program file*\\\\cuass*\", \x09\"*\\\\program file*\\\\microsoft games\", \"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\x09\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\", \"*media player\",\x09\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\x09\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"]}\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}") returned 8 [0057.920] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3898670, Size=0x18) returned 0x3898910 [0057.920] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38986f0 [0057.920] strtol (in: _Str="5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"knoocknoo@cock.li\",\"eeeooppaaaxxx@tuta.io\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\", \"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\", \"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft\\\\provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\x09\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\x09\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\x09\"*\\\\program file*\\\\windowspowershell\",\x09\"*\\\\program file*\\\\cuass*\", \x09\"*\\\\program file*\\\\microsoft games\", \"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\x09\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\", \"*media player\",\x09\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\x09\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"]}\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}", _EndPtr=0x363fdf0, _Radix=0 | out: _EndPtr=0x363fdf0*=", \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"knoocknoo@cock.li\",\"eeeooppaaaxxx@tuta.io\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\", \"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\", \"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft\\\\provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\x09\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\x09\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\x09\"*\\\\program file*\\\\windowspowershell\",\x09\"*\\\\program file*\\\\cuass*\", \x09\"*\\\\program file*\\\\microsoft games\", \"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\x09\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\", \"*media player\",\x09\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\x09\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"]}\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}") returned 5 [0057.920] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3898910, Size=0x1c) returned 0x389c400 [0057.920] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x3898910 [0057.920] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x389c400, Size=0x20) returned 0x389c0b8 [0057.920] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38987b0 [0057.920] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4) returned 0x3896900 [0057.920] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x3898670 [0057.920] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3896900, Size=0x8) returned 0x38968e0 [0057.920] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x3898750 [0057.920] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x389c0b8, Size=0x24) returned 0x3891f10 [0057.920] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x3898710 [0057.920] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891f10, Size=0x28) returned 0x3891c70 [0057.920] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38987d0 [0057.920] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891c70, Size=0x2c) returned 0x388c210 [0057.920] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38987f0 [0057.921] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4) returned 0x38968f0 [0057.921] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x3898830 [0057.921] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4) returned 0x3896900 [0057.921] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x3898850 [0057.921] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3896900, Size=0x8) returned 0x38a0c50 [0057.921] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x3898930 [0057.921] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38a0c50, Size=0xc) returned 0x3892500 [0057.921] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x3898870 [0057.921] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3892500, Size=0x10) returned 0x3892488 [0057.921] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38988d0 [0057.921] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3892488, Size=0x14) returned 0x38988f0 [0057.921] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x3898950 [0057.921] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38988f0, Size=0x18) returned 0x3898970 [0057.921] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38988f0 [0057.921] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3898970, Size=0x1c) returned 0x389c180 [0057.921] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38989d0 [0057.921] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x389c180, Size=0x20) returned 0x389c248 [0057.921] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38989f0 [0057.921] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x389c248, Size=0x24) returned 0x3891eb0 [0057.921] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x3898970 [0057.921] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891eb0, Size=0x28) returned 0x3891bb0 [0057.921] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38989b0 [0057.921] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891bb0, Size=0x2c) returned 0x388bf38 [0057.921] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x3898990 [0057.921] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388bf38, Size=0x30) returned 0x388bf70 [0057.921] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a0c08 [0057.921] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388bf70, Size=0x34) returned 0x389f300 [0057.921] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a0c88 [0057.921] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x389f300, Size=0x38) returned 0x389f540 [0057.921] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a0e48 [0057.921] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x389f540, Size=0x3c) returned 0x388d0e0 [0057.921] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a0c48 [0057.921] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388d0e0, Size=0x40) returned 0x388d1b8 [0057.921] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a0ca8 [0057.921] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388d1b8, Size=0x44) returned 0x3892e30 [0057.921] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a0d48 [0057.921] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3892e30, Size=0x48) returned 0x3892ac0 [0057.921] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a0cc8 [0057.921] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3892ac0, Size=0x4c) returned 0x3891168 [0057.921] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a0e68 [0057.922] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891168, Size=0x50) returned 0x3891168 [0057.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a0ec8 [0057.922] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891168, Size=0x54) returned 0x3891168 [0057.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a0c28 [0057.922] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891168, Size=0x58) returned 0x3891168 [0057.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a0da8 [0057.922] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891168, Size=0x5c) returned 0x3891168 [0057.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a0f28 [0057.922] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891168, Size=0x60) returned 0x3891168 [0057.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a0dc8 [0057.922] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891168, Size=0x64) returned 0x3891920 [0057.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a0c68 [0057.922] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891920, Size=0x68) returned 0x3891920 [0057.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a0ce8 [0057.922] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891920, Size=0x6c) returned 0x3891920 [0057.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a0f88 [0057.922] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891920, Size=0x70) returned 0x3891920 [0057.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a0d08 [0057.922] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891920, Size=0x74) returned 0x3887bc0 [0057.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a0d28 [0057.922] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3887bc0, Size=0x78) returned 0x3887bc0 [0057.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a0e08 [0057.922] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3887bc0, Size=0x7c) returned 0x3887d40 [0057.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a0e88 [0057.922] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3887d40, Size=0x80) returned 0x3887d40 [0057.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a0fc8 [0057.922] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3887d40, Size=0x84) returned 0x3887d40 [0057.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a0de8 [0057.922] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3887d40, Size=0x88) returned 0x3887d40 [0057.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a0ea8 [0057.922] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3887d40, Size=0x8c) returned 0x388aab8 [0057.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a0d68 [0057.922] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388aab8, Size=0x90) returned 0x388aab8 [0057.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a0e28 [0057.922] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388aab8, Size=0x94) returned 0x3891200 [0057.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a0ee8 [0057.922] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891200, Size=0x98) returned 0x3891200 [0057.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a0f48 [0057.922] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891200, Size=0x9c) returned 0x388bcd8 [0057.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a0f08 [0057.922] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38968f0, Size=0x8) returned 0x3896900 [0057.923] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a0f68 [0057.923] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4) returned 0x38968f0 [0057.923] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a0fa8 [0057.923] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38968f0, Size=0x8) returned 0x38a1148 [0057.923] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a0d88 [0057.923] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38a1148, Size=0xc) returned 0x3892380 [0057.923] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a1050 [0057.923] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3892380, Size=0x10) returned 0x3892518 [0057.923] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a10d0 [0057.923] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3892518, Size=0x14) returned 0x38a13b0 [0057.923] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a13d0 [0057.923] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38a13b0, Size=0x18) returned 0x38a12d0 [0057.923] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a1010 [0057.923] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38a12d0, Size=0x1c) returned 0x389c0e0 [0057.923] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a1330 [0057.923] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x389c0e0, Size=0x20) returned 0x389c248 [0057.923] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a1270 [0057.923] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x389c248, Size=0x24) returned 0x3891d00 [0057.923] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a1390 [0057.923] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891d00, Size=0x28) returned 0x3891dc0 [0057.923] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a1030 [0057.923] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891dc0, Size=0x2c) returned 0x388c280 [0057.923] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a1350 [0057.923] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388c280, Size=0x30) returned 0x388bf38 [0057.923] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a1090 [0057.924] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388bf38, Size=0x34) returned 0x389f300 [0057.924] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a10f0 [0057.924] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x389f300, Size=0x38) returned 0x389f180 [0057.924] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a1130 [0057.924] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x389f180, Size=0x3c) returned 0x388d0e0 [0057.924] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a1170 [0057.924] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388d0e0, Size=0x40) returned 0x388d1b8 [0057.924] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a11d0 [0057.924] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3896900, Size=0xc) returned 0x3892398 [0057.924] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a1370 [0057.925] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4) returned 0x38968f0 [0057.925] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a1070 [0057.925] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38968f0, Size=0x8) returned 0x3896900 [0057.925] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a12f0 [0057.925] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3896900, Size=0xc) returned 0x3892350 [0057.925] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a1190 [0057.925] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3892350, Size=0x10) returned 0x3892380 [0057.925] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a10b0 [0057.925] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3892380, Size=0x14) returned 0x38a1310 [0057.925] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a1290 [0057.925] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38a1310, Size=0x18) returned 0x38a13b0 [0057.925] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a1110 [0057.925] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38a13b0, Size=0x1c) returned 0x389c3d8 [0057.925] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a1150 [0057.925] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x389c3d8, Size=0x20) returned 0x389c180 [0057.925] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a11b0 [0057.925] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x389c180, Size=0x24) returned 0x3891dc0 [0057.926] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a1310 [0057.926] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891dc0, Size=0x28) returned 0x3891e20 [0057.926] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a11f0 [0057.926] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891e20, Size=0x2c) returned 0x388bf38 [0057.926] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a1210 [0057.926] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388bf38, Size=0x30) returned 0x388bf70 [0057.926] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a13b0 [0057.926] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388bf70, Size=0x34) returned 0x389f500 [0057.926] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a1230 [0057.926] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x389f500, Size=0x38) returned 0x389f640 [0057.926] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a1250 [0057.926] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x389f640, Size=0x3c) returned 0x388d0e0 [0057.926] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a12d0 [0057.926] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388d0e0, Size=0x40) returned 0x38a2158 [0057.926] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a12b0 [0057.926] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38a2158, Size=0x44) returned 0x3892750 [0057.926] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a25e8 [0057.926] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3892750, Size=0x48) returned 0x38927a0 [0057.926] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a24e8 [0057.926] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38927a0, Size=0x4c) returned 0x3891168 [0057.926] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a26e8 [0057.926] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891168, Size=0x50) returned 0x3891168 [0057.926] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2448 [0057.926] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891168, Size=0x54) returned 0x3891168 [0057.926] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2508 [0057.926] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891168, Size=0x58) returned 0x3891168 [0057.926] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a27c8 [0057.926] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891168, Size=0x5c) returned 0x3891168 [0057.927] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2488 [0057.927] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891168, Size=0x60) returned 0x3891168 [0057.927] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2548 [0057.927] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891168, Size=0x64) returned 0x3891920 [0057.927] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a27a8 [0057.927] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891920, Size=0x68) returned 0x3891920 [0057.927] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2628 [0057.927] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891920, Size=0x6c) returned 0x3891920 [0057.927] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2588 [0057.927] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891920, Size=0x70) returned 0x3891920 [0057.927] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a27e8 [0057.927] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891920, Size=0x74) returned 0x3887bc0 [0057.927] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2688 [0057.927] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3887bc0, Size=0x78) returned 0x3887bc0 [0057.927] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a24a8 [0057.927] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3887bc0, Size=0x7c) returned 0x3887d40 [0057.927] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2788 [0057.927] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3887d40, Size=0x80) returned 0x3887d40 [0057.927] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a26c8 [0057.927] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3887d40, Size=0x84) returned 0x3887d40 [0057.927] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2528 [0057.927] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3887d40, Size=0x88) returned 0x3887d40 [0057.927] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2568 [0057.927] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3887d40, Size=0x8c) returned 0x388aab8 [0057.927] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a24c8 [0057.927] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388aab8, Size=0x90) returned 0x388aab8 [0057.927] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2648 [0057.927] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388aab8, Size=0x94) returned 0x3891200 [0057.927] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2708 [0057.927] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891200, Size=0x98) returned 0x3891200 [0057.927] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2428 [0057.927] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891200, Size=0x9c) returned 0x388ad40 [0057.927] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2808 [0057.927] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388ad40, Size=0xa0) returned 0x388ad40 [0057.927] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2468 [0057.927] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388ad40, Size=0xa4) returned 0x3883c10 [0057.927] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2608 [0057.927] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3883c10, Size=0xa8) returned 0x3883c10 [0057.927] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a25a8 [0057.927] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3883c10, Size=0xac) returned 0x3891ad0 [0057.927] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a25c8 [0057.928] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891ad0, Size=0xb0) returned 0x3891ad0 [0057.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2668 [0057.928] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891ad0, Size=0xb4) returned 0x388a4f0 [0057.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a26a8 [0057.928] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388a4f0, Size=0xb8) returned 0x388a4f0 [0057.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2728 [0057.928] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388a4f0, Size=0xbc) returned 0x388a4f0 [0057.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2748 [0057.928] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388a4f0, Size=0xc0) returned 0x388a4f0 [0057.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2768 [0057.928] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388a4f0, Size=0xc4) returned 0x388a4f0 [0057.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2988 [0057.928] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388a4f0, Size=0xc8) returned 0x388a4f0 [0057.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2828 [0057.928] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388a4f0, Size=0xcc) returned 0x388a4f0 [0057.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2a88 [0057.928] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388a4f0, Size=0xd0) returned 0x388a4f0 [0057.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2a48 [0057.928] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388c210, Size=0x30) returned 0x388bf38 [0057.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a28a8 [0057.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4) returned 0x38968f0 [0057.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2b68 [0057.928] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38968f0, Size=0x8) returned 0x3896900 [0057.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2b48 [0057.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4) returned 0x38968f0 [0057.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2b28 [0057.928] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38968f0, Size=0x8) returned 0x38a3200 [0057.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2aa8 [0057.928] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38a3200, Size=0xc) returned 0x3892350 [0057.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a29e8 [0057.928] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3892350, Size=0x10) returned 0x3892368 [0057.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2bc8 [0057.928] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3892368, Size=0x14) returned 0x38a28e8 [0057.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2908 [0057.928] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38a28e8, Size=0x18) returned 0x38a29a8 [0057.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2b88 [0057.928] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38a29a8, Size=0x1c) returned 0x389c090 [0057.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2ba8 [0057.928] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x389c090, Size=0x20) returned 0x389c3d8 [0057.929] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2ac8 [0057.929] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x389c3d8, Size=0x24) returned 0x3891dc0 [0057.929] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a28c8 [0057.929] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891dc0, Size=0x28) returned 0x3891c70 [0057.929] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2a08 [0057.929] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891c70, Size=0x2c) returned 0x388bf70 [0057.929] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2928 [0057.929] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388bf70, Size=0x30) returned 0x388c130 [0057.929] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2848 [0057.929] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388c130, Size=0x34) returned 0x389f500 [0057.929] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2948 [0057.929] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x389f500, Size=0x38) returned 0x389f280 [0057.929] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a28e8 [0057.929] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x389f280, Size=0x3c) returned 0x388d0e0 [0057.929] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2968 [0057.929] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388d0e0, Size=0x40) returned 0x38a14f8 [0057.929] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2ae8 [0057.929] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38a14f8, Size=0x44) returned 0x3892e30 [0057.929] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2b08 [0057.929] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3892e30, Size=0x48) returned 0x3892e80 [0057.929] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2868 [0057.929] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3892e80, Size=0x4c) returned 0x3891168 [0057.929] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a29a8 [0057.929] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891168, Size=0x50) returned 0x3891168 [0057.929] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2888 [0057.929] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891168, Size=0x54) returned 0x3891168 [0057.929] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a29c8 [0057.929] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891168, Size=0x58) returned 0x3891168 [0057.929] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2a28 [0057.929] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891168, Size=0x5c) returned 0x3891168 [0057.929] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a2a68 [0057.929] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891168, Size=0x60) returned 0x3891168 [0057.929] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3308 [0057.929] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891168, Size=0x64) returned 0x3891920 [0057.929] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a30e8 [0057.929] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891920, Size=0x68) returned 0x3891920 [0057.929] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a32c8 [0057.929] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891920, Size=0x6c) returned 0x3891920 [0057.929] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3148 [0057.930] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891920, Size=0x70) returned 0x3891920 [0057.930] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3288 [0057.930] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891920, Size=0x74) returned 0x3887bc0 [0057.930] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3028 [0057.930] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3887bc0, Size=0x78) returned 0x3887bc0 [0057.930] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3328 [0057.930] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3887bc0, Size=0x7c) returned 0x3887d40 [0057.930] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3068 [0057.930] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3887d40, Size=0x80) returned 0x3887d40 [0057.930] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3048 [0057.930] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3887d40, Size=0x84) returned 0x3887d40 [0057.930] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3088 [0057.930] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3887d40, Size=0x88) returned 0x3887d40 [0057.930] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a32e8 [0057.930] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3887d40, Size=0x8c) returned 0x388aab8 [0057.930] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3108 [0057.930] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388aab8, Size=0x90) returned 0x388aab8 [0057.930] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a30a8 [0057.930] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388aab8, Size=0x94) returned 0x3891200 [0057.930] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3368 [0057.930] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891200, Size=0x98) returned 0x3891200 [0057.930] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3128 [0057.930] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891200, Size=0x9c) returned 0x388ad40 [0057.930] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a31c8 [0057.930] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388ad40, Size=0xa0) returned 0x388ad40 [0057.930] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3168 [0057.930] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388ad40, Size=0xa4) returned 0x3883c10 [0057.930] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a30c8 [0057.930] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3883c10, Size=0xa8) returned 0x3883c10 [0057.930] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3188 [0057.930] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3883c10, Size=0xac) returned 0x3891ad0 [0057.930] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a31e8 [0057.930] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891ad0, Size=0xb0) returned 0x3891ad0 [0057.930] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a31a8 [0057.930] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891ad0, Size=0xb4) returned 0x3883a00 [0057.930] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3208 [0057.930] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3883a00, Size=0xb8) returned 0x3883a00 [0057.930] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a32a8 [0057.930] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3883a00, Size=0xbc) returned 0x3883a00 [0057.931] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3228 [0057.931] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3883a00, Size=0xc0) returned 0x3883a00 [0057.947] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3248 [0057.948] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3883a00, Size=0xc4) returned 0x3883a00 [0057.948] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3268 [0057.948] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3883a00, Size=0xc8) returned 0x3883a00 [0057.948] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3348 [0057.948] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3883a00, Size=0xcc) returned 0x3883a00 [0057.948] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3388 [0057.948] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3883a00, Size=0xd0) returned 0x3883a00 [0057.948] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a33a8 [0057.948] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3883a00, Size=0xd4) returned 0x3883a00 [0057.948] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a33c8 [0057.948] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3883a00, Size=0xd8) returned 0x3883a00 [0057.948] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a33e8 [0057.948] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3883a00, Size=0xdc) returned 0x3891300 [0057.948] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a39d8 [0057.948] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891300, Size=0xe0) returned 0x3891300 [0057.948] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3898 [0057.948] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891300, Size=0xe4) returned 0x3884790 [0057.948] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3a38 [0057.948] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3884790, Size=0xe8) returned 0x3884790 [0057.948] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3ab8 [0057.948] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3884790, Size=0xec) returned 0x3884790 [0057.948] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3a78 [0057.948] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3884790, Size=0xf0) returned 0x3884790 [0057.948] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3b98 [0057.948] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3884790, Size=0xf4) returned 0x3888960 [0057.948] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a38f8 [0057.948] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3888960, Size=0xf8) returned 0x3888960 [0057.948] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3af8 [0057.948] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3888960, Size=0xfc) returned 0x3888960 [0057.948] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3978 [0057.948] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3888960, Size=0x100) returned 0x3888960 [0057.948] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3918 [0057.948] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3888960, Size=0x104) returned 0x3888960 [0057.948] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a38b8 [0057.948] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3888960, Size=0x108) returned 0x3888960 [0057.948] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3998 [0057.948] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3896900, Size=0xc) returned 0x3892350 [0057.949] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3b18 [0057.949] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4) returned 0x38968f0 [0057.949] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3bd8 [0057.949] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38968f0, Size=0x8) returned 0x3896900 [0057.949] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3938 [0057.949] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3896900, Size=0xc) returned 0x3892500 [0057.949] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3838 [0057.949] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3892500, Size=0x10) returned 0x38923b0 [0057.949] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3a58 [0057.949] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38923b0, Size=0x14) returned 0x38a3858 [0057.949] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3a98 [0057.949] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38a3858, Size=0x18) returned 0x38a38d8 [0057.949] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3b58 [0057.949] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38a38d8, Size=0x1c) returned 0x389c2c0 [0057.949] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3958 [0057.949] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x389c2c0, Size=0x20) returned 0x389c0b8 [0057.949] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a39b8 [0057.949] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x389c0b8, Size=0x24) returned 0x3891c70 [0057.949] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3b38 [0057.949] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891c70, Size=0x28) returned 0x3891d00 [0057.949] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a39f8 [0057.949] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891d00, Size=0x2c) returned 0x388bf70 [0057.949] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3ad8 [0057.949] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388bf70, Size=0x30) returned 0x388c280 [0057.949] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3858 [0057.949] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388c280, Size=0x34) returned 0x389f180 [0057.949] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3b78 [0057.949] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x389f180, Size=0x38) returned 0x389f1c0 [0057.949] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3878 [0057.949] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x389f1c0, Size=0x3c) returned 0x388d0e0 [0057.949] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3bb8 [0057.949] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388d0e0, Size=0x40) returned 0x38a18e8 [0057.949] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3a18 [0057.949] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38a18e8, Size=0x44) returned 0x3892890 [0057.949] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a38d8 [0057.949] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3892890, Size=0x48) returned 0x38929d0 [0057.949] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a37b8 [0057.949] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38929d0, Size=0x4c) returned 0x3891168 [0057.950] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a34b8 [0057.950] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891168, Size=0x50) returned 0x3891168 [0057.950] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3558 [0057.950] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891168, Size=0x54) returned 0x3891168 [0057.950] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a35f8 [0057.950] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891168, Size=0x58) returned 0x3891168 [0057.950] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a35b8 [0057.950] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891168, Size=0x5c) returned 0x3891168 [0057.950] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3758 [0057.950] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891168, Size=0x60) returned 0x3891168 [0057.950] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3518 [0057.950] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891168, Size=0x64) returned 0x3891920 [0057.950] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a34d8 [0057.950] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891920, Size=0x68) returned 0x3891920 [0057.950] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3618 [0057.950] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891920, Size=0x6c) returned 0x3891920 [0057.950] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a35d8 [0057.950] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891920, Size=0x70) returned 0x3891920 [0057.950] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3698 [0057.950] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3891920, Size=0x74) returned 0x3887bc0 [0057.950] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a36b8 [0057.950] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3887bc0, Size=0x78) returned 0x3887bc0 [0057.950] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3638 [0057.950] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3887bc0, Size=0x7c) returned 0x3887d40 [0057.950] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3658 [0057.950] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3887d40, Size=0x80) returned 0x3887d40 [0057.950] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3718 [0057.950] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3887d40, Size=0x84) returned 0x3887d40 [0057.950] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a37f8 [0057.950] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3887d40, Size=0x88) returned 0x3887d40 [0057.950] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3478 [0057.950] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3887d40, Size=0x8c) returned 0x388aab8 [0057.950] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a37d8 [0057.950] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388aab8, Size=0x90) returned 0x388aab8 [0057.950] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3538 [0057.950] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3892350, Size=0x10) returned 0x3892530 [0057.950] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3818 [0057.950] strtol (in: _Str="30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}", _EndPtr=0x363fdcc, _Radix=0 | out: _EndPtr=0x363fdcc*=",\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}") returned 30 [0057.950] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3892530, Size=0x14) returned 0x38a36f8 [0057.951] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3438 [0057.951] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4) returned 0x38968f0 [0057.951] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a3778 [0057.951] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38968f0, Size=0x8) returned 0x3896900 [0057.951] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3896900, Size=0xc) returned 0x3892368 [0057.951] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3892368, Size=0x10) returned 0x3892350 [0057.951] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3892350, Size=0x14) returned 0x38a3738 [0057.951] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x388bf38, Size=0x34) returned 0x389f500 [0057.951] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38968f0, Size=0x8) returned 0x3896900 [0057.951] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38968f0, Size=0x8) returned 0x38a3cd0 [0057.951] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38a3cd0, Size=0xc) returned 0x3892488 [0057.951] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38968f0, Size=0x8) returned 0x38a3e70 [0057.951] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x389f500, Size=0x38) returned 0x389f2c0 [0057.952] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38a3f70, Size=0x8) returned 0x38a3e80 [0057.952] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38a3f40, Size=0x8) returned 0x38a3f10 [0057.952] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38a3e40, Size=0x8) returned 0x38a3ff0 [0057.952] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38a3ff0, Size=0xc) returned 0x38924b8 [0057.952] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38a3f10, Size=0xc) returned 0x3892350 [0057.952] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38a3e90, Size=0x8) returned 0x38a3f50 [0057.952] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38967b0) returned 1 [0057.952] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38986b0) returned 1 [0057.956] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="ntuser.dat*" | out: DestinationString="ntuser.dat*") [0057.957] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="ntuser.dat*", AllocateDestinationString=1 | out: DestinationString="ntuser.dat*") returned 0x0 [0057.957] RtlFreeAnsiString (AnsiString="n") [0057.957] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="iconcache.db" | out: DestinationString="iconcache.db") [0057.957] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="iconcache.db", AllocateDestinationString=1 | out: DestinationString="iconcache.db") returned 0x0 [0057.957] RtlFreeAnsiString (AnsiString="i") [0057.957] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="gdipfont*.dat" | out: DestinationString="gdipfont*.dat") [0057.957] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="gdipfont*.dat", AllocateDestinationString=1 | out: DestinationString="gdipfont*.dat") returned 0x0 [0057.957] RtlFreeAnsiString (AnsiString="g") [0057.957] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="ntuser.ini" | out: DestinationString="ntuser.ini") [0057.957] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="ntuser.ini", AllocateDestinationString=1 | out: DestinationString="ntuser.ini") returned 0x0 [0057.957] RtlFreeAnsiString (AnsiString="n") [0057.957] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="usrclass.dat" | out: DestinationString="usrclass.dat") [0057.957] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="usrclass.dat", AllocateDestinationString=1 | out: DestinationString="usrclass.dat") returned 0x0 [0057.957] RtlFreeAnsiString (AnsiString="u") [0057.957] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="usrclass.dat*" | out: DestinationString="usrclass.dat*") [0057.957] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="usrclass.dat*", AllocateDestinationString=1 | out: DestinationString="usrclass.dat*") returned 0x0 [0057.957] RtlFreeAnsiString (AnsiString="u") [0057.957] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="boot.ini" | out: DestinationString="boot.ini") [0057.957] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="boot.ini", AllocateDestinationString=1 | out: DestinationString="boot.ini") returned 0x0 [0057.957] RtlFreeAnsiString (AnsiString="b") [0057.957] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="bootmgr" | out: DestinationString="bootmgr") [0057.957] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="bootmgr", AllocateDestinationString=1 | out: DestinationString="bootmgr") returned 0x0 [0057.957] RtlFreeAnsiString (AnsiString="b") [0057.957] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="bootnxt" | out: DestinationString="bootnxt") [0057.957] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="bootnxt", AllocateDestinationString=1 | out: DestinationString="bootnxt") returned 0x0 [0057.958] RtlFreeAnsiString (AnsiString="b") [0057.958] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="desktop.ini" | out: DestinationString="desktop.ini") [0057.958] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="desktop.ini", AllocateDestinationString=1 | out: DestinationString="desktop.ini") returned 0x0 [0057.958] RtlFreeAnsiString (AnsiString="d") [0057.958] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="ntuser.dat" | out: DestinationString="ntuser.dat") [0057.958] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="ntuser.dat", AllocateDestinationString=1 | out: DestinationString="ntuser.dat") returned 0x0 [0057.958] RtlFreeAnsiString (AnsiString="n") [0057.958] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="autorun.inf" | out: DestinationString="autorun.inf") [0057.958] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="autorun.inf", AllocateDestinationString=1 | out: DestinationString="autorun.inf") returned 0x0 [0057.958] RtlFreeAnsiString (AnsiString="a") [0057.958] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="ntldr" | out: DestinationString="ntldr") [0057.958] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="ntldr", AllocateDestinationString=1 | out: DestinationString="ntldr") returned 0x0 [0057.958] RtlFreeAnsiString (AnsiString="n") [0057.958] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="thumbs.db" | out: DestinationString="thumbs.db") [0057.958] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="thumbs.db", AllocateDestinationString=1 | out: DestinationString="thumbs.db") returned 0x0 [0057.958] RtlFreeAnsiString (AnsiString="t") [0057.958] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="bootsect.bak" | out: DestinationString="bootsect.bak") [0057.958] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="bootsect.bak", AllocateDestinationString=1 | out: DestinationString="bootsect.bak") returned 0x0 [0057.958] RtlFreeAnsiString (AnsiString="b") [0057.958] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="bootfont.bin" | out: DestinationString="bootfont.bin") [0057.958] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="bootfont.bin", AllocateDestinationString=1 | out: DestinationString="bootfont.bin") returned 0x0 [0057.958] RtlFreeAnsiString (AnsiString="b") [0057.958] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*system volume information" | out: DestinationString="*system volume information") [0057.958] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*system volume information", AllocateDestinationString=1 | out: DestinationString="*system volume information") returned 0x0 [0057.958] RtlFreeAnsiString (AnsiString="*") [0057.958] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*windows.old" | out: DestinationString="*windows.old") [0057.958] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*windows.old", AllocateDestinationString=1 | out: DestinationString="*windows.old") returned 0x0 [0057.959] RtlFreeAnsiString (AnsiString="*") [0057.959] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*:\\users\\*\\*temp" | out: DestinationString="*:\\users\\*\\*temp") [0057.959] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*:\\users\\*\\*temp", AllocateDestinationString=1 | out: DestinationString="*:\\users\\*\\*temp") returned 0x0 [0057.959] RtlFreeAnsiString (AnsiString="*") [0057.959] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*msocache" | out: DestinationString="*msocache") [0057.959] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*msocache", AllocateDestinationString=1 | out: DestinationString="*msocache") returned 0x0 [0057.959] RtlFreeAnsiString (AnsiString="*") [0057.959] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*:\\winnt" | out: DestinationString="*:\\winnt") [0057.959] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*:\\winnt", AllocateDestinationString=1 | out: DestinationString="*:\\winnt") returned 0x0 [0057.959] RtlFreeAnsiString (AnsiString="*") [0057.959] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*$windows.~ws" | out: DestinationString="*$windows.~ws") [0057.959] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*$windows.~ws", AllocateDestinationString=1 | out: DestinationString="*$windows.~ws") returned 0x0 [0057.960] RtlFreeAnsiString (AnsiString="*") [0057.960] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*perflogs" | out: DestinationString="*perflogs") [0057.960] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*perflogs", AllocateDestinationString=1 | out: DestinationString="*perflogs") returned 0x0 [0057.960] RtlFreeAnsiString (AnsiString="*") [0057.960] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*boot" | out: DestinationString="*boot") [0057.960] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*boot", AllocateDestinationString=1 | out: DestinationString="*boot") returned 0x0 [0057.960] RtlFreeAnsiString (AnsiString="*") [0057.960] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*:\\windows" | out: DestinationString="*:\\windows") [0057.960] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*:\\windows", AllocateDestinationString=1 | out: DestinationString="*:\\windows") returned 0x0 [0057.960] RtlFreeAnsiString (AnsiString="*") [0057.960] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*:\\program file*\\vmware" | out: DestinationString="*:\\program file*\\vmware") [0057.960] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*:\\program file*\\vmware", AllocateDestinationString=1 | out: DestinationString="*:\\program file*\\vmware") returned 0x0 [0057.960] RtlFreeAnsiString (AnsiString="*") [0057.960] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="\\\\*\\users\\*\\*temp" | out: DestinationString="\\\\*\\users\\*\\*temp") [0057.960] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="\\\\*\\users\\*\\*temp", AllocateDestinationString=1 | out: DestinationString="\\\\*\\users\\*\\*temp") returned 0x0 [0057.960] RtlFreeAnsiString (AnsiString="\\") [0057.960] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="\\\\*\\winnt" | out: DestinationString="\\\\*\\winnt") [0057.960] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="\\\\*\\winnt", AllocateDestinationString=1 | out: DestinationString="\\\\*\\winnt") returned 0x0 [0057.960] RtlFreeAnsiString (AnsiString="\\") [0057.960] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="\\\\*\\windows" | out: DestinationString="\\\\*\\windows") [0057.960] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="\\\\*\\windows", AllocateDestinationString=1 | out: DestinationString="\\\\*\\windows") returned 0x0 [0057.960] RtlFreeAnsiString (AnsiString="\\") [0057.960] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*\\program file*\\vmware" | out: DestinationString="*\\program file*\\vmware") [0057.960] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*\\program file*\\vmware", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\vmware") returned 0x0 [0057.961] RtlFreeAnsiString (AnsiString="*") [0057.961] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*appdata*microsoft" | out: DestinationString="*appdata*microsoft") [0057.961] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*appdata*microsoft", AllocateDestinationString=1 | out: DestinationString="*appdata*microsoft") returned 0x0 [0057.961] RtlFreeAnsiString (AnsiString="*") [0057.961] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*appdata*packages" | out: DestinationString="*appdata*packages") [0057.961] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*appdata*packages", AllocateDestinationString=1 | out: DestinationString="*appdata*packages") returned 0x0 [0057.961] RtlFreeAnsiString (AnsiString="*") [0057.961] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*microsoft\\provisioning" | out: DestinationString="*microsoft\\provisioning") [0057.961] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*microsoft\\provisioning", AllocateDestinationString=1 | out: DestinationString="*microsoft\\provisioning") returned 0x0 [0057.961] RtlFreeAnsiString (AnsiString="*") [0057.961] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*dvd maker" | out: DestinationString="*dvd maker") [0057.961] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*dvd maker", AllocateDestinationString=1 | out: DestinationString="*dvd maker") returned 0x0 [0057.961] RtlFreeAnsiString (AnsiString="*") [0057.961] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*Internet Explorer" | out: DestinationString="*Internet Explorer") [0057.961] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*Internet Explorer", AllocateDestinationString=1 | out: DestinationString="*Internet Explorer") returned 0x0 [0057.961] RtlFreeAnsiString (AnsiString="*") [0057.961] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*Mozilla" | out: DestinationString="*Mozilla") [0057.961] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*Mozilla", AllocateDestinationString=1 | out: DestinationString="*Mozilla") returned 0x0 [0057.961] RtlFreeAnsiString (AnsiString="*") [0057.961] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*Mozilla*" | out: DestinationString="*Mozilla*") [0057.961] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*Mozilla*", AllocateDestinationString=1 | out: DestinationString="*Mozilla*") returned 0x0 [0057.961] RtlFreeAnsiString (AnsiString="*") [0057.961] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*Old Firefox data" | out: DestinationString="*Old Firefox data") [0057.961] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*Old Firefox data", AllocateDestinationString=1 | out: DestinationString="*Old Firefox data") returned 0x0 [0057.961] RtlFreeAnsiString (AnsiString="*") [0057.961] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*\\program file*\\windows media*" | out: DestinationString="*\\program file*\\windows media*") [0057.962] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*\\program file*\\windows media*", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\windows media*") returned 0x0 [0057.967] RtlFreeAnsiString (AnsiString="*") [0057.967] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*\\program file*\\windows portable*" | out: DestinationString="*\\program file*\\windows portable*") [0057.967] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*\\program file*\\windows portable*", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\windows portable*") returned 0x0 [0057.967] RtlFreeAnsiString (AnsiString="*") [0057.967] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*windows defender" | out: DestinationString="*windows defender") [0057.967] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*windows defender", AllocateDestinationString=1 | out: DestinationString="*windows defender") returned 0x0 [0057.967] RtlFreeAnsiString (AnsiString="*") [0057.967] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*\\program file*\\windows nt" | out: DestinationString="*\\program file*\\windows nt") [0057.967] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*\\program file*\\windows nt", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\windows nt") returned 0x0 [0057.967] RtlFreeAnsiString (AnsiString="*") [0057.967] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*\\program file*\\windows photo*" | out: DestinationString="*\\program file*\\windows photo*") [0057.967] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*\\program file*\\windows photo*", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\windows photo*") returned 0x0 [0057.968] RtlFreeAnsiString (AnsiString="*") [0057.968] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*\\program file*\\windows side*" | out: DestinationString="*\\program file*\\windows side*") [0057.968] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*\\program file*\\windows side*", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\windows side*") returned 0x0 [0057.968] RtlFreeAnsiString (AnsiString="*") [0057.968] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*\\program file*\\windowspowershell" | out: DestinationString="*\\program file*\\windowspowershell") [0057.968] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*\\program file*\\windowspowershell", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\windowspowershell") returned 0x0 [0057.968] RtlFreeAnsiString (AnsiString="*") [0057.968] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*\\program file*\\cuass*" | out: DestinationString="*\\program file*\\cuass*") [0057.968] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*\\program file*\\cuass*", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\cuass*") returned 0x0 [0057.968] RtlFreeAnsiString (AnsiString="*") [0057.968] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*\\program file*\\microsoft games" | out: DestinationString="*\\program file*\\microsoft games") [0057.968] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*\\program file*\\microsoft games", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\microsoft games") returned 0x0 [0057.968] RtlFreeAnsiString (AnsiString="*") [0057.968] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*\\program file*\\common files\\system" | out: DestinationString="*\\program file*\\common files\\system") [0057.968] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*\\program file*\\common files\\system", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\common files\\system") returned 0x0 [0057.968] RtlFreeAnsiString (AnsiString="*") [0057.968] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*\\program file*\\common files\\*shared" | out: DestinationString="*\\program file*\\common files\\*shared") [0057.968] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*\\program file*\\common files\\*shared", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\common files\\*shared") returned 0x0 [0057.968] RtlFreeAnsiString (AnsiString="*") [0057.968] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*\\program file*\\common files\\reference ass*" | out: DestinationString="*\\program file*\\common files\\reference ass*") [0057.968] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*\\program file*\\common files\\reference ass*", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\common files\\reference ass*") returned 0x0 [0057.968] RtlFreeAnsiString (AnsiString="*") [0057.968] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*\\windows\\cache*" | out: DestinationString="*\\windows\\cache*") [0057.968] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*\\windows\\cache*", AllocateDestinationString=1 | out: DestinationString="*\\windows\\cache*") returned 0x0 [0057.968] RtlFreeAnsiString (AnsiString="*") [0057.968] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*temporary internet*" | out: DestinationString="*temporary internet*") [0057.969] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*temporary internet*", AllocateDestinationString=1 | out: DestinationString="*temporary internet*") returned 0x0 [0057.969] RtlFreeAnsiString (AnsiString="*") [0057.969] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*media player" | out: DestinationString="*media player") [0057.969] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*media player", AllocateDestinationString=1 | out: DestinationString="*media player") returned 0x0 [0057.969] RtlFreeAnsiString (AnsiString="*") [0057.969] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*:\\users\\*\\appdata\\*\\microsoft" | out: DestinationString="*:\\users\\*\\appdata\\*\\microsoft") [0057.969] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*:\\users\\*\\appdata\\*\\microsoft", AllocateDestinationString=1 | out: DestinationString="*:\\users\\*\\appdata\\*\\microsoft") returned 0x0 [0057.969] RtlFreeAnsiString (AnsiString="*") [0057.969] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="\\\\*\\users\\*\\appdata\\*\\microsoft" | out: DestinationString="\\\\*\\users\\*\\appdata\\*\\microsoft") [0057.969] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="\\\\*\\users\\*\\appdata\\*\\microsoft", AllocateDestinationString=1 | out: DestinationString="\\\\*\\users\\*\\appdata\\*\\microsoft") returned 0x0 [0057.969] RtlFreeAnsiString (AnsiString="\\") [0057.969] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="msp" | out: DestinationString="msp") [0057.969] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="msp", AllocateDestinationString=1 | out: DestinationString="msp") returned 0x0 [0057.969] RtlFreeAnsiString (AnsiString="m") [0057.969] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="exe" | out: DestinationString="exe") [0057.969] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="exe", AllocateDestinationString=1 | out: DestinationString="exe") returned 0x0 [0057.969] RtlFreeAnsiString (AnsiString="e") [0057.969] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="sys" | out: DestinationString="sys") [0057.969] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="sys", AllocateDestinationString=1 | out: DestinationString="sys") returned 0x0 [0057.969] RtlFreeAnsiString (AnsiString="s") [0057.969] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="msc" | out: DestinationString="msc") [0057.969] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="msc", AllocateDestinationString=1 | out: DestinationString="msc") returned 0x0 [0057.969] RtlFreeAnsiString (AnsiString="m") [0057.969] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="mod" | out: DestinationString="mod") [0057.969] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="mod", AllocateDestinationString=1 | out: DestinationString="mod") returned 0x0 [0057.969] RtlFreeAnsiString (AnsiString="m") [0057.970] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="clb" | out: DestinationString="clb") [0057.970] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="clb", AllocateDestinationString=1 | out: DestinationString="clb") returned 0x0 [0057.970] RtlFreeAnsiString (AnsiString="c") [0057.970] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="mui" | out: DestinationString="mui") [0057.970] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="mui", AllocateDestinationString=1 | out: DestinationString="mui") returned 0x0 [0057.970] RtlFreeAnsiString (AnsiString="m") [0057.970] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="regtrans-ms" | out: DestinationString="regtrans-ms") [0057.970] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="regtrans-ms", AllocateDestinationString=1 | out: DestinationString="regtrans-ms") returned 0x0 [0057.970] RtlFreeAnsiString (AnsiString="r") [0057.970] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="theme" | out: DestinationString="theme") [0057.970] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="theme", AllocateDestinationString=1 | out: DestinationString="theme") returned 0x0 [0057.970] RtlFreeAnsiString (AnsiString="t") [0057.970] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="hta" | out: DestinationString="hta") [0057.970] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="hta", AllocateDestinationString=1 | out: DestinationString="hta") returned 0x0 [0057.970] RtlFreeAnsiString (AnsiString="h") [0057.970] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="shs" | out: DestinationString="shs") [0057.970] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="shs", AllocateDestinationString=1 | out: DestinationString="shs") returned 0x0 [0057.970] RtlFreeAnsiString (AnsiString="s") [0057.970] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="nomedia" | out: DestinationString="nomedia") [0057.970] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="nomedia", AllocateDestinationString=1 | out: DestinationString="nomedia") returned 0x0 [0057.970] RtlFreeAnsiString (AnsiString="n") [0057.970] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="diagpkg" | out: DestinationString="diagpkg") [0057.970] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="diagpkg", AllocateDestinationString=1 | out: DestinationString="diagpkg") returned 0x0 [0057.970] RtlFreeAnsiString (AnsiString="d") [0057.970] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="cab" | out: DestinationString="cab") [0057.970] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="cab", AllocateDestinationString=1 | out: DestinationString="cab") returned 0x0 [0057.970] RtlFreeAnsiString (AnsiString="c") [0057.971] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="ics" | out: DestinationString="ics") [0057.971] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="ics", AllocateDestinationString=1 | out: DestinationString="ics") returned 0x0 [0057.971] RtlFreeAnsiString (AnsiString="i") [0057.971] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="msstyles" | out: DestinationString="msstyles") [0057.971] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="msstyles", AllocateDestinationString=1 | out: DestinationString="msstyles") returned 0x0 [0057.971] RtlFreeAnsiString (AnsiString="m") [0057.971] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="cur" | out: DestinationString="cur") [0057.971] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="cur", AllocateDestinationString=1 | out: DestinationString="cur") returned 0x0 [0057.971] RtlFreeAnsiString (AnsiString="c") [0057.971] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="drv" | out: DestinationString="drv") [0057.971] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="drv", AllocateDestinationString=1 | out: DestinationString="drv") returned 0x0 [0057.971] RtlFreeAnsiString (AnsiString="d") [0057.971] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="icns" | out: DestinationString="icns") [0057.971] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="icns", AllocateDestinationString=1 | out: DestinationString="icns") returned 0x0 [0057.971] RtlFreeAnsiString (AnsiString="i") [0057.971] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="diagcfg" | out: DestinationString="diagcfg") [0057.971] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="diagcfg", AllocateDestinationString=1 | out: DestinationString="diagcfg") returned 0x0 [0057.971] RtlFreeAnsiString (AnsiString="d") [0057.971] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="dll" | out: DestinationString="dll") [0057.971] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="dll", AllocateDestinationString=1 | out: DestinationString="dll") returned 0x0 [0057.971] RtlFreeAnsiString (AnsiString="d") [0057.971] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="ocx" | out: DestinationString="ocx") [0057.971] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="ocx", AllocateDestinationString=1 | out: DestinationString="ocx") returned 0x0 [0057.971] RtlFreeAnsiString (AnsiString="o") [0057.971] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="lnk" | out: DestinationString="lnk") [0057.971] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="lnk", AllocateDestinationString=1 | out: DestinationString="lnk") returned 0x0 [0057.971] RtlFreeAnsiString (AnsiString="l") [0057.971] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="ico" | out: DestinationString="ico") [0057.972] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="ico", AllocateDestinationString=1 | out: DestinationString="ico") returned 0x0 [0057.972] RtlFreeAnsiString (AnsiString="i") [0057.972] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="idx" | out: DestinationString="idx") [0057.972] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="idx", AllocateDestinationString=1 | out: DestinationString="idx") returned 0x0 [0057.972] RtlFreeAnsiString (AnsiString="i") [0057.972] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="ps1" | out: DestinationString="ps1") [0057.972] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="ps1", AllocateDestinationString=1 | out: DestinationString="ps1") returned 0x0 [0057.972] RtlFreeAnsiString (AnsiString="p") [0057.972] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="mpa" | out: DestinationString="mpa") [0057.972] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="mpa", AllocateDestinationString=1 | out: DestinationString="mpa") returned 0x0 [0057.972] RtlFreeAnsiString (AnsiString="m") [0057.972] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="cpl" | out: DestinationString="cpl") [0057.972] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="cpl", AllocateDestinationString=1 | out: DestinationString="cpl") returned 0x0 [0057.972] RtlFreeAnsiString (AnsiString="c") [0057.972] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="icl" | out: DestinationString="icl") [0057.972] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="icl", AllocateDestinationString=1 | out: DestinationString="icl") returned 0x0 [0057.972] RtlFreeAnsiString (AnsiString="i") [0057.972] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="msu" | out: DestinationString="msu") [0057.972] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="msu", AllocateDestinationString=1 | out: DestinationString="msu") returned 0x0 [0057.972] RtlFreeAnsiString (AnsiString="m") [0057.972] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="msi" | out: DestinationString="msi") [0057.972] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="msi", AllocateDestinationString=1 | out: DestinationString="msi") returned 0x0 [0057.972] RtlFreeAnsiString (AnsiString="m") [0057.972] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="nls" | out: DestinationString="nls") [0057.972] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="nls", AllocateDestinationString=1 | out: DestinationString="nls") returned 0x0 [0057.972] RtlFreeAnsiString (AnsiString="n") [0057.973] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="scr" | out: DestinationString="scr") [0057.973] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="scr", AllocateDestinationString=1 | out: DestinationString="scr") returned 0x0 [0057.973] RtlFreeAnsiString (AnsiString="s") [0057.973] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="adv" | out: DestinationString="adv") [0057.973] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="adv", AllocateDestinationString=1 | out: DestinationString="adv") returned 0x0 [0057.973] RtlFreeAnsiString (AnsiString="a") [0057.973] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="386" | out: DestinationString="386") [0057.973] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="386", AllocateDestinationString=1 | out: DestinationString="386") returned 0x0 [0057.973] RtlFreeAnsiString (AnsiString="3") [0057.973] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="com" | out: DestinationString="com") [0057.973] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="com", AllocateDestinationString=1 | out: DestinationString="com") returned 0x0 [0057.973] RtlFreeAnsiString (AnsiString="c") [0057.973] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="hlp" | out: DestinationString="hlp") [0057.973] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="hlp", AllocateDestinationString=1 | out: DestinationString="hlp") returned 0x0 [0057.973] RtlFreeAnsiString (AnsiString="h") [0057.973] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="rom" | out: DestinationString="rom") [0057.973] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="rom", AllocateDestinationString=1 | out: DestinationString="rom") returned 0x0 [0057.973] RtlFreeAnsiString (AnsiString="r") [0057.973] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="lock" | out: DestinationString="lock") [0057.973] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="lock", AllocateDestinationString=1 | out: DestinationString="lock") returned 0x0 [0057.973] RtlFreeAnsiString (AnsiString="l") [0057.973] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="386" | out: DestinationString="386") [0057.973] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="386", AllocateDestinationString=1 | out: DestinationString="386") returned 0x0 [0057.973] RtlFreeAnsiString (AnsiString="3") [0057.973] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="wpx" | out: DestinationString="wpx") [0057.973] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="wpx", AllocateDestinationString=1 | out: DestinationString="wpx") returned 0x0 [0057.974] RtlFreeAnsiString (AnsiString="w") [0057.974] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="ani" | out: DestinationString="ani") [0057.974] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="ani", AllocateDestinationString=1 | out: DestinationString="ani") returned 0x0 [0057.974] RtlFreeAnsiString (AnsiString="a") [0057.974] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="prf" | out: DestinationString="prf") [0057.974] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="prf", AllocateDestinationString=1 | out: DestinationString="prf") returned 0x0 [0057.974] RtlFreeAnsiString (AnsiString="p") [0057.974] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="rtp" | out: DestinationString="rtp") [0057.974] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="rtp", AllocateDestinationString=1 | out: DestinationString="rtp") returned 0x0 [0057.974] RtlFreeAnsiString (AnsiString="r") [0057.974] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="ldf" | out: DestinationString="ldf") [0057.974] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="ldf", AllocateDestinationString=1 | out: DestinationString="ldf") returned 0x0 [0057.974] RtlFreeAnsiString (AnsiString="l") [0057.974] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="key" | out: DestinationString="key") [0057.974] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="key", AllocateDestinationString=1 | out: DestinationString="key") returned 0x0 [0057.974] RtlFreeAnsiString (AnsiString="k") [0057.974] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="diagcab" | out: DestinationString="diagcab") [0057.974] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="diagcab", AllocateDestinationString=1 | out: DestinationString="diagcab") returned 0x0 [0057.974] RtlFreeAnsiString (AnsiString="d") [0057.974] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="cmd" | out: DestinationString="cmd") [0057.974] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="cmd", AllocateDestinationString=1 | out: DestinationString="cmd") returned 0x0 [0057.974] RtlFreeAnsiString (AnsiString="c") [0057.974] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="spl" | out: DestinationString="spl") [0057.974] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="spl", AllocateDestinationString=1 | out: DestinationString="spl") returned 0x0 [0057.974] RtlFreeAnsiString (AnsiString="s") [0057.974] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="deskthemepack" | out: DestinationString="deskthemepack") [0057.975] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="deskthemepack", AllocateDestinationString=1 | out: DestinationString="deskthemepack") returned 0x0 [0057.975] RtlFreeAnsiString (AnsiString="d") [0057.975] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="bat" | out: DestinationString="bat") [0057.975] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="bat", AllocateDestinationString=1 | out: DestinationString="bat") returned 0x0 [0057.975] RtlFreeAnsiString (AnsiString="b") [0057.975] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="themepack" | out: DestinationString="themepack") [0057.975] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="themepack", AllocateDestinationString=1 | out: DestinationString="themepack") returned 0x0 [0057.975] RtlFreeAnsiString (AnsiString="t") [0057.975] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="nslsvice.exe" | out: DestinationString="nslsvice.exe") [0057.975] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="nslsvice.exe", AllocateDestinationString=1 | out: DestinationString="nslsvice.exe") returned 0x0 [0057.975] RtlFreeAnsiString (AnsiString="n") [0057.975] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="pg*" | out: DestinationString="pg*") [0057.975] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="pg*", AllocateDestinationString=1 | out: DestinationString="pg*") returned 0x0 [0057.975] RtlFreeAnsiString (AnsiString="p") [0057.975] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="nservice.exe" | out: DestinationString="nservice.exe") [0057.975] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="nservice.exe", AllocateDestinationString=1 | out: DestinationString="nservice.exe") returned 0x0 [0057.975] RtlFreeAnsiString (AnsiString="n") [0057.975] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="cbvscserv*" | out: DestinationString="cbvscserv*") [0057.976] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="cbvscserv*", AllocateDestinationString=1 | out: DestinationString="cbvscserv*") returned 0x0 [0057.976] RtlFreeAnsiString (AnsiString="c") [0057.976] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="ntrtscan.exe" | out: DestinationString="ntrtscan.exe") [0057.976] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="ntrtscan.exe", AllocateDestinationString=1 | out: DestinationString="ntrtscan.exe") returned 0x0 [0057.976] RtlFreeAnsiString (AnsiString="n") [0057.976] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="cbservi*" | out: DestinationString="cbservi*") [0057.976] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="cbservi*", AllocateDestinationString=1 | out: DestinationString="cbservi*") returned 0x0 [0057.976] RtlFreeAnsiString (AnsiString="c") [0057.976] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="hMailServer*" | out: DestinationString="hMailServer*") [0057.976] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="hMailServer*", AllocateDestinationString=1 | out: DestinationString="hMailServer*") returned 0x0 [0057.976] RtlFreeAnsiString (AnsiString="h") [0057.976] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="IBM*" | out: DestinationString="IBM*") [0057.976] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="IBM*", AllocateDestinationString=1 | out: DestinationString="IBM*") returned 0x0 [0057.976] RtlFreeAnsiString (AnsiString="I") [0057.976] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="bes10*" | out: DestinationString="bes10*") [0057.976] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="bes10*", AllocateDestinationString=1 | out: DestinationString="bes10*") returned 0x0 [0057.976] RtlFreeAnsiString (AnsiString="b") [0057.976] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="black*" | out: DestinationString="black*") [0057.976] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="black*", AllocateDestinationString=1 | out: DestinationString="black*") returned 0x0 [0057.976] RtlFreeAnsiString (AnsiString="b") [0057.976] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="apach*" | out: DestinationString="apach*") [0057.976] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="apach*", AllocateDestinationString=1 | out: DestinationString="apach*") returned 0x0 [0057.976] RtlFreeAnsiString (AnsiString="a") [0057.976] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="bd2*" | out: DestinationString="bd2*") [0057.976] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="bd2*", AllocateDestinationString=1 | out: DestinationString="bd2*") returned 0x0 [0057.976] RtlFreeAnsiString (AnsiString="b") [0057.977] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="db*" | out: DestinationString="db*") [0057.977] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="db*", AllocateDestinationString=1 | out: DestinationString="db*") returned 0x0 [0057.977] RtlFreeAnsiString (AnsiString="d") [0057.977] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="ba*" | out: DestinationString="ba*") [0057.977] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="ba*", AllocateDestinationString=1 | out: DestinationString="ba*") returned 0x0 [0057.977] RtlFreeAnsiString (AnsiString="b") [0057.977] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="be*" | out: DestinationString="be*") [0057.977] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="be*", AllocateDestinationString=1 | out: DestinationString="be*") returned 0x0 [0057.977] RtlFreeAnsiString (AnsiString="b") [0057.977] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="QB*" | out: DestinationString="QB*") [0057.977] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="QB*", AllocateDestinationString=1 | out: DestinationString="QB*") returned 0x0 [0057.977] RtlFreeAnsiString (AnsiString="Q") [0057.977] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="oracle*" | out: DestinationString="oracle*") [0057.977] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="oracle*", AllocateDestinationString=1 | out: DestinationString="oracle*") returned 0x0 [0057.977] RtlFreeAnsiString (AnsiString="o") [0057.977] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="wbengine*" | out: DestinationString="wbengine*") [0057.977] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="wbengine*", AllocateDestinationString=1 | out: DestinationString="wbengine*") returned 0x0 [0057.977] RtlFreeAnsiString (AnsiString="w") [0057.977] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="vee*" | out: DestinationString="vee*") [0057.977] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="vee*", AllocateDestinationString=1 | out: DestinationString="vee*") returned 0x0 [0057.977] RtlFreeAnsiString (AnsiString="v") [0057.977] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="postg*" | out: DestinationString="postg*") [0057.977] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="postg*", AllocateDestinationString=1 | out: DestinationString="postg*") returned 0x0 [0057.977] RtlFreeAnsiString (AnsiString="p") [0057.978] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="sage*" | out: DestinationString="sage*") [0057.978] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="sage*", AllocateDestinationString=1 | out: DestinationString="sage*") returned 0x0 [0057.978] RtlFreeAnsiString (AnsiString="s") [0057.978] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="sap*" | out: DestinationString="sap*") [0057.978] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="sap*", AllocateDestinationString=1 | out: DestinationString="sap*") returned 0x0 [0057.978] RtlFreeAnsiString (AnsiString="s") [0057.978] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="b1*" | out: DestinationString="b1*") [0057.978] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="b1*", AllocateDestinationString=1 | out: DestinationString="b1*") returned 0x0 [0057.978] RtlFreeAnsiString (AnsiString="b") [0057.978] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="fdlaunch*" | out: DestinationString="fdlaunch*") [0057.978] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="fdlaunch*", AllocateDestinationString=1 | out: DestinationString="fdlaunch*") returned 0x0 [0057.978] RtlFreeAnsiString (AnsiString="f") [0057.979] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="msmdsrv*" | out: DestinationString="msmdsrv*") [0057.979] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="msmdsrv*", AllocateDestinationString=1 | out: DestinationString="msmdsrv*") returned 0x0 [0057.979] RtlFreeAnsiString (AnsiString="m") [0057.979] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="report*" | out: DestinationString="report*") [0057.979] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="report*", AllocateDestinationString=1 | out: DestinationString="report*") returned 0x0 [0057.979] RtlFreeAnsiString (AnsiString="r") [0057.979] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="msdtssr*" | out: DestinationString="msdtssr*") [0057.979] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="msdtssr*", AllocateDestinationString=1 | out: DestinationString="msdtssr*") returned 0x0 [0057.979] RtlFreeAnsiString (AnsiString="m") [0057.979] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="coldfus*" | out: DestinationString="coldfus*") [0057.979] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="coldfus*", AllocateDestinationString=1 | out: DestinationString="coldfus*") returned 0x0 [0057.979] RtlFreeAnsiString (AnsiString="c") [0057.979] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="cfdot*" | out: DestinationString="cfdot*") [0057.979] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="cfdot*", AllocateDestinationString=1 | out: DestinationString="cfdot*") returned 0x0 [0057.979] RtlFreeAnsiString (AnsiString="c") [0057.979] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="swag*" | out: DestinationString="swag*") [0057.979] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="swag*", AllocateDestinationString=1 | out: DestinationString="swag*") returned 0x0 [0057.979] RtlFreeAnsiString (AnsiString="s") [0057.979] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="swstrtr*" | out: DestinationString="swstrtr*") [0057.979] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="swstrtr*", AllocateDestinationString=1 | out: DestinationString="swstrtr*") returned 0x0 [0057.979] RtlFreeAnsiString (AnsiString="s") [0057.979] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="jetty.exe" | out: DestinationString="jetty.exe") [0057.979] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="jetty.exe", AllocateDestinationString=1 | out: DestinationString="jetty.exe") returned 0x0 [0057.979] RtlFreeAnsiString (AnsiString="j") [0057.979] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="wrsa.exe" | out: DestinationString="wrsa.exe") [0057.979] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="wrsa.exe", AllocateDestinationString=1 | out: DestinationString="wrsa.exe") returned 0x0 [0057.979] RtlFreeAnsiString (AnsiString="w") [0057.980] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="team*" | out: DestinationString="team*") [0057.980] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="team*", AllocateDestinationString=1 | out: DestinationString="team*") returned 0x0 [0057.980] RtlFreeAnsiString (AnsiString="t") [0057.980] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="agent*" | out: DestinationString="agent*") [0057.980] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="agent*", AllocateDestinationString=1 | out: DestinationString="agent*") returned 0x0 [0057.980] RtlFreeAnsiString (AnsiString="a") [0057.980] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="store.exe" | out: DestinationString="store.exe") [0057.980] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="store.exe", AllocateDestinationString=1 | out: DestinationString="store.exe") returned 0x0 [0057.980] RtlFreeAnsiString (AnsiString="s") [0057.980] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="sql*" | out: DestinationString="sql*") [0057.980] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="sql*", AllocateDestinationString=1 | out: DestinationString="sql*") returned 0x0 [0057.980] RtlFreeAnsiString (AnsiString="s") [0057.980] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="sqbcoreservice.exe" | out: DestinationString="sqbcoreservice.exe") [0057.980] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="sqbcoreservice.exe", AllocateDestinationString=1 | out: DestinationString="sqbcoreservice.exe") returned 0x0 [0057.980] RtlFreeAnsiString (AnsiString="s") [0057.980] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="thunderbird.exe" | out: DestinationString="thunderbird.exe") [0057.980] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="thunderbird.exe", AllocateDestinationString=1 | out: DestinationString="thunderbird.exe") returned 0x0 [0057.980] RtlFreeAnsiString (AnsiString="t") [0057.980] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="ocssd.exe" | out: DestinationString="ocssd.exe") [0057.980] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="ocssd.exe", AllocateDestinationString=1 | out: DestinationString="ocssd.exe") returned 0x0 [0057.980] RtlFreeAnsiString (AnsiString="o") [0057.980] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="encsvc.exe" | out: DestinationString="encsvc.exe") [0057.980] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="encsvc.exe", AllocateDestinationString=1 | out: DestinationString="encsvc.exe") returned 0x0 [0057.980] RtlFreeAnsiString (AnsiString="e") [0057.980] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="excel.exe" | out: DestinationString="excel.exe") [0057.980] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="excel.exe", AllocateDestinationString=1 | out: DestinationString="excel.exe") returned 0x0 [0057.981] RtlFreeAnsiString (AnsiString="e") [0057.981] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="synctime.exe" | out: DestinationString="synctime.exe") [0057.981] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="synctime.exe", AllocateDestinationString=1 | out: DestinationString="synctime.exe") returned 0x0 [0057.981] RtlFreeAnsiString (AnsiString="s") [0057.981] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="mspub.exe" | out: DestinationString="mspub.exe") [0057.981] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="mspub.exe", AllocateDestinationString=1 | out: DestinationString="mspub.exe") returned 0x0 [0057.981] RtlFreeAnsiString (AnsiString="m") [0057.981] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="ocautoupds.exe" | out: DestinationString="ocautoupds.exe") [0057.981] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="ocautoupds.exe", AllocateDestinationString=1 | out: DestinationString="ocautoupds.exe") returned 0x0 [0057.981] RtlFreeAnsiString (AnsiString="o") [0057.981] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="thebat.exe" | out: DestinationString="thebat.exe") [0057.981] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="thebat.exe", AllocateDestinationString=1 | out: DestinationString="thebat.exe") returned 0x0 [0057.981] RtlFreeAnsiString (AnsiString="t") [0057.981] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="dbeng50.exe" | out: DestinationString="dbeng50.exe") [0057.981] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="dbeng50.exe", AllocateDestinationString=1 | out: DestinationString="dbeng50.exe") returned 0x0 [0057.981] RtlFreeAnsiString (AnsiString="d") [0057.981] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*sql*" | out: DestinationString="*sql*") [0057.981] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*sql*", AllocateDestinationString=1 | out: DestinationString="*sql*") returned 0x0 [0057.981] RtlFreeAnsiString (AnsiString="*") [0057.981] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="mydesktopservice.exe" | out: DestinationString="mydesktopservice.exe") [0057.981] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="mydesktopservice.exe", AllocateDestinationString=1 | out: DestinationString="mydesktopservice.exe") returned 0x0 [0057.981] RtlFreeAnsiString (AnsiString="m") [0057.981] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="onenote.exe" | out: DestinationString="onenote.exe") [0057.981] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="onenote.exe", AllocateDestinationString=1 | out: DestinationString="onenote.exe") returned 0x0 [0057.981] RtlFreeAnsiString (AnsiString="o") [0057.981] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="outlook.exe" | out: DestinationString="outlook.exe") [0057.982] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="outlook.exe", AllocateDestinationString=1 | out: DestinationString="outlook.exe") returned 0x0 [0057.982] RtlFreeAnsiString (AnsiString="o") [0057.982] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="powerpnt.exe" | out: DestinationString="powerpnt.exe") [0057.982] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="powerpnt.exe", AllocateDestinationString=1 | out: DestinationString="powerpnt.exe") returned 0x0 [0057.982] RtlFreeAnsiString (AnsiString="p") [0057.982] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="msaccess.exe" | out: DestinationString="msaccess.exe") [0057.982] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="msaccess.exe", AllocateDestinationString=1 | out: DestinationString="msaccess.exe") returned 0x0 [0057.982] RtlFreeAnsiString (AnsiString="m") [0057.982] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="tbirdconfig.exe" | out: DestinationString="tbirdconfig.exe") [0057.982] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="tbirdconfig.exe", AllocateDestinationString=1 | out: DestinationString="tbirdconfig.exe") returned 0x0 [0057.982] RtlFreeAnsiString (AnsiString="t") [0057.982] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="wordpad.exe" | out: DestinationString="wordpad.exe") [0057.982] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="wordpad.exe", AllocateDestinationString=1 | out: DestinationString="wordpad.exe") returned 0x0 [0057.982] RtlFreeAnsiString (AnsiString="w") [0057.982] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="ocomm.exe" | out: DestinationString="ocomm.exe") [0057.982] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="ocomm.exe", AllocateDestinationString=1 | out: DestinationString="ocomm.exe") returned 0x0 [0057.982] RtlFreeAnsiString (AnsiString="o") [0057.982] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="dbsnmp.exe" | out: DestinationString="dbsnmp.exe") [0057.982] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="dbsnmp.exe", AllocateDestinationString=1 | out: DestinationString="dbsnmp.exe") returned 0x0 [0057.982] RtlFreeAnsiString (AnsiString="d") [0057.982] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="thebat64.exe" | out: DestinationString="thebat64.exe") [0057.982] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="thebat64.exe", AllocateDestinationString=1 | out: DestinationString="thebat64.exe") returned 0x0 [0057.982] RtlFreeAnsiString (AnsiString="t") [0057.982] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="winword.exe" | out: DestinationString="winword.exe") [0057.982] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="winword.exe", AllocateDestinationString=1 | out: DestinationString="winword.exe") returned 0x0 [0057.983] RtlFreeAnsiString (AnsiString="w") [0057.983] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="oracle.exe" | out: DestinationString="oracle.exe") [0057.983] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="oracle.exe", AllocateDestinationString=1 | out: DestinationString="oracle.exe") returned 0x0 [0057.983] RtlFreeAnsiString (AnsiString="o") [0057.983] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="xfssvccon.exe" | out: DestinationString="xfssvccon.exe") [0057.983] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="xfssvccon.exe", AllocateDestinationString=1 | out: DestinationString="xfssvccon.exe") returned 0x0 [0057.983] RtlFreeAnsiString (AnsiString="x") [0057.983] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="firefoxconfig.exe" | out: DestinationString="firefoxconfig.exe") [0057.983] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="firefoxconfig.exe", AllocateDestinationString=1 | out: DestinationString="firefoxconfig.exe") returned 0x0 [0057.983] RtlFreeAnsiString (AnsiString="f") [0057.983] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="visio.exe" | out: DestinationString="visio.exe") [0057.983] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="visio.exe", AllocateDestinationString=1 | out: DestinationString="visio.exe") returned 0x0 [0057.983] RtlFreeAnsiString (AnsiString="v") [0057.983] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="mydesktopqos.exe" | out: DestinationString="mydesktopqos.exe") [0057.983] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="mydesktopqos.exe", AllocateDestinationString=1 | out: DestinationString="mydesktopqos.exe") returned 0x0 [0057.983] RtlFreeAnsiString (AnsiString="m") [0057.983] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="infopath.exe" | out: DestinationString="infopath.exe") [0057.983] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="infopath.exe", AllocateDestinationString=1 | out: DestinationString="infopath.exe") returned 0x0 [0057.983] RtlFreeAnsiString (AnsiString="i") [0057.983] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="agntsvc.exe" | out: DestinationString="agntsvc.exe") [0057.983] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="agntsvc.exe", AllocateDestinationString=1 | out: DestinationString="agntsvc.exe") returned 0x0 [0057.983] RtlFreeAnsiString (AnsiString="a") [0057.983] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="Lotus*" | out: DestinationString="Lotus*") [0057.983] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="Lotus*", AllocateDestinationString=1 | out: DestinationString="Lotus*") returned 0x0 [0057.984] RtlFreeAnsiString (AnsiString="L") [0057.984] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="veeam*" | out: DestinationString="veeam*") [0057.984] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="veeam*", AllocateDestinationString=1 | out: DestinationString="veeam*") returned 0x0 [0057.984] RtlFreeAnsiString (AnsiString="v") [0057.984] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="cbvscserv*" | out: DestinationString="cbvscserv*") [0057.984] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="cbvscserv*", AllocateDestinationString=1 | out: DestinationString="cbvscserv*") returned 0x0 [0057.984] RtlFreeAnsiString (AnsiString="c") [0057.984] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="hMailServer" | out: DestinationString="hMailServer") [0057.984] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="hMailServer", AllocateDestinationString=1 | out: DestinationString="hMailServer") returned 0x0 [0057.984] RtlFreeAnsiString (AnsiString="h") [0057.984] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="backup*" | out: DestinationString="backup*") [0057.984] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="backup*", AllocateDestinationString=1 | out: DestinationString="backup*") returned 0x0 [0057.984] RtlFreeAnsiString (AnsiString="b") [0057.984] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*backup*" | out: DestinationString="*backup*") [0057.984] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*backup*", AllocateDestinationString=1 | out: DestinationString="*backup*") returned 0x0 [0057.984] RtlFreeAnsiString (AnsiString="*") [0057.984] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="apach*" | out: DestinationString="apach*") [0057.984] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="apach*", AllocateDestinationString=1 | out: DestinationString="apach*") returned 0x0 [0057.984] RtlFreeAnsiString (AnsiString="a") [0057.984] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="firebird*" | out: DestinationString="firebird*") [0057.984] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="firebird*", AllocateDestinationString=1 | out: DestinationString="firebird*") returned 0x0 [0057.984] RtlFreeAnsiString (AnsiString="f") [0057.984] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="ibmiasrw" | out: DestinationString="ibmiasrw") [0057.984] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="ibmiasrw", AllocateDestinationString=1 | out: DestinationString="ibmiasrw") returned 0x0 [0057.985] RtlFreeAnsiString (AnsiString="i") [0057.985] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="IBM Domino*" | out: DestinationString="IBM Domino*") [0057.985] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="IBM Domino*", AllocateDestinationString=1 | out: DestinationString="IBM Domino*") returned 0x0 [0057.985] RtlFreeAnsiString (AnsiString="I") [0057.985] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="Simply Accounting Database Connection Manager" | out: DestinationString="Simply Accounting Database Connection Manager") [0057.985] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="Simply Accounting Database Connection Manager", AllocateDestinationString=1 | out: DestinationString="Simply Accounting Database Connection Manager") returned 0x0 [0057.985] RtlFreeAnsiString (AnsiString="S") [0057.985] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="IASJet" | out: DestinationString="IASJet") [0057.985] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="IASJet", AllocateDestinationString=1 | out: DestinationString="IASJet") returned 0x0 [0057.985] RtlFreeAnsiString (AnsiString="I") [0057.985] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="QB*" | out: DestinationString="QB*") [0057.985] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="QB*", AllocateDestinationString=1 | out: DestinationString="QB*") returned 0x0 [0057.985] RtlFreeAnsiString (AnsiString="Q") [0057.985] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*sql*" | out: DestinationString="*sql*") [0057.985] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*sql*", AllocateDestinationString=1 | out: DestinationString="*sql*") returned 0x0 [0057.985] RtlFreeAnsiString (AnsiString="*") [0057.985] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="sql*" | out: DestinationString="sql*") [0057.985] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="sql*", AllocateDestinationString=1 | out: DestinationString="sql*") returned 0x0 [0057.985] RtlFreeAnsiString (AnsiString="s") [0057.985] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="QuickBooksDB*" | out: DestinationString="QuickBooksDB*") [0057.985] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="QuickBooksDB*", AllocateDestinationString=1 | out: DestinationString="QuickBooksDB*") returned 0x0 [0057.985] RtlFreeAnsiString (AnsiString="Q") [0057.985] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="IISADMIN" | out: DestinationString="IISADMIN") [0057.985] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="IISADMIN", AllocateDestinationString=1 | out: DestinationString="IISADMIN") returned 0x0 [0057.985] RtlFreeAnsiString (AnsiString="I") [0057.986] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="omsad" | out: DestinationString="omsad") [0057.986] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="omsad", AllocateDestinationString=1 | out: DestinationString="omsad") returned 0x0 [0057.986] RtlFreeAnsiString (AnsiString="o") [0057.986] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="dc*32" | out: DestinationString="dc*32") [0057.986] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="dc*32", AllocateDestinationString=1 | out: DestinationString="dc*32") returned 0x0 [0057.986] RtlFreeAnsiString (AnsiString="d") [0057.986] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="server Administrator" | out: DestinationString="server Administrator") [0057.986] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="server Administrator", AllocateDestinationString=1 | out: DestinationString="server Administrator") returned 0x0 [0057.986] RtlFreeAnsiString (AnsiString="s") [0057.986] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="wbengine" | out: DestinationString="wbengine") [0057.986] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="wbengine", AllocateDestinationString=1 | out: DestinationString="wbengine") returned 0x0 [0057.986] RtlFreeAnsiString (AnsiString="w") [0057.986] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="mr2kserv" | out: DestinationString="mr2kserv") [0057.986] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="mr2kserv", AllocateDestinationString=1 | out: DestinationString="mr2kserv") returned 0x0 [0057.986] RtlFreeAnsiString (AnsiString="m") [0057.986] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="MSExchange*" | out: DestinationString="MSExchange*") [0057.986] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="MSExchange*", AllocateDestinationString=1 | out: DestinationString="MSExchange*") returned 0x0 [0057.986] RtlFreeAnsiString (AnsiString="M") [0057.986] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="ShadowProtectSvc" | out: DestinationString="ShadowProtectSvc") [0057.986] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="ShadowProtectSvc", AllocateDestinationString=1 | out: DestinationString="ShadowProtectSvc") returned 0x0 [0057.986] RtlFreeAnsiString (AnsiString="S") [0057.986] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="SP*4" | out: DestinationString="SP*4") [0057.986] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="SP*4", AllocateDestinationString=1 | out: DestinationString="SP*4") returned 0x0 [0057.986] RtlFreeAnsiString (AnsiString="S") [0057.986] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="teamviewer" | out: DestinationString="teamviewer") [0057.986] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="teamviewer", AllocateDestinationString=1 | out: DestinationString="teamviewer") returned 0x0 [0057.987] RtlFreeAnsiString (AnsiString="t") [0057.987] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="MMS" | out: DestinationString="MMS") [0057.987] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="MMS", AllocateDestinationString=1 | out: DestinationString="MMS") returned 0x0 [0057.987] RtlFreeAnsiString (AnsiString="M") [0057.987] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="AcronisAgent" | out: DestinationString="AcronisAgent") [0057.987] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="AcronisAgent", AllocateDestinationString=1 | out: DestinationString="AcronisAgent") returned 0x0 [0057.987] RtlFreeAnsiString (AnsiString="A") [0057.987] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="ARSM" | out: DestinationString="ARSM") [0057.987] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="ARSM", AllocateDestinationString=1 | out: DestinationString="ARSM") returned 0x0 [0057.987] RtlFreeAnsiString (AnsiString="A") [0057.987] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="AcrSch2Svc" | out: DestinationString="AcrSch2Svc") [0057.987] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="AcrSch2Svc", AllocateDestinationString=1 | out: DestinationString="AcrSch2Svc") returned 0x0 [0057.987] RtlFreeAnsiString (AnsiString="A") [0057.987] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="vsnapvss" | out: DestinationString="vsnapvss") [0057.987] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="vsnapvss", AllocateDestinationString=1 | out: DestinationString="vsnapvss") returned 0x0 [0057.987] RtlFreeAnsiString (AnsiString="v") [0057.987] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="SPXService" | out: DestinationString="SPXService") [0057.987] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="SPXService", AllocateDestinationString=1 | out: DestinationString="SPXService") returned 0x0 [0057.987] RtlFreeAnsiString (AnsiString="S") [0057.987] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="StorageCraft ImageManager" | out: DestinationString="StorageCraft ImageManager") [0057.987] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="StorageCraft ImageManager", AllocateDestinationString=1 | out: DestinationString="StorageCraft ImageManager") returned 0x0 [0057.987] RtlFreeAnsiString (AnsiString="S") [0057.987] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="wrsvc" | out: DestinationString="wrsvc") [0057.987] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="wrsvc", AllocateDestinationString=1 | out: DestinationString="wrsvc") returned 0x0 [0057.987] RtlFreeAnsiString (AnsiString="w") [0057.987] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="stc_endpt_svc" | out: DestinationString="stc_endpt_svc") [0057.987] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="stc_endpt_svc", AllocateDestinationString=1 | out: DestinationString="stc_endpt_svc") returned 0x0 [0057.988] RtlFreeAnsiString (AnsiString="s") [0057.988] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="acrsch2svc" | out: DestinationString="acrsch2svc") [0057.988] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="acrsch2svc", AllocateDestinationString=1 | out: DestinationString="acrsch2svc") returned 0x0 [0057.988] RtlFreeAnsiString (AnsiString="a") [0057.988] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="reboot" | out: DestinationString="reboot") [0057.988] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="reboot", AllocateDestinationString=1 | out: DestinationString="reboot") returned 0x0 [0057.988] RtlFreeAnsiString (AnsiString="r") [0057.988] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="restart" | out: DestinationString="restart") [0057.988] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="restart", AllocateDestinationString=1 | out: DestinationString="restart") returned 0x0 [0057.988] RtlFreeAnsiString (AnsiString="r") [0057.988] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="shutdown" | out: DestinationString="shutdown") [0057.988] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="shutdown", AllocateDestinationString=1 | out: DestinationString="shutdown") returned 0x0 [0057.988] RtlFreeAnsiString (AnsiString="s") [0057.988] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="logoff" | out: DestinationString="logoff") [0057.988] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="logoff", AllocateDestinationString=1 | out: DestinationString="logoff") returned 0x0 [0057.988] RtlFreeAnsiString (AnsiString="l") [0057.988] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="back" | out: DestinationString="back") [0057.988] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="back", AllocateDestinationString=1 | out: DestinationString="back") returned 0x0 [0057.988] RtlFreeAnsiString (AnsiString="b") [0057.989] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="ipc$" | out: DestinationString="ipc$") [0057.989] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="ipc$", AllocateDestinationString=1 | out: DestinationString="ipc$") returned 0x0 [0057.989] RtlFreeAnsiString (AnsiString="i") [0057.989] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="admin$" | out: DestinationString="admin$") [0057.989] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="admin$", AllocateDestinationString=1 | out: DestinationString="admin$") returned 0x0 [0057.989] RtlFreeAnsiString (AnsiString="a") [0057.990] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="psexec.exe" | out: DestinationString="psexec.exe") [0057.990] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="psexec.exe", AllocateDestinationString=1 | out: DestinationString="psexec.exe") returned 0x0 [0057.990] RtlFreeAnsiString (AnsiString="p") [0057.990] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="system" | out: DestinationString="system") [0057.990] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="system", AllocateDestinationString=1 | out: DestinationString="system") returned 0x0 [0057.990] RtlFreeAnsiString (AnsiString="s") [0057.990] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*:\\windows*" | out: DestinationString="*:\\windows*") [0057.990] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*:\\windows*", AllocateDestinationString=1 | out: DestinationString="*:\\windows*") returned 0x0 [0057.990] RtlFreeAnsiString (AnsiString="*") [0057.990] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*:\\winnt*" | out: DestinationString="*:\\winnt*") [0057.990] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*:\\winnt*", AllocateDestinationString=1 | out: DestinationString="*:\\winnt*") returned 0x0 [0057.990] RtlFreeAnsiString (AnsiString="*") [0057.990] RtlInitAnsiString (in: DestinationString=0x363fdf4, SourceString="*:\\program file*\\vmwar*" | out: DestinationString="*:\\program file*\\vmwar*") [0057.990] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fdfc, SourceString="*:\\program file*\\vmwar*", AllocateDestinationString=1 | out: DestinationString="*:\\program file*\\vmwar*") returned 0x0 [0057.990] RtlFreeAnsiString (AnsiString="*") [0057.990] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38968d0) returned 1 [0057.993] GetVersion () returned 0x3ad7000a [0057.993] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x38a9060 | out: Wow64Process=0x38a9060) returned 1 [0057.993] GetCurrentProcessId () returned 0x10dc [0057.999] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x363fe70 | out: TokenHandle=0x363fe70*=0x2d8) returned 0x0 [0058.000] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100) returned 0x388b210 [0058.000] GetTokenInformation (in: TokenHandle=0x2d8, TokenInformationClass=0x1, TokenInformation=0x388b210, TokenInformationLength=0x100, ReturnLength=0x363fea8 | out: TokenInformation=0x388b210, ReturnLength=0x363fea8) returned 1 [0058.000] IsWellKnownSid (pSid=0x388b218*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xb4)), WellKnownSidType=0x16) returned 0 [0058.000] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388b210) returned 1 [0058.000] GetTokenInformation (in: TokenHandle=0x2d8, TokenInformationClass=0x12, TokenInformation=0x363fe84, TokenInformationLength=0x4, ReturnLength=0x363fea8 | out: TokenInformation=0x363fe84, ReturnLength=0x363fea8) returned 1 [0058.000] NtClose (Handle=0x2d8) returned 0x0 [0058.000] GetComputerNameExW (in: NameType=0x0, lpBuffer=0x0, nSize=0x363fe6c | out: lpBuffer=0x0, nSize=0x363fe6c) returned 0 [0058.000] GetLastError () returned 0xea [0058.000] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10) returned 0x38a8910 [0058.000] GetComputerNameExW (in: NameType=0x0, lpBuffer=0x38a8910, nSize=0x363fe6c | out: lpBuffer="NQDPDE", nSize=0x363fe6c) returned 1 [0058.000] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf4) returned 0x388b210 [0058.000] GetCurrentHwProfileW (in: lpHwProfileInfo=0x388b210 | out: lpHwProfileInfo=0x388b210) returned 1 [0058.001] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x38849b8 [0058.001] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5530 [0058.001] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5530) returned 1 [0058.001] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5530 [0058.001] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5170 [0058.001] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5170) returned 1 [0058.001] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x41) returned 0x3892cf0 [0058.001] sprintf (in: _Dest=0x3892cf0, _Format="%0.2x" | out: _Dest="a0") returned 2 [0058.002] sprintf (in: _Dest=0x3892cf2, _Format="%0.2x" | out: _Dest="a7") returned 2 [0058.002] sprintf (in: _Dest=0x3892cf4, _Format="%0.2x" | out: _Dest="02") returned 2 [0058.002] sprintf (in: _Dest=0x3892cf6, _Format="%0.2x" | out: _Dest="90") returned 2 [0058.002] sprintf (in: _Dest=0x3892cf8, _Format="%0.2x" | out: _Dest="71") returned 2 [0058.002] sprintf (in: _Dest=0x3892cfa, _Format="%0.2x" | out: _Dest="28") returned 2 [0058.002] sprintf (in: _Dest=0x3892cfc, _Format="%0.2x" | out: _Dest="eb") returned 2 [0058.002] sprintf (in: _Dest=0x3892cfe, _Format="%0.2x" | out: _Dest="03") returned 2 [0058.002] sprintf (in: _Dest=0x3892d00, _Format="%0.2x" | out: _Dest="0e") returned 2 [0058.002] sprintf (in: _Dest=0x3892d02, _Format="%0.2x" | out: _Dest="de") returned 2 [0058.002] sprintf (in: _Dest=0x3892d04, _Format="%0.2x" | out: _Dest="23") returned 2 [0058.002] sprintf (in: _Dest=0x3892d06, _Format="%0.2x" | out: _Dest="a3") returned 2 [0058.002] sprintf (in: _Dest=0x3892d08, _Format="%0.2x" | out: _Dest="fb") returned 2 [0058.002] sprintf (in: _Dest=0x3892d0a, _Format="%0.2x" | out: _Dest="75") returned 2 [0058.002] sprintf (in: _Dest=0x3892d0c, _Format="%0.2x" | out: _Dest="38") returned 2 [0058.002] sprintf (in: _Dest=0x3892d0e, _Format="%0.2x" | out: _Dest="23") returned 2 [0058.002] sprintf (in: _Dest=0x3892d10, _Format="%0.2x" | out: _Dest="a7") returned 2 [0058.002] sprintf (in: _Dest=0x3892d12, _Format="%0.2x" | out: _Dest="54") returned 2 [0058.002] sprintf (in: _Dest=0x3892d14, _Format="%0.2x" | out: _Dest="3f") returned 2 [0058.002] sprintf (in: _Dest=0x3892d16, _Format="%0.2x" | out: _Dest="21") returned 2 [0058.002] sprintf (in: _Dest=0x3892d18, _Format="%0.2x" | out: _Dest="9d") returned 2 [0058.002] sprintf (in: _Dest=0x3892d1a, _Format="%0.2x" | out: _Dest="cb") returned 2 [0058.002] sprintf (in: _Dest=0x3892d1c, _Format="%0.2x" | out: _Dest="b5") returned 2 [0058.002] sprintf (in: _Dest=0x3892d1e, _Format="%0.2x" | out: _Dest="8a") returned 2 [0058.002] sprintf (in: _Dest=0x3892d20, _Format="%0.2x" | out: _Dest="fe") returned 2 [0058.002] sprintf (in: _Dest=0x3892d22, _Format="%0.2x" | out: _Dest="a5") returned 2 [0058.002] sprintf (in: _Dest=0x3892d24, _Format="%0.2x" | out: _Dest="56") returned 2 [0058.002] sprintf (in: _Dest=0x3892d26, _Format="%0.2x" | out: _Dest="c2") returned 2 [0058.002] sprintf (in: _Dest=0x3892d28, _Format="%0.2x" | out: _Dest="4f") returned 2 [0058.002] sprintf (in: _Dest=0x3892d2a, _Format="%0.2x" | out: _Dest="58") returned 2 [0058.002] sprintf (in: _Dest=0x3892d2c, _Format="%0.2x" | out: _Dest="4f") returned 2 [0058.002] sprintf (in: _Dest=0x3892d2e, _Format="%0.2x" | out: _Dest="2d") returned 2 [0058.002] RtlInitAnsiString (in: DestinationString=0x363fe1c, SourceString="a0a702907128eb030ede23a3fb753823a7543f219dcbb58afea556c24f584f2d" | out: DestinationString="a0a702907128eb030ede23a3fb753823a7543f219dcbb58afea556c24f584f2d") [0058.002] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fe24, SourceString="a0a702907128eb030ede23a3fb753823a7543f219dcbb58afea556c24f584f2d", AllocateDestinationString=1 | out: DestinationString="a0a702907128eb030ede23a3fb753823a7543f219dcbb58afea556c24f584f2d") returned 0x0 [0058.002] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x82) returned 0x38a8ab8 [0058.002] RtlFreeAnsiString (AnsiString="a") [0058.003] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12) returned 0x38a8040 [0058.003] wcscpy (in: _Dest=0x38a8040, _Source="\\\\" | out: _Dest="\\\\") returned="\\\\" [0058.003] wcscat (in: _Dest=0x38a8040, _Source="NQDPDE" | out: _Dest="\\\\NQDPDE") returned="\\\\NQDPDE" [0058.003] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4) returned 0x38a3cd0 [0058.003] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12) returned 0x38a7fa0 [0058.003] wcscpy (in: _Dest=0x38a7fa0, _Source="\\\\NQDPDE" | out: _Dest="\\\\NQDPDE") returned="\\\\NQDPDE" [0058.003] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a8040) returned 1 [0058.003] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5530) returned 1 [0058.003] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38849b8) returned 1 [0058.003] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388b210) returned 1 [0058.003] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12) returned 0x38a7f20 [0058.003] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12) returned 0x38a7e20 [0058.003] wcscpy (in: _Dest=0x38a7e20, _Source="a0a70290" | out: _Dest="a0a70290") returned="a0a70290" [0058.003] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20a) returned 0x388a120 [0058.003] wcscpy (in: _Dest=0x388a120, _Source="C:\\Users\\FD1HVy\\Desktop\\ef3ff3f0.exe" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ef3ff3f0.exe") returned="C:\\Users\\FD1HVy\\Desktop\\ef3ff3f0.exe" [0058.003] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20a) returned 0x38a9a08 [0058.003] SHGetFolderPathW (in: hwnd=0x0, csidl=42, hToken=0x0, dwFlags=0x0, pszPath=0x38a9a08 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0058.006] wcscat (in: _Dest=0x38a9a08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0058.006] wcscat (in: _Dest=0x38a9a08, _Source="a0a70290" | out: _Dest="C:\\Program Files (x86)\\a0a70290") returned="C:\\Program Files (x86)\\a0a70290" [0058.006] CreateDirectoryW (lpPathName="C:\\Program Files (x86)\\a0a70290" (normalized: "c:\\program files (x86)\\a0a70290"), lpSecurityAttributes=0x0) returned 1 [0058.008] wcscat (in: _Dest=0x38a9a08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\a0a70290\\") returned="C:\\Program Files (x86)\\a0a70290\\" [0058.008] wcscat (in: _Dest=0x38a9a08, _Source="a0a70290" | out: _Dest="C:\\Program Files (x86)\\a0a70290\\a0a70290") returned="C:\\Program Files (x86)\\a0a70290\\a0a70290" [0058.008] wcscat (in: _Dest=0x38a9a08, _Source=".exe" | out: _Dest="C:\\Program Files (x86)\\a0a70290\\a0a70290.exe") returned="C:\\Program Files (x86)\\a0a70290\\a0a70290.exe" [0058.009] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ef3ff3f0.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ef3ff3f0.exe"), lpNewFileName="C:\\Program Files (x86)\\a0a70290\\a0a70290.exe" (normalized: "c:\\program files (x86)\\a0a70290\\a0a70290.exe"), bFailIfExists=0) returned 1 [0058.020] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="software\\microsoft\\windows\\currentversion\\run", ulOptions=0x0, samDesired=0x2011f, phkResult=0x363fdd4 | out: phkResult=0x363fdd4*=0x2dc) returned 0x0 [0058.020] RegSetValueExW (in: hKey=0x2dc, lpValueName="a0a70290", Reserved=0x0, dwType=0x1, lpData="C:\\Program Files (x86)\\a0a70290\\a0a70290.exe", cbData=0x5a | out: lpData="C:\\Program Files (x86)\\a0a70290\\a0a70290.exe") returned 0x0 [0058.020] wcscpy (in: _Dest=0x3667198, _Source="C:\\Program Files (x86)\\a0a70290\\a0a70290.exe" | out: _Dest="C:\\Program Files (x86)\\a0a70290\\a0a70290.exe") returned="C:\\Program Files (x86)\\a0a70290\\a0a70290.exe" [0058.021] RegFlushKey (hKey=0x2dc) returned 0x0 [0058.077] RegCloseKey (hKey=0x2dc) returned 0x0 [0058.077] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a9a08) returned 1 [0058.077] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5058 [0058.077] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a52d8 [0058.077] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4e00 [0058.077] NtQuerySystemTime (in: CurrentTime=0x363fe30 | out: CurrentTime=0x363fe30*=132260136152375797) returned 0x0 [0058.077] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0x89981ef3 [0058.077] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0x24268095 [0058.077] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0xb2ca37cb [0058.077] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0x43d215eb [0058.077] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0x955e6d7f [0058.077] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0xe2fac212 [0058.077] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0x6c506f96 [0058.077] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0x63402e0a [0058.077] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0xa4008bb1 [0058.077] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0x605f6f72 [0058.077] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0xae337f33 [0058.077] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0x7127770c [0058.077] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0x7743d7ad [0058.077] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0xfae0ca02 [0058.077] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0x354e351d [0058.078] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0xeb4604dc [0058.078] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0xe3f8ee00 [0058.078] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0x3dd64b6c [0058.078] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0x7700bbb9 [0058.078] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0x61c29ff4 [0058.078] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0x63f01ad6 [0058.078] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0xd3ac4cb [0058.078] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0x8ec6d417 [0058.078] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0x6f5a9a3a [0058.078] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0x6e47ba46 [0058.078] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0x2f5ada39 [0058.078] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0x29b00f2f [0058.078] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0xe1aef84d [0058.078] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0x16bcd8da [0058.078] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0x3f2b1c4e [0058.078] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0x6ab8418a [0058.078] RtlRandom (in: Seed=0x363fe3c | out: Seed=0x363fe3c) returned 0xb76aaf63 [0058.090] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5148 [0058.090] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5288 [0058.090] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ef0 [0058.090] NtQuerySystemTime (in: CurrentTime=0x363fdf0 | out: CurrentTime=0x363fdf0*=132260136152532970) returned 0x0 [0058.090] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0xe2cd8dd9 [0058.090] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0xede24b67 [0058.090] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0xc2334305 [0058.090] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0x88453577 [0058.090] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0xc1f29e16 [0058.090] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0xe65e5758 [0058.090] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0x3f3d65d8 [0058.090] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0x999d0d27 [0058.090] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0x2aee6fa5 [0058.090] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0x652d1ff9 [0058.090] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0x3ec4b04a [0058.091] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0x466f7f64 [0058.091] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0x848e786 [0058.091] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0x6079d25e [0058.091] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0x158d5989 [0058.091] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0x9fdbd8a7 [0058.091] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0xe555eac4 [0058.091] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0x10e1c333 [0058.091] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0x825737b1 [0058.091] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0xc285696a [0058.091] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0xcb0b7ac2 [0058.091] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0xcd6d1b04 [0058.091] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0xc456a397 [0058.091] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0x23786a89 [0058.091] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0x28e85afb [0058.091] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0x22ea6988 [0058.091] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0xded11e67 [0058.091] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0x5ff7b211 [0058.091] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0x2170d447 [0058.091] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0x29e111a3 [0058.091] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0xc3284bd6 [0058.091] RtlRandom (in: Seed=0x363fdfc | out: Seed=0x363fdfc) returned 0xa139afda [0058.093] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a51e8 [0058.095] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x38aab58 [0058.095] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4f18 [0058.095] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38aab58) returned 1 [0058.095] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4ef0) returned 1 [0058.095] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5148) returned 1 [0058.095] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a6268 [0058.095] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x38aa4c8 [0058.095] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4f40 [0058.095] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4f40) returned 1 [0058.095] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5008 [0058.095] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a52b0 [0058.095] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5148 [0058.095] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5148) returned 1 [0058.095] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38aa4c8) returned 1 [0058.095] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6268) returned 1 [0058.095] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6c) returned 0x38aa978 [0058.096] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5008) returned 1 [0058.096] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a52b0) returned 1 [0058.096] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5288) returned 1 [0058.096] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a51e8) returned 1 [0058.096] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4f18) returned 1 [0058.096] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e00) returned 1 [0058.096] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5058) returned 1 [0058.096] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8c) returned 0x38a6ea8 [0058.096] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x24) returned 0x38a6ca0 [0058.096] wcscpy (in: _Dest=0x38a6ca0, _Source="software\\" | out: _Dest="software\\") returned="software\\" [0058.096] wcscat (in: _Dest=0x38a6ca0, _Source="a0a70290" | out: _Dest="software\\a0a70290") returned="software\\a0a70290" [0058.096] RegCreateKeyExW (in: hKey=0x80000002, lpSubKey="software\\a0a70290", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xf013f, lpSecurityAttributes=0x0, phkResult=0x363fe38, lpdwDisposition=0x0 | out: phkResult=0x363fe38*=0x2dc, lpdwDisposition=0x0) returned 0x0 [0058.096] RegSetValueExW (in: hKey=0x2dc, lpValueName="a0a70290", Reserved=0x0, dwType=0x3, lpData=0x38a6ea8*, cbData=0x8c | out: lpData=0x38a6ea8*) returned 0x0 [0058.096] RegFlushKey (hKey=0x2dc) returned 0x0 [0058.125] RegCloseKey (hKey=0x2dc) returned 0x0 [0058.125] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6ca0) returned 1 [0058.125] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6ea8) returned 1 [0058.125] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1024) returned 0x38aac30 [0058.125] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.128] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0x2048) returned 0x38aac30 [0058.128] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.128] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0x306c) returned 0x38aac30 [0058.128] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.129] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0x4090) returned 0x38aac30 [0058.129] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.129] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0x50b4) returned 0x38aac30 [0058.129] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.129] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0x60d8) returned 0x38aac30 [0058.129] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.130] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0x70fc) returned 0x38aac30 [0058.130] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.131] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0x8120) returned 0x38aac30 [0058.131] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.131] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0x9144) returned 0x38aac30 [0058.131] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.132] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0xa168) returned 0x38aac30 [0058.132] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.133] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0xb18c) returned 0x38aac30 [0058.133] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.139] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0xc1b0) returned 0x38aac30 [0058.139] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.139] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0xd1d4) returned 0x38aac30 [0058.140] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.140] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0xe1f8) returned 0x38aac30 [0058.140] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.140] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0xf21c) returned 0x38aac30 [0058.140] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.141] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0x10240) returned 0x38aac30 [0058.141] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.141] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0x11264) returned 0x38aac30 [0058.141] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.142] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0x12288) returned 0x38aac30 [0058.142] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.142] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0x132ac) returned 0x38aac30 [0058.142] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.143] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0x142d0) returned 0x38aac30 [0058.143] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.143] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0x152f4) returned 0x38aac30 [0058.143] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.144] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0x16318) returned 0x38aac30 [0058.144] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.145] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0x1733c) returned 0x38aac30 [0058.145] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.145] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0x18360) returned 0x38aac30 [0058.145] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.146] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0x19384) returned 0x38aac30 [0058.146] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.146] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0x1a3a8) returned 0x38aac30 [0058.146] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.147] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0x1b3cc) returned 0x38c4fe8 [0058.149] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38c4fe8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x38c4fe8, ResultLength=0x0) returned 0xc0000004 [0058.149] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38c4fe8, Size=0x1c3f0) returned 0x38e03c0 [0058.153] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38e03c0, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x38e03c0, ResultLength=0x0) returned 0xc0000004 [0058.153] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38e03c0, Size=0x1d414) returned 0x38e03c0 [0058.153] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38e03c0, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x38e03c0, ResultLength=0x0) returned 0xc0000004 [0058.154] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38e03c0, Size=0x1e438) returned 0x38aac30 [0058.154] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.155] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0x1f45c) returned 0x38aac30 [0058.155] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.160] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0x20480) returned 0x38aac30 [0058.160] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.161] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0x214a4) returned 0x38aac30 [0058.161] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.161] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0x224c8) returned 0x38aac30 [0058.161] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.162] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0x234ec) returned 0x38aac30 [0058.162] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0xc0000004 [0058.162] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38aac30, Size=0x24510) returned 0x38aac30 [0058.162] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38aac30, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x38aac30, ResultLength=0x0) returned 0x0 [0058.163] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38aac30) returned 1 [0058.163] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ef3ff3f0.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ef3ff3f0.exe")) returned 1 [0058.165] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388a120) returned 1 [0058.165] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6) returned 0x38a3d90 [0058.165] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc) returned 0x38a8688 [0058.165] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x28) returned 0x38a6ca0 [0058.165] strstr (_Str="{ID}-Readme.txt", _SubStr="{ID}") returned="{ID}-Readme.txt" [0058.165] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd) returned 0x38a86e8 [0058.165] strstr (_Str="*-Readme.txt", _SubStr="{ID}") returned 0x0 [0058.165] RtlInitAnsiString (in: DestinationString=0x363fe5c, SourceString="*-Readme.txt" | out: DestinationString="*-Readme.txt") [0058.165] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fe64, SourceString="*-Readme.txt", AllocateDestinationString=1 | out: DestinationString="*-Readme.txt") returned 0x0 [0058.165] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1a) returned 0x38a5288 [0058.165] RtlFreeAnsiString (AnsiString="*") [0058.165] strstr (_Str=".mailto[{mail1}].{id}", _SubStr="{id}") returned="{id}" [0058.165] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x17) returned 0x38a7ec0 [0058.165] strstr (_Str=".mailto[{mail1}].a0a70", _SubStr="{id}") returned 0x0 [0058.165] strstr (_Str=".mailto[{mail1}].a0a70", _SubStr="{ID}") returned 0x0 [0058.165] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x17) returned 0x38a7fe0 [0058.165] strcpy (in: _Dest=0x38a7fe0, _Source=".mailto[{mail1}].a0a70" | out: _Dest=".mailto[{mail1}].a0a70") returned=".mailto[{mail1}].a0a70" [0058.166] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a7ec0) returned 1 [0058.166] strstr (_Str=".mailto[{mail1}].a0a70", _SubStr="{mail1}") returned="{mail1}].a0a70" [0058.166] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x21) returned 0x38a6d00 [0058.166] strstr (_Str=".mailto[knoocknoo@cock.li].a0a70", _SubStr="{mail1}") returned 0x0 [0058.166] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a7fe0) returned 1 [0058.166] strstr (_Str=".mailto[knoocknoo@cock.li].a0a70", _SubStr="{mail2}") returned 0x0 [0058.166] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x21) returned 0x38a6910 [0058.166] strcpy (in: _Dest=0x38a6910, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest=".mailto[knoocknoo@cock.li].a0a70") returned=".mailto[knoocknoo@cock.li].a0a70" [0058.166] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6d00) returned 1 [0058.166] RtlInitAnsiString (in: DestinationString=0x363fe5c, SourceString=".mailto[knoocknoo@cock.li].a0a70" | out: DestinationString=".mailto[knoocknoo@cock.li].a0a70") [0058.166] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fe64, SourceString=".mailto[knoocknoo@cock.li].a0a70", AllocateDestinationString=1 | out: DestinationString=".mailto[knoocknoo@cock.li].a0a70") returned 0x0 [0058.166] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x42) returned 0x3892e80 [0058.166] RtlFreeAnsiString (AnsiString=".") [0058.166] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe) returned 0x38a87f0 [0058.166] wcscpy (in: _Dest=0x38a87f0, _Source="." | out: _Dest=".") returned="." [0058.166] wcscat (in: _Dest=0x38a87f0, _Source="a0a70" | out: _Dest=".a0a70") returned=".a0a70" [0058.166] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x42) returned 0x3892840 [0058.166] wcscpy (in: _Dest=0x3892840, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest=".mailto[knoocknoo@cock.li].a0a70") returned=".mailto[knoocknoo@cock.li].a0a70" [0058.166] strstr (_Str="{ID}-Readme.txt", _SubStr="{id}") returned 0x0 [0058.166] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10) returned 0x38a88b0 [0058.166] strcpy (in: _Dest=0x38a88b0, _Source="{ID}-Readme.txt" | out: _Dest="{ID}-Readme.txt") returned="{ID}-Readme.txt" [0058.331] strstr (_Str="{ID}-Readme.txt", _SubStr="{ID}") returned="{ID}-Readme.txt" [0058.331] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11) returned 0x38a8140 [0058.331] strstr (_Str="A0A70-Readme.txt", _SubStr="{ID}") returned 0x0 [0058.331] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a88b0) returned 1 [0058.331] strstr (_Str="A0A70-Readme.txt", _SubStr="{mail1}") returned 0x0 [0058.331] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11) returned 0x38a7fe0 [0058.331] strcpy (in: _Dest=0x38a7fe0, _Source="A0A70-Readme.txt" | out: _Dest="A0A70-Readme.txt") returned="A0A70-Readme.txt" [0058.331] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a8140) returned 1 [0058.331] strstr (_Str="A0A70-Readme.txt", _SubStr="{mail2}") returned 0x0 [0058.331] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11) returned 0x38a8000 [0058.331] strcpy (in: _Dest=0x38a8000, _Source="A0A70-Readme.txt" | out: _Dest="A0A70-Readme.txt") returned="A0A70-Readme.txt" [0058.331] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a7fe0) returned 1 [0058.331] RtlInitAnsiString (in: DestinationString=0x363fe5c, SourceString="A0A70-Readme.txt" | out: DestinationString="A0A70-Readme.txt") [0058.331] RtlAnsiStringToUnicodeString (in: DestinationString=0x363fe64, SourceString="A0A70-Readme.txt", AllocateDestinationString=1 | out: DestinationString="A0A70-Readme.txt") returned 0x0 [0058.331] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x22) returned 0x38a6940 [0058.331] RtlFreeAnsiString (AnsiString="A") [0058.331] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x89) returned 0x38a78c0 [0058.331] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4e00 [0058.331] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a52b0 [0058.331] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5238 [0058.331] NtQuerySystemTime (in: CurrentTime=0x363fdcc | out: CurrentTime=0x363fdcc*=132260136154876107) returned 0x0 [0058.331] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0xdb1fd797 [0058.331] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0x925831cc [0058.331] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0x119e09f4 [0058.331] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0x620cea02 [0058.331] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0xea7d02b6 [0058.331] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0xf5da879e [0058.331] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0x21ff116b [0058.331] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0x87817d2f [0058.332] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0x3f4918d8 [0058.332] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0x432b74b [0058.332] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0xf7238d3 [0058.332] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0xef323850 [0058.332] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0xf755d [0058.332] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0xa66cf05d [0058.332] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0xd49d18a0 [0058.332] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0x5a1398d [0058.332] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0xe522f9e2 [0058.332] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0xee86844f [0058.332] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0xa79d13e4 [0058.332] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0x5855183e [0058.332] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0xd9cc138c [0058.332] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0xb7af6a66 [0058.332] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0x52810c3c [0058.332] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0xf1669cf3 [0058.332] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0xe3516195 [0058.332] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0xc30f801b [0058.332] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0xcf5c0d38 [0058.332] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0xfd12197f [0058.332] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0xa668ce6f [0058.332] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0x6e140245 [0058.332] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0x31167ad3 [0058.332] RtlRandom (in: Seed=0x363fdd8 | out: Seed=0x363fdd8) returned 0x5ee7025f [0058.334] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5030 [0058.335] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x38aa5b8 [0058.335] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4e50 [0058.335] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38aa5b8) returned 1 [0058.335] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5238) returned 1 [0058.335] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e00) returned 1 [0058.335] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a6220 [0058.335] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x38aa888 [0058.335] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ec8 [0058.335] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4ec8) returned 1 [0058.335] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x88) returned 0x38a8e18 [0058.335] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4e78 [0058.336] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4fe0 [0058.336] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4fe0) returned 1 [0058.336] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38aa888) returned 1 [0058.336] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6220) returned 1 [0058.336] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd4) returned 0x3883a00 [0058.336] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11d) returned 0x388b210 [0058.336] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12d) returned 0x3890b80 [0058.336] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb) returned 0x38a8628 [0058.336] sprintf (in: _Dest=0x38a8628, _Format="%0.8x" | out: _Dest="1b1ea859") returned 8 [0058.336] strstr (_Str="{code_ph_id:\r\nb64}", _SubStr="ph") returned="ph_id:\r\nb64}" [0058.336] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x19) returned 0x38a5120 [0058.336] strstr (_Str="{code_1b1ea859_id:\r\nb64}", _SubStr="ph") returned 0x0 [0058.336] strstr (_Str="{code_1b1ea859_id:\r\nb64}", _SubStr="id") returned="id:\r\nb64}" [0058.336] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1c) returned 0x38a50a8 [0058.336] strstr (_Str="{code_1b1ea859_a0a70:\r\nb64}", _SubStr="id") returned 0x0 [0058.336] strstr (_Str="{code_1b1ea859_a0a70:\r\nb64}", _SubStr="b64") returned="b64}" [0058.336] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x13f) returned 0x3891f90 [0058.336] strstr (_Str="{code_1b1ea859_a0a70:\r\nJPVl7n/E7ewxXwVG+fdjRGAWJ6wYT2Q9OTWV1jLxWmz2C2StyK\r\nkLKbps2eVpZ+qVRPSYSq8sIQU6oP8515givIO9cGoA9NtvWage\r\nG6X3PFXZOgXCL69wX17Ym1npE//3sxUSK8oc/vBpNeD8z7XT7p\r\n5e+eHx5oSvvA91JlZZCA9olT75O85aZSguGASud6Ek94X5lKMY\r\n636VUUC6fxJedNNd/4A+XlOXXc2KnlLLgrq+otVyDo7nbce7SZ\r\nJ0NS3J7WlzprFBctbvKy0XoV2YQ9ohEGs=}", _SubStr="b64") returned 0x0 [0058.336] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a50a8) returned 1 [0058.336] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5120) returned 1 [0058.336] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a8628) returned 1 [0058.336] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3890b80) returned 1 [0058.336] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388b210) returned 1 [0058.336] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3883a00) returned 1 [0058.336] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a8e18) returned 1 [0058.336] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e78) returned 1 [0058.336] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5030) returned 1 [0058.336] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a52b0) returned 1 [0058.336] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e50) returned 1 [0058.336] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a78c0) returned 1 [0058.336] strstr (_Str="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .{id}\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}", _SubStr="{id}") returned="{id}\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}" [0058.336] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a5) returned 0x38aac30 [0058.337] strstr (_Str="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .a0a70\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}", _SubStr="{id}") returned 0x0 [0058.337] strstr (_Str="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .a0a70\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}", _SubStr="{ID}") returned 0x0 [0058.337] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a5) returned 0x38ab1e0 [0058.337] strcpy (in: _Dest=0x38ab1e0, _Source="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .a0a70\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}" | out: _Dest="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .a0a70\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}") returned="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .a0a70\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}" [0058.337] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38aac30) returned 1 [0058.337] strstr (_Str="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .a0a70\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}", _SubStr="{mail1}") returned="{mail1}\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}" [0058.337] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5af) returned 0x38ab790 [0058.338] strstr (_Str="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .a0a70\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.knoocknoo@cock.li\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}", _SubStr="{mail1}") returned 0x0 [0058.338] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ab1e0) returned 1 [0058.338] strstr (_Str="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .a0a70\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.knoocknoo@cock.li\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}", _SubStr="{mail2}") returned="{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}" [0058.338] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5bd) returned 0x38aac30 [0058.338] strstr (_Str="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .a0a70\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.knoocknoo@cock.li\r\n2.eeeooppaaaxxx@tuta.io\r\n\r\nDon't forget to include your code in the email:\r\n{code}", _SubStr="{mail2}") returned 0x0 [0058.338] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ab790) returned 1 [0058.340] strstr (_Str="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .a0a70\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.knoocknoo@cock.li\r\n2.eeeooppaaaxxx@tuta.io\r\n\r\nDon't forget to include your code in the email:\r\n{code}", _SubStr="{code}") returned="{code}" [0058.340] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6f5) returned 0x38ab1f8 [0058.341] strstr (_Str="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .a0a70\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.knoocknoo@cock.li\r\n2.eeeooppaaaxxx@tuta.io\r\n\r\nDon't forget to include your code in the email:\r\n{code_1b1ea859_a0a70:\r\nJPVl7n/E7ewxXwVG+fdjRGAWJ6wYT2Q9OTWV1jLxWmz2C2StyK\r\nkLKbps2eVpZ+qVRPSYSq8sIQU6oP8515givIO9cGoA9NtvWage\r\nG6X3PFXZOgXCL69wX17Ym1npE//3sxUSK8oc/vBpNeD8z7XT7p\r\n5e+eHx5oSvvA91JlZZCA9olT75O85aZSguGASud6Ek94X5lKMY\r\n636VUUC6fxJedNNd/4A+XlOXXc2KnlLLgrq+otVyDo7nbce7SZ\r\nJ0NS3J7WlzprFBctbvKy0XoV2YQ9ohEGs=}", _SubStr="{code}") returned 0x0 [0058.341] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38aac30) returned 1 [0058.341] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3891f90) returned 1 [0058.341] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a8000) returned 1 [0058.341] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6910) returned 1 [0058.341] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a86e8) returned 1 [0058.341] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6ca0) returned 1 [0058.341] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a8688) returned 1 [0058.341] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a3d90) returned 1 [0058.341] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a8ab8) returned 1 [0058.341] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20a) returned 0x38a9a08 [0058.341] GetSystemDirectoryW (in: lpBuffer=0x38a9a08, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0058.341] wcscat (in: _Dest=0x38a9a08, _Source="\\" | out: _Dest="C:\\WINDOWS\\system32\\") returned="C:\\WINDOWS\\system32\\" [0058.341] wcscat (in: _Dest=0x38a9a08, _Source="explorer.exe" | out: _Dest="C:\\WINDOWS\\system32\\explorer.exe") returned="C:\\WINDOWS\\system32\\explorer.exe" [0058.341] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x28) returned 0x38a6d00 [0058.341] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\explorer.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x363fe64*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x363fea8 | out: lpCommandLine=0x0, lpProcessInformation=0x363fea8*(hProcess=0x2e4, hThread=0x2dc, dwProcessId=0x4c4, dwThreadId=0x374)) returned 1 [0058.370] NtCreateSection (in: SectionHandle=0x363fe3c, DesiredAccess=0xf001f, ObjectAttributes=0x0, MaximumSize=0x363fe1c, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x363fe3c*=0x2ec) returned 0x0 [0058.370] NtMapViewOfSection (in: SectionHandle=0x2ec, ProcessHandle=0xffffffff, BaseAddress=0x363fe40*=0x0, ZeroBits=0x0, CommitSize=0x1b000, SectionOffset=0x0, ViewSize=0x363fe30*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4 | out: BaseAddress=0x363fe40*=0x5250000, SectionOffset=0x0, ViewSize=0x363fe30*=0x1b000) returned 0x0 [0058.372] NtMapViewOfSection (in: SectionHandle=0x2ec, ProcessHandle=0x2e4, BaseAddress=0x363fe38*=0x0, ZeroBits=0x0, CommitSize=0x1b000, SectionOffset=0x0, ViewSize=0x363fe30*=0x1b000, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x363fe38*=0x9c0000, SectionOffset=0x0, ViewSize=0x363fe30*=0x1b000) returned 0x0 [0058.373] NtUnmapViewOfSection (ProcessHandle=0xffffffff, BaseAddress=0x5250000) returned 0x0 [0058.375] NtClose (Handle=0x2ec) returned 0x0 [0058.375] NtQueueApcThread (ThreadHandle=0x2dc, ApcRoutine=0x9d3940, NormalContext=0x0, SystemArgument1=0x0, SystemArgument2=0x0) returned 0x0 [0058.375] NtResumeThread (in: ThreadHandle=0x2dc, SuspendCount=0x0 | out: SuspendCount=0x0) returned 0x0 [0058.375] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a9a08) returned 1 [0058.375] Sleep (dwMilliseconds=0x7530) [0068.617] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x363fe3c | out: lpLuid=0x363fe3c*(LowPart=0x14, HighPart=0)) returned 1 [0068.623] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x363fe18 | out: TokenHandle=0x363fe18*=0x30c) returned 0x0 [0068.623] AdjustTokenPrivileges (in: TokenHandle=0x30c, DisableAllPrivileges=0, NewState=0x363fe2c*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0068.623] GetLastError () returned 0x0 [0068.623] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeImpersonatePrivilege", lpLuid=0x363fe3c | out: lpLuid=0x363fe3c*(LowPart=0x1d, HighPart=0)) returned 1 [0068.624] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x363fe18 | out: TokenHandle=0x363fe18*=0x310) returned 0x0 [0068.624] AdjustTokenPrivileges (in: TokenHandle=0x310, DisableAllPrivileges=0, NewState=0x363fe2c*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0068.624] GetLastError () returned 0x0 [0068.626] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1770) returned 0x38ad940 [0068.626] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10) returned 0x38a87a8 [0068.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x36651e0, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x314 [0068.627] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x36650f0, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x318 [0068.630] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1024) returned 0x38af0b8 [0068.630] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38af0b8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x38af0b8, ResultLength=0x0) returned 0xc0000004 [0068.632] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38af0b8, Size=0x2048) returned 0x38af0b8 [0068.632] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38af0b8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x38af0b8, ResultLength=0x0) returned 0xc0000004 [0068.634] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38af0b8, Size=0x306c) returned 0x38af0b8 [0068.634] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38af0b8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x38af0b8, ResultLength=0x0) returned 0xc0000004 [0068.635] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38af0b8, Size=0x4090) returned 0x38af0b8 [0068.635] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38af0b8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x38af0b8, ResultLength=0x0) returned 0xc0000004 [0068.636] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38af0b8, Size=0x50b4) returned 0x38af0b8 [0068.636] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38af0b8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x38af0b8, ResultLength=0x0) returned 0xc0000004 [0068.639] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38af0b8, Size=0x60d8) returned 0x38af0b8 [0068.639] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38af0b8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x38af0b8, ResultLength=0x0) returned 0xc0000004 [0068.640] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38af0b8, Size=0x70fc) returned 0x38af0b8 [0068.640] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38af0b8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x38af0b8, ResultLength=0x0) returned 0xc0000004 [0068.641] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38af0b8, Size=0x8120) returned 0x38af0b8 [0068.642] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38af0b8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x38af0b8, ResultLength=0x0) returned 0xc0000004 [0068.643] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38af0b8, Size=0x9144) returned 0x38af0b8 [0068.643] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38af0b8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x38af0b8, ResultLength=0x0) returned 0xc0000004 [0068.644] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38af0b8, Size=0xa168) returned 0x38af0b8 [0068.644] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38af0b8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x38af0b8, ResultLength=0x0) returned 0xc0000004 [0068.712] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38af0b8, Size=0xb18c) returned 0x38b9fc8 [0068.712] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.714] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0xc1b0) returned 0x38b9fc8 [0068.714] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.716] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0xd1d4) returned 0x38b9fc8 [0068.716] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.718] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0xe1f8) returned 0x38b9fc8 [0068.718] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.720] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0xf21c) returned 0x38b9fc8 [0068.720] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.721] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x10240) returned 0x38b9fc8 [0068.722] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.724] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x11264) returned 0x38b9fc8 [0068.724] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.726] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x12288) returned 0x38b9fc8 [0068.726] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.728] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x132ac) returned 0x38b9fc8 [0068.728] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.730] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x142d0) returned 0x38b9fc8 [0068.730] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.732] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x152f4) returned 0x38b9fc8 [0068.732] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.735] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x16318) returned 0x38b9fc8 [0068.735] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.737] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x1733c) returned 0x38b9fc8 [0068.737] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.740] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x18360) returned 0x38b9fc8 [0068.740] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.742] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x19384) returned 0x38b9fc8 [0068.742] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.745] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x1a3a8) returned 0x38b9fc8 [0068.745] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.748] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x1b3cc) returned 0x38b9fc8 [0068.748] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.750] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x1c3f0) returned 0x38b9fc8 [0068.750] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.846] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x1d414) returned 0x38b9fc8 [0068.847] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.850] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x1e438) returned 0x38b9fc8 [0068.850] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.853] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x1f45c) returned 0x38b9fc8 [0068.853] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.856] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x20480) returned 0x38b9fc8 [0068.856] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.858] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x214a4) returned 0x38b9fc8 [0068.858] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.861] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x224c8) returned 0x38b9fc8 [0068.861] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.864] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x234ec) returned 0x38b9fc8 [0068.864] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.867] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x24510) returned 0x38b9fc8 [0068.867] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.931] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x25534) returned 0x38b9fc8 [0068.931] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.934] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x26558) returned 0x38b9fc8 [0068.934] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x26558, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.937] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x2757c) returned 0x38b9fc8 [0068.937] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x2757c, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.941] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x285a0) returned 0x38b9fc8 [0068.941] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x285a0, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.944] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x295c4) returned 0x38b9fc8 [0068.944] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x295c4, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.948] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x2a5e8) returned 0x38b9fc8 [0068.948] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x2a5e8, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.951] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x2b60c) returned 0x38b9fc8 [0068.951] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x2b60c, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.955] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x2c630) returned 0x38b9fc8 [0068.955] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x2c630, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.959] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x2d654) returned 0x38b9fc8 [0068.959] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x2d654, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.963] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x2e678) returned 0x38b9fc8 [0068.963] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x2e678, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.967] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x2f69c) returned 0x38b9fc8 [0068.967] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x2f69c, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0068.971] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x306c0) returned 0x38b9fc8 [0068.972] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x306c0, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0069.054] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x316e4) returned 0x38b9fc8 [0069.054] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x316e4, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0069.059] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x32708) returned 0x38b9fc8 [0069.059] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x32708, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0069.064] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x3372c) returned 0x38b9fc8 [0069.064] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x3372c, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0069.068] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x34750) returned 0x38b9fc8 [0069.075] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x34750, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0069.080] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x35774) returned 0x38b9fc8 [0069.080] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x35774, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0069.151] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x36798) returned 0x38b9fc8 [0069.151] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x36798, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0069.156] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x377bc) returned 0x38b9fc8 [0069.156] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x377bc, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0069.161] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x387e0) returned 0x38b9fc8 [0069.161] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x387e0, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0069.166] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x39804) returned 0x38b9fc8 [0069.166] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x39804, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0069.171] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x3a828) returned 0x38b9fc8 [0069.171] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x3a828, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0069.176] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x3b84c) returned 0x38b9fc8 [0069.176] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x3b84c, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0069.182] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x3c870) returned 0x38b9fc8 [0069.183] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x3c870, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0069.188] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x3d894) returned 0x38b9fc8 [0069.188] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x3d894, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0069.265] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x3e8b8) returned 0x38b9fc8 [0069.265] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x3e8b8, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0069.272] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x3f8dc) returned 0x38b9fc8 [0069.272] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x3f8dc, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0069.278] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x40900) returned 0x38b9fc8 [0069.279] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x40900, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0069.285] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x41924) returned 0x38b9fc8 [0069.285] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x41924, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0069.291] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x42948) returned 0x38b9fc8 [0069.291] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x42948, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0069.297] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x4396c) returned 0x38b9fc8 [0069.297] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x4396c, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0069.352] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x44990) returned 0x38fd940 [0069.357] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38fd940, Length=0x44990, ResultLength=0x0 | out: SystemInformation=0x38fd940, ResultLength=0x0) returned 0xc0000004 [0069.364] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38fd940, Size=0x459b4) returned 0x5370048 [0069.372] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x5370048, Length=0x459b4, ResultLength=0x0 | out: SystemInformation=0x5370048, ResultLength=0x0) returned 0xc0000004 [0069.384] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x5370048, Size=0x469d8) returned 0x5370048 [0069.384] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x5370048, Length=0x469d8, ResultLength=0x0 | out: SystemInformation=0x5370048, ResultLength=0x0) returned 0xc0000004 [0069.391] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x5370048, Size=0x479fc) returned 0x53b6a28 [0069.475] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x53b6a28, Length=0x479fc, ResultLength=0x0 | out: SystemInformation=0x53b6a28, ResultLength=0x0) returned 0xc0000004 [0069.483] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53b6a28, Size=0x48a20) returned 0x53fe430 [0069.491] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x53fe430, Length=0x48a20, ResultLength=0x0 | out: SystemInformation=0x53fe430, ResultLength=0x0) returned 0xc0000004 [0069.500] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe430, Size=0x49a44) returned 0x53fe430 [0069.500] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x53fe430, Length=0x49a44, ResultLength=0x0 | out: SystemInformation=0x53fe430, ResultLength=0x0) returned 0xc0000004 [0069.507] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe430, Size=0x4aa68) returned 0x5370048 [0069.512] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x5370048, Length=0x4aa68, ResultLength=0x0 | out: SystemInformation=0x5370048, ResultLength=0x0) returned 0xc0000004 [0069.519] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x5370048, Size=0x4ba8c) returned 0x5370048 [0069.519] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x5370048, Length=0x4ba8c, ResultLength=0x0 | out: SystemInformation=0x5370048, ResultLength=0x0) returned 0xc0000004 [0069.636] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x5370048, Size=0x4cab0) returned 0x38b9fc8 [0069.641] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x4cab0, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0069.648] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x4dad4) returned 0x3906a80 [0069.653] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x3906a80, Length=0x4dad4, ResultLength=0x0 | out: SystemInformation=0x3906a80, ResultLength=0x0) returned 0xc0000004 [0069.661] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x3906a80, Size=0x4eaf8) returned 0x5470048 [0069.669] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x5470048, Length=0x4eaf8, ResultLength=0x0 | out: SystemInformation=0x5470048, ResultLength=0x0) returned 0xc0000004 [0069.740] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x5470048, Size=0x4fb1c) returned 0x5470048 [0069.740] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x5470048, Length=0x4fb1c, ResultLength=0x0 | out: SystemInformation=0x5470048, ResultLength=0x0) returned 0xc0000004 [0069.752] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x5470048, Size=0x50b40) returned 0x38b9fc8 [0069.757] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x38b9fc8, Length=0x50b40, ResultLength=0x0 | out: SystemInformation=0x38b9fc8, ResultLength=0x0) returned 0xc0000004 [0069.765] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38b9fc8, Size=0x51b64) returned 0x390ab10 [0069.769] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x390ab10, Length=0x51b64, ResultLength=0x0 | out: SystemInformation=0x390ab10, ResultLength=0x0) returned 0xc0000004 [0069.778] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x390ab10, Size=0x52b88) returned 0x5470048 [0069.782] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x5470048, Length=0x52b88, ResultLength=0x0 | out: SystemInformation=0x5470048, ResultLength=0x0) returned 0xc0000004 [0069.839] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x5470048, Size=0x53bac) returned 0x5470048 [0069.840] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x5470048, Length=0x53bac, ResultLength=0x0 | out: SystemInformation=0x5470048, ResultLength=0x0) returned 0xc0000004 [0069.847] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x5470048, Size=0x54bd0) returned 0x5470048 [0069.847] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x5470048, Length=0x54bd0, ResultLength=0x0 | out: SystemInformation=0x5470048, ResultLength=0x0) returned 0xc0000004 [0069.854] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x5470048, Size=0x55bf4) returned 0x5470048 [0069.854] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x5470048, Length=0x55bf4, ResultLength=0x0 | out: SystemInformation=0x5470048, ResultLength=0x0) returned 0xc0000004 [0069.860] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x5470048, Size=0x56c18) returned 0x5470048 [0069.860] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x5470048, Length=0x56c18, ResultLength=0x0 | out: SystemInformation=0x5470048, ResultLength=0x0) returned 0xc0000004 [0069.867] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x5470048, Size=0x57c3c) returned 0x5470048 [0069.867] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x5470048, Length=0x57c3c, ResultLength=0x0 | out: SystemInformation=0x5470048, ResultLength=0x0) returned 0xc0000004 [0069.874] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x5470048, Size=0x58c60) returned 0x5470048 [0069.875] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x5470048, Length=0x58c60, ResultLength=0x0 | out: SystemInformation=0x5470048, ResultLength=0x0) returned 0xc0000004 [0069.976] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x5470048, Size=0x59c84) returned 0x5470048 [0069.976] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x5470048, Length=0x59c84, ResultLength=0x0 | out: SystemInformation=0x5470048, ResultLength=0x0) returned 0xc0000004 [0069.986] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x5470048, Size=0x5aca8) returned 0x5470048 [0069.987] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x5470048, Length=0x5aca8, ResultLength=0x0 | out: SystemInformation=0x5470048, ResultLength=0x0) returned 0xc0000004 [0069.995] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x5470048, Size=0x5bccc) returned 0x5470048 [0069.995] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x5470048, Length=0x5bccc, ResultLength=0x0 | out: SystemInformation=0x5470048, ResultLength=0x0) returned 0xc0000004 [0070.002] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x5470048, Size=0x5ccf0) returned 0x5470048 [0070.002] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x5470048, Length=0x5ccf0, ResultLength=0x0 | out: SystemInformation=0x5470048, ResultLength=0x0) returned 0xc0000004 [0070.010] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x5470048, Size=0x5dd14) returned 0x5470048 [0070.010] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x5470048, Length=0x5dd14, ResultLength=0x0 | out: SystemInformation=0x5470048, ResultLength=0x0) returned 0xc0000004 [0070.017] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x5470048, Size=0x5ed38) returned 0x5470048 [0070.017] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x5470048, Length=0x5ed38, ResultLength=0x0 | out: SystemInformation=0x5470048, ResultLength=0x0) returned 0xc0000004 [0070.113] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x5470048, Size=0x5fd5c) returned 0x5470048 [0070.114] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x5470048, Length=0x5fd5c, ResultLength=0x0 | out: SystemInformation=0x5470048, ResultLength=0x0) returned 0xc0000004 [0070.122] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x5470048, Size=0x60d80) returned 0x5470048 [0070.122] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x5470048, Length=0x60d80, ResultLength=0x0 | out: SystemInformation=0x5470048, ResultLength=0x0) returned 0xc0000004 [0070.129] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x5470048, Size=0x61da4) returned 0x5470048 [0070.130] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x5470048, Length=0x61da4, ResultLength=0x0 | out: SystemInformation=0x5470048, ResultLength=0x0) returned 0xc0000004 [0070.137] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x5470048, Size=0x62dc8) returned 0x5470048 [0070.137] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x5470048, Length=0x62dc8, ResultLength=0x0 | out: SystemInformation=0x5470048, ResultLength=0x0) returned 0xc0000004 [0070.220] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x5470048, Size=0x63dec) returned 0x5470048 [0070.221] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x5470048, Length=0x63dec, ResultLength=0x0 | out: SystemInformation=0x5470048, ResultLength=0x0) returned 0xc0000004 [0070.230] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x5470048, Size=0x64e10) returned 0x5470048 [0070.230] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x5470048, Length=0x64e10, ResultLength=0x0 | out: SystemInformation=0x5470048, ResultLength=0x0) returned 0xc0000004 [0070.238] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x5470048, Size=0x65e34) returned 0x5470048 [0070.239] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x5470048, Length=0x65e34, ResultLength=0x0 | out: SystemInformation=0x5470048, ResultLength=0x0) returned 0xc0000004 [0070.251] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x5470048, Size=0x66e58) returned 0x5470048 [0070.252] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x5470048, Length=0x66e58, ResultLength=0x0 | out: SystemInformation=0x5470048, ResultLength=0x0) returned 0xc0000004 [0070.309] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x5470048, Size=0x67e7c) returned 0x5470048 [0070.309] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x5470048, Length=0x67e7c, ResultLength=0x0 | out: SystemInformation=0x5470048, ResultLength=0x0) returned 0x0 [0070.317] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.317] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.318] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.318] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.318] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.318] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.318] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.318] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.318] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.318] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.318] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.318] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.318] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.319] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.319] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.319] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.319] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.319] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.319] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.319] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.319] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.319] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.319] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.319] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.319] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.319] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.319] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.319] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.319] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.319] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.319] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.319] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.319] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.320] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.320] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.320] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.320] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.320] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.320] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.320] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.320] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.320] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.320] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.320] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.320] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.320] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.320] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.320] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.320] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.320] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.320] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.320] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.320] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.320] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.321] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.321] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.321] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.321] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.321] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.321] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.321] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.321] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.321] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.321] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.321] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.321] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.321] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.321] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.321] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.321] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.321] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.321] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.321] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.321] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.321] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.322] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.322] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.322] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.322] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.322] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.322] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.322] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.322] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.322] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.322] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.322] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.322] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.322] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.322] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.322] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.322] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.322] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.322] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.322] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.322] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.322] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.322] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.323] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.323] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.323] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.323] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.323] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.323] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.323] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.323] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.323] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.323] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.323] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.323] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.323] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.323] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.323] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.323] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.323] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.323] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.323] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.323] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.323] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.324] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.324] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.324] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.324] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.324] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.324] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.324] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.324] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.324] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.324] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.324] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.324] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.324] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.324] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.324] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.324] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.324] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.324] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.324] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.324] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.324] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.324] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.325] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.325] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.325] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.325] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.325] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.325] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.325] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.325] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.325] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.325] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.325] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.325] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.325] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.325] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.325] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.325] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.325] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.325] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.325] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.325] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.325] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.326] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.326] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.326] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.326] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.326] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.326] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.326] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.326] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.326] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.326] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.326] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.326] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.326] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.326] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.326] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.326] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.326] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.326] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.326] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.326] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.326] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.327] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.327] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.327] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.327] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.327] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.327] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.327] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.327] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.327] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.327] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.327] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.327] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.327] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.327] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.327] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.327] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.327] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.327] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.327] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.327] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.327] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.327] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.328] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.328] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.328] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.328] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.328] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.328] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.328] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.328] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.328] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.328] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.328] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.328] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.328] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.328] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.328] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.328] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.328] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.328] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.328] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.328] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.328] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.329] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.329] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.329] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.329] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.329] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.329] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.329] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.329] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.329] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.329] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.329] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.329] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.329] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.329] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.329] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.329] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.329] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.329] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.329] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.329] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.329] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.329] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.330] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.330] NtOpenProcess (in: ProcessHandle=0x363fef0, DesiredAccess=0x440, ObjectAttributes=0x363fed0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fee8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x363fef0*=0x0) returned 0xc0000022 [0070.332] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x4, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.332] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.332] NtClose (Handle=0x320) returned 0x0 [0070.332] NtClose (Handle=0x31c) returned 0x0 [0070.332] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x8, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.332] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.332] NtClose (Handle=0x320) returned 0x0 [0070.332] NtClose (Handle=0x31c) returned 0x0 [0070.332] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0xc, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.332] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.332] NtClose (Handle=0x320) returned 0x0 [0070.332] NtClose (Handle=0x31c) returned 0x0 [0070.332] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x10, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.332] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.332] NtClose (Handle=0x320) returned 0x0 [0070.332] NtClose (Handle=0x31c) returned 0x0 [0070.332] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x14, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.332] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.333] NtClose (Handle=0x320) returned 0x0 [0070.333] NtClose (Handle=0x31c) returned 0x0 [0070.333] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x18, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.333] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.333] NtClose (Handle=0x320) returned 0x0 [0070.333] NtClose (Handle=0x31c) returned 0x0 [0070.333] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x1c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.333] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.333] NtClose (Handle=0x320) returned 0x0 [0070.333] NtClose (Handle=0x31c) returned 0x0 [0070.333] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x20, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.333] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.333] NtClose (Handle=0x320) returned 0x0 [0070.333] NtClose (Handle=0x31c) returned 0x0 [0070.333] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x24, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.333] NtClose (Handle=0x31c) returned 0x0 [0070.333] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x28, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.333] NtClose (Handle=0x31c) returned 0x0 [0070.333] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x2c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.333] NtClose (Handle=0x31c) returned 0x0 [0070.333] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x30, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.334] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.334] NtClose (Handle=0x320) returned 0x0 [0070.334] NtClose (Handle=0x31c) returned 0x0 [0070.334] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x34, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.334] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.334] NtClose (Handle=0x320) returned 0x0 [0070.334] NtClose (Handle=0x31c) returned 0x0 [0070.334] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x38, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.334] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.334] NtClose (Handle=0x320) returned 0x0 [0070.334] NtClose (Handle=0x31c) returned 0x0 [0070.334] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x3c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.334] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000022 [0070.334] NtClose (Handle=0x320) returned 0x0 [0070.334] NtClose (Handle=0x31c) returned 0x0 [0070.334] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x40, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.334] NtClose (Handle=0x31c) returned 0x0 [0070.334] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x44, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.334] NtClose (Handle=0x31c) returned 0x0 [0070.334] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x48, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.335] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.335] NtClose (Handle=0x320) returned 0x0 [0070.335] NtClose (Handle=0x31c) returned 0x0 [0070.335] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x4c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.335] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.335] NtClose (Handle=0x320) returned 0x0 [0070.335] NtClose (Handle=0x31c) returned 0x0 [0070.335] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x50, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.335] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.335] NtClose (Handle=0x320) returned 0x0 [0070.335] NtClose (Handle=0x31c) returned 0x0 [0070.335] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x54, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.335] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.335] NtClose (Handle=0x320) returned 0x0 [0070.335] NtClose (Handle=0x31c) returned 0x0 [0070.335] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x58, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.335] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.335] NtClose (Handle=0x320) returned 0x0 [0070.335] NtClose (Handle=0x31c) returned 0x0 [0070.335] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x5c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.335] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.335] NtClose (Handle=0x320) returned 0x0 [0070.336] NtClose (Handle=0x31c) returned 0x0 [0070.336] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x60, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.336] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.336] NtClose (Handle=0x320) returned 0x0 [0070.336] NtClose (Handle=0x31c) returned 0x0 [0070.336] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x64, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.336] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.336] NtClose (Handle=0x320) returned 0x0 [0070.336] NtClose (Handle=0x31c) returned 0x0 [0070.336] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x68, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.336] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.336] NtClose (Handle=0x320) returned 0x0 [0070.336] NtClose (Handle=0x31c) returned 0x0 [0070.336] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x6c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.336] NtClose (Handle=0x31c) returned 0x0 [0070.336] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x70, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.336] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.336] NtClose (Handle=0x320) returned 0x0 [0070.336] NtClose (Handle=0x31c) returned 0x0 [0070.336] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x74, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.336] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000020 [0070.337] NtClose (Handle=0x320) returned 0x0 [0070.337] NtClose (Handle=0x31c) returned 0x0 [0070.337] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x78, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.337] NtClose (Handle=0x31c) returned 0x0 [0070.337] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x7c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.337] NtClose (Handle=0x31c) returned 0x0 [0070.337] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x80, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.337] NtClose (Handle=0x31c) returned 0x0 [0070.337] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x84, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.337] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.337] NtClose (Handle=0x320) returned 0x0 [0070.337] NtClose (Handle=0x31c) returned 0x0 [0070.337] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x88, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.337] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.337] NtClose (Handle=0x320) returned 0x0 [0070.337] NtClose (Handle=0x31c) returned 0x0 [0070.337] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x8c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.337] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.337] NtClose (Handle=0x320) returned 0x0 [0070.337] NtClose (Handle=0x31c) returned 0x0 [0070.337] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x90, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.337] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.338] NtClose (Handle=0x320) returned 0x0 [0070.338] NtClose (Handle=0x31c) returned 0x0 [0070.338] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x94, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.338] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.338] NtClose (Handle=0x320) returned 0x0 [0070.338] NtClose (Handle=0x31c) returned 0x0 [0070.338] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x98, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.338] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.338] NtClose (Handle=0x320) returned 0x0 [0070.338] NtClose (Handle=0x31c) returned 0x0 [0070.338] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x9c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.338] NtClose (Handle=0x31c) returned 0x0 [0070.338] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0xa0, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.338] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.338] NtClose (Handle=0x320) returned 0x0 [0070.338] NtClose (Handle=0x31c) returned 0x0 [0070.338] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0xa4, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.338] NtClose (Handle=0x31c) returned 0x0 [0070.338] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0xa8, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.338] NtClose (Handle=0x31c) returned 0x0 [0070.338] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0xac, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.338] NtClose (Handle=0x31c) returned 0x0 [0070.339] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0xb0, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.339] NtClose (Handle=0x31c) returned 0x0 [0070.339] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0xb4, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.339] NtClose (Handle=0x31c) returned 0x0 [0070.339] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0xb8, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.339] NtClose (Handle=0x31c) returned 0x0 [0070.339] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0xbc, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.339] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.339] NtClose (Handle=0x320) returned 0x0 [0070.339] NtClose (Handle=0x31c) returned 0x0 [0070.339] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0xc0, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.339] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.339] NtClose (Handle=0x320) returned 0x0 [0070.339] NtClose (Handle=0x31c) returned 0x0 [0070.339] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0xc4, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.339] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.339] NtClose (Handle=0x320) returned 0x0 [0070.339] NtClose (Handle=0x31c) returned 0x0 [0070.339] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0xc8, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.339] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000020 [0070.339] NtClose (Handle=0x320) returned 0x0 [0070.339] NtClose (Handle=0x31c) returned 0x0 [0070.340] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0xcc, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.340] NtClose (Handle=0x31c) returned 0x0 [0070.340] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0xd0, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.340] NtClose (Handle=0x31c) returned 0x0 [0070.340] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0xd4, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.340] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.340] NtClose (Handle=0x320) returned 0x0 [0070.340] NtClose (Handle=0x31c) returned 0x0 [0070.340] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0xd8, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.340] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.340] NtClose (Handle=0x320) returned 0x0 [0070.340] NtClose (Handle=0x31c) returned 0x0 [0070.340] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0xdc, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.340] NtClose (Handle=0x31c) returned 0x0 [0070.340] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0xe0, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.340] NtClose (Handle=0x31c) returned 0x0 [0070.340] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0xe4, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.340] NtClose (Handle=0x31c) returned 0x0 [0070.340] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0xe8, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.340] NtClose (Handle=0x31c) returned 0x0 [0070.340] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0xec, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.340] NtClose (Handle=0x31c) returned 0x0 [0070.341] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0xf0, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.341] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.341] NtClose (Handle=0x320) returned 0x0 [0070.341] NtClose (Handle=0x31c) returned 0x0 [0070.341] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0xf4, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.341] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.341] NtClose (Handle=0x320) returned 0x0 [0070.341] NtClose (Handle=0x31c) returned 0x0 [0070.341] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0xf8, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.341] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.341] NtClose (Handle=0x320) returned 0x0 [0070.341] NtClose (Handle=0x31c) returned 0x0 [0070.341] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0xfc, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.341] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.341] NtClose (Handle=0x320) returned 0x0 [0070.341] NtClose (Handle=0x31c) returned 0x0 [0070.341] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x100, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.341] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.341] NtClose (Handle=0x320) returned 0x0 [0070.341] NtClose (Handle=0x31c) returned 0x0 [0070.341] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x104, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.341] NtClose (Handle=0x31c) returned 0x0 [0070.342] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x108, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.342] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.342] NtClose (Handle=0x320) returned 0x0 [0070.342] NtClose (Handle=0x31c) returned 0x0 [0070.342] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x10c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.342] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.342] NtClose (Handle=0x320) returned 0x0 [0070.342] NtClose (Handle=0x31c) returned 0x0 [0070.342] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x110, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.342] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.342] NtClose (Handle=0x320) returned 0x0 [0070.342] NtClose (Handle=0x31c) returned 0x0 [0070.342] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x114, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.342] NtClose (Handle=0x31c) returned 0x0 [0070.342] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x118, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.342] NtClose (Handle=0x31c) returned 0x0 [0070.342] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x11c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.342] NtClose (Handle=0x31c) returned 0x0 [0070.342] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x120, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.342] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.342] NtClose (Handle=0x320) returned 0x0 [0070.342] NtClose (Handle=0x31c) returned 0x0 [0070.343] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x124, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.343] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.343] NtClose (Handle=0x320) returned 0x0 [0070.343] NtClose (Handle=0x31c) returned 0x0 [0070.343] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x128, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.343] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.343] NtClose (Handle=0x320) returned 0x0 [0070.343] NtClose (Handle=0x31c) returned 0x0 [0070.343] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x12c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.343] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.343] NtClose (Handle=0x320) returned 0x0 [0070.343] NtClose (Handle=0x31c) returned 0x0 [0070.343] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x130, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.343] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.343] NtClose (Handle=0x320) returned 0x0 [0070.343] NtClose (Handle=0x31c) returned 0x0 [0070.343] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x134, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.343] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.343] NtClose (Handle=0x320) returned 0x0 [0070.343] NtClose (Handle=0x31c) returned 0x0 [0070.343] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x138, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.343] NtClose (Handle=0x31c) returned 0x0 [0070.344] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x13c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x320) returned 0x0 [0070.344] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x320 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.344] NtClose (Handle=0x320) returned 0xc0000235 [0070.344] NtClose (Handle=0x31c) returned 0x0 [0070.344] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x140, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x324) returned 0x0 [0070.344] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x324 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.344] NtClose (Handle=0x324) returned 0xc0000235 [0070.344] NtClose (Handle=0x31c) returned 0x0 [0070.344] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x144, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x328) returned 0x0 [0070.344] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x328 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.344] NtClose (Handle=0x328) returned 0x0 [0070.344] NtClose (Handle=0x31c) returned 0x0 [0070.344] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x148, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.344] NtClose (Handle=0x31c) returned 0x0 [0070.344] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x14c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x328) returned 0x0 [0070.344] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x328 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.344] NtClose (Handle=0x328) returned 0x0 [0070.344] NtClose (Handle=0x31c) returned 0x0 [0070.344] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x150, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x328) returned 0x0 [0070.344] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x328 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.345] NtClose (Handle=0x328) returned 0x0 [0070.345] NtClose (Handle=0x31c) returned 0x0 [0070.345] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x154, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x328) returned 0x0 [0070.345] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x328 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.345] NtClose (Handle=0x328) returned 0x0 [0070.345] NtClose (Handle=0x31c) returned 0x0 [0070.345] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x158, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x328) returned 0x0 [0070.345] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x328 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.345] NtClose (Handle=0x328) returned 0x0 [0070.345] NtClose (Handle=0x31c) returned 0x0 [0070.345] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x15c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x328) returned 0x0 [0070.345] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x328 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.345] NtClose (Handle=0x328) returned 0x0 [0070.345] NtClose (Handle=0x31c) returned 0x0 [0070.345] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x160, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x328) returned 0x0 [0070.345] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x328 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.345] NtClose (Handle=0x328) returned 0x0 [0070.345] NtClose (Handle=0x31c) returned 0x0 [0070.345] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x164, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x328) returned 0x0 [0070.345] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x328 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.346] NtClose (Handle=0x328) returned 0x0 [0070.346] NtClose (Handle=0x31c) returned 0x0 [0070.346] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x168, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x328) returned 0x0 [0070.346] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x328 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.346] NtClose (Handle=0x328) returned 0x0 [0070.346] NtClose (Handle=0x31c) returned 0x0 [0070.346] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x16c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x328) returned 0x0 [0070.346] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x328 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.346] NtClose (Handle=0x328) returned 0x0 [0070.346] NtClose (Handle=0x31c) returned 0x0 [0070.346] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x170, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x328) returned 0x0 [0070.346] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x328 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.346] NtClose (Handle=0x328) returned 0x0 [0070.346] NtClose (Handle=0x31c) returned 0x0 [0070.346] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x174, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x328) returned 0x0 [0070.346] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x328 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.346] NtClose (Handle=0x328) returned 0x0 [0070.346] NtClose (Handle=0x31c) returned 0x0 [0070.347] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x178, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.347] NtClose (Handle=0x31c) returned 0x0 [0070.347] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x17c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x328) returned 0x0 [0070.347] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x328 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.347] NtClose (Handle=0x328) returned 0x0 [0070.347] NtClose (Handle=0x31c) returned 0x0 [0070.347] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x180, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.347] NtClose (Handle=0x31c) returned 0x0 [0070.347] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x184, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x328) returned 0x0 [0070.347] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x328 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.347] NtClose (Handle=0x328) returned 0x0 [0070.347] NtClose (Handle=0x31c) returned 0x0 [0070.347] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x18c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.347] NtClose (Handle=0x31c) returned 0x0 [0070.347] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x190, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x328) returned 0x0 [0070.347] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x328 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.347] NtClose (Handle=0x328) returned 0x0 [0070.347] NtClose (Handle=0x31c) returned 0x0 [0070.347] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x194, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x328) returned 0x0 [0070.347] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x328 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.347] NtClose (Handle=0x328) returned 0x0 [0070.347] NtClose (Handle=0x31c) returned 0x0 [0070.348] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x198, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x328) returned 0x0 [0070.348] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x328 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.348] NtClose (Handle=0x328) returned 0x0 [0070.348] NtClose (Handle=0x31c) returned 0x0 [0070.348] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x19c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.348] NtClose (Handle=0x31c) returned 0x0 [0070.421] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x1a4, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.421] NtClose (Handle=0x31c) returned 0x0 [0070.421] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x1a8, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.421] NtClose (Handle=0x31c) returned 0x0 [0070.421] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x1ac, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.421] NtClose (Handle=0x31c) returned 0x0 [0070.421] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x1b0, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.421] NtClose (Handle=0x31c) returned 0x0 [0070.421] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x1b4, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x328) returned 0x0 [0070.421] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x328 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.421] NtClose (Handle=0x328) returned 0x0 [0070.421] NtClose (Handle=0x31c) returned 0x0 [0070.421] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x1b8, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x328) returned 0x0 [0070.421] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x328 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.422] NtClose (Handle=0x328) returned 0x0 [0070.422] NtClose (Handle=0x31c) returned 0x0 [0070.422] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x1bc, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x328) returned 0x0 [0070.422] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x328 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.422] NtClose (Handle=0x328) returned 0x0 [0070.422] NtClose (Handle=0x31c) returned 0x0 [0070.422] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x1c0, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x328) returned 0x0 [0070.422] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x328 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.422] NtClose (Handle=0x328) returned 0x0 [0070.422] NtClose (Handle=0x31c) returned 0x0 [0070.422] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x1c4, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x328) returned 0x0 [0070.422] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x328 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.422] NtClose (Handle=0x328) returned 0x0 [0070.422] NtClose (Handle=0x31c) returned 0x0 [0070.422] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x1c8, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x328) returned 0x0 [0070.422] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x328 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.422] NtClose (Handle=0x328) returned 0x0 [0070.422] NtClose (Handle=0x31c) returned 0x0 [0070.422] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x1cc, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x328) returned 0x0 [0070.422] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x328 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.422] NtClose (Handle=0x328) returned 0x0 [0070.423] NtClose (Handle=0x31c) returned 0x0 [0070.423] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x1d0, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x328) returned 0x0 [0070.423] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x328 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.423] NtClose (Handle=0x328) returned 0x0 [0070.423] NtClose (Handle=0x31c) returned 0x0 [0070.423] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x1d4, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.423] NtClose (Handle=0x31c) returned 0x0 [0070.423] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x1d8, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.423] NtClose (Handle=0x31c) returned 0x0 [0070.423] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x1dc, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.423] NtClose (Handle=0x31c) returned 0x0 [0070.423] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x1e0, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.423] NtClose (Handle=0x31c) returned 0x0 [0070.423] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x1e4, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.423] NtClose (Handle=0x31c) returned 0x0 [0070.423] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x1e8, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.423] NtClose (Handle=0x31c) returned 0x0 [0070.423] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x1ec, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x328) returned 0x0 [0070.423] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x328 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.423] NtClose (Handle=0x328) returned 0xc0000235 [0070.423] NtClose (Handle=0x31c) returned 0x0 [0070.423] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x1f0, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.424] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.424] NtClose (Handle=0x32c) returned 0x0 [0070.424] NtClose (Handle=0x31c) returned 0x0 [0070.424] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x1f4, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.424] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.424] NtClose (Handle=0x32c) returned 0x0 [0070.424] NtClose (Handle=0x31c) returned 0x0 [0070.424] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x1f8, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.424] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.424] NtClose (Handle=0x32c) returned 0x0 [0070.424] NtClose (Handle=0x31c) returned 0x0 [0070.424] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x1fc, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.424] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.424] NtClose (Handle=0x32c) returned 0x0 [0070.424] NtClose (Handle=0x31c) returned 0x0 [0070.424] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x200, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.424] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.424] NtClose (Handle=0x32c) returned 0x0 [0070.424] NtClose (Handle=0x31c) returned 0x0 [0070.424] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x204, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.424] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.425] NtClose (Handle=0x32c) returned 0x0 [0070.425] NtClose (Handle=0x31c) returned 0x0 [0070.425] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x208, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.425] NtClose (Handle=0x31c) returned 0x0 [0070.425] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x20c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.425] NtClose (Handle=0x31c) returned 0x0 [0070.425] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x210, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.425] NtClose (Handle=0x31c) returned 0x0 [0070.425] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x214, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.425] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000020 [0070.425] NtClose (Handle=0x32c) returned 0x0 [0070.425] NtClose (Handle=0x31c) returned 0x0 [0070.425] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x218, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.425] NtClose (Handle=0x31c) returned 0x0 [0070.425] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x21c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.425] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.425] NtClose (Handle=0x32c) returned 0x0 [0070.425] NtClose (Handle=0x31c) returned 0x0 [0070.425] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x220, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.425] NtClose (Handle=0x31c) returned 0x0 [0070.425] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x224, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.425] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.425] NtClose (Handle=0x32c) returned 0x0 [0070.426] NtClose (Handle=0x31c) returned 0x0 [0070.426] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x228, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.426] NtClose (Handle=0x31c) returned 0x0 [0070.426] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x22c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.426] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.426] NtClose (Handle=0x32c) returned 0x0 [0070.426] NtClose (Handle=0x31c) returned 0x0 [0070.426] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x230, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.426] NtClose (Handle=0x31c) returned 0x0 [0070.426] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x234, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.426] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.426] NtClose (Handle=0x32c) returned 0x0 [0070.426] NtClose (Handle=0x31c) returned 0x0 [0070.426] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x238, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.426] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.426] NtClose (Handle=0x32c) returned 0x0 [0070.426] NtClose (Handle=0x31c) returned 0x0 [0070.427] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x23c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.427] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.427] NtClose (Handle=0x32c) returned 0x0 [0070.427] NtClose (Handle=0x31c) returned 0x0 [0070.427] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x240, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.427] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.427] NtClose (Handle=0x32c) returned 0x0 [0070.427] NtClose (Handle=0x31c) returned 0x0 [0070.427] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x244, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.427] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.427] NtClose (Handle=0x32c) returned 0x0 [0070.427] NtClose (Handle=0x31c) returned 0x0 [0070.427] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x248, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.427] NtClose (Handle=0x31c) returned 0x0 [0070.427] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x24c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.427] NtClose (Handle=0x31c) returned 0x0 [0070.427] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x250, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.427] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.427] NtClose (Handle=0x32c) returned 0x0 [0070.427] NtClose (Handle=0x31c) returned 0x0 [0070.427] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x254, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.427] NtClose (Handle=0x31c) returned 0x0 [0070.428] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x258, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.428] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.428] NtClose (Handle=0x32c) returned 0x0 [0070.428] NtClose (Handle=0x31c) returned 0x0 [0070.428] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x25c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.428] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.428] NtClose (Handle=0x32c) returned 0x0 [0070.428] NtClose (Handle=0x31c) returned 0x0 [0070.428] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x260, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.428] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.428] NtClose (Handle=0x32c) returned 0x0 [0070.428] NtClose (Handle=0x31c) returned 0x0 [0070.428] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x264, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.428] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.428] NtClose (Handle=0x32c) returned 0x0 [0070.428] NtClose (Handle=0x31c) returned 0x0 [0070.428] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x268, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.428] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.428] NtClose (Handle=0x32c) returned 0x0 [0070.428] NtClose (Handle=0x31c) returned 0x0 [0070.428] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x26c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.429] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.429] NtClose (Handle=0x32c) returned 0x0 [0070.429] NtClose (Handle=0x31c) returned 0x0 [0070.429] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x270, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.429] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.429] NtClose (Handle=0x32c) returned 0x0 [0070.429] NtClose (Handle=0x31c) returned 0x0 [0070.429] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x274, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.429] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.429] NtClose (Handle=0x32c) returned 0x0 [0070.429] NtClose (Handle=0x31c) returned 0x0 [0070.429] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x278, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.429] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.429] NtClose (Handle=0x32c) returned 0x0 [0070.429] NtClose (Handle=0x31c) returned 0x0 [0070.429] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x27c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.429] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.429] NtClose (Handle=0x32c) returned 0x0 [0070.429] NtClose (Handle=0x31c) returned 0x0 [0070.430] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x280, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.430] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.430] NtClose (Handle=0x32c) returned 0x0 [0070.430] NtClose (Handle=0x31c) returned 0x0 [0070.430] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x284, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.430] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.430] NtClose (Handle=0x32c) returned 0x0 [0070.430] NtClose (Handle=0x31c) returned 0x0 [0070.430] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x288, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.430] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.430] NtClose (Handle=0x32c) returned 0x0 [0070.430] NtClose (Handle=0x31c) returned 0x0 [0070.430] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x28c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.430] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.430] NtClose (Handle=0x32c) returned 0x0 [0070.430] NtClose (Handle=0x31c) returned 0x0 [0070.430] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x290, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.430] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.430] NtClose (Handle=0x32c) returned 0x0 [0070.430] NtClose (Handle=0x31c) returned 0x0 [0070.430] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x294, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.430] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.431] NtClose (Handle=0x32c) returned 0x0 [0070.431] NtClose (Handle=0x31c) returned 0x0 [0070.431] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x298, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.431] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.431] NtClose (Handle=0x32c) returned 0x0 [0070.431] NtClose (Handle=0x31c) returned 0x0 [0070.431] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x29c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.431] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.431] NtClose (Handle=0x32c) returned 0x0 [0070.431] NtClose (Handle=0x31c) returned 0x0 [0070.431] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x2a0, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.431] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.431] NtClose (Handle=0x32c) returned 0x0 [0070.431] NtClose (Handle=0x31c) returned 0x0 [0070.431] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x2a4, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.431] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.431] NtClose (Handle=0x32c) returned 0x0 [0070.431] NtClose (Handle=0x31c) returned 0x0 [0070.431] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x2a8, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.431] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.431] NtClose (Handle=0x32c) returned 0x0 [0070.432] NtClose (Handle=0x31c) returned 0x0 [0070.432] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x2ac, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.432] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.432] NtClose (Handle=0x32c) returned 0x0 [0070.432] NtClose (Handle=0x31c) returned 0x0 [0070.432] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x2b0, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.432] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.432] NtClose (Handle=0x32c) returned 0x0 [0070.432] NtClose (Handle=0x31c) returned 0x0 [0070.432] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x2b4, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.432] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.432] NtClose (Handle=0x32c) returned 0x0 [0070.432] NtClose (Handle=0x31c) returned 0x0 [0070.432] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x2b8, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x32c) returned 0x0 [0070.432] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x32c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.432] NtClose (Handle=0x32c) returned 0xc0000235 [0070.432] NtClose (Handle=0x31c) returned 0x0 [0070.432] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x2bc, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x330) returned 0x0 [0070.432] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x330 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.432] NtClose (Handle=0x330) returned 0xc0000235 [0070.432] NtClose (Handle=0x31c) returned 0x0 [0070.433] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x2c0, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x334) returned 0x0 [0070.433] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x334 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.433] NtClose (Handle=0x334) returned 0x0 [0070.433] NtClose (Handle=0x31c) returned 0x0 [0070.433] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x2c4, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x334) returned 0x0 [0070.433] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x334 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.433] NtClose (Handle=0x334) returned 0x0 [0070.433] NtClose (Handle=0x31c) returned 0x0 [0070.433] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x2c8, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x334) returned 0x0 [0070.433] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x334 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.433] NtClose (Handle=0x334) returned 0xc0000235 [0070.433] NtClose (Handle=0x31c) returned 0x0 [0070.433] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x2cc, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x338) returned 0x0 [0070.433] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x338 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.433] NtClose (Handle=0x338) returned 0xc0000235 [0070.433] NtClose (Handle=0x31c) returned 0x0 [0070.433] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x2d0, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x33c) returned 0x0 [0070.433] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x33c | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.433] NtClose (Handle=0x33c) returned 0xc0000235 [0070.433] NtClose (Handle=0x31c) returned 0x0 [0070.433] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x2d4, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x340) returned 0x0 [0070.433] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x340 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.434] NtClose (Handle=0x340) returned 0x0 [0070.434] NtClose (Handle=0x31c) returned 0x0 [0070.434] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x2d8, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x340) returned 0x0 [0070.434] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x340 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.434] NtClose (Handle=0x340) returned 0x0 [0070.434] NtClose (Handle=0x31c) returned 0x0 [0070.434] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x2dc, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x340) returned 0x0 [0070.434] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x340 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.434] NtClose (Handle=0x340) returned 0x0 [0070.434] NtClose (Handle=0x31c) returned 0x0 [0070.434] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x2e0, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x340) returned 0x0 [0070.434] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x340 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.434] NtClose (Handle=0x340) returned 0x0 [0070.434] NtClose (Handle=0x31c) returned 0x0 [0070.434] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x2e4, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x340) returned 0x0 [0070.434] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x340 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.434] NtClose (Handle=0x340) returned 0x0 [0070.434] NtClose (Handle=0x31c) returned 0x0 [0070.434] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x2e8, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x340) returned 0x0 [0070.434] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x340 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.434] NtClose (Handle=0x340) returned 0x0 [0070.435] NtClose (Handle=0x31c) returned 0x0 [0070.435] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x2ec, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x340) returned 0x0 [0070.435] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x340 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.435] NtClose (Handle=0x340) returned 0x0 [0070.435] NtClose (Handle=0x31c) returned 0x0 [0070.435] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x2f0, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x340) returned 0x0 [0070.435] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x340 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.435] NtClose (Handle=0x340) returned 0x0 [0070.435] NtClose (Handle=0x31c) returned 0x0 [0070.435] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x2f4, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x340) returned 0x0 [0070.435] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x340 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.435] NtClose (Handle=0x340) returned 0x0 [0070.435] NtClose (Handle=0x31c) returned 0x0 [0070.435] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x2f8, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.435] NtClose (Handle=0x31c) returned 0x0 [0070.435] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x2fc, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.435] NtClose (Handle=0x31c) returned 0x0 [0070.435] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x300, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x0) returned 0xc00000bb [0070.435] NtClose (Handle=0x31c) returned 0x0 [0070.435] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x304, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x340) returned 0x0 [0070.435] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x340 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.435] NtClose (Handle=0x340) returned 0xc0000235 [0070.436] NtClose (Handle=0x31c) returned 0x0 [0070.436] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x308, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x344) returned 0x0 [0070.436] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x344 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.436] NtClose (Handle=0x344) returned 0xc0000235 [0070.436] NtClose (Handle=0x31c) returned 0x0 [0070.436] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x30c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x348) returned 0x0 [0070.436] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x348 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.436] NtClose (Handle=0x348) returned 0x0 [0070.436] NtClose (Handle=0x31c) returned 0x0 [0070.436] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x310, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x348) returned 0x0 [0070.436] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x348 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.436] NtClose (Handle=0x348) returned 0x0 [0070.436] NtClose (Handle=0x31c) returned 0x0 [0070.436] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x314, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x348) returned 0x0 [0070.436] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x348 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.436] NtClose (Handle=0x348) returned 0x0 [0070.436] NtClose (Handle=0x31c) returned 0x0 [0070.436] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x318, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x348) returned 0x0 [0070.436] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x348 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.436] NtClose (Handle=0x348) returned 0x0 [0070.437] NtClose (Handle=0x31c) returned 0x0 [0070.437] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x31c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x348) returned 0x0 [0070.437] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x348 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.437] NtClose (Handle=0x348) returned 0x0 [0070.437] NtClose (Handle=0x31c) returned 0x0 [0070.437] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x320, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x348) returned 0x0 [0070.437] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x348 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.437] NtClose (Handle=0x348) returned 0x0 [0070.437] NtClose (Handle=0x31c) returned 0x0 [0070.437] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x324, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x348) returned 0x0 [0070.437] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x348 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.437] NtClose (Handle=0x348) returned 0x0 [0070.437] NtClose (Handle=0x31c) returned 0x0 [0070.437] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x328, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x348) returned 0x0 [0070.437] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x348 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.437] NtClose (Handle=0x348) returned 0x0 [0070.437] NtClose (Handle=0x31c) returned 0x0 [0070.437] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x32c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x348) returned 0x0 [0070.437] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x348 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.437] NtClose (Handle=0x348) returned 0x0 [0070.437] NtClose (Handle=0x31c) returned 0x0 [0070.438] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x330, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x348) returned 0x0 [0070.438] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x348 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.438] NtClose (Handle=0x348) returned 0x0 [0070.438] NtClose (Handle=0x31c) returned 0x0 [0070.438] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x334, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x348) returned 0x0 [0070.438] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x348 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.438] NtClose (Handle=0x348) returned 0x0 [0070.438] NtClose (Handle=0x31c) returned 0x0 [0070.438] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x338, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x348) returned 0x0 [0070.438] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x348 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.438] NtClose (Handle=0x348) returned 0x0 [0070.438] NtClose (Handle=0x31c) returned 0x0 [0070.438] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x33c, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x348) returned 0x0 [0070.438] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x348 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.438] NtClose (Handle=0x348) returned 0x0 [0070.438] NtClose (Handle=0x31c) returned 0x0 [0070.438] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x340, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x348) returned 0x0 [0070.438] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x348 | out: SectionHandle=0x363fee8*=0x0) returned 0xc0000024 [0070.438] NtClose (Handle=0x348) returned 0x0 [0070.438] NtClose (Handle=0x31c) returned 0x0 [0070.438] NtDuplicateObject (in: SourceProcessHandle=0x31c, SourceHandle=0x344, TargetProcessHandle=0xffffffff, TargetHandle=0x363ff10, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x6 | out: TargetHandle=0x363ff10*=0x348) returned 0x0 [0070.439] NtCreateSection (in: SectionHandle=0x363fee8, DesiredAccess=0x4, ObjectAttributes=0x0, MaximumSize=0x363fecc, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x348 | out: SectionHandle=0x363fee8*=0x34c) returned 0x0 [0070.439] NtMapViewOfSection (in: SectionHandle=0x34c, ProcessHandle=0xffffffff, BaseAddress=0x363feec*=0x0, ZeroBits=0x0, CommitSize=0x1, SectionOffset=0x0, ViewSize=0x363fedc*=0x0, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x363feec*=0x52d0000, SectionOffset=0x0, ViewSize=0x363fedc*=0x1000) returned 0x0 [0070.581] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x210) returned 0x38aae40 [0070.581] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x52d0000, VirtualMemoryInformationClass=0x2, VirtualMemoryInformation=0x38aae40, Length=0x210, ResultLength=0x363fed8 | out: VirtualMemoryInformation=0x38aae40*(SectionFileName.Length=0x7a, SectionFileName.MaximumLength=0x7c, SectionFileName.Buffer="\\Device\\HarddiskVolume1\\Windows\\System32\\en-US\\user32.dll.mui"), ResultLength=0x363fed8) returned 0x0 [0070.581] GetLogicalDriveStringsW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x5 [0070.581] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc) returned 0x38a89a0 [0070.581] GetLogicalDriveStringsW (in: nBufferLength=0x5, lpBuffer=0x38a89a0 | out: lpBuffer="C:\\") returned 0x4 [0070.581] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8) returned 0x38a3d90 [0070.581] wcscpy (in: _Dest=0x38a3d90, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0070.581] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20a) returned 0x38af0b8 [0070.582] QueryDosDeviceW (in: lpDeviceName="C:", lpTargetPath=0x38af0b8, ucchMax=0x104 | out: lpTargetPath="\\Device\\HarddiskVolume1") returned 0x19 [0070.582] wcscat (in: _Dest=0x38af0b8, _Source="\\" | out: _Dest="\\Device\\HarddiskVolume1\\") returned="\\Device\\HarddiskVolume1\\" [0070.582] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x38883d8 [0070.582] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38883d8) returned 1 [0070.582] NtClose (Handle=0x348) returned 0x0 [0070.582] NtClose (Handle=0x31c) returned 0x0 [0070.582] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5470048) returned 1 [0070.589] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1024) returned 0x38af0b8 [0070.589] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38af0b8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x38af0b8, ResultLength=0x0) returned 0xc0000004 [0070.589] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38af0b8, Size=0x2048) returned 0x38af0b8 [0070.589] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38af0b8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x38af0b8, ResultLength=0x0) returned 0xc0000004 [0070.589] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38af0b8, Size=0x306c) returned 0x38af0b8 [0070.589] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38af0b8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x38af0b8, ResultLength=0x0) returned 0xc0000004 [0070.590] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38af0b8, Size=0x4090) returned 0x38af0b8 [0070.590] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38af0b8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x38af0b8, ResultLength=0x0) returned 0xc0000004 [0070.590] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38af0b8, Size=0x50b4) returned 0x38af0b8 [0070.590] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38af0b8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x38af0b8, ResultLength=0x0) returned 0xc0000004 [0070.590] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38af0b8, Size=0x60d8) returned 0x38af0b8 [0070.590] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38af0b8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x38af0b8, ResultLength=0x0) returned 0xc0000004 [0070.590] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38af0b8, Size=0x70fc) returned 0x38af0b8 [0070.590] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38af0b8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x38af0b8, ResultLength=0x0) returned 0xc0000004 [0070.591] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38af0b8, Size=0x8120) returned 0x38af0b8 [0070.591] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38af0b8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x38af0b8, ResultLength=0x0) returned 0xc0000004 [0070.591] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38af0b8, Size=0x9144) returned 0x38af0b8 [0070.591] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38af0b8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x38af0b8, ResultLength=0x0) returned 0xc0000004 [0070.591] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38af0b8, Size=0xa168) returned 0x38af0b8 [0070.591] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38af0b8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x38af0b8, ResultLength=0x0) returned 0xc0000004 [0070.591] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38af0b8, Size=0xb18c) returned 0x53fe008 [0070.594] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.595] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0xc1b0) returned 0x53fe008 [0070.595] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.596] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0xd1d4) returned 0x53fe008 [0070.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.596] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0xe1f8) returned 0x53fe008 [0070.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.596] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0xf21c) returned 0x53fe008 [0070.597] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.597] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x10240) returned 0x53fe008 [0070.597] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.597] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x11264) returned 0x53fe008 [0070.597] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.598] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x12288) returned 0x53fe008 [0070.599] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.599] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x132ac) returned 0x53fe008 [0070.599] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.599] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x142d0) returned 0x53fe008 [0070.600] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.600] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x152f4) returned 0x53fe008 [0070.600] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.600] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x16318) returned 0x53fe008 [0070.601] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.601] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x1733c) returned 0x53fe008 [0070.601] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.601] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x18360) returned 0x53fe008 [0070.601] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.602] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x19384) returned 0x53fe008 [0070.602] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.602] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x1a3a8) returned 0x53fe008 [0070.602] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.603] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x1b3cc) returned 0x53fe008 [0070.603] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.603] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x1c3f0) returned 0x53fe008 [0070.603] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.604] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x1d414) returned 0x53fe008 [0070.604] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.604] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x1e438) returned 0x53fe008 [0070.604] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.605] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x1f45c) returned 0x53fe008 [0070.605] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.605] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x20480) returned 0x53fe008 [0070.605] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.606] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x214a4) returned 0x53fe008 [0070.606] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.606] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x224c8) returned 0x53fe008 [0070.606] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.606] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x234ec) returned 0x53fe008 [0070.607] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.607] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x24510) returned 0x53fe008 [0070.607] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0x0 [0070.608] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fe008) returned 1 [0070.609] NtOpenProcess (in: ProcessHandle=0x363feb0, DesiredAccess=0x400, ObjectAttributes=0x363fe90*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fea8*(UniqueProcess=0x220, UniqueThread=0x0) | out: ProcessHandle=0x363feb0*=0x31c) returned 0x0 [0070.609] NtOpenProcessToken (in: ProcessHandle=0x31c, DesiredAccess=0xf, TokenHandle=0x363feb4 | out: TokenHandle=0x363feb4*=0x348) returned 0x0 [0070.609] DuplicateTokenEx (in: hExistingToken=0x348, dwDesiredAccess=0x2000000, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0x363feac | out: phNewToken=0x363feac*=0x34c) returned 1 [0070.609] NtClose (Handle=0x348) returned 0x0 [0070.610] NtClose (Handle=0x31c) returned 0x0 [0070.610] ImpersonateLoggedOnUser (hToken=0x34c) returned 1 [0070.679] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100) returned 0x388b210 [0070.679] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1024) returned 0x38af0b8 [0070.679] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38af0b8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x38af0b8, ResultLength=0x0) returned 0xc0000004 [0070.680] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38af0b8, Size=0x2048) returned 0x38af0b8 [0070.680] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38af0b8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x38af0b8, ResultLength=0x0) returned 0xc0000004 [0070.680] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38af0b8, Size=0x306c) returned 0x38af0b8 [0070.680] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38af0b8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x38af0b8, ResultLength=0x0) returned 0xc0000004 [0070.680] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38af0b8, Size=0x4090) returned 0x38af0b8 [0070.680] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38af0b8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x38af0b8, ResultLength=0x0) returned 0xc0000004 [0070.680] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38af0b8, Size=0x50b4) returned 0x38af0b8 [0070.680] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38af0b8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x38af0b8, ResultLength=0x0) returned 0xc0000004 [0070.681] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38af0b8, Size=0x60d8) returned 0x38af0b8 [0070.681] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38af0b8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x38af0b8, ResultLength=0x0) returned 0xc0000004 [0070.681] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38af0b8, Size=0x70fc) returned 0x38af0b8 [0070.681] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38af0b8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x38af0b8, ResultLength=0x0) returned 0xc0000004 [0070.681] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38af0b8, Size=0x8120) returned 0x38af0b8 [0070.681] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38af0b8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x38af0b8, ResultLength=0x0) returned 0xc0000004 [0070.682] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38af0b8, Size=0x9144) returned 0x38af0b8 [0070.682] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38af0b8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x38af0b8, ResultLength=0x0) returned 0xc0000004 [0070.682] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38af0b8, Size=0xa168) returned 0x38af0b8 [0070.682] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38af0b8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x38af0b8, ResultLength=0x0) returned 0xc0000004 [0070.682] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38af0b8, Size=0xb18c) returned 0x53fe008 [0070.684] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.684] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0xc1b0) returned 0x53fe008 [0070.684] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.684] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0xd1d4) returned 0x53fe008 [0070.684] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.685] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0xe1f8) returned 0x53fe008 [0070.685] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.685] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0xf21c) returned 0x53fe008 [0070.685] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.685] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x10240) returned 0x53fe008 [0070.686] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.686] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x11264) returned 0x53fe008 [0070.686] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.686] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x12288) returned 0x53fe008 [0070.686] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.687] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x132ac) returned 0x53fe008 [0070.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.687] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x142d0) returned 0x53fe008 [0070.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.688] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x152f4) returned 0x53fe008 [0070.688] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.688] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x16318) returned 0x53fe008 [0070.688] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.688] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x1733c) returned 0x53fe008 [0070.689] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.689] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x18360) returned 0x53fe008 [0070.689] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.689] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x19384) returned 0x53fe008 [0070.689] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.690] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x1a3a8) returned 0x53fe008 [0070.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.690] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x1b3cc) returned 0x53fe008 [0070.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.691] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x1c3f0) returned 0x53fe008 [0070.691] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.691] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x1d414) returned 0x53fe008 [0070.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.692] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x1e438) returned 0x53fe008 [0070.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.693] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x1f45c) returned 0x53fe008 [0070.693] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.693] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x20480) returned 0x53fe008 [0070.693] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.694] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x214a4) returned 0x53fe008 [0070.694] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.694] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x224c8) returned 0x53fe008 [0070.694] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.695] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x234ec) returned 0x53fe008 [0070.695] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0xc0000004 [0070.695] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x53fe008, Size=0x24510) returned 0x53fe008 [0070.695] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x53fe008, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x53fe008, ResultLength=0x0) returned 0x0 [0070.696] NtOpenProcess (in: ProcessHandle=0x363fed0, DesiredAccess=0x400, ObjectAttributes=0x363feb0*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x363fec8*(UniqueProcess=0x7d0, UniqueThread=0x0) | out: ProcessHandle=0x363fed0*=0x31c) returned 0x0 [0070.696] NtOpenProcessToken (in: ProcessHandle=0x31c, DesiredAccess=0xf, TokenHandle=0x363fed4 | out: TokenHandle=0x363fed4*=0x348) returned 0x0 [0070.696] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100) returned 0x388b7a0 [0070.696] GetTokenInformation (in: TokenHandle=0x348, TokenInformationClass=0x1, TokenInformation=0x388b7a0, TokenInformationLength=0x100, ReturnLength=0x363fec8 | out: TokenInformation=0x388b7a0, ReturnLength=0x363fec8) returned 1 [0070.696] ConvertSidToStringSidW () returned 0x1 [0070.696] LocalFree (hMem=0x3887bc0) returned 0x0 [0070.696] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388b7a0) returned 1 [0070.696] DuplicateTokenEx (in: hExistingToken=0x348, dwDesiredAccess=0x2000000, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0x363fecc | out: phNewToken=0x363fecc*=0x350) returned 1 [0070.696] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4) returned 0x38a3d90 [0070.696] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4) returned 0x38a3da0 [0070.696] NtClose (Handle=0x348) returned 0x0 [0070.696] NtClose (Handle=0x31c) returned 0x0 [0070.696] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fe008) returned 1 [0070.696] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388b210) returned 1 [0070.696] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a3d90) returned 1 [0070.696] RevertToSelf () returned 1 [0070.696] SetErrorMode (uMode=0x8003) returned 0x0 [0070.699] GetLogicalDriveStringsW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x5 [0070.699] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc) returned 0x38a89d0 [0070.699] GetLogicalDriveStringsW (in: nBufferLength=0x5, lpBuffer=0x38a89d0 | out: lpBuffer="C:\\") returned 0x4 [0070.699] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8) returned 0x38a3d90 [0070.699] wcscpy (in: _Dest=0x38a3d90, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0070.699] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0070.699] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a3d90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x31c [0070.700] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a89d0) returned 1 [0070.700] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x36622f0, lpParameter=0x350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x348 [0070.700] Sleep (dwMilliseconds=0x3e8) [0072.115] Sleep (dwMilliseconds=0x3e8) [0073.218] Sleep (dwMilliseconds=0x3e8) [0074.251] Sleep (dwMilliseconds=0x3e8) [0075.754] Sleep (dwMilliseconds=0x3e8) [0081.281] Sleep (dwMilliseconds=0x3e8) [0088.575] Sleep (dwMilliseconds=0x3e8) Thread: id = 4 os_tid = 0xe04 Thread: id = 5 os_tid = 0xfa4 Thread: id = 21 os_tid = 0xb38 [0068.709] Sleep (dwMilliseconds=0x1) [0068.846] Sleep (dwMilliseconds=0x1) [0068.927] Sleep (dwMilliseconds=0x1) [0069.036] Sleep (dwMilliseconds=0x1) [0069.145] Sleep (dwMilliseconds=0x1) [0069.263] Sleep (dwMilliseconds=0x1) [0069.348] Sleep (dwMilliseconds=0x1) [0069.471] Sleep (dwMilliseconds=0x1) [0069.629] Sleep (dwMilliseconds=0x1) [0069.739] Sleep (dwMilliseconds=0x1) [0069.833] Sleep (dwMilliseconds=0x1) [0069.973] Sleep (dwMilliseconds=0x1) [0070.106] Sleep (dwMilliseconds=0x1) [0070.220] Sleep (dwMilliseconds=0x1) [0070.301] Sleep (dwMilliseconds=0x1) [0070.421] Sleep (dwMilliseconds=0x1) [0070.567] Sleep (dwMilliseconds=0x1) [0070.770] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x0) returned 0x102 [0070.770] WaitForSingleObject (hHandle=0x348, dwMilliseconds=0x0) returned 0x102 [0070.770] Sleep (dwMilliseconds=0x1) [0070.853] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x0) returned 0x0 [0070.853] CloseHandle (hObject=0x31c) returned 1 [0070.853] WaitForSingleObject (hHandle=0x348, dwMilliseconds=0x0) returned 0x0 [0070.853] CloseHandle (hObject=0x348) returned 1 [0070.853] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0x0) returned 0x102 [0070.853] WaitForSingleObject (hHandle=0x35c, dwMilliseconds=0x0) returned 0x102 [0070.853] WaitForSingleObject (hHandle=0x360, dwMilliseconds=0x0) returned 0x102 [0070.853] WaitForSingleObject (hHandle=0x364, dwMilliseconds=0x0) returned 0x102 [0070.853] WaitForSingleObject (hHandle=0x368, dwMilliseconds=0x0) returned 0x102 [0070.853] WaitForSingleObject (hHandle=0x36c, dwMilliseconds=0x0) returned 0x102 [0070.853] WaitForSingleObject (hHandle=0x370, dwMilliseconds=0x0) returned 0x102 [0070.853] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0x0) returned 0x102 [0070.854] WaitForSingleObject (hHandle=0x378, dwMilliseconds=0x0) returned 0x102 [0070.854] WaitForSingleObject (hHandle=0x37c, dwMilliseconds=0x0) returned 0x102 [0070.854] WaitForSingleObject (hHandle=0x380, dwMilliseconds=0x0) returned 0x102 [0070.854] WaitForSingleObject (hHandle=0x384, dwMilliseconds=0x0) returned 0x102 [0070.854] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0x0) returned 0x102 [0070.854] Sleep (dwMilliseconds=0x1) [0070.998] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x0) returned 0x102 [0070.998] WaitForSingleObject (hHandle=0x354, dwMilliseconds=0x0) returned 0x102 [0070.998] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0x0) returned 0x0 [0070.998] CloseHandle (hObject=0x358) returned 1 [0070.998] WaitForSingleObject (hHandle=0x35c, dwMilliseconds=0x0) returned 0x0 [0070.998] CloseHandle (hObject=0x35c) returned 1 [0070.998] WaitForSingleObject (hHandle=0x360, dwMilliseconds=0x0) returned 0x0 [0070.998] CloseHandle (hObject=0x360) returned 1 [0070.998] WaitForSingleObject (hHandle=0x364, dwMilliseconds=0x0) returned 0x102 [0070.998] WaitForSingleObject (hHandle=0x368, dwMilliseconds=0x0) returned 0x0 [0070.998] CloseHandle (hObject=0x368) returned 1 [0070.998] WaitForSingleObject (hHandle=0x36c, dwMilliseconds=0x0) returned 0x102 [0070.998] WaitForSingleObject (hHandle=0x370, dwMilliseconds=0x0) returned 0x102 [0070.998] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0x0) returned 0x0 [0070.998] CloseHandle (hObject=0x374) returned 1 [0070.999] WaitForSingleObject (hHandle=0x378, dwMilliseconds=0x0) returned 0x0 [0070.999] CloseHandle (hObject=0x378) returned 1 [0070.999] WaitForSingleObject (hHandle=0x37c, dwMilliseconds=0x0) returned 0x102 [0070.999] WaitForSingleObject (hHandle=0x380, dwMilliseconds=0x0) returned 0x102 [0070.999] WaitForSingleObject (hHandle=0x384, dwMilliseconds=0x0) returned 0x102 [0070.999] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0x0) returned 0x102 [0070.999] WaitForSingleObject (hHandle=0x38c, dwMilliseconds=0x0) returned 0x102 [0070.999] WaitForSingleObject (hHandle=0x390, dwMilliseconds=0x0) returned 0x102 [0070.999] WaitForSingleObject (hHandle=0x39c, dwMilliseconds=0x0) returned 0x102 [0070.999] WaitForSingleObject (hHandle=0x3a0, dwMilliseconds=0x0) returned 0x102 [0070.999] WaitForSingleObject (hHandle=0x3a4, dwMilliseconds=0x0) returned 0x102 [0070.999] WaitForSingleObject (hHandle=0x3a8, dwMilliseconds=0x0) returned 0x102 [0070.999] WaitForSingleObject (hHandle=0x3ac, dwMilliseconds=0x0) returned 0x102 [0070.999] WaitForSingleObject (hHandle=0x3b0, dwMilliseconds=0x0) returned 0x102 [0070.999] WaitForSingleObject (hHandle=0x3b4, dwMilliseconds=0x0) returned 0x102 [0070.999] WaitForSingleObject (hHandle=0x3b8, dwMilliseconds=0x0) returned 0x102 [0070.999] WaitForSingleObject (hHandle=0x3bc, dwMilliseconds=0x0) returned 0x102 [0070.999] WaitForSingleObject (hHandle=0x394, dwMilliseconds=0x0) returned 0x102 [0070.999] WaitForSingleObject (hHandle=0x3c0, dwMilliseconds=0x0) returned 0x102 [0070.999] WaitForSingleObject (hHandle=0x3c4, dwMilliseconds=0x0) returned 0x102 [0070.999] WaitForSingleObject (hHandle=0x3c8, dwMilliseconds=0x0) returned 0x102 [0070.999] WaitForSingleObject (hHandle=0x3cc, dwMilliseconds=0x0) returned 0x102 [0070.999] WaitForSingleObject (hHandle=0x3d0, dwMilliseconds=0x0) returned 0x102 [0071.000] WaitForSingleObject (hHandle=0x3d4, dwMilliseconds=0x0) returned 0x102 [0071.000] WaitForSingleObject (hHandle=0x3d8, dwMilliseconds=0x0) returned 0x102 [0071.000] WaitForSingleObject (hHandle=0x3dc, dwMilliseconds=0x0) returned 0x102 [0071.000] WaitForSingleObject (hHandle=0x3e0, dwMilliseconds=0x0) returned 0x102 [0071.000] WaitForSingleObject (hHandle=0x3e4, dwMilliseconds=0x0) returned 0x102 [0071.000] WaitForSingleObject (hHandle=0x3e8, dwMilliseconds=0x0) returned 0x102 [0071.000] WaitForSingleObject (hHandle=0x3ec, dwMilliseconds=0x0) returned 0x102 [0071.000] WaitForSingleObject (hHandle=0x3f0, dwMilliseconds=0x0) returned 0x102 [0071.000] WaitForSingleObject (hHandle=0x3f4, dwMilliseconds=0x0) returned 0x102 [0071.000] WaitForSingleObject (hHandle=0x3f8, dwMilliseconds=0x0) returned 0x102 [0071.000] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102 [0071.000] WaitForSingleObject (hHandle=0x404, dwMilliseconds=0x0) returned 0x102 [0071.000] WaitForSingleObject (hHandle=0x408, dwMilliseconds=0x0) returned 0x102 [0071.000] WaitForSingleObject (hHandle=0x40c, dwMilliseconds=0x0) returned 0x102 [0071.000] WaitForSingleObject (hHandle=0x410, dwMilliseconds=0x0) returned 0x102 [0071.000] WaitForSingleObject (hHandle=0x414, dwMilliseconds=0x0) returned 0x102 [0071.000] WaitForSingleObject (hHandle=0x418, dwMilliseconds=0x0) returned 0x102 [0071.000] WaitForSingleObject (hHandle=0x41c, dwMilliseconds=0x0) returned 0x102 [0071.000] WaitForSingleObject (hHandle=0x420, dwMilliseconds=0x0) returned 0x102 [0071.000] WaitForSingleObject (hHandle=0x424, dwMilliseconds=0x0) returned 0x102 [0071.000] WaitForSingleObject (hHandle=0x428, dwMilliseconds=0x0) returned 0x102 [0071.000] WaitForSingleObject (hHandle=0x42c, dwMilliseconds=0x0) returned 0x102 [0071.000] WaitForSingleObject (hHandle=0x430, dwMilliseconds=0x0) returned 0x102 [0071.001] WaitForSingleObject (hHandle=0x434, dwMilliseconds=0x0) returned 0x102 [0071.001] WaitForSingleObject (hHandle=0x438, dwMilliseconds=0x0) returned 0x102 [0071.001] WaitForSingleObject (hHandle=0x43c, dwMilliseconds=0x0) returned 0x102 [0071.001] WaitForSingleObject (hHandle=0x440, dwMilliseconds=0x0) returned 0x102 [0071.001] WaitForSingleObject (hHandle=0x444, dwMilliseconds=0x0) returned 0x102 [0071.001] WaitForSingleObject (hHandle=0x448, dwMilliseconds=0x0) returned 0x102 [0071.001] WaitForSingleObject (hHandle=0x44c, dwMilliseconds=0x0) returned 0x102 [0071.001] WaitForSingleObject (hHandle=0x450, dwMilliseconds=0x0) returned 0x102 [0071.001] WaitForSingleObject (hHandle=0x454, dwMilliseconds=0x0) returned 0x102 [0071.001] WaitForSingleObject (hHandle=0x458, dwMilliseconds=0x0) returned 0x102 [0071.001] WaitForSingleObject (hHandle=0x45c, dwMilliseconds=0x0) returned 0x102 [0071.001] WaitForSingleObject (hHandle=0x460, dwMilliseconds=0x0) returned 0x102 [0071.001] WaitForSingleObject (hHandle=0x464, dwMilliseconds=0x0) returned 0x102 [0071.001] WaitForSingleObject (hHandle=0x468, dwMilliseconds=0x0) returned 0x102 [0071.001] WaitForSingleObject (hHandle=0x46c, dwMilliseconds=0x0) returned 0x102 [0071.001] WaitForSingleObject (hHandle=0x470, dwMilliseconds=0x0) returned 0x102 [0071.001] WaitForSingleObject (hHandle=0x474, dwMilliseconds=0x0) returned 0x102 [0071.001] WaitForSingleObject (hHandle=0x478, dwMilliseconds=0x0) returned 0x102 [0071.001] Sleep (dwMilliseconds=0x1) [0071.379] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x0) returned 0x102 [0071.379] WaitForSingleObject (hHandle=0x354, dwMilliseconds=0x0) returned 0x102 [0071.379] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0x0) returned 0x0 [0071.379] CloseHandle (hObject=0x374) returned 1 [0071.379] WaitForSingleObject (hHandle=0x368, dwMilliseconds=0x0) returned 0x0 [0071.379] CloseHandle (hObject=0x368) returned 1 [0071.379] WaitForSingleObject (hHandle=0x360, dwMilliseconds=0x0) returned 0x0 [0071.379] CloseHandle (hObject=0x360) returned 1 [0071.379] WaitForSingleObject (hHandle=0x364, dwMilliseconds=0x0) returned 0x102 [0071.379] WaitForSingleObject (hHandle=0x35c, dwMilliseconds=0x0) returned 0x0 [0071.379] CloseHandle (hObject=0x35c) returned 1 [0071.379] WaitForSingleObject (hHandle=0x36c, dwMilliseconds=0x0) returned 0x0 [0071.379] CloseHandle (hObject=0x36c) returned 1 [0071.379] WaitForSingleObject (hHandle=0x370, dwMilliseconds=0x0) returned 0x102 [0071.379] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0x0) returned 0x0 [0071.380] CloseHandle (hObject=0x358) returned 1 [0071.380] WaitForSingleObject (hHandle=0x398, dwMilliseconds=0x0) returned 0x102 [0071.380] WaitForSingleObject (hHandle=0x37c, dwMilliseconds=0x0) returned 0x0 [0071.380] CloseHandle (hObject=0x37c) returned 1 [0071.380] WaitForSingleObject (hHandle=0x380, dwMilliseconds=0x0) returned 0x102 [0071.380] WaitForSingleObject (hHandle=0x384, dwMilliseconds=0x0) returned 0x0 [0071.380] CloseHandle (hObject=0x384) returned 1 [0071.380] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0x0) returned 0x102 [0071.380] WaitForSingleObject (hHandle=0x38c, dwMilliseconds=0x0) returned 0x0 [0071.380] CloseHandle (hObject=0x38c) returned 1 [0071.380] WaitForSingleObject (hHandle=0x390, dwMilliseconds=0x0) returned 0x102 [0071.380] WaitForSingleObject (hHandle=0x39c, dwMilliseconds=0x0) returned 0x102 [0071.380] WaitForSingleObject (hHandle=0x3a0, dwMilliseconds=0x0) returned 0x102 [0071.380] WaitForSingleObject (hHandle=0x3a4, dwMilliseconds=0x0) returned 0x102 [0071.380] WaitForSingleObject (hHandle=0x3a8, dwMilliseconds=0x0) returned 0x102 [0071.380] WaitForSingleObject (hHandle=0x3ac, dwMilliseconds=0x0) returned 0x102 [0071.380] WaitForSingleObject (hHandle=0x3b0, dwMilliseconds=0x0) returned 0x102 [0071.380] WaitForSingleObject (hHandle=0x3b4, dwMilliseconds=0x0) returned 0x102 [0071.380] WaitForSingleObject (hHandle=0x3b8, dwMilliseconds=0x0) returned 0x0 [0071.380] CloseHandle (hObject=0x3b8) returned 1 [0071.380] WaitForSingleObject (hHandle=0x3bc, dwMilliseconds=0x0) returned 0x102 [0071.380] WaitForSingleObject (hHandle=0x394, dwMilliseconds=0x0) returned 0x102 [0071.381] WaitForSingleObject (hHandle=0x3c0, dwMilliseconds=0x0) returned 0x102 [0071.381] WaitForSingleObject (hHandle=0x3c4, dwMilliseconds=0x0) returned 0x0 [0071.381] CloseHandle (hObject=0x3c4) returned 1 [0071.381] WaitForSingleObject (hHandle=0x3c8, dwMilliseconds=0x0) returned 0x102 [0071.381] WaitForSingleObject (hHandle=0x3cc, dwMilliseconds=0x0) returned 0x102 [0071.381] WaitForSingleObject (hHandle=0x3d0, dwMilliseconds=0x0) returned 0x102 [0071.381] WaitForSingleObject (hHandle=0x3d4, dwMilliseconds=0x0) returned 0x102 [0071.381] WaitForSingleObject (hHandle=0x3d8, dwMilliseconds=0x0) returned 0x102 [0071.381] WaitForSingleObject (hHandle=0x3dc, dwMilliseconds=0x0) returned 0x102 [0071.381] WaitForSingleObject (hHandle=0x3e0, dwMilliseconds=0x0) returned 0x102 [0071.381] WaitForSingleObject (hHandle=0x3e4, dwMilliseconds=0x0) returned 0x0 [0071.381] CloseHandle (hObject=0x3e4) returned 1 [0071.381] WaitForSingleObject (hHandle=0x3e8, dwMilliseconds=0x0) returned 0x102 [0071.381] WaitForSingleObject (hHandle=0x3ec, dwMilliseconds=0x0) returned 0x102 [0071.381] WaitForSingleObject (hHandle=0x3f0, dwMilliseconds=0x0) returned 0x102 [0071.381] WaitForSingleObject (hHandle=0x3f4, dwMilliseconds=0x0) returned 0x102 [0071.381] WaitForSingleObject (hHandle=0x3f8, dwMilliseconds=0x0) returned 0x102 [0071.381] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102 [0071.381] WaitForSingleObject (hHandle=0x404, dwMilliseconds=0x0) returned 0x102 [0071.382] WaitForSingleObject (hHandle=0x408, dwMilliseconds=0x0) returned 0x102 [0071.382] WaitForSingleObject (hHandle=0x40c, dwMilliseconds=0x0) returned 0x102 [0071.382] WaitForSingleObject (hHandle=0x410, dwMilliseconds=0x0) returned 0x102 [0071.382] WaitForSingleObject (hHandle=0x414, dwMilliseconds=0x0) returned 0x102 [0071.382] WaitForSingleObject (hHandle=0x418, dwMilliseconds=0x0) returned 0x102 [0071.382] WaitForSingleObject (hHandle=0x41c, dwMilliseconds=0x0) returned 0x102 [0071.382] WaitForSingleObject (hHandle=0x420, dwMilliseconds=0x0) returned 0x102 [0071.382] WaitForSingleObject (hHandle=0x424, dwMilliseconds=0x0) returned 0x102 [0071.382] WaitForSingleObject (hHandle=0x428, dwMilliseconds=0x0) returned 0x102 [0071.382] WaitForSingleObject (hHandle=0x42c, dwMilliseconds=0x0) returned 0x102 [0071.382] WaitForSingleObject (hHandle=0x430, dwMilliseconds=0x0) returned 0x102 [0071.382] WaitForSingleObject (hHandle=0x434, dwMilliseconds=0x0) returned 0x102 [0071.382] WaitForSingleObject (hHandle=0x438, dwMilliseconds=0x0) returned 0x102 [0071.382] WaitForSingleObject (hHandle=0x43c, dwMilliseconds=0x0) returned 0x102 [0071.382] WaitForSingleObject (hHandle=0x440, dwMilliseconds=0x0) returned 0x102 [0071.382] WaitForSingleObject (hHandle=0x444, dwMilliseconds=0x0) returned 0x102 [0071.382] WaitForSingleObject (hHandle=0x448, dwMilliseconds=0x0) returned 0x102 [0071.382] WaitForSingleObject (hHandle=0x44c, dwMilliseconds=0x0) returned 0x102 [0071.382] WaitForSingleObject (hHandle=0x450, dwMilliseconds=0x0) returned 0x102 [0071.383] WaitForSingleObject (hHandle=0x454, dwMilliseconds=0x0) returned 0x102 [0071.383] WaitForSingleObject (hHandle=0x458, dwMilliseconds=0x0) returned 0x102 [0071.383] WaitForSingleObject (hHandle=0x45c, dwMilliseconds=0x0) returned 0x102 [0071.383] WaitForSingleObject (hHandle=0x460, dwMilliseconds=0x0) returned 0x102 [0071.383] WaitForSingleObject (hHandle=0x464, dwMilliseconds=0x0) returned 0x102 [0071.383] WaitForSingleObject (hHandle=0x468, dwMilliseconds=0x0) returned 0x102 [0071.383] WaitForSingleObject (hHandle=0x46c, dwMilliseconds=0x0) returned 0x102 [0071.383] WaitForSingleObject (hHandle=0x470, dwMilliseconds=0x0) returned 0x102 [0071.383] WaitForSingleObject (hHandle=0x474, dwMilliseconds=0x0) returned 0x102 [0071.383] WaitForSingleObject (hHandle=0x478, dwMilliseconds=0x0) returned 0x102 [0071.383] WaitForSingleObject (hHandle=0x47c, dwMilliseconds=0x0) returned 0x0 [0071.383] CloseHandle (hObject=0x47c) returned 1 [0071.383] WaitForSingleObject (hHandle=0x480, dwMilliseconds=0x0) returned 0x0 [0071.383] CloseHandle (hObject=0x480) returned 1 [0071.383] WaitForSingleObject (hHandle=0x484, dwMilliseconds=0x0) returned 0x0 [0071.383] CloseHandle (hObject=0x484) returned 1 [0071.383] WaitForSingleObject (hHandle=0x488, dwMilliseconds=0x0) returned 0x0 [0071.383] CloseHandle (hObject=0x488) returned 1 [0071.383] WaitForSingleObject (hHandle=0x48c, dwMilliseconds=0x0) returned 0x0 [0071.383] CloseHandle (hObject=0x48c) returned 1 [0071.383] WaitForSingleObject (hHandle=0x490, dwMilliseconds=0x0) returned 0x0 [0071.383] CloseHandle (hObject=0x490) returned 1 [0071.383] WaitForSingleObject (hHandle=0x494, dwMilliseconds=0x0) returned 0x0 [0071.384] CloseHandle (hObject=0x494) returned 1 [0071.384] WaitForSingleObject (hHandle=0x498, dwMilliseconds=0x0) returned 0x0 [0071.384] CloseHandle (hObject=0x498) returned 1 [0071.384] WaitForSingleObject (hHandle=0x49c, dwMilliseconds=0x0) returned 0x0 [0071.384] CloseHandle (hObject=0x49c) returned 1 [0071.384] WaitForSingleObject (hHandle=0x4a0, dwMilliseconds=0x0) returned 0x102 [0071.384] WaitForSingleObject (hHandle=0x4a4, dwMilliseconds=0x0) returned 0x0 [0071.384] CloseHandle (hObject=0x4a4) returned 1 [0071.384] WaitForSingleObject (hHandle=0x4a8, dwMilliseconds=0x0) returned 0x102 [0071.384] WaitForSingleObject (hHandle=0x4ac, dwMilliseconds=0x0) returned 0x102 [0071.384] WaitForSingleObject (hHandle=0x4b0, dwMilliseconds=0x0) returned 0x102 [0071.384] WaitForSingleObject (hHandle=0x4b4, dwMilliseconds=0x0) returned 0x102 [0071.384] WaitForSingleObject (hHandle=0x4b8, dwMilliseconds=0x0) returned 0x102 [0071.384] WaitForSingleObject (hHandle=0x4bc, dwMilliseconds=0x0) returned 0x102 [0071.384] WaitForSingleObject (hHandle=0x4c0, dwMilliseconds=0x0) returned 0x102 [0071.384] WaitForSingleObject (hHandle=0x4c4, dwMilliseconds=0x0) returned 0x102 [0071.384] WaitForSingleObject (hHandle=0x4c8, dwMilliseconds=0x0) returned 0x102 [0071.384] WaitForSingleObject (hHandle=0x4cc, dwMilliseconds=0x0) returned 0x102 [0071.384] WaitForSingleObject (hHandle=0x4d0, dwMilliseconds=0x0) returned 0x102 [0071.384] WaitForSingleObject (hHandle=0x4d4, dwMilliseconds=0x0) returned 0x102 [0071.384] WaitForSingleObject (hHandle=0x4d8, dwMilliseconds=0x0) returned 0x102 [0071.384] WaitForSingleObject (hHandle=0x4dc, dwMilliseconds=0x0) returned 0x102 [0071.384] WaitForSingleObject (hHandle=0x4e0, dwMilliseconds=0x0) returned 0x102 [0071.385] WaitForSingleObject (hHandle=0x4e4, dwMilliseconds=0x0) returned 0x102 [0071.385] WaitForSingleObject (hHandle=0x4e8, dwMilliseconds=0x0) returned 0x102 [0071.385] WaitForSingleObject (hHandle=0x4ec, dwMilliseconds=0x0) returned 0x102 [0071.385] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0x0) returned 0x102 [0071.385] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0x0) returned 0x102 [0071.385] WaitForSingleObject (hHandle=0x4f8, dwMilliseconds=0x0) returned 0x102 [0071.385] WaitForSingleObject (hHandle=0x4fc, dwMilliseconds=0x0) returned 0x102 [0071.385] WaitForSingleObject (hHandle=0x500, dwMilliseconds=0x0) returned 0x102 [0071.385] WaitForSingleObject (hHandle=0x504, dwMilliseconds=0x0) returned 0x102 [0071.385] WaitForSingleObject (hHandle=0x508, dwMilliseconds=0x0) returned 0x102 [0071.385] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0x0) returned 0x102 [0071.385] WaitForSingleObject (hHandle=0x510, dwMilliseconds=0x0) returned 0x102 [0071.385] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0x0) returned 0x102 [0071.385] WaitForSingleObject (hHandle=0x518, dwMilliseconds=0x0) returned 0x102 [0071.385] WaitForSingleObject (hHandle=0x51c, dwMilliseconds=0x0) returned 0x102 [0071.385] WaitForSingleObject (hHandle=0x520, dwMilliseconds=0x0) returned 0x102 [0071.385] WaitForSingleObject (hHandle=0x524, dwMilliseconds=0x0) returned 0x102 [0071.385] WaitForSingleObject (hHandle=0x528, dwMilliseconds=0x0) returned 0x102 [0071.385] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0x0) returned 0x102 [0071.385] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0x0) returned 0x102 [0071.385] WaitForSingleObject (hHandle=0x578, dwMilliseconds=0x0) returned 0x102 [0071.385] WaitForSingleObject (hHandle=0x57c, dwMilliseconds=0x0) returned 0x102 [0071.385] WaitForSingleObject (hHandle=0x580, dwMilliseconds=0x0) returned 0x102 [0071.386] WaitForSingleObject (hHandle=0x538, dwMilliseconds=0x0) returned 0x102 [0071.386] WaitForSingleObject (hHandle=0x584, dwMilliseconds=0x0) returned 0x102 [0071.386] WaitForSingleObject (hHandle=0x588, dwMilliseconds=0x0) returned 0x102 [0071.386] WaitForSingleObject (hHandle=0x58c, dwMilliseconds=0x0) returned 0x102 [0071.386] WaitForSingleObject (hHandle=0x590, dwMilliseconds=0x0) returned 0x102 [0071.386] WaitForSingleObject (hHandle=0x594, dwMilliseconds=0x0) returned 0x102 [0071.386] WaitForSingleObject (hHandle=0x598, dwMilliseconds=0x0) returned 0x102 [0071.386] WaitForSingleObject (hHandle=0x59c, dwMilliseconds=0x0) returned 0x102 [0071.386] WaitForSingleObject (hHandle=0x5a0, dwMilliseconds=0x0) returned 0x102 [0071.386] WaitForSingleObject (hHandle=0x5a4, dwMilliseconds=0x0) returned 0x102 [0071.386] WaitForSingleObject (hHandle=0x5a8, dwMilliseconds=0x0) returned 0x102 [0071.386] WaitForSingleObject (hHandle=0x5ac, dwMilliseconds=0x0) returned 0x102 [0071.386] WaitForSingleObject (hHandle=0x5b0, dwMilliseconds=0x0) returned 0x102 [0071.386] WaitForSingleObject (hHandle=0x5b4, dwMilliseconds=0x0) returned 0x102 [0071.386] WaitForSingleObject (hHandle=0x5b8, dwMilliseconds=0x0) returned 0x102 [0071.386] WaitForSingleObject (hHandle=0x5bc, dwMilliseconds=0x0) returned 0x102 [0071.386] WaitForSingleObject (hHandle=0x574, dwMilliseconds=0x0) returned 0x102 [0071.386] WaitForSingleObject (hHandle=0x5c0, dwMilliseconds=0x0) returned 0x102 [0071.386] WaitForSingleObject (hHandle=0x5c4, dwMilliseconds=0x0) returned 0x102 [0071.386] WaitForSingleObject (hHandle=0x5c8, dwMilliseconds=0x0) returned 0x102 [0071.386] WaitForSingleObject (hHandle=0x564, dwMilliseconds=0x0) returned 0x102 [0071.386] WaitForSingleObject (hHandle=0x56c, dwMilliseconds=0x0) returned 0x102 [0071.386] WaitForSingleObject (hHandle=0x568, dwMilliseconds=0x0) returned 0x102 [0071.387] WaitForSingleObject (hHandle=0x5cc, dwMilliseconds=0x0) returned 0x102 [0071.387] WaitForSingleObject (hHandle=0x5d0, dwMilliseconds=0x0) returned 0x102 [0071.387] WaitForSingleObject (hHandle=0x5d4, dwMilliseconds=0x0) returned 0x102 [0071.387] WaitForSingleObject (hHandle=0x5d8, dwMilliseconds=0x0) returned 0x102 [0071.387] WaitForSingleObject (hHandle=0x5dc, dwMilliseconds=0x0) returned 0x102 [0071.387] WaitForSingleObject (hHandle=0x5e0, dwMilliseconds=0x0) returned 0x102 [0071.387] WaitForSingleObject (hHandle=0x5e4, dwMilliseconds=0x0) returned 0x102 [0071.387] WaitForSingleObject (hHandle=0x5e8, dwMilliseconds=0x0) returned 0x102 [0071.387] WaitForSingleObject (hHandle=0x5ec, dwMilliseconds=0x0) returned 0x102 [0071.387] WaitForSingleObject (hHandle=0x5f0, dwMilliseconds=0x0) returned 0x102 [0071.387] WaitForSingleObject (hHandle=0x5f4, dwMilliseconds=0x0) returned 0x102 [0071.387] WaitForSingleObject (hHandle=0x5f8, dwMilliseconds=0x0) returned 0x102 [0071.387] WaitForSingleObject (hHandle=0x5fc, dwMilliseconds=0x0) returned 0x102 [0071.387] WaitForSingleObject (hHandle=0x600, dwMilliseconds=0x0) returned 0x102 [0071.387] Sleep (dwMilliseconds=0x1) [0071.410] Sleep (dwMilliseconds=0x1) [0071.428] Sleep (dwMilliseconds=0x1) [0071.442] Sleep (dwMilliseconds=0x1) [0071.462] Sleep (dwMilliseconds=0x1) [0071.474] Sleep (dwMilliseconds=0x1) [0071.516] Sleep (dwMilliseconds=0x1) [0071.521] Sleep (dwMilliseconds=0x1) [0071.537] Sleep (dwMilliseconds=0x1) [0071.554] Sleep (dwMilliseconds=0x1) [0071.567] Sleep (dwMilliseconds=0x1) [0071.583] Sleep (dwMilliseconds=0x1) [0071.598] Sleep (dwMilliseconds=0x1) [0071.615] Sleep (dwMilliseconds=0x1) [0071.632] Sleep (dwMilliseconds=0x1) [0072.094] Sleep (dwMilliseconds=0x1) [0072.502] Sleep (dwMilliseconds=0x1) [0072.805] Sleep (dwMilliseconds=0x1) [0072.867] Sleep (dwMilliseconds=0x1) [0072.915] Sleep (dwMilliseconds=0x1) [0072.958] Sleep (dwMilliseconds=0x1) [0073.021] Sleep (dwMilliseconds=0x1) [0073.068] Sleep (dwMilliseconds=0x1) [0073.217] Sleep (dwMilliseconds=0x1) [0073.255] Sleep (dwMilliseconds=0x1) [0073.302] Sleep (dwMilliseconds=0x1) [0073.349] Sleep (dwMilliseconds=0x1) [0073.421] Sleep (dwMilliseconds=0x1) [0073.459] Sleep (dwMilliseconds=0x1) [0073.527] Sleep (dwMilliseconds=0x1) [0073.568] Sleep (dwMilliseconds=0x1) [0073.604] Sleep (dwMilliseconds=0x1) [0073.782] Sleep (dwMilliseconds=0x1) [0073.853] Sleep (dwMilliseconds=0x1) [0073.889] Sleep (dwMilliseconds=0x1) [0073.930] Sleep (dwMilliseconds=0x1) [0073.993] Sleep (dwMilliseconds=0x1) [0074.045] Sleep (dwMilliseconds=0x1) [0074.112] Sleep (dwMilliseconds=0x1) [0074.150] Sleep (dwMilliseconds=0x1) [0074.196] Sleep (dwMilliseconds=0x1) [0074.251] Sleep (dwMilliseconds=0x1) [0074.399] Sleep (dwMilliseconds=0x1) [0074.462] Sleep (dwMilliseconds=0x1) [0074.508] Sleep (dwMilliseconds=0x1) [0076.052] Sleep (dwMilliseconds=0x1) [0080.466] Sleep (dwMilliseconds=0x1) [0080.474] Sleep (dwMilliseconds=0x1) [0080.517] Sleep (dwMilliseconds=0x1) [0080.522] Sleep (dwMilliseconds=0x1) [0080.535] Sleep (dwMilliseconds=0x1) [0080.551] Sleep (dwMilliseconds=0x1) [0080.569] Sleep (dwMilliseconds=0x1) [0080.592] Sleep (dwMilliseconds=0x1) [0080.598] Sleep (dwMilliseconds=0x1) [0080.617] Sleep (dwMilliseconds=0x1) [0080.634] Sleep (dwMilliseconds=0x1) [0080.651] Sleep (dwMilliseconds=0x1) [0083.517] Sleep (dwMilliseconds=0x1) [0088.571] Sleep (dwMilliseconds=0x1) [0088.579] Sleep (dwMilliseconds=0x1) [0088.593] Sleep (dwMilliseconds=0x1) [0088.618] Sleep (dwMilliseconds=0x1) [0088.635] Sleep (dwMilliseconds=0x1) [0088.640] Sleep (dwMilliseconds=0x1) [0088.662] Sleep (dwMilliseconds=0x1) [0088.672] Sleep (dwMilliseconds=0x1) [0088.743] Sleep (dwMilliseconds=0x1) [0088.760] Sleep (dwMilliseconds=0x1) [0088.776] Sleep (dwMilliseconds=0x1) [0088.786] Sleep (dwMilliseconds=0x1) [0088.797] Sleep (dwMilliseconds=0x1) [0088.813] Sleep (dwMilliseconds=0x1) [0088.830] Sleep (dwMilliseconds=0x1) [0088.846] Sleep (dwMilliseconds=0x1) [0088.864] Sleep (dwMilliseconds=0x1) [0088.878] Sleep (dwMilliseconds=0x1) [0088.891] Sleep (dwMilliseconds=0x1) [0088.906] Sleep (dwMilliseconds=0x1) [0088.921] Sleep (dwMilliseconds=0x1) [0088.938] Sleep (dwMilliseconds=0x1) [0088.954] Sleep (dwMilliseconds=0x1) [0088.969] Sleep (dwMilliseconds=0x1) [0088.984] Sleep (dwMilliseconds=0x1) [0089.000] Sleep (dwMilliseconds=0x1) [0091.180] Sleep (dwMilliseconds=0x1) Thread: id = 22 os_tid = 0xeac [0068.710] Sleep (dwMilliseconds=0x1) [0068.846] Sleep (dwMilliseconds=0x1) [0068.927] Sleep (dwMilliseconds=0x1) [0069.036] Sleep (dwMilliseconds=0x1) [0069.145] Sleep (dwMilliseconds=0x1) [0069.263] Sleep (dwMilliseconds=0x1) [0069.348] Sleep (dwMilliseconds=0x1) [0069.471] Sleep (dwMilliseconds=0x1) [0069.629] Sleep (dwMilliseconds=0x1) [0069.739] Sleep (dwMilliseconds=0x1) [0069.832] Sleep (dwMilliseconds=0x1) [0069.973] Sleep (dwMilliseconds=0x1) [0070.106] Sleep (dwMilliseconds=0x1) [0070.220] Sleep (dwMilliseconds=0x1) [0070.301] Sleep (dwMilliseconds=0x1) [0070.421] Sleep (dwMilliseconds=0x1) [0070.567] Sleep (dwMilliseconds=0x1) [0070.771] Sleep (dwMilliseconds=0x1) [0070.853] Sleep (dwMilliseconds=0x1) [0071.001] Sleep (dwMilliseconds=0x1) [0071.224] Sleep (dwMilliseconds=0x1) [0071.615] Sleep (dwMilliseconds=0x1) [0072.094] Sleep (dwMilliseconds=0x1) [0072.502] Sleep (dwMilliseconds=0x1) [0072.805] Sleep (dwMilliseconds=0x1) [0072.869] Sleep (dwMilliseconds=0x1) [0072.914] Sleep (dwMilliseconds=0x1) [0072.958] Sleep (dwMilliseconds=0x1) [0073.021] Sleep (dwMilliseconds=0x1) [0073.068] Sleep (dwMilliseconds=0x1) [0073.217] Sleep (dwMilliseconds=0x1) [0073.255] Sleep (dwMilliseconds=0x1) [0073.302] Sleep (dwMilliseconds=0x1) [0073.349] Sleep (dwMilliseconds=0x1) [0073.420] Sleep (dwMilliseconds=0x1) [0073.459] Sleep (dwMilliseconds=0x1) [0073.527] Sleep (dwMilliseconds=0x1) [0073.569] Sleep (dwMilliseconds=0x1) [0073.604] Sleep (dwMilliseconds=0x1) [0073.782] Sleep (dwMilliseconds=0x1) [0073.853] Sleep (dwMilliseconds=0x1) [0073.889] Sleep (dwMilliseconds=0x1) [0073.930] Sleep (dwMilliseconds=0x1) [0073.993] Sleep (dwMilliseconds=0x1) [0074.044] Sleep (dwMilliseconds=0x1) [0074.112] Sleep (dwMilliseconds=0x1) [0074.150] Sleep (dwMilliseconds=0x1) [0074.196] Sleep (dwMilliseconds=0x1) [0074.251] Sleep (dwMilliseconds=0x1) [0074.399] Sleep (dwMilliseconds=0x1) [0074.462] Sleep (dwMilliseconds=0x1) [0074.508] Sleep (dwMilliseconds=0x1) [0074.946] Sleep (dwMilliseconds=0x1) [0075.395] Sleep (dwMilliseconds=0x1) [0076.089] Sleep (dwMilliseconds=0x1) [0080.445] Sleep (dwMilliseconds=0x1) [0082.903] Sleep (dwMilliseconds=0x1) [0087.611] Sleep (dwMilliseconds=0x1) [0089.519] Sleep (dwMilliseconds=0x1) [0092.137] Sleep (dwMilliseconds=0x1) Thread: id = 23 os_tid = 0xfc0 [0070.795] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc) returned 0x5470108 [0070.795] wcscpy (in: _Dest=0x5470108, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0070.795] wcscat (in: _Dest=0x5470108, _Source="*" | out: _Dest="C:\\*") returned="C:\\*" [0070.795] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5470b20 [0070.795] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x389f300 [0070.795] wcscmp (_String1="$GetCurrent", _String2=".") returned -1 [0070.795] wcscmp (_String1="$GetCurrent", _String2="..") returned -1 [0070.795] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5238 [0070.795] wcscpy (in: _Dest=0x38a5238, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0070.795] wcscat (in: _Dest=0x38a5238, _Source="$GetCurrent" | out: _Dest="C:\\$GetCurrent") returned="C:\\$GetCurrent" [0070.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a5238, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x358 [0070.796] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0070.796] wcscmp (_String1="$Recycle.Bin", _String2=".") returned -1 [0070.796] wcscmp (_String1="$Recycle.Bin", _String2="..") returned -1 [0070.796] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x22) returned 0x38a6be0 [0070.796] wcscpy (in: _Dest=0x38a6be0, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0070.796] wcscat (in: _Dest=0x38a6be0, _Source="$Recycle.Bin" | out: _Dest="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0070.796] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a6be0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x35c [0070.797] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0070.797] wcscmp (_String1="$WINRE_BACKUP_PARTITION.MARKER", _String2=".") returned -1 [0070.797] wcscmp (_String1="$WINRE_BACKUP_PARTITION.MARKER", _String2="..") returned -1 [0070.797] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x46) returned 0x3892b10 [0070.797] wcscpy (in: _Dest=0x3892b10, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0070.797] wcscat (in: _Dest=0x3892b10, _Source="$WINRE_BACKUP_PARTITION.MARKER" | out: _Dest="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned="C:\\$WINRE_BACKUP_PARTITION.MARKER" [0070.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3892b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x360 [0070.798] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0070.798] wcscmp (_String1="588bce7c90097ed212", _String2=".") returned 1 [0070.798] wcscmp (_String1="588bce7c90097ed212", _String2="..") returned 1 [0070.798] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2e) returned 0x38a9fd0 [0070.798] wcscpy (in: _Dest=0x38a9fd0, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0070.798] wcscat (in: _Dest=0x38a9fd0, _Source="588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a9fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x364 [0070.799] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0070.799] wcscmp (_String1="Boot", _String2=".") returned 1 [0070.799] wcscmp (_String1="Boot", _String2="..") returned 1 [0070.799] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12) returned 0x38a7e60 [0070.799] wcscpy (in: _Dest=0x38a7e60, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0070.799] wcscat (in: _Dest=0x38a7e60, _Source="Boot" | out: _Dest="C:\\Boot") returned="C:\\Boot" [0070.799] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a7e60) returned 1 [0070.799] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0070.799] wcscmp (_String1="bootmgr", _String2=".") returned 1 [0070.799] wcscmp (_String1="bootmgr", _String2="..") returned 1 [0070.799] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef9d0a0c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0070.799] wcscmp (_String1="BOOTNXT", _String2=".") returned 1 [0070.799] wcscmp (_String1="BOOTNXT", _String2="..") returned 1 [0070.799] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xc4ee267e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4ee267e, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1c63cdd, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0070.799] wcscmp (_String1="BOOTSECT.BAK", _String2=".") returned 1 [0070.799] wcscmp (_String1="BOOTSECT.BAK", _String2="..") returned 1 [0070.799] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0070.799] wcscmp (_String1="Documents and Settings", _String2=".") returned 1 [0070.799] wcscmp (_String1="Documents and Settings", _String2="..") returned 1 [0070.799] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389f380 [0070.799] wcscpy (in: _Dest=0x389f380, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0070.799] wcscat (in: _Dest=0x389f380, _Source="Documents and Settings" | out: _Dest="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0070.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389f380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x368 [0070.800] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1 [0070.800] wcscmp (_String1="ESD", _String2=".") returned 1 [0070.800] wcscmp (_String1="ESD", _String2="..") returned 1 [0070.800] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10) returned 0x54700c0 [0070.800] wcscpy (in: _Dest=0x54700c0, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0070.800] wcscat (in: _Dest=0x54700c0, _Source="ESD" | out: _Dest="C:\\ESD") returned="C:\\ESD" [0070.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54700c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x36c [0070.801] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x174ff10, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0070.801] wcscmp (_String1="hiberfil.sys", _String2=".") returned 1 [0070.801] wcscmp (_String1="hiberfil.sys", _String2="..") returned 1 [0070.801] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0070.801] wcscmp (_String1="Logs", _String2=".") returned 1 [0070.801] wcscmp (_String1="Logs", _String2="..") returned 1 [0070.801] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12) returned 0x38a8160 [0070.801] wcscpy (in: _Dest=0x38a8160, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0070.801] wcscat (in: _Dest=0x38a8160, _Source="Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0070.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a8160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x370 [0070.802] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x21ffac8, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0070.802] wcscmp (_String1="pagefile.sys", _String2=".") returned 1 [0070.802] wcscmp (_String1="pagefile.sys", _String2="..") returned 1 [0070.802] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0070.802] wcscmp (_String1="PerfLogs", _String2=".") returned 1 [0070.802] wcscmp (_String1="PerfLogs", _String2="..") returned 1 [0070.802] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1a) returned 0x38a50d0 [0070.802] wcscpy (in: _Dest=0x38a50d0, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0070.802] wcscat (in: _Dest=0x38a50d0, _Source="PerfLogs" | out: _Dest="C:\\PerfLogs") returned="C:\\PerfLogs" [0070.802] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a50d0) returned 1 [0070.802] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x413f1d3b, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x413f1d3b, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0070.802] wcscmp (_String1="Program Files", _String2=".") returned 1 [0070.802] wcscmp (_String1="Program Files", _String2="..") returned 1 [0070.802] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x24) returned 0x38a6790 [0070.802] wcscpy (in: _Dest=0x38a6790, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0070.802] wcscat (in: _Dest=0x38a6790, _Source="Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0070.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a6790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x374 [0070.803] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0070.803] wcscmp (_String1="Program Files (x86)", _String2=".") returned 1 [0070.803] wcscmp (_String1="Program Files (x86)", _String2="..") returned 1 [0070.803] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x30) returned 0x38a9c88 [0070.803] wcscpy (in: _Dest=0x38a9c88, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0070.803] wcscat (in: _Dest=0x38a9c88, _Source="Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0070.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a9c88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x378 [0070.804] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0070.804] wcscmp (_String1="ProgramData", _String2=".") returned 1 [0070.804] wcscmp (_String1="ProgramData", _String2="..") returned 1 [0070.804] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4f68 [0070.804] wcscpy (in: _Dest=0x38a4f68, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0070.804] wcscat (in: _Dest=0x38a4f68, _Source="ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0070.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a4f68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c [0070.804] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0070.804] wcscmp (_String1="Recovery", _String2=".") returned 1 [0070.804] wcscmp (_String1="Recovery", _String2="..") returned 1 [0070.804] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1a) returned 0x38a4e78 [0070.805] wcscpy (in: _Dest=0x38a4e78, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0070.805] wcscat (in: _Dest=0x38a4e78, _Source="Recovery" | out: _Dest="C:\\Recovery") returned="C:\\Recovery" [0070.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a4e78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x380 [0070.805] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6ead2556, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6ead2556, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x21ffac8, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x10000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="swapfile.sys", cAlternateFileName="")) returned 1 [0070.805] wcscmp (_String1="swapfile.sys", _String2=".") returned 1 [0070.805] wcscmp (_String1="swapfile.sys", _String2="..") returned 1 [0070.805] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x6e16f135, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0xb1ff7ba5, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xb1ff7ba5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0070.805] wcscmp (_String1="System Volume Information", _String2=".") returned 1 [0070.805] wcscmp (_String1="System Volume Information", _String2="..") returned 1 [0070.805] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3c) returned 0x38a6460 [0070.805] wcscpy (in: _Dest=0x38a6460, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0070.805] wcscat (in: _Dest=0x38a6460, _Source="System Volume Information" | out: _Dest="C:\\System Volume Information") returned="C:\\System Volume Information" [0070.805] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6460) returned 1 [0070.805] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0070.805] wcscmp (_String1="Users", _String2=".") returned 1 [0070.806] wcscmp (_String1="Users", _String2="..") returned 1 [0070.806] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x14) returned 0x38a8000 [0070.806] wcscpy (in: _Dest=0x38a8000, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0070.806] wcscat (in: _Dest=0x38a8000, _Source="Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0070.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a8000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384 [0070.806] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0070.806] wcscmp (_String1="Windows", _String2=".") returned 1 [0070.806] wcscmp (_String1="Windows", _String2="..") returned 1 [0070.806] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18) returned 0x38a8040 [0070.806] wcscpy (in: _Dest=0x38a8040, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0070.806] wcscat (in: _Dest=0x38a8040, _Source="Windows" | out: _Dest="C:\\Windows") returned="C:\\Windows" [0070.806] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a8040) returned 1 [0070.806] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 1 [0070.806] wcscmp (_String1="Windows10Upgrade", _String2=".") returned 1 [0070.806] wcscmp (_String1="Windows10Upgrade", _String2="..") returned 1 [0070.806] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2a) returned 0x38a9d30 [0070.806] wcscpy (in: _Dest=0x38a9d30, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0070.807] wcscat (in: _Dest=0x38a9d30, _Source="Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0070.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a9d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x388 [0070.807] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 0 [0070.807] FindClose (in: hFindFile=0x389f300 | out: hFindFile=0x389f300) returned 1 [0070.809] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5470b20) returned 1 [0070.809] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5470108) returned 1 [0070.809] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a3d90) returned 1 Thread: id = 24 os_tid = 0x380 [0070.810] ImpersonateLoggedOnUser (hToken=0x350) returned 1 [0070.810] GetLogicalDriveStringsW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x5 [0070.811] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc) returned 0x54701b0 [0070.811] GetLogicalDriveStringsW (in: nBufferLength=0x5, lpBuffer=0x54701b0 | out: lpBuffer="C:\\") returned 0x4 [0070.811] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0070.811] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54701b0) returned 1 [0070.811] RevertToSelf () returned 1 Thread: id = 25 os_tid = 0x518 [0070.854] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x22) returned 0x38a6880 [0070.854] wcscpy (in: _Dest=0x38a6880, _Source="C:\\$GetCurrent" | out: _Dest="C:\\$GetCurrent") returned="C:\\$GetCurrent" [0070.854] wcscat (in: _Dest=0x38a6880, _Source="\\" | out: _Dest="C:\\$GetCurrent\\") returned="C:\\$GetCurrent\\" [0070.854] wcscat (in: _Dest=0x38a6880, _Source="*" | out: _Dest="C:\\$GetCurrent\\*") returned="C:\\$GetCurrent\\*" [0070.855] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5470b20 [0070.855] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f040 [0070.856] wcscmp (_String1=".", _String2=".") returned 0 [0070.856] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.857] wcscmp (_String1="..", _String2=".") returned 1 [0070.857] wcscmp (_String1="..", _String2="..") returned 0 [0070.857] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0070.857] wcscmp (_String1="Logs", _String2=".") returned 1 [0070.857] wcscmp (_String1="Logs", _String2="..") returned 1 [0070.857] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x28) returned 0x38a6a30 [0070.857] wcscpy (in: _Dest=0x38a6a30, _Source="C:\\$GetCurrent" | out: _Dest="C:\\$GetCurrent") returned="C:\\$GetCurrent" [0070.857] wcscat (in: _Dest=0x38a6a30, _Source="\\" | out: _Dest="C:\\$GetCurrent\\") returned="C:\\$GetCurrent\\" [0070.857] wcscat (in: _Dest=0x38a6a30, _Source="Logs" | out: _Dest="C:\\$GetCurrent\\Logs") returned="C:\\$GetCurrent\\Logs" [0070.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a6a30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x31c [0070.858] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0070.858] wcscmp (_String1="SafeOS", _String2=".") returned 1 [0070.858] wcscmp (_String1="SafeOS", _String2="..") returned 1 [0070.858] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2c) returned 0x38aa008 [0070.858] wcscpy (in: _Dest=0x38aa008, _Source="C:\\$GetCurrent" | out: _Dest="C:\\$GetCurrent") returned="C:\\$GetCurrent" [0070.858] wcscat (in: _Dest=0x38aa008, _Source="\\" | out: _Dest="C:\\$GetCurrent\\") returned="C:\\$GetCurrent\\" [0070.858] wcscat (in: _Dest=0x38aa008, _Source="SafeOS" | out: _Dest="C:\\$GetCurrent\\SafeOS") returned="C:\\$GetCurrent\\SafeOS" [0070.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38aa008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x354 [0070.859] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0070.859] FindClose (in: hFindFile=0x389f040 | out: hFindFile=0x389f040) returned 1 [0070.859] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5470b20) returned 1 [0070.859] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6880) returned 1 [0070.859] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5238) returned 1 Thread: id = 26 os_tid = 0xf28 [0070.860] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x24) returned 0x38a6880 [0070.860] wcscpy (in: _Dest=0x38a6880, _Source="C:\\$Recycle.Bin" | out: _Dest="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0070.860] wcscat (in: _Dest=0x38a6880, _Source="\\" | out: _Dest="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0070.860] wcscat (in: _Dest=0x38a6880, _Source="*" | out: _Dest="C:\\$Recycle.Bin\\*") returned="C:\\$Recycle.Bin\\*" [0070.860] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5470b20 [0070.860] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f040 [0070.860] wcscmp (_String1=".", _String2=".") returned 0 [0070.860] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.860] wcscmp (_String1="..", _String2=".") returned 1 [0070.860] wcscmp (_String1="..", _String2="..") returned 0 [0070.860] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0070.860] wcscmp (_String1="S-1-5-18", _String2=".") returned 1 [0070.860] wcscmp (_String1="S-1-5-18", _String2="..") returned 1 [0070.860] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x32) returned 0x389f480 [0070.860] wcscpy (in: _Dest=0x389f480, _Source="C:\\$Recycle.Bin" | out: _Dest="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0070.860] wcscat (in: _Dest=0x389f480, _Source="\\" | out: _Dest="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0070.860] wcscat (in: _Dest=0x389f480, _Source="S-1-5-18" | out: _Dest="C:\\$Recycle.Bin\\S-1-5-18") returned="C:\\$Recycle.Bin\\S-1-5-18" [0070.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389f480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x38c [0070.861] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0070.861] wcscmp (_String1="S-1-5-21-1051304884-625712362-2192934891-1000", _String2=".") returned 1 [0070.861] wcscmp (_String1="S-1-5-21-1051304884-625712362-2192934891-1000", _String2="..") returned 1 [0070.861] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7c) returned 0x3887d40 [0070.861] wcscpy (in: _Dest=0x3887d40, _Source="C:\\$Recycle.Bin" | out: _Dest="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0070.861] wcscat (in: _Dest=0x3887d40, _Source="\\" | out: _Dest="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0070.861] wcscat (in: _Dest=0x3887d40, _Source="S-1-5-21-1051304884-625712362-2192934891-1000" | out: _Dest="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000") returned="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000" [0070.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3887d40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x390 [0070.862] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x5470b20 | out: lpFindFileData=0x5470b20*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0070.862] FindClose (in: hFindFile=0x389f040 | out: hFindFile=0x389f040) returned 1 [0070.862] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5470b20) returned 1 [0070.862] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6880) returned 1 [0070.862] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6be0) returned 1 Thread: id = 27 os_tid = 0xd14 [0070.866] GetFileAttributesW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker")) returned 0x22 [0070.870] SetFileAttributesW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER", dwFileAttributes=0x20) returned 1 [0070.871] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x394 [0070.871] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x58efabc | out: lpFileSize=0x58efabc*=0) returned 1 [0070.871] FlushFileBuffers (hFile=0x394) returned 1 [0070.887] CloseHandle (hObject=0x394) returned 1 [0070.887] SetFileAttributesW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER", dwFileAttributes=0x22) returned 1 [0070.887] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3892b10) returned 1 Thread: id = 28 os_tid = 0xd78 [0070.867] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x30) returned 0x38aa040 [0070.867] wcscpy (in: _Dest=0x38aa040, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.867] wcscat (in: _Dest=0x38aa040, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.867] wcscat (in: _Dest=0x38aa040, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\*") returned="C:\\588bce7c90097ed212\\*" [0070.867] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5470d30 [0070.867] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f080 [0070.886] wcscmp (_String1=".", _String2=".") returned 0 [0070.886] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.905] wcscmp (_String1="..", _String2=".") returned 1 [0070.905] wcscmp (_String1="..", _String2="..") returned 0 [0070.905] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1025", cAlternateFileName="")) returned 1 [0070.905] wcscmp (_String1="1025", _String2=".") returned 1 [0070.905] wcscmp (_String1="1025", _String2="..") returned 1 [0070.905] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389f580 [0070.905] wcscpy (in: _Dest=0x389f580, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.905] wcscat (in: _Dest=0x389f580, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.905] wcscat (in: _Dest=0x389f580, _Source="1025" | out: _Dest="C:\\588bce7c90097ed212\\1025") returned="C:\\588bce7c90097ed212\\1025" [0070.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389f580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f8 [0070.907] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1028", cAlternateFileName="")) returned 1 [0070.907] wcscmp (_String1="1028", _String2=".") returned 1 [0070.907] wcscmp (_String1="1028", _String2="..") returned 1 [0070.907] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389f100 [0070.907] wcscpy (in: _Dest=0x389f100, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.907] wcscat (in: _Dest=0x389f100, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.907] wcscat (in: _Dest=0x389f100, _Source="1028" | out: _Dest="C:\\588bce7c90097ed212\\1028") returned="C:\\588bce7c90097ed212\\1028" [0070.907] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389f100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3fc [0070.908] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1029", cAlternateFileName="")) returned 1 [0070.908] wcscmp (_String1="1029", _String2=".") returned 1 [0070.908] wcscmp (_String1="1029", _String2="..") returned 1 [0070.908] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389f5c0 [0070.908] wcscpy (in: _Dest=0x389f5c0, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.908] wcscat (in: _Dest=0x389f5c0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.908] wcscat (in: _Dest=0x389f5c0, _Source="1029" | out: _Dest="C:\\588bce7c90097ed212\\1029") returned="C:\\588bce7c90097ed212\\1029" [0070.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389f5c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x404 [0070.909] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1030", cAlternateFileName="")) returned 1 [0070.909] wcscmp (_String1="1030", _String2=".") returned 1 [0070.909] wcscmp (_String1="1030", _String2="..") returned 1 [0070.909] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389f140 [0070.909] wcscpy (in: _Dest=0x389f140, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.909] wcscat (in: _Dest=0x389f140, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.909] wcscat (in: _Dest=0x389f140, _Source="1030" | out: _Dest="C:\\588bce7c90097ed212\\1030") returned="C:\\588bce7c90097ed212\\1030" [0070.909] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389f140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x408 [0070.909] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1031", cAlternateFileName="")) returned 1 [0070.909] wcscmp (_String1="1031", _String2=".") returned 1 [0070.910] wcscmp (_String1="1031", _String2="..") returned 1 [0070.910] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389ef00 [0070.910] wcscpy (in: _Dest=0x389ef00, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.910] wcscat (in: _Dest=0x389ef00, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.910] wcscat (in: _Dest=0x389ef00, _Source="1031" | out: _Dest="C:\\588bce7c90097ed212\\1031") returned="C:\\588bce7c90097ed212\\1031" [0070.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389ef00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x40c [0070.910] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1032", cAlternateFileName="")) returned 1 [0070.910] wcscmp (_String1="1032", _String2=".") returned 1 [0070.910] wcscmp (_String1="1032", _String2="..") returned 1 [0070.910] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389f600 [0070.911] wcscpy (in: _Dest=0x389f600, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.911] wcscat (in: _Dest=0x389f600, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.911] wcscat (in: _Dest=0x389f600, _Source="1032" | out: _Dest="C:\\588bce7c90097ed212\\1032") returned="C:\\588bce7c90097ed212\\1032" [0070.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389f600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410 [0070.911] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0070.911] wcscmp (_String1="1033", _String2=".") returned 1 [0070.911] wcscmp (_String1="1033", _String2="..") returned 1 [0070.911] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389f440 [0070.911] wcscpy (in: _Dest=0x389f440, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.911] wcscat (in: _Dest=0x389f440, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.911] wcscat (in: _Dest=0x389f440, _Source="1033" | out: _Dest="C:\\588bce7c90097ed212\\1033") returned="C:\\588bce7c90097ed212\\1033" [0070.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389f440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414 [0070.912] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1035", cAlternateFileName="")) returned 1 [0070.912] wcscmp (_String1="1035", _String2=".") returned 1 [0070.912] wcscmp (_String1="1035", _String2="..") returned 1 [0070.912] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389f0c0 [0070.912] wcscpy (in: _Dest=0x389f0c0, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.912] wcscat (in: _Dest=0x389f0c0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.912] wcscat (in: _Dest=0x389f0c0, _Source="1035" | out: _Dest="C:\\588bce7c90097ed212\\1035") returned="C:\\588bce7c90097ed212\\1035" [0070.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389f0c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418 [0070.913] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0070.913] wcscmp (_String1="1036", _String2=".") returned 1 [0070.913] wcscmp (_String1="1036", _String2="..") returned 1 [0070.913] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389f000 [0070.913] wcscpy (in: _Dest=0x389f000, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.913] wcscat (in: _Dest=0x389f000, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.913] wcscat (in: _Dest=0x389f000, _Source="1036" | out: _Dest="C:\\588bce7c90097ed212\\1036") returned="C:\\588bce7c90097ed212\\1036" [0070.913] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389f000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x41c [0070.914] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1037", cAlternateFileName="")) returned 1 [0070.914] wcscmp (_String1="1037", _String2=".") returned 1 [0070.914] wcscmp (_String1="1037", _String2="..") returned 1 [0070.914] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389f640 [0070.914] wcscpy (in: _Dest=0x389f640, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.914] wcscat (in: _Dest=0x389f640, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.914] wcscat (in: _Dest=0x389f640, _Source="1037" | out: _Dest="C:\\588bce7c90097ed212\\1037") returned="C:\\588bce7c90097ed212\\1037" [0070.914] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389f640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x420 [0070.916] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1038", cAlternateFileName="")) returned 1 [0070.916] wcscmp (_String1="1038", _String2=".") returned 1 [0070.916] wcscmp (_String1="1038", _String2="..") returned 1 [0070.916] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389f180 [0070.916] wcscpy (in: _Dest=0x389f180, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.916] wcscat (in: _Dest=0x389f180, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.916] wcscat (in: _Dest=0x389f180, _Source="1038" | out: _Dest="C:\\588bce7c90097ed212\\1038") returned="C:\\588bce7c90097ed212\\1038" [0070.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389f180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x424 [0070.917] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1040", cAlternateFileName="")) returned 1 [0070.917] wcscmp (_String1="1040", _String2=".") returned 1 [0070.917] wcscmp (_String1="1040", _String2="..") returned 1 [0070.917] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389f300 [0070.917] wcscpy (in: _Dest=0x389f300, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.917] wcscat (in: _Dest=0x389f300, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.917] wcscat (in: _Dest=0x389f300, _Source="1040" | out: _Dest="C:\\588bce7c90097ed212\\1040") returned="C:\\588bce7c90097ed212\\1040" [0070.917] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389f300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x428 [0070.918] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1041", cAlternateFileName="")) returned 1 [0070.918] wcscmp (_String1="1041", _String2=".") returned 1 [0070.918] wcscmp (_String1="1041", _String2="..") returned 1 [0070.918] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389f380 [0070.918] wcscpy (in: _Dest=0x389f380, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.918] wcscat (in: _Dest=0x389f380, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.918] wcscat (in: _Dest=0x389f380, _Source="1041" | out: _Dest="C:\\588bce7c90097ed212\\1041") returned="C:\\588bce7c90097ed212\\1041" [0070.918] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389f380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x42c [0070.919] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1042", cAlternateFileName="")) returned 1 [0070.919] wcscmp (_String1="1042", _String2=".") returned 1 [0070.919] wcscmp (_String1="1042", _String2="..") returned 1 [0070.919] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389f680 [0070.919] wcscpy (in: _Dest=0x389f680, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.919] wcscat (in: _Dest=0x389f680, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.919] wcscat (in: _Dest=0x389f680, _Source="1042" | out: _Dest="C:\\588bce7c90097ed212\\1042") returned="C:\\588bce7c90097ed212\\1042" [0070.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389f680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x430 [0070.920] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1043", cAlternateFileName="")) returned 1 [0070.920] wcscmp (_String1="1043", _String2=".") returned 1 [0070.920] wcscmp (_String1="1043", _String2="..") returned 1 [0070.920] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389ef40 [0070.920] wcscpy (in: _Dest=0x389ef40, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.920] wcscat (in: _Dest=0x389ef40, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.920] wcscat (in: _Dest=0x389ef40, _Source="1043" | out: _Dest="C:\\588bce7c90097ed212\\1043") returned="C:\\588bce7c90097ed212\\1043" [0070.920] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389ef40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x434 [0070.921] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1044", cAlternateFileName="")) returned 1 [0070.921] wcscmp (_String1="1044", _String2=".") returned 1 [0070.921] wcscmp (_String1="1044", _String2="..") returned 1 [0070.921] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389f3c0 [0070.921] wcscpy (in: _Dest=0x389f3c0, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.921] wcscat (in: _Dest=0x389f3c0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.921] wcscat (in: _Dest=0x389f3c0, _Source="1044" | out: _Dest="C:\\588bce7c90097ed212\\1044") returned="C:\\588bce7c90097ed212\\1044" [0070.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389f3c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x438 [0070.922] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1045", cAlternateFileName="")) returned 1 [0070.922] wcscmp (_String1="1045", _String2=".") returned 1 [0070.922] wcscmp (_String1="1045", _String2="..") returned 1 [0070.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389ef80 [0070.922] wcscpy (in: _Dest=0x389ef80, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.922] wcscat (in: _Dest=0x389ef80, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.922] wcscat (in: _Dest=0x389ef80, _Source="1045" | out: _Dest="C:\\588bce7c90097ed212\\1045") returned="C:\\588bce7c90097ed212\\1045" [0070.922] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389ef80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x43c [0070.923] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1046", cAlternateFileName="")) returned 1 [0070.923] wcscmp (_String1="1046", _String2=".") returned 1 [0070.923] wcscmp (_String1="1046", _String2="..") returned 1 [0070.923] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389efc0 [0070.923] wcscpy (in: _Dest=0x389efc0, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.923] wcscat (in: _Dest=0x389efc0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.923] wcscat (in: _Dest=0x389efc0, _Source="1046" | out: _Dest="C:\\588bce7c90097ed212\\1046") returned="C:\\588bce7c90097ed212\\1046" [0070.923] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389efc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x440 [0070.925] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1049", cAlternateFileName="")) returned 1 [0070.925] wcscmp (_String1="1049", _String2=".") returned 1 [0070.926] wcscmp (_String1="1049", _String2="..") returned 1 [0070.926] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389eb80 [0070.926] wcscpy (in: _Dest=0x389eb80, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.926] wcscat (in: _Dest=0x389eb80, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.926] wcscat (in: _Dest=0x389eb80, _Source="1049" | out: _Dest="C:\\588bce7c90097ed212\\1049") returned="C:\\588bce7c90097ed212\\1049" [0070.926] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389eb80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x444 [0070.927] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1053", cAlternateFileName="")) returned 1 [0070.927] wcscmp (_String1="1053", _String2=".") returned 1 [0070.927] wcscmp (_String1="1053", _String2="..") returned 1 [0070.927] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389ec80 [0070.927] wcscpy (in: _Dest=0x389ec80, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.927] wcscat (in: _Dest=0x389ec80, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.927] wcscat (in: _Dest=0x389ec80, _Source="1053" | out: _Dest="C:\\588bce7c90097ed212\\1053") returned="C:\\588bce7c90097ed212\\1053" [0070.927] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389ec80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448 [0070.927] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1055", cAlternateFileName="")) returned 1 [0070.927] wcscmp (_String1="1055", _String2=".") returned 1 [0070.927] wcscmp (_String1="1055", _String2="..") returned 1 [0070.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389e700 [0070.928] wcscpy (in: _Dest=0x389e700, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.928] wcscat (in: _Dest=0x389e700, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.928] wcscat (in: _Dest=0x389e700, _Source="1055" | out: _Dest="C:\\588bce7c90097ed212\\1055") returned="C:\\588bce7c90097ed212\\1055" [0070.928] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389e700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x44c [0070.928] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2052", cAlternateFileName="")) returned 1 [0070.928] wcscmp (_String1="2052", _String2=".") returned 1 [0070.928] wcscmp (_String1="2052", _String2="..") returned 1 [0070.929] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389e9c0 [0070.929] wcscpy (in: _Dest=0x389e9c0, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.929] wcscat (in: _Dest=0x389e9c0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.929] wcscat (in: _Dest=0x389e9c0, _Source="2052" | out: _Dest="C:\\588bce7c90097ed212\\2052") returned="C:\\588bce7c90097ed212\\2052" [0070.929] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389e9c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450 [0070.929] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2070", cAlternateFileName="")) returned 1 [0070.929] wcscmp (_String1="2070", _String2=".") returned 1 [0070.929] wcscmp (_String1="2070", _String2="..") returned 1 [0070.929] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389ecc0 [0070.929] wcscpy (in: _Dest=0x389ecc0, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.929] wcscat (in: _Dest=0x389ecc0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.930] wcscat (in: _Dest=0x389ecc0, _Source="2070" | out: _Dest="C:\\588bce7c90097ed212\\2070") returned="C:\\588bce7c90097ed212\\2070" [0070.930] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389ecc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x454 [0070.930] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3076", cAlternateFileName="")) returned 1 [0070.930] wcscmp (_String1="3076", _String2=".") returned 1 [0070.930] wcscmp (_String1="3076", _String2="..") returned 1 [0070.930] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389e980 [0070.930] wcscpy (in: _Dest=0x389e980, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.930] wcscat (in: _Dest=0x389e980, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.930] wcscat (in: _Dest=0x389e980, _Source="3076" | out: _Dest="C:\\588bce7c90097ed212\\3076") returned="C:\\588bce7c90097ed212\\3076" [0070.931] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389e980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x458 [0070.931] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0070.931] wcscmp (_String1="3082", _String2=".") returned 1 [0070.931] wcscmp (_String1="3082", _String2="..") returned 1 [0070.931] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389e740 [0070.931] wcscpy (in: _Dest=0x389e740, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.931] wcscat (in: _Dest=0x389e740, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.931] wcscat (in: _Dest=0x389e740, _Source="3082" | out: _Dest="C:\\588bce7c90097ed212\\3082") returned="C:\\588bce7c90097ed212\\3082" [0070.931] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389e740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x45c [0070.932] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client", cAlternateFileName="")) returned 1 [0070.932] wcscmp (_String1="Client", _String2=".") returned 1 [0070.932] wcscmp (_String1="Client", _String2="..") returned 1 [0070.932] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a6388 [0070.932] wcscpy (in: _Dest=0x38a6388, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.932] wcscat (in: _Dest=0x38a6388, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.932] wcscat (in: _Dest=0x38a6388, _Source="Client" | out: _Dest="C:\\588bce7c90097ed212\\Client") returned="C:\\588bce7c90097ed212\\Client" [0070.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a6388, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x460 [0070.933] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0070.933] wcscmp (_String1="DHtmlHeader.html", _String2=".") returned 1 [0070.933] wcscmp (_String1="DHtmlHeader.html", _String2="..") returned 1 [0070.933] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x38845b8 [0070.933] wcscpy (in: _Dest=0x38845b8, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.933] wcscat (in: _Dest=0x38845b8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.933] wcscat (in: _Dest=0x38845b8, _Source="DHtmlHeader.html" | out: _Dest="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned="C:\\588bce7c90097ed212\\DHtmlHeader.html" [0070.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38845b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x464 [0070.934] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0070.934] wcscmp (_String1="DisplayIcon.ico", _String2=".") returned 1 [0070.934] wcscmp (_String1="DisplayIcon.ico", _String2="..") returned 1 [0070.934] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extended", cAlternateFileName="")) returned 1 [0070.934] wcscmp (_String1="Extended", _String2=".") returned 1 [0070.934] wcscmp (_String1="Extended", _String2="..") returned 1 [0070.934] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3e) returned 0x38a64a8 [0070.934] wcscpy (in: _Dest=0x38a64a8, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.934] wcscat (in: _Dest=0x38a64a8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.934] wcscat (in: _Dest=0x38a64a8, _Source="Extended" | out: _Dest="C:\\588bce7c90097ed212\\Extended") returned="C:\\588bce7c90097ed212\\Extended" [0070.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a64a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x468 [0070.935] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graphics", cAlternateFileName="")) returned 1 [0070.935] wcscmp (_String1="Graphics", _String2=".") returned 1 [0070.935] wcscmp (_String1="Graphics", _String2="..") returned 1 [0070.935] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3e) returned 0x38a6148 [0070.935] wcscpy (in: _Dest=0x38a6148, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.935] wcscat (in: _Dest=0x38a6148, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.935] wcscat (in: _Dest=0x38a6148, _Source="Graphics" | out: _Dest="C:\\588bce7c90097ed212\\Graphics") returned="C:\\588bce7c90097ed212\\Graphics" [0070.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a6148, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x46c [0070.936] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0070.936] wcscmp (_String1="header.bmp", _String2=".") returned 1 [0070.936] wcscmp (_String1="header.bmp", _String2="..") returned 1 [0070.936] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x42) returned 0x38b2aa8 [0070.936] wcscpy (in: _Dest=0x38b2aa8, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.936] wcscat (in: _Dest=0x38b2aa8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.936] wcscat (in: _Dest=0x38b2aa8, _Source="header.bmp" | out: _Dest="C:\\588bce7c90097ed212\\header.bmp") returned="C:\\588bce7c90097ed212\\header.bmp" [0070.936] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b2aa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x470 [0070.937] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0070.937] wcscmp (_String1="netfx_Core.mzz", _String2=".") returned 1 [0070.937] wcscmp (_String1="netfx_Core.mzz", _String2="..") returned 1 [0070.937] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x388a618 [0070.937] wcscpy (in: _Dest=0x388a618, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.937] wcscat (in: _Dest=0x388a618, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.937] wcscat (in: _Dest=0x388a618, _Source="netfx_Core.mzz" | out: _Dest="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned="C:\\588bce7c90097ed212\\netfx_Core.mzz" [0070.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x388a618, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x474 [0070.938] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0070.938] wcscmp (_String1="netfx_Core_x64.msi", _String2=".") returned 1 [0070.938] wcscmp (_String1="netfx_Core_x64.msi", _String2="..") returned 1 [0070.938] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0070.938] wcscmp (_String1="netfx_Core_x86.msi", _String2=".") returned 1 [0070.938] wcscmp (_String1="netfx_Core_x86.msi", _String2="..") returned 1 [0070.938] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0070.938] wcscmp (_String1="netfx_Extended.mzz", _String2=".") returned 1 [0070.938] wcscmp (_String1="netfx_Extended.mzz", _String2="..") returned 1 [0070.938] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x3891200 [0070.938] wcscpy (in: _Dest=0x3891200, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0070.938] wcscat (in: _Dest=0x3891200, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0070.938] wcscat (in: _Dest=0x3891200, _Source="netfx_Extended.mzz" | out: _Dest="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned="C:\\588bce7c90097ed212\\netfx_Extended.mzz" [0070.938] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3891200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x478 [0070.939] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0070.939] wcscmp (_String1="netfx_Extended_x64.msi", _String2=".") returned 1 [0070.939] wcscmp (_String1="netfx_Extended_x64.msi", _String2="..") returned 1 [0070.939] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0071.087] wcscmp (_String1="netfx_Extended_x86.msi", _String2=".") returned 1 [0071.088] wcscmp (_String1="netfx_Extended_x86.msi", _String2="..") returned 1 [0071.088] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0071.088] wcscmp (_String1="ParameterInfo.xml", _String2=".") returned 1 [0071.088] wcscmp (_String1="ParameterInfo.xml", _String2="..") returned 1 [0071.088] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x541b360 [0071.088] wcscpy (in: _Dest=0x541b360, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0071.088] wcscat (in: _Dest=0x541b360, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0071.088] wcscat (in: _Dest=0x541b360, _Source="ParameterInfo.xml" | out: _Dest="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned="C:\\588bce7c90097ed212\\ParameterInfo.xml" [0071.088] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x541b360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc [0071.088] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0071.089] wcscmp (_String1="RGB9RAST_x64.msi", _String2=".") returned 1 [0071.089] wcscmp (_String1="RGB9RAST_x64.msi", _String2="..") returned 1 [0071.089] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0071.089] wcscmp (_String1="RGB9Rast_x86.msi", _String2=".") returned 1 [0071.089] wcscmp (_String1="RGB9Rast_x86.msi", _String2="..") returned 1 [0071.089] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0071.089] wcscmp (_String1="Setup.exe", _String2=".") returned 1 [0071.089] wcscmp (_String1="Setup.exe", _String2="..") returned 1 [0071.089] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0071.089] wcscmp (_String1="SetupEngine.dll", _String2=".") returned 1 [0071.089] wcscmp (_String1="SetupEngine.dll", _String2="..") returned 1 [0071.089] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0071.089] wcscmp (_String1="SetupUi.dll", _String2=".") returned 1 [0071.089] wcscmp (_String1="SetupUi.dll", _String2="..") returned 1 [0071.089] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0071.089] wcscmp (_String1="SetupUi.xsd", _String2=".") returned 1 [0071.089] wcscmp (_String1="SetupUi.xsd", _String2="..") returned 1 [0071.089] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x541d028 [0071.089] wcscpy (in: _Dest=0x541d028, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0071.089] wcscat (in: _Dest=0x541d028, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0071.089] wcscat (in: _Dest=0x541d028, _Source="SetupUi.xsd" | out: _Dest="C:\\588bce7c90097ed212\\SetupUi.xsd") returned="C:\\588bce7c90097ed212\\SetupUi.xsd" [0071.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x541d028, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c0 [0071.090] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0071.090] wcscmp (_String1="SetupUtility.exe", _String2=".") returned 1 [0071.090] wcscmp (_String1="SetupUtility.exe", _String2="..") returned 1 [0071.090] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0071.090] wcscmp (_String1="SplashScreen.bmp", _String2=".") returned 1 [0071.090] wcscmp (_String1="SplashScreen.bmp", _String2="..") returned 1 [0071.090] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x541b678 [0071.090] wcscpy (in: _Dest=0x541b678, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0071.090] wcscat (in: _Dest=0x541b678, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0071.090] wcscat (in: _Dest=0x541b678, _Source="SplashScreen.bmp" | out: _Dest="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned="C:\\588bce7c90097ed212\\SplashScreen.bmp" [0071.090] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x541b678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c4 [0071.091] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0071.091] wcscmp (_String1="sqmapi.dll", _String2=".") returned 1 [0071.091] wcscmp (_String1="sqmapi.dll", _String2="..") returned 1 [0071.091] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x0, dwReserved1=0x0, cFileName="Strings.xml", cAlternateFileName="")) returned 1 [0071.091] wcscmp (_String1="Strings.xml", _String2=".") returned 1 [0071.091] wcscmp (_String1="Strings.xml", _String2="..") returned 1 [0071.091] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x541cdf8 [0071.091] wcscpy (in: _Dest=0x541cdf8, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0071.091] wcscat (in: _Dest=0x541cdf8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0071.091] wcscat (in: _Dest=0x541cdf8, _Source="Strings.xml" | out: _Dest="C:\\588bce7c90097ed212\\Strings.xml") returned="C:\\588bce7c90097ed212\\Strings.xml" [0071.091] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x541cdf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c8 [0071.092] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0071.092] wcscmp (_String1="UiInfo.xml", _String2=".") returned 1 [0071.092] wcscmp (_String1="UiInfo.xml", _String2="..") returned 1 [0071.092] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x42) returned 0x541d078 [0071.092] wcscpy (in: _Dest=0x541d078, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0071.092] wcscat (in: _Dest=0x541d078, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0071.092] wcscat (in: _Dest=0x541d078, _Source="UiInfo.xml" | out: _Dest="C:\\588bce7c90097ed212\\UiInfo.xml") returned="C:\\588bce7c90097ed212\\UiInfo.xml" [0071.092] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x541d078, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4cc [0071.093] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1 [0071.093] wcscmp (_String1="watermark.bmp", _String2=".") returned 1 [0071.093] wcscmp (_String1="watermark.bmp", _String2="..") returned 1 [0071.093] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x541cee8 [0071.093] wcscpy (in: _Dest=0x541cee8, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0071.093] wcscat (in: _Dest=0x541cee8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0071.093] wcscat (in: _Dest=0x541cee8, _Source="watermark.bmp" | out: _Dest="C:\\588bce7c90097ed212\\watermark.bmp") returned="C:\\588bce7c90097ed212\\watermark.bmp" [0071.093] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x541cee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d0 [0071.094] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0071.094] wcscmp (_String1="Windows6.0-KB956250-v6001-x64.msu", _String2=".") returned 1 [0071.094] wcscmp (_String1="Windows6.0-KB956250-v6001-x64.msu", _String2="..") returned 1 [0071.094] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0071.094] wcscmp (_String1="Windows6.0-KB956250-v6001-x86.msu", _String2=".") returned 1 [0071.094] wcscmp (_String1="Windows6.0-KB956250-v6001-x86.msu", _String2="..") returned 1 [0071.094] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0071.094] wcscmp (_String1="Windows6.1-KB958488-v6001-x64.msu", _String2=".") returned 1 [0071.094] wcscmp (_String1="Windows6.1-KB958488-v6001-x64.msu", _String2="..") returned 1 [0071.094] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0071.094] wcscmp (_String1="Windows6.1-KB958488-v6001-x86.msu", _String2=".") returned 1 [0071.094] wcscmp (_String1="Windows6.1-KB958488-v6001-x86.msu", _String2="..") returned 1 [0071.094] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5470d30 | out: lpFindFileData=0x5470d30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0071.543] FindClose (in: hFindFile=0x389f080 | out: hFindFile=0x389f080) returned 1 [0072.606] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5470d30) returned 1 [0072.606] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38aa040) returned 1 [0072.606] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a9fd0) returned 1 Thread: id = 29 os_tid = 0xb24 [0070.868] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x38) returned 0x389f280 [0070.868] wcscpy (in: _Dest=0x389f280, _Source="C:\\Documents and Settings" | out: _Dest="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0070.868] wcscat (in: _Dest=0x389f280, _Source="\\" | out: _Dest="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0070.868] wcscat (in: _Dest=0x389f280, _Source="*" | out: _Dest="C:\\Documents and Settings\\*") returned="C:\\Documents and Settings\\*" [0070.868] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x38b0068 [0070.868] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x38b0068 | out: lpFindFileData=0x38b0068*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0070.871] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b0068) returned 1 [0070.871] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f280) returned 1 [0070.872] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f380) returned 1 Thread: id = 30 os_tid = 0xb10 [0070.868] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12) returned 0x38a8040 [0070.868] wcscpy (in: _Dest=0x38a8040, _Source="C:\\ESD" | out: _Dest="C:\\ESD") returned="C:\\ESD" [0070.868] wcscat (in: _Dest=0x38a8040, _Source="\\" | out: _Dest="C:\\ESD\\") returned="C:\\ESD\\" [0070.868] wcscat (in: _Dest=0x38a8040, _Source="*" | out: _Dest="C:\\ESD\\*") returned="C:\\ESD\\*" [0070.868] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x38af788 [0070.872] FindFirstFileW (in: lpFileName="C:\\ESD\\*", lpFindFileData=0x38af788 | out: lpFindFileData=0x38af788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ee80 [0071.139] wcscmp (_String1=".", _String2=".") returned 0 [0071.139] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x38af788 | out: lpFindFileData=0x38af788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.139] wcscmp (_String1="..", _String2=".") returned 1 [0071.139] wcscmp (_String1="..", _String2="..") returned 0 [0071.139] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x38af788 | out: lpFindFileData=0x38af788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0071.140] FindClose (in: hFindFile=0x389ee80 | out: hFindFile=0x389ee80) returned 1 [0071.140] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38af788) returned 1 [0071.140] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a8040) returned 1 [0071.140] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54700c0) returned 1 Thread: id = 31 os_tid = 0x7c4 [0070.875] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x14) returned 0x38a8060 [0070.875] wcscpy (in: _Dest=0x38a8060, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0070.875] wcscat (in: _Dest=0x38a8060, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0070.875] wcscat (in: _Dest=0x38a8060, _Source="*" | out: _Dest="C:\\Logs\\*") returned="C:\\Logs\\*" [0070.875] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x38b0ba0 [0070.875] FindFirstFileW (in: lpFileName="C:\\Logs\\*", lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f480 [0071.095] wcscmp (_String1=".", _String2=".") returned 0 [0071.095] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.099] wcscmp (_String1="..", _String2=".") returned 1 [0071.099] wcscmp (_String1="..", _String2="..") returned 0 [0071.099] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5052fa31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5052fa31, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Application.evtx", cAlternateFileName="APPLIC~1.EVT")) returned 1 [0071.099] wcscmp (_String1="Application.evtx", _String2=".") returned 1 [0071.099] wcscmp (_String1="Application.evtx", _String2="..") returned 1 [0071.099] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x32) returned 0x389ea40 [0071.099] wcscpy (in: _Dest=0x389ea40, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.099] wcscat (in: _Dest=0x389ea40, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.100] wcscat (in: _Dest=0x389ea40, _Source="Application.evtx" | out: _Dest="C:\\Logs\\Application.evtx") returned="C:\\Logs\\Application.evtx" [0071.100] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x389ea40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4 [0071.100] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505ee5f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505ee5f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="HardwareEvents.evtx", cAlternateFileName="HARDWA~1.EVT")) returned 1 [0071.100] wcscmp (_String1="HardwareEvents.evtx", _String2=".") returned 1 [0071.100] wcscmp (_String1="HardwareEvents.evtx", _String2="..") returned 1 [0071.100] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x38) returned 0x389ed80 [0071.101] wcscpy (in: _Dest=0x389ed80, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.101] wcscat (in: _Dest=0x389ed80, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.101] wcscat (in: _Dest=0x389ed80, _Source="HardwareEvents.evtx" | out: _Dest="C:\\Logs\\HardwareEvents.evtx") returned="C:\\Logs\\HardwareEvents.evtx" [0071.101] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x389ed80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8 [0071.105] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505a2134, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505a2134, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer.evtx", cAlternateFileName="INTERN~1.EVT")) returned 1 [0071.105] wcscmp (_String1="Internet Explorer.evtx", _String2=".") returned 1 [0071.105] wcscmp (_String1="Internet Explorer.evtx", _String2="..") returned 1 [0071.105] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3e) returned 0x38a6100 [0071.105] wcscpy (in: _Dest=0x38a6100, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.105] wcscat (in: _Dest=0x38a6100, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.105] wcscat (in: _Dest=0x38a6100, _Source="Internet Explorer.evtx" | out: _Dest="C:\\Logs\\Internet Explorer.evtx") returned="C:\\Logs\\Internet Explorer.evtx" [0071.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38a6100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc [0071.106] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5057bed8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5057bed8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Key Management Service.evtx", cAlternateFileName="KEYMAN~1.EVT")) returned 1 [0071.106] wcscmp (_String1="Key Management Service.evtx", _String2=".") returned 1 [0071.106] wcscmp (_String1="Key Management Service.evtx", _String2="..") returned 1 [0071.106] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x541cf38 [0071.106] wcscpy (in: _Dest=0x541cf38, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.106] wcscat (in: _Dest=0x541cf38, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.106] wcscat (in: _Dest=0x541cf38, _Source="Key Management Service.evtx" | out: _Dest="C:\\Logs\\Key Management Service.evtx") returned="C:\\Logs\\Key Management Service.evtx" [0071.106] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x541cf38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e0 [0071.107] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1dbd7c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1dbd7c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Client-Licensing-Platform%4Admin.evtx", cAlternateFileName="MICROS~1.EVT")) returned 1 [0071.107] wcscmp (_String1="Microsoft-Client-Licensing-Platform%4Admin.evtx", _String2=".") returned 1 [0071.107] wcscmp (_String1="Microsoft-Client-Licensing-Platform%4Admin.evtx", _String2="..") returned 1 [0071.107] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x38aa630 [0071.107] wcscpy (in: _Dest=0x38aa630, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.107] wcscat (in: _Dest=0x38aa630, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.107] wcscat (in: _Dest=0x38aa630, _Source="Microsoft-Client-Licensing-Platform%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" [0071.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38aa630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e4 [0071.108] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5d836e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5d836e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", cAlternateFileName="MICROS~2.EVT")) returned 1 [0071.108] wcscmp (_String1="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", _String2=".") returned 1 [0071.108] wcscmp (_String1="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", _String2="..") returned 1 [0071.108] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xae) returned 0x38a14d0 [0071.108] wcscpy (in: _Dest=0x38a14d0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.108] wcscat (in: _Dest=0x38a14d0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.108] wcscat (in: _Dest=0x38a14d0, _Source="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" [0071.108] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38a14d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8 [0071.109] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9206ac5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9206ac5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9c0f529, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", cAlternateFileName="MICROS~3.EVT")) returned 1 [0071.109] wcscmp (_String1="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", _String2=".") returned 1 [0071.109] wcscmp (_String1="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", _String2="..") returned 1 [0071.109] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa0) returned 0x38ab920 [0071.109] wcscpy (in: _Dest=0x38ab920, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.109] wcscat (in: _Dest=0x38ab920, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.109] wcscat (in: _Dest=0x38ab920, _Source="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" [0071.109] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38ab920, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ec [0071.111] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", cAlternateFileName="MICROS~4.EVT")) returned 1 [0071.111] wcscmp (_String1="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", _String2=".") returned 1 [0071.111] wcscmp (_String1="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", _String2="..") returned 1 [0071.111] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6c) returned 0x38aa6a8 [0071.111] wcscpy (in: _Dest=0x38aa6a8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.111] wcscat (in: _Dest=0x38aa6a8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.111] wcscat (in: _Dest=0x38aa6a8, _Source="Microsoft-Windows-AppLocker%4EXE and DLL.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" [0071.111] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38aa6a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f0 [0071.112] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4169a7a, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4169a7a, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4MSI and Script.evtx", cAlternateFileName="MI2EEA~1.EVT")) returned 1 [0071.112] wcscmp (_String1="Microsoft-Windows-AppLocker%4MSI and Script.evtx", _String2=".") returned 1 [0071.112] wcscmp (_String1="Microsoft-Windows-AppLocker%4MSI and Script.evtx", _String2="..") returned 1 [0071.112] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x72) returned 0x38909a0 [0071.112] wcscpy (in: _Dest=0x38909a0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.112] wcscat (in: _Dest=0x38909a0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.112] wcscat (in: _Dest=0x38909a0, _Source="Microsoft-Windows-AppLocker%4MSI and Script.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" [0071.112] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38909a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f4 [0071.113] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", cAlternateFileName="MI07E1~1.EVT")) returned 1 [0071.113] wcscmp (_String1="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", _String2=".") returned 1 [0071.113] wcscmp (_String1="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", _String2="..") returned 1 [0071.113] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x84) returned 0x38a90e8 [0071.113] wcscpy (in: _Dest=0x38a90e8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.113] wcscat (in: _Dest=0x38a90e8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.114] wcscat (in: _Dest=0x38a90e8, _Source="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" [0071.114] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38a90e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f8 [0071.115] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", cAlternateFileName="MI8196~1.EVT")) returned 1 [0071.115] wcscmp (_String1="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", _String2=".") returned 1 [0071.115] wcscmp (_String1="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", _String2="..") returned 1 [0071.115] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x82) returned 0x38a94d8 [0071.115] wcscpy (in: _Dest=0x38a94d8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.115] wcscat (in: _Dest=0x38a94d8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.115] wcscat (in: _Dest=0x38a94d8, _Source="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" [0071.115] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38a94d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4fc [0071.116] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41b5f2d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd41b5f2d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", cAlternateFileName="MIE36C~1.EVT")) returned 1 [0071.116] wcscmp (_String1="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", _String2=".") returned 1 [0071.116] wcscmp (_String1="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", _String2="..") returned 1 [0071.116] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6e) returned 0x38aa540 [0071.116] wcscpy (in: _Dest=0x38aa540, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.116] wcscat (in: _Dest=0x38aa540, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.116] wcscat (in: _Dest=0x38aa540, _Source="Microsoft-Windows-AppModel-Runtime%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" [0071.116] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38aa540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x500 [0071.117] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd389efbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd389efbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppReadiness%4Admin.evtx", cAlternateFileName="MIC5CB~1.EVT")) returned 1 [0071.117] wcscmp (_String1="Microsoft-Windows-AppReadiness%4Admin.evtx", _String2=".") returned 1 [0071.117] wcscmp (_String1="Microsoft-Windows-AppReadiness%4Admin.evtx", _String2="..") returned 1 [0071.117] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x38b2178 [0071.117] wcscpy (in: _Dest=0x38b2178, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.117] wcscat (in: _Dest=0x38b2178, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.117] wcscat (in: _Dest=0x38b2178, _Source="Microsoft-Windows-AppReadiness%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" [0071.117] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b2178, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x504 [0071.118] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38c5212, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd38c5212, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppReadiness%4Operational.evtx", cAlternateFileName="MIF8AA~1.EVT")) returned 1 [0071.118] wcscmp (_String1="Microsoft-Windows-AppReadiness%4Operational.evtx", _String2=".") returned 1 [0071.118] wcscmp (_String1="Microsoft-Windows-AppReadiness%4Operational.evtx", _String2="..") returned 1 [0071.118] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x72) returned 0x388fea0 [0071.118] wcscpy (in: _Dest=0x388fea0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.118] wcscat (in: _Dest=0x388fea0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.118] wcscat (in: _Dest=0x388fea0, _Source="Microsoft-Windows-AppReadiness%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" [0071.118] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x388fea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x508 [0071.119] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeployment%4Operational.evtx", cAlternateFileName="MI34FE~1.EVT")) returned 1 [0071.119] wcscmp (_String1="Microsoft-Windows-AppXDeployment%4Operational.evtx", _String2=".") returned 1 [0071.119] wcscmp (_String1="Microsoft-Windows-AppXDeployment%4Operational.evtx", _String2="..") returned 1 [0071.119] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x76) returned 0x388fca0 [0071.119] wcscpy (in: _Dest=0x388fca0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.119] wcscat (in: _Dest=0x388fca0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.119] wcscat (in: _Dest=0x388fca0, _Source="Microsoft-Windows-AppXDeployment%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" [0071.119] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x388fca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x50c [0071.120] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x211000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", cAlternateFileName="MIA24C~1.EVT")) returned 1 [0071.120] wcscmp (_String1="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", _String2=".") returned 1 [0071.120] wcscmp (_String1="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", _String2="..") returned 1 [0071.120] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x82) returned 0x38a8b48 [0071.120] wcscpy (in: _Dest=0x38a8b48, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.120] wcscat (in: _Dest=0x38a8b48, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.120] wcscat (in: _Dest=0x38a8b48, _Source="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" [0071.120] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38a8b48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x510 [0071.121] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", cAlternateFileName="MIDBEC~1.EVT")) returned 1 [0071.121] wcscmp (_String1="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", _String2=".") returned 1 [0071.121] wcscmp (_String1="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", _String2="..") returned 1 [0071.121] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x80) returned 0x5409368 [0071.121] wcscpy (in: _Dest=0x5409368, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.121] wcscat (in: _Dest=0x5409368, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.121] wcscat (in: _Dest=0x5409368, _Source="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" [0071.121] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5409368, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x514 [0071.122] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85798667, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x85798667, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppxPackaging%4Operational.evtx", cAlternateFileName="MI54F1~1.EVT")) returned 1 [0071.122] wcscmp (_String1="Microsoft-Windows-AppxPackaging%4Operational.evtx", _String2=".") returned 1 [0071.122] wcscmp (_String1="Microsoft-Windows-AppxPackaging%4Operational.evtx", _String2="..") returned 1 [0071.122] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x74) returned 0x3890420 [0071.122] wcscpy (in: _Dest=0x3890420, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.122] wcscat (in: _Dest=0x3890420, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.122] wcscat (in: _Dest=0x3890420, _Source="Microsoft-Windows-AppxPackaging%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" [0071.122] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3890420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x518 [0071.123] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74d25ab, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74d25ab, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", cAlternateFileName="MI111F~1.EVT")) returned 1 [0071.123] wcscmp (_String1="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", _String2=".") returned 1 [0071.123] wcscmp (_String1="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", _String2="..") returned 1 [0071.123] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x92) returned 0x54265e8 [0071.123] wcscpy (in: _Dest=0x54265e8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.123] wcscat (in: _Dest=0x54265e8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.123] wcscat (in: _Dest=0x54265e8, _Source="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" [0071.123] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54265e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x51c [0071.124] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f96ca4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe1f96ca4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Bits-Client%4Operational.evtx", cAlternateFileName="MI9465~1.EVT")) returned 1 [0071.124] wcscmp (_String1="Microsoft-Windows-Bits-Client%4Operational.evtx", _String2=".") returned 1 [0071.124] wcscmp (_String1="Microsoft-Windows-Bits-Client%4Operational.evtx", _String2="..") returned 1 [0071.124] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x38aa900 [0071.124] wcscpy (in: _Dest=0x38aa900, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.124] wcscat (in: _Dest=0x38aa900, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.124] wcscat (in: _Dest=0x38aa900, _Source="Microsoft-Windows-Bits-Client%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" [0071.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38aa900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x520 [0071.124] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8783aa15, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8783aa15, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-CodeIntegrity%4Operational.evtx", cAlternateFileName="MI03A7~1.EVT")) returned 1 [0071.125] wcscmp (_String1="Microsoft-Windows-CodeIntegrity%4Operational.evtx", _String2=".") returned 1 [0071.125] wcscmp (_String1="Microsoft-Windows-CodeIntegrity%4Operational.evtx", _String2="..") returned 1 [0071.125] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x74) returned 0x3890520 [0071.125] wcscpy (in: _Dest=0x3890520, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.125] wcscat (in: _Dest=0x3890520, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.125] wcscat (in: _Dest=0x3890520, _Source="Microsoft-Windows-CodeIntegrity%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" [0071.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3890520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x524 [0071.126] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3c71c5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3c71c5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", cAlternateFileName="MI5CA2~1.EVT")) returned 1 [0071.126] wcscmp (_String1="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", _String2=".") returned 1 [0071.126] wcscmp (_String1="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", _String2="..") returned 1 [0071.126] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x90) returned 0x38a7ce8 [0071.126] wcscpy (in: _Dest=0x38a7ce8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.126] wcscat (in: _Dest=0x38a7ce8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.126] wcscat (in: _Dest=0x38a7ce8, _Source="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" [0071.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38a7ce8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x528 [0071.127] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", cAlternateFileName="MI5FD1~1.EVT")) returned 1 [0071.127] wcscmp (_String1="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", _String2=".") returned 1 [0071.127] wcscmp (_String1="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", _String2="..") returned 1 [0071.127] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x74) returned 0x38900a0 [0071.127] wcscpy (in: _Dest=0x38900a0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.127] wcscat (in: _Dest=0x38900a0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.127] wcscat (in: _Dest=0x38900a0, _Source="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" [0071.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38900a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x52c [0071.128] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", cAlternateFileName="MI8BDF~1.EVT")) returned 1 [0071.128] wcscmp (_String1="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", _String2=".") returned 1 [0071.128] wcscmp (_String1="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", _String2="..") returned 1 [0071.128] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x72) returned 0x3890720 [0071.128] wcscpy (in: _Dest=0x3890720, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.128] wcscat (in: _Dest=0x3890720, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.128] wcscat (in: _Dest=0x3890720, _Source="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" [0071.128] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3890720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x530 [0071.128] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3ed420, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3ed420, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", cAlternateFileName="MIAEBD~1.EVT")) returned 1 [0071.129] wcscmp (_String1="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", _String2=".") returned 1 [0071.129] wcscmp (_String1="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", _String2="..") returned 1 [0071.129] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xae) returned 0x38a1920 [0071.129] wcscpy (in: _Dest=0x38a1920, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.129] wcscat (in: _Dest=0x38a1920, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.129] wcscat (in: _Dest=0x38a1920, _Source="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" [0071.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38a1920, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x578 [0071.446] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cef47f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cef47f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", cAlternateFileName="MIA726~1.EVT")) returned 1 [0071.446] wcscmp (_String1="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", _String2=".") returned 1 [0071.446] wcscmp (_String1="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", _String2="..") returned 1 [0071.446] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x72) returned 0x388fda0 [0071.446] wcscpy (in: _Dest=0x388fda0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.446] wcscat (in: _Dest=0x388fda0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.446] wcscat (in: _Dest=0x388fda0, _Source="Microsoft-Windows-DeviceSetupManager%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" [0071.446] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x388fda0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x53c [0071.447] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", cAlternateFileName="MI08CB~1.EVT")) returned 1 [0071.447] wcscmp (_String1="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", _String2=".") returned 1 [0071.447] wcscmp (_String1="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", _String2="..") returned 1 [0071.447] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7e) returned 0x54093f0 [0071.447] wcscpy (in: _Dest=0x54093f0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.447] wcscat (in: _Dest=0x54093f0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.447] wcscat (in: _Dest=0x54093f0, _Source="Microsoft-Windows-DeviceSetupManager%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" [0071.447] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54093f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b0 [0071.448] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc967f17e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc967f17e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Dhcp-Client%4Admin.evtx", cAlternateFileName="MI8270~1.EVT")) returned 1 [0071.448] wcscmp (_String1="Microsoft-Windows-Dhcp-Client%4Admin.evtx", _String2=".") returned 1 [0071.448] wcscmp (_String1="Microsoft-Windows-Dhcp-Client%4Admin.evtx", _String2="..") returned 1 [0071.448] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x38b22c8 [0071.448] wcscpy (in: _Dest=0x38b22c8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.448] wcscat (in: _Dest=0x38b22c8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.448] wcscat (in: _Dest=0x38b22c8, _Source="Microsoft-Windows-Dhcp-Client%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" [0071.448] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b22c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b4 [0071.449] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96cb64b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc96cb64b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", cAlternateFileName="MIEBFF~1.EVT")) returned 1 [0071.449] wcscmp (_String1="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", _String2=".") returned 1 [0071.449] wcscmp (_String1="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", _String2="..") returned 1 [0071.449] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x68) returned 0x38b2418 [0071.449] wcscpy (in: _Dest=0x38b2418, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.449] wcscat (in: _Dest=0x38b2418, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.449] wcscat (in: _Dest=0x38b2418, _Source="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" [0071.449] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b2418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b8 [0071.450] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64aa7b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca64aa7b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", cAlternateFileName="MI9F85~1.EVT")) returned 1 [0071.450] wcscmp (_String1="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", _String2=".") returned 1 [0071.450] wcscmp (_String1="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", _String2="..") returned 1 [0071.450] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x74) returned 0x38907a0 [0071.450] wcscpy (in: _Dest=0x38907a0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.450] wcscat (in: _Dest=0x38907a0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.450] wcscat (in: _Dest=0x38907a0, _Source="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" [0071.450] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38907a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc [0071.450] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9ec80, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xfd9ec80, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", cAlternateFileName="MIBE3D~1.EVT")) returned 1 [0071.450] wcscmp (_String1="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", _String2=".") returned 1 [0071.451] wcscmp (_String1="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", _String2="..") returned 1 [0071.451] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x88) returned 0x38a97a8 [0071.451] wcscpy (in: _Dest=0x38a97a8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.451] wcscat (in: _Dest=0x38a97a8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.451] wcscat (in: _Dest=0x38a97a8, _Source="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" [0071.451] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38a97a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c0 [0071.451] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9658ef3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9658ef3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-GroupPolicy%4Operational.evtx", cAlternateFileName="MIE38D~1.EVT")) returned 1 [0071.451] wcscmp (_String1="Microsoft-Windows-GroupPolicy%4Operational.evtx", _String2=".") returned 1 [0071.451] wcscmp (_String1="Microsoft-Windows-GroupPolicy%4Operational.evtx", _String2="..") returned 1 [0071.451] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x38aa5b8 [0071.451] wcscpy (in: _Dest=0x38aa5b8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.451] wcscat (in: _Dest=0x38aa5b8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.452] wcscat (in: _Dest=0x38aa5b8, _Source="Microsoft-Windows-GroupPolicy%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" [0071.452] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38aa5b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d4 [0071.472] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9dcc480, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9dcc480, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-HotspotAuth%4Operational.evtx", cAlternateFileName="MIE386~1.EVT")) returned 1 [0071.472] wcscmp (_String1="Microsoft-Windows-HotspotAuth%4Operational.evtx", _String2=".") returned 1 [0071.472] wcscmp (_String1="Microsoft-Windows-HotspotAuth%4Operational.evtx", _String2="..") returned 1 [0071.472] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x38aa888 [0071.472] wcscpy (in: _Dest=0x38aa888, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.472] wcscat (in: _Dest=0x38aa888, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.472] wcscat (in: _Dest=0x38aa888, _Source="Microsoft-Windows-HotspotAuth%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" [0071.473] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38aa888, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c8 [0071.474] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b4bacf, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b4bacf, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", cAlternateFileName="MI6B25~1.EVT")) returned 1 [0071.474] wcscmp (_String1="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", _String2=".") returned 1 [0071.474] wcscmp (_String1="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", _String2="..") returned 1 [0071.474] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x78) returned 0x3890020 [0071.474] wcscpy (in: _Dest=0x3890020, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.474] wcscat (in: _Dest=0x3890020, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.474] wcscat (in: _Dest=0x3890020, _Source="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" [0071.474] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3890020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3bc [0071.475] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb66288f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-International%4Operational.evtx", cAlternateFileName="MI854A~1.EVT")) returned 1 [0071.475] wcscmp (_String1="Microsoft-Windows-International%4Operational.evtx", _String2=".") returned 1 [0071.475] wcscmp (_String1="Microsoft-Windows-International%4Operational.evtx", _String2="..") returned 1 [0071.475] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x74) returned 0x3890220 [0071.475] wcscpy (in: _Dest=0x3890220, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.475] wcscat (in: _Dest=0x3890220, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.475] wcscat (in: _Dest=0x3890220, _Source="Microsoft-Windows-International%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" [0071.475] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3890220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ac [0071.476] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506ad1ac, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x506ad1ac, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-Boot%4Operational.evtx", cAlternateFileName="MI32CE~1.EVT")) returned 1 [0071.476] wcscmp (_String1="Microsoft-Windows-Kernel-Boot%4Operational.evtx", _String2=".") returned 1 [0071.476] wcscmp (_String1="Microsoft-Windows-Kernel-Boot%4Operational.evtx", _String2="..") returned 1 [0071.476] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x38aa9f0 [0071.476] wcscpy (in: _Dest=0x38aa9f0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.476] wcscat (in: _Dest=0x38aa9f0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.476] wcscat (in: _Dest=0x38aa9f0, _Source="Microsoft-Windows-Kernel-Boot%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" [0071.476] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38aa9f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a4 [0071.476] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", cAlternateFileName="MIA934~1.EVT")) returned 1 [0071.476] wcscmp (_String1="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", _String2=".") returned 1 [0071.477] wcscmp (_String1="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", _String2="..") returned 1 [0071.477] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x74) returned 0x3890120 [0071.477] wcscpy (in: _Dest=0x3890120, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.477] wcscat (in: _Dest=0x3890120, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.477] wcscat (in: _Dest=0x3890120, _Source="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" [0071.477] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3890120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ec [0071.477] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5071f8b0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5071f8b0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", cAlternateFileName="MIB32D~1.EVT")) returned 1 [0071.477] wcscmp (_String1="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", _String2=".") returned 1 [0071.477] wcscmp (_String1="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", _String2="..") returned 1 [0071.477] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x72) returned 0x38904a0 [0071.477] wcscpy (in: _Dest=0x38904a0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.477] wcscat (in: _Dest=0x38904a0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.477] wcscat (in: _Dest=0x38904a0, _Source="Microsoft-Windows-Kernel-PnP%4Configuration.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" [0071.477] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38904a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0 [0071.478] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ebf6d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc8ebf6d7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", cAlternateFileName="MICA77~1.EVT")) returned 1 [0071.478] wcscmp (_String1="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", _String2=".") returned 1 [0071.478] wcscmp (_String1="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", _String2="..") returned 1 [0071.478] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x82) returned 0x38a8e18 [0071.478] wcscpy (in: _Dest=0x38a8e18, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.478] wcscat (in: _Dest=0x38a8e18, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.478] wcscat (in: _Dest=0x38a8e18, _Source="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" [0071.478] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38a8e18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f4 [0071.479] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5090f75d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5090f75d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", cAlternateFileName="MI1E8D~1.EVT")) returned 1 [0071.479] wcscmp (_String1="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", _String2=".") returned 1 [0071.479] wcscmp (_String1="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", _String2="..") returned 1 [0071.479] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7c) returned 0x5409cf8 [0071.479] wcscpy (in: _Dest=0x5409cf8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.479] wcscat (in: _Dest=0x5409cf8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.479] wcscat (in: _Dest=0x5409cf8, _Source="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" [0071.479] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5409cf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f8 [0071.480] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd75102f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd75102f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", cAlternateFileName="MID067~1.EVT")) returned 1 [0071.915] wcscmp (_String1="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", _String2=".") returned 1 [0071.915] wcscmp (_String1="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", _String2="..") returned 1 [0071.915] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x78) returned 0x38902a0 [0071.915] wcscpy (in: _Dest=0x38902a0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.915] wcscat (in: _Dest=0x38902a0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.915] wcscat (in: _Dest=0x38902a0, _Source="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" [0071.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38902a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x838 [0071.916] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", cAlternateFileName="MIDE4D~1.EVT")) returned 1 [0071.916] wcscmp (_String1="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", _String2=".") returned 1 [0071.916] wcscmp (_String1="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", _String2="..") returned 1 [0071.916] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x38b2028 [0071.916] wcscpy (in: _Dest=0x38b2028, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.916] wcscat (in: _Dest=0x38b2028, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.916] wcscat (in: _Dest=0x38b2028, _Source="Microsoft-Windows-Kernel-WHEA%4Errors.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" [0071.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b2028, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x850 [0071.916] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", cAlternateFileName="MI36C5~1.EVT")) returned 1 [0071.916] wcscmp (_String1="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", _String2=".") returned 1 [0071.916] wcscmp (_String1="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", _String2="..") returned 1 [0071.916] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x54678f0 [0071.916] wcscpy (in: _Dest=0x54678f0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.916] wcscat (in: _Dest=0x54678f0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.917] wcscat (in: _Dest=0x54678f0, _Source="Microsoft-Windows-Kernel-WHEA%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" [0071.917] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54678f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x854 [0071.917] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59547c37, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x59547c37, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Known Folders API Service.evtx", cAlternateFileName="MI86D6~1.EVT")) returned 1 [0071.917] wcscmp (_String1="Microsoft-Windows-Known Folders API Service.evtx", _String2=".") returned 1 [0071.917] wcscmp (_String1="Microsoft-Windows-Known Folders API Service.evtx", _String2="..") returned 1 [0071.917] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x72) returned 0x38905a0 [0071.917] wcscpy (in: _Dest=0x38905a0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.917] wcscat (in: _Dest=0x38905a0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.917] wcscat (in: _Dest=0x38905a0, _Source="Microsoft-Windows-Known Folders API Service.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" [0071.918] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38905a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x858 [0071.918] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7386e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbb7386e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-LiveId%4Operational.evtx", cAlternateFileName="MI4C58~1.EVT")) returned 1 [0071.918] wcscmp (_String1="Microsoft-Windows-LiveId%4Operational.evtx", _String2=".") returned 1 [0071.918] wcscmp (_String1="Microsoft-Windows-LiveId%4Operational.evtx", _String2="..") returned 1 [0071.918] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x38b2098 [0071.918] wcscpy (in: _Dest=0x38b2098, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.918] wcscat (in: _Dest=0x38b2098, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.918] wcscat (in: _Dest=0x38b2098, _Source="Microsoft-Windows-LiveId%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" [0071.918] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b2098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x85c [0071.919] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93d06f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93d06f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-MUI%4Admin.evtx", cAlternateFileName="MI30D3~1.EVT")) returned 1 [0071.919] wcscmp (_String1="Microsoft-Windows-MUI%4Admin.evtx", _String2=".") returned 1 [0071.919] wcscmp (_String1="Microsoft-Windows-MUI%4Admin.evtx", _String2="..") returned 1 [0071.919] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x38b5fa8 [0071.919] wcscpy (in: _Dest=0x38b5fa8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.919] wcscat (in: _Dest=0x38b5fa8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.919] wcscat (in: _Dest=0x38b5fa8, _Source="Microsoft-Windows-MUI%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" [0071.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b5fa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x860 [0071.920] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93aa49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93aa49b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-MUI%4Operational.evtx", cAlternateFileName="MI6F01~1.EVT")) returned 1 [0071.920] wcscmp (_String1="Microsoft-Windows-MUI%4Operational.evtx", _String2=".") returned 1 [0071.920] wcscmp (_String1="Microsoft-Windows-MUI%4Operational.evtx", _String2="..") returned 1 [0071.920] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x542be80 [0071.920] wcscpy (in: _Dest=0x542be80, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.920] wcscat (in: _Dest=0x542be80, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.920] wcscat (in: _Dest=0x542be80, _Source="Microsoft-Windows-MUI%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" [0071.920] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x542be80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x864 [0071.921] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d33b19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9d33b19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-NCSI%4Operational.evtx", cAlternateFileName="MI483C~1.EVT")) returned 1 [0071.921] wcscmp (_String1="Microsoft-Windows-NCSI%4Operational.evtx", _String2=".") returned 1 [0071.921] wcscmp (_String1="Microsoft-Windows-NCSI%4Operational.evtx", _String2="..") returned 1 [0071.921] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x38b2108 [0071.921] wcscpy (in: _Dest=0x38b2108, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.921] wcscat (in: _Dest=0x38b2108, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.921] wcscat (in: _Dest=0x38b2108, _Source="Microsoft-Windows-NCSI%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" [0071.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b2108, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x868 [0071.922] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbcf0ff2, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbcf0ff2, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-NetworkProfile%4Operational.evtx", cAlternateFileName="MIFC66~1.EVT")) returned 1 [0071.922] wcscmp (_String1="Microsoft-Windows-NetworkProfile%4Operational.evtx", _String2=".") returned 1 [0071.922] wcscmp (_String1="Microsoft-Windows-NetworkProfile%4Operational.evtx", _String2="..") returned 1 [0071.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x76) returned 0x388fc20 [0071.922] wcscpy (in: _Dest=0x388fc20, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.922] wcscat (in: _Dest=0x388fc20, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.922] wcscat (in: _Dest=0x388fc20, _Source="Microsoft-Windows-NetworkProfile%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" [0071.922] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x388fc20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x86c [0071.923] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab3154, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ab3154, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Ntfs%4Operational.evtx", cAlternateFileName="MI6E98~1.EVT")) returned 1 [0071.923] wcscmp (_String1="Microsoft-Windows-Ntfs%4Operational.evtx", _String2=".") returned 1 [0071.923] wcscmp (_String1="Microsoft-Windows-Ntfs%4Operational.evtx", _String2="..") returned 1 [0071.923] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x54687f0 [0071.923] wcscpy (in: _Dest=0x54687f0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.923] wcscat (in: _Dest=0x54687f0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.923] wcscat (in: _Dest=0x54687f0, _Source="Microsoft-Windows-Ntfs%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" [0071.923] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54687f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x870 [0071.925] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ad9393, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ad9393, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Ntfs%4WHC.evtx", cAlternateFileName="MIB2AC~1.EVT")) returned 1 [0071.925] wcscmp (_String1="Microsoft-Windows-Ntfs%4WHC.evtx", _String2=".") returned 1 [0071.925] wcscmp (_String1="Microsoft-Windows-Ntfs%4WHC.evtx", _String2="..") returned 1 [0071.925] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x38b5f48 [0071.925] wcscpy (in: _Dest=0x38b5f48, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.925] wcscat (in: _Dest=0x38b5f48, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.925] wcscat (in: _Dest=0x38b5f48, _Source="Microsoft-Windows-Ntfs%4WHC.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" [0071.925] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b5f48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x874 [0071.926] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5fe5cb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5fe5cb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", cAlternateFileName="MI6AFE~1.EVT")) returned 1 [0071.926] wcscmp (_String1="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", _String2=".") returned 1 [0071.926] wcscmp (_String1="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", _String2="..") returned 1 [0071.926] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa6) returned 0x388f880 [0071.926] wcscpy (in: _Dest=0x388f880, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.926] wcscat (in: _Dest=0x388f880, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.926] wcscat (in: _Dest=0x388f880, _Source="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" [0071.926] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x388f880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x878 [0071.927] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24cdef0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe24cdef0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-ReadyBoost%4Operational.evtx", cAlternateFileName="MIB9D2~1.EVT")) returned 1 [0071.927] wcscmp (_String1="Microsoft-Windows-ReadyBoost%4Operational.evtx", _String2=".") returned 1 [0071.927] wcscmp (_String1="Microsoft-Windows-ReadyBoost%4Operational.evtx", _String2="..") returned 1 [0071.927] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6e) returned 0x5467878 [0071.927] wcscpy (in: _Dest=0x5467878, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.927] wcscat (in: _Dest=0x5467878, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.927] wcscat (in: _Dest=0x5467878, _Source="Microsoft-Windows-ReadyBoost%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" [0071.927] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5467878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x87c [0071.928] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd125335f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd125335f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", cAlternateFileName="MI7A67~1.EVT")) returned 1 [0071.928] wcscmp (_String1="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", _String2=".") returned 1 [0071.928] wcscmp (_String1="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", _String2="..") returned 1 [0071.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x92) returned 0x5426408 [0071.928] wcscpy (in: _Dest=0x5426408, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.928] wcscat (in: _Dest=0x5426408, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.928] wcscat (in: _Dest=0x5426408, _Source="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" [0071.928] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5426408, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x880 [0071.929] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SettingSync%4Debug.evtx", cAlternateFileName="MI3773~1.EVT")) returned 1 [0071.929] wcscmp (_String1="Microsoft-Windows-SettingSync%4Debug.evtx", _String2=".") returned 1 [0071.929] wcscmp (_String1="Microsoft-Windows-SettingSync%4Debug.evtx", _String2="..") returned 1 [0071.929] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x5468c50 [0071.929] wcscpy (in: _Dest=0x5468c50, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.929] wcscat (in: _Dest=0x5468c50, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.929] wcscat (in: _Dest=0x5468c50, _Source="Microsoft-Windows-SettingSync%4Debug.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" [0071.929] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5468c50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x884 [0071.930] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SettingSync%4Operational.evtx", cAlternateFileName="MI36AA~1.EVT")) returned 1 [0071.930] wcscmp (_String1="Microsoft-Windows-SettingSync%4Operational.evtx", _String2=".") returned 1 [0071.930] wcscmp (_String1="Microsoft-Windows-SettingSync%4Operational.evtx", _String2="..") returned 1 [0071.930] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x54675a8 [0071.930] wcscpy (in: _Dest=0x54675a8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.930] wcscat (in: _Dest=0x54675a8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.930] wcscat (in: _Dest=0x54675a8, _Source="Microsoft-Windows-SettingSync%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" [0071.930] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54675a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x888 [0071.931] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", cAlternateFileName="MI2E2E~1.EVT")) returned 1 [0071.931] wcscmp (_String1="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", _String2=".") returned 1 [0071.931] wcscmp (_String1="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", _String2="..") returned 1 [0071.931] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5467e90 [0071.931] wcscpy (in: _Dest=0x5467e90, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.931] wcscat (in: _Dest=0x5467e90, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.931] wcscat (in: _Dest=0x5467e90, _Source="Microsoft-Windows-Shell-Core%4ActionCenter.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" [0071.931] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5467e90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x88c [0071.932] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Shell-Core%4Operational.evtx", cAlternateFileName="MI1C6C~1.EVT")) returned 1 [0071.932] wcscmp (_String1="Microsoft-Windows-Shell-Core%4Operational.evtx", _String2=".") returned 1 [0071.932] wcscmp (_String1="Microsoft-Windows-Shell-Core%4Operational.evtx", _String2="..") returned 1 [0071.932] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6e) returned 0x54674b8 [0071.932] wcscpy (in: _Dest=0x54674b8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.932] wcscat (in: _Dest=0x54674b8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.932] wcscat (in: _Dest=0x54674b8, _Source="Microsoft-Windows-Shell-Core%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" [0071.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54674b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x890 [0071.932] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SmbClient%4Connectivity.evtx", cAlternateFileName="MI00FB~1.EVT")) returned 1 [0071.932] wcscmp (_String1="Microsoft-Windows-SmbClient%4Connectivity.evtx", _String2=".") returned 1 [0071.933] wcscmp (_String1="Microsoft-Windows-SmbClient%4Connectivity.evtx", _String2="..") returned 1 [0071.933] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6e) returned 0x5467260 [0071.933] wcscpy (in: _Dest=0x5467260, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.933] wcscat (in: _Dest=0x5467260, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.933] wcscat (in: _Dest=0x5467260, _Source="Microsoft-Windows-SmbClient%4Connectivity.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" [0071.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5467260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x894 [0071.933] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b042f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97b042f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBClient%4Operational.evtx", cAlternateFileName="MID8B0~1.EVT")) returned 1 [0071.933] wcscmp (_String1="Microsoft-Windows-SMBClient%4Operational.evtx", _String2=".") returned 1 [0071.933] wcscmp (_String1="Microsoft-Windows-SMBClient%4Operational.evtx", _String2="..") returned 1 [0071.934] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6c) returned 0x54672d8 [0071.934] wcscpy (in: _Dest=0x54672d8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.934] wcscat (in: _Dest=0x54672d8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.934] wcscat (in: _Dest=0x54672d8, _Source="Microsoft-Windows-SMBClient%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" [0071.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54672d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x898 [0071.934] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SmbClient%4Security.evtx", cAlternateFileName="MI8CEE~1.EVT")) returned 1 [0071.934] wcscmp (_String1="Microsoft-Windows-SmbClient%4Security.evtx", _String2=".") returned 1 [0071.934] wcscmp (_String1="Microsoft-Windows-SmbClient%4Security.evtx", _String2="..") returned 1 [0071.934] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x54689b0 [0071.934] wcscpy (in: _Dest=0x54689b0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0071.934] wcscat (in: _Dest=0x54689b0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0071.934] wcscat (in: _Dest=0x54689b0, _Source="Microsoft-Windows-SmbClient%4Security.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" [0071.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54689b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x89c [0071.935] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1ea1c9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb1ea1c9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Audit.evtx", cAlternateFileName="MIE3AD~1.EVT")) returned 1 [0074.845] wcscmp (_String1="Microsoft-Windows-SMBServer%4Audit.evtx", _String2=".") returned 1 [0074.845] wcscmp (_String1="Microsoft-Windows-SMBServer%4Audit.evtx", _String2="..") returned 1 [0074.845] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x38fd000 [0074.845] wcscpy (in: _Dest=0x38fd000, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0074.845] wcscat (in: _Dest=0x38fd000, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0074.845] wcscat (in: _Dest=0x38fd000, _Source="Microsoft-Windows-SMBServer%4Audit.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" [0074.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fd000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb88 [0074.846] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19dd19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb19dd19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Connectivity.evtx", cAlternateFileName="MI8248~1.EVT")) returned 1 [0074.846] wcscmp (_String1="Microsoft-Windows-SMBServer%4Connectivity.evtx", _String2=".") returned 1 [0074.846] wcscmp (_String1="Microsoft-Windows-SMBServer%4Connectivity.evtx", _String2="..") returned 1 [0074.846] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6e) returned 0x5467bc0 [0074.846] wcscpy (in: _Dest=0x5467bc0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0074.846] wcscat (in: _Dest=0x5467bc0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0074.846] wcscat (in: _Dest=0x5467bc0, _Source="Microsoft-Windows-SMBServer%4Connectivity.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" [0074.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5467bc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbd4 [0074.846] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb151873, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb151873, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Operational.evtx", cAlternateFileName="MI4B6B~1.EVT")) returned 1 [0074.846] wcscmp (_String1="Microsoft-Windows-SMBServer%4Operational.evtx", _String2=".") returned 1 [0074.846] wcscmp (_String1="Microsoft-Windows-SMBServer%4Operational.evtx", _String2="..") returned 1 [0074.846] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6c) returned 0x54670f8 [0074.847] wcscpy (in: _Dest=0x54670f8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0074.847] wcscat (in: _Dest=0x54670f8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0074.847] wcscat (in: _Dest=0x54670f8, _Source="Microsoft-Windows-SMBServer%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" [0074.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54670f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbd8 [0074.847] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb177aca, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb177aca, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Security.evtx", cAlternateFileName="MI7709~1.EVT")) returned 1 [0074.847] wcscmp (_String1="Microsoft-Windows-SMBServer%4Security.evtx", _String2=".") returned 1 [0074.847] wcscmp (_String1="Microsoft-Windows-SMBServer%4Security.evtx", _String2="..") returned 1 [0074.847] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x396ddc0 [0074.847] wcscpy (in: _Dest=0x396ddc0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0074.847] wcscat (in: _Dest=0x396ddc0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0074.847] wcscat (in: _Dest=0x396ddc0, _Source="Microsoft-Windows-SMBServer%4Security.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" [0074.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396ddc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbdc [0074.848] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd751ea61, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd751ea61, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Store%4Operational.evtx", cAlternateFileName="MICEDD~1.EVT")) returned 1 [0074.848] wcscmp (_String1="Microsoft-Windows-Store%4Operational.evtx", _String2=".") returned 1 [0074.848] wcscmp (_String1="Microsoft-Windows-Store%4Operational.evtx", _String2="..") returned 1 [0074.848] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x396d880 [0074.848] wcscpy (in: _Dest=0x396d880, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0074.848] wcscat (in: _Dest=0x396d880, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0074.848] wcscat (in: _Dest=0x396d880, _Source="Microsoft-Windows-Store%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" [0074.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396d880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbe0 [0074.849] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0763ff, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd0763ff, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", cAlternateFileName="MIE2F0~1.EVT")) returned 1 [0074.849] wcscmp (_String1="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", _String2=".") returned 1 [0074.849] wcscmp (_String1="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", _String2="..") returned 1 [0074.849] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x74) returned 0x38d0ba0 [0074.849] wcscpy (in: _Dest=0x38d0ba0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0074.849] wcscat (in: _Dest=0x38d0ba0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0074.849] wcscat (in: _Dest=0x38d0ba0, _Source="Microsoft-Windows-TaskScheduler%4Maintenance.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" [0074.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d0ba0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbe4 [0074.850] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5089d037, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5089d037, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", cAlternateFileName="MIAB1D~1.EVT")) returned 1 [0074.850] wcscmp (_String1="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", _String2=".") returned 1 [0074.850] wcscmp (_String1="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", _String2="..") returned 1 [0074.850] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x96) returned 0x5426728 [0074.850] wcscpy (in: _Dest=0x5426728, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0074.850] wcscat (in: _Dest=0x5426728, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0074.850] wcscat (in: _Dest=0x5426728, _Source="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" [0074.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5426728, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbe8 [0074.850] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508c32a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x508c32a6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", cAlternateFileName="MI62D3~1.EVT")) returned 1 [0074.850] wcscmp (_String1="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", _String2=".") returned 1 [0074.850] wcscmp (_String1="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", _String2="..") returned 1 [0074.850] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa2) returned 0x388ecd0 [0074.850] wcscpy (in: _Dest=0x388ecd0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0074.851] wcscat (in: _Dest=0x388ecd0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0074.851] wcscat (in: _Dest=0x388ecd0, _Source="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" [0074.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x388ecd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbec [0074.852] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc14341c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc14341c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", cAlternateFileName="MIEC03~1.EVT")) returned 1 [0074.852] wcscmp (_String1="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", _String2=".") returned 1 [0074.852] wcscmp (_String1="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", _String2="..") returned 1 [0074.852] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9e) returned 0x38abdb8 [0074.852] wcscpy (in: _Dest=0x38abdb8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0074.852] wcscat (in: _Dest=0x38abdb8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0074.852] wcscat (in: _Dest=0x38abdb8, _Source="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" [0074.852] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38abdb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbf0 [0074.852] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1b5b23, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1b5b23, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", cAlternateFileName="MI1F5D~1.EVT")) returned 1 [0074.852] wcscmp (_String1="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", _String2=".") returned 1 [0074.852] wcscmp (_String1="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", _String2="..") returned 1 [0074.852] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xaa) returned 0x5446b50 [0074.853] wcscpy (in: _Dest=0x5446b50, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0074.853] wcscat (in: _Dest=0x5446b50, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0074.853] wcscat (in: _Dest=0x5446b50, _Source="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" [0074.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5446b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbf4 [0074.853] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74ac348, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74ac348, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TWinUI%4Operational.evtx", cAlternateFileName="MIA925~1.EVT")) returned 1 [0074.853] wcscmp (_String1="Microsoft-Windows-TWinUI%4Operational.evtx", _String2=".") returned 1 [0074.853] wcscmp (_String1="Microsoft-Windows-TWinUI%4Operational.evtx", _String2="..") returned 1 [0074.853] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x396e060 [0074.853] wcscpy (in: _Dest=0x396e060, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0074.853] wcscat (in: _Dest=0x396e060, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0074.853] wcscat (in: _Dest=0x396e060, _Source="Microsoft-Windows-TWinUI%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" [0074.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396e060, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbf8 [0074.854] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50aff605, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50aff605, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-User Profile Service%4Operational.evtx", cAlternateFileName="MI4D4C~1.EVT")) returned 1 [0074.854] wcscmp (_String1="Microsoft-Windows-User Profile Service%4Operational.evtx", _String2=".") returned 1 [0074.854] wcscmp (_String1="Microsoft-Windows-User Profile Service%4Operational.evtx", _String2="..") returned 1 [0074.854] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x82) returned 0x38a9838 [0074.854] wcscpy (in: _Dest=0x38a9838, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0074.854] wcscat (in: _Dest=0x38a9838, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0074.854] wcscat (in: _Dest=0x38a9838, _Source="Microsoft-Windows-User Profile Service%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" [0074.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38a9838, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbfc [0074.855] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50981e6e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50981e6e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-UserPnp%4ActionCenter.evtx", cAlternateFileName="MI5FF0~1.EVT")) returned 1 [0074.855] wcscmp (_String1="Microsoft-Windows-UserPnp%4ActionCenter.evtx", _String2=".") returned 1 [0074.855] wcscmp (_String1="Microsoft-Windows-UserPnp%4ActionCenter.evtx", _String2="..") returned 1 [0074.855] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6a) returned 0x5467b48 [0074.855] wcscpy (in: _Dest=0x5467b48, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0074.855] wcscat (in: _Dest=0x5467b48, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0074.855] wcscat (in: _Dest=0x5467b48, _Source="Microsoft-Windows-UserPnp%4ActionCenter.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" [0074.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5467b48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc04 [0074.856] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5095bc04, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5095bc04, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", cAlternateFileName="MIBD88~1.EVT")) returned 1 [0074.856] wcscmp (_String1="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", _String2=".") returned 1 [0074.856] wcscmp (_String1="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", _String2="..") returned 1 [0074.856] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6c) returned 0x5467c38 [0074.856] wcscpy (in: _Dest=0x5467c38, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0074.856] wcscat (in: _Dest=0x5467c38, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0074.856] wcscat (in: _Dest=0x5467c38, _Source="Microsoft-Windows-UserPnp%4DeviceInstall.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" [0074.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5467c38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc08 [0074.856] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b97f64, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b97f64, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", cAlternateFileName="MICC17~1.EVT")) returned 1 [0074.856] wcscmp (_String1="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", _String2=".") returned 1 [0074.857] wcscmp (_String1="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", _String2="..") returned 1 [0074.857] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x84) returned 0x38a8ea8 [0074.857] wcscpy (in: _Dest=0x38a8ea8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0074.857] wcscat (in: _Dest=0x38a8ea8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0074.857] wcscat (in: _Dest=0x38a8ea8, _Source="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" [0074.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38a8ea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc0c [0074.857] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc986efe1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc986efe1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Wcmsvc%4Operational.evtx", cAlternateFileName="MI72BF~1.EVT")) returned 1 [0074.857] wcscmp (_String1="Microsoft-Windows-Wcmsvc%4Operational.evtx", _String2=".") returned 1 [0074.857] wcscmp (_String1="Microsoft-Windows-Wcmsvc%4Operational.evtx", _String2="..") returned 1 [0074.857] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x396de30 [0074.857] wcscpy (in: _Dest=0x396de30, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0074.857] wcscat (in: _Dest=0x396de30, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0074.857] wcscat (in: _Dest=0x396de30, _Source="Microsoft-Windows-Wcmsvc%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" [0074.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396de30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc10 [0074.858] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb426548, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb426548, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Defender%4Operational.evtx", cAlternateFileName="MI7501~1.EVT")) returned 1 [0074.858] wcscmp (_String1="Microsoft-Windows-Windows Defender%4Operational.evtx", _String2=".") returned 1 [0074.858] wcscmp (_String1="Microsoft-Windows-Windows Defender%4Operational.evtx", _String2="..") returned 1 [0074.858] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7a) returned 0x5409e90 [0074.858] wcscpy (in: _Dest=0x5409e90, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0074.858] wcscat (in: _Dest=0x5409e90, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0074.858] wcscat (in: _Dest=0x5409e90, _Source="Microsoft-Windows-Windows Defender%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" [0074.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5409e90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc14 [0074.859] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4729e7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb4729e7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Defender%4WHC.evtx", cAlternateFileName="MIF226~1.EVT")) returned 1 [0074.859] wcscmp (_String1="Microsoft-Windows-Windows Defender%4WHC.evtx", _String2=".") returned 1 [0074.859] wcscmp (_String1="Microsoft-Windows-Windows Defender%4WHC.evtx", _String2="..") returned 1 [0074.859] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6a) returned 0x5467cb0 [0074.859] wcscpy (in: _Dest=0x5467cb0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0074.859] wcscat (in: _Dest=0x5467cb0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0074.859] wcscat (in: _Dest=0x5467cb0, _Source="Microsoft-Windows-Windows Defender%4WHC.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" [0074.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5467cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc18 [0074.860] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b19353, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4b19353, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", cAlternateFileName="MIDCC7~1.EVT")) returned 1 [0074.860] wcscmp (_String1="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", _String2=".") returned 1 [0074.860] wcscmp (_String1="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", _String2="..") returned 1 [0074.860] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb6) returned 0x3904ae0 [0074.860] wcscpy (in: _Dest=0x3904ae0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0074.860] wcscat (in: _Dest=0x3904ae0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0074.860] wcscat (in: _Dest=0x3904ae0, _Source="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" [0074.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3904ae0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc1c [0074.861] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c9b1b6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9c9b1b6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", cAlternateFileName="MI7771~1.EVT")) returned 1 [0075.734] wcscmp (_String1="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", _String2=".") returned 1 [0075.734] wcscmp (_String1="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", _String2="..") returned 1 [0075.734] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa2) returned 0x54de190 [0075.734] wcscpy (in: _Dest=0x54de190, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0075.734] wcscat (in: _Dest=0x54de190, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0075.734] wcscat (in: _Dest=0x54de190, _Source="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" [0075.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54de190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0 [0075.746] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9df26e9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9df26e9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", cAlternateFileName="MI4667~1.EVT")) returned 1 [0075.746] wcscmp (_String1="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", _String2=".") returned 1 [0075.746] wcscmp (_String1="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", _String2="..") returned 1 [0075.746] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x84) returned 0x38a93b8 [0075.746] wcscpy (in: _Dest=0x38a93b8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0075.746] wcscat (in: _Dest=0x38a93b8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0075.747] wcscat (in: _Dest=0x38a93b8, _Source="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" [0075.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38a93b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x738 [0075.747] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd122d184, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd122d184, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Winlogon%4Operational.evtx", cAlternateFileName="MID6AB~1.EVT")) returned 1 [0075.747] wcscmp (_String1="Microsoft-Windows-Winlogon%4Operational.evtx", _String2=".") returned 1 [0075.747] wcscmp (_String1="Microsoft-Windows-Winlogon%4Operational.evtx", _String2="..") returned 1 [0075.747] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6a) returned 0x5497340 [0075.747] wcscpy (in: _Dest=0x5497340, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0075.747] wcscat (in: _Dest=0x5497340, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0075.747] wcscat (in: _Dest=0x5497340, _Source="Microsoft-Windows-Winlogon%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" [0075.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5497340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x730 [0075.748] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf164b9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcf164b9b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-WMI-Activity%4Operational.evtx", cAlternateFileName="MIFF83~1.EVT")) returned 1 [0075.748] wcscmp (_String1="Microsoft-Windows-WMI-Activity%4Operational.evtx", _String2=".") returned 1 [0075.748] wcscmp (_String1="Microsoft-Windows-WMI-Activity%4Operational.evtx", _String2="..") returned 1 [0075.748] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x72) returned 0x38d12a0 [0075.748] wcscpy (in: _Dest=0x38d12a0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0075.748] wcscat (in: _Dest=0x38d12a0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0075.748] wcscat (in: _Dest=0x38d12a0, _Source="Microsoft-Windows-WMI-Activity%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" [0075.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d12a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x72c [0075.749] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9a458f4, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security.evtx", cAlternateFileName="SECURI~1.EVT")) returned 1 [0075.749] wcscmp (_String1="Security.evtx", _String2=".") returned 1 [0075.749] wcscmp (_String1="Security.evtx", _String2="..") returned 1 [0075.749] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2c) returned 0x5531e38 [0075.749] wcscpy (in: _Dest=0x5531e38, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0075.749] wcscat (in: _Dest=0x5531e38, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0075.749] wcscat (in: _Dest=0x5531e38, _Source="Security.evtx" | out: _Dest="C:\\Logs\\Security.evtx") returned="C:\\Logs\\Security.evtx" [0075.749] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5531e38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x724 [0075.750] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a6db2c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x95a6db2c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.evtx", cAlternateFileName="SETUP~1.EVT")) returned 1 [0075.750] wcscmp (_String1="Setup.evtx", _String2=".") returned 1 [0075.750] wcscmp (_String1="Setup.evtx", _String2="..") returned 1 [0075.750] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x26) returned 0x38a6610 [0075.750] wcscpy (in: _Dest=0x38a6610, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0075.750] wcscat (in: _Dest=0x38a6610, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0075.750] wcscat (in: _Dest=0x38a6610, _Source="Setup.evtx" | out: _Dest="C:\\Logs\\Setup.evtx") returned="C:\\Logs\\Setup.evtx" [0075.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38a6610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x708 [0075.750] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505097c4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505097c4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.evtx", cAlternateFileName="SYSTEM~1.EVT")) returned 1 [0075.750] wcscmp (_String1="System.evtx", _String2=".") returned 1 [0075.750] wcscmp (_String1="System.evtx", _String2="..") returned 1 [0075.751] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x28) returned 0x38a6a00 [0075.751] wcscpy (in: _Dest=0x38a6a00, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0075.751] wcscat (in: _Dest=0x38a6a00, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0075.751] wcscat (in: _Dest=0x38a6a00, _Source="System.evtx" | out: _Dest="C:\\Logs\\System.evtx") returned="C:\\Logs\\System.evtx" [0075.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38a6a00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x550 [0075.751] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 1 [0075.751] wcscmp (_String1="Windows PowerShell.evtx", _String2=".") returned 1 [0075.751] wcscmp (_String1="Windows PowerShell.evtx", _String2="..") returned 1 [0075.751] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a6388 [0075.751] wcscpy (in: _Dest=0x38a6388, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0075.751] wcscat (in: _Dest=0x38a6388, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0075.751] wcscat (in: _Dest=0x38a6388, _Source="Windows PowerShell.evtx" | out: _Dest="C:\\Logs\\Windows PowerShell.evtx") returned="C:\\Logs\\Windows PowerShell.evtx" [0075.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38a6388, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x664 [0075.753] FindNextFileW (in: hFindFile=0x389f480, lpFindFileData=0x38b0ba0 | out: lpFindFileData=0x38b0ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 0 [0076.199] FindClose (hFindFile=0x389f480) Thread: id = 32 os_tid = 0xc94 [0070.876] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x26) returned 0x38a6880 [0070.876] wcscpy (in: _Dest=0x38a6880, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0070.876] wcscat (in: _Dest=0x38a6880, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0070.877] wcscat (in: _Dest=0x38a6880, _Source="*" | out: _Dest="C:\\Program Files\\*") returned="C:\\Program Files\\*" [0070.877] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x38b16d8 [0070.877] FindFirstFileW (in: lpFileName="C:\\Program Files\\*", lpFindFileData=0x38b16d8 | out: lpFindFileData=0x38b16d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x413f1d3b, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x413f1d3b, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f040 [0070.877] wcscmp (_String1=".", _String2=".") returned 0 [0070.877] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b16d8 | out: lpFindFileData=0x38b16d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x413f1d3b, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x413f1d3b, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.877] wcscmp (_String1="..", _String2=".") returned 1 [0070.877] wcscmp (_String1="..", _String2="..") returned 0 [0070.877] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b16d8 | out: lpFindFileData=0x38b16d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0070.877] wcscmp (_String1="Common Files", _String2=".") returned 1 [0070.877] wcscmp (_String1="Common Files", _String2="..") returned 1 [0070.877] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3c) returned 0x38a6418 [0070.877] wcscpy (in: _Dest=0x38a6418, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0070.877] wcscat (in: _Dest=0x38a6418, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0070.877] wcscat (in: _Dest=0x38a6418, _Source="Common Files" | out: _Dest="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0070.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a6418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x39c [0070.878] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b16d8 | out: lpFindFileData=0x38b16d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a307d95, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5d0779b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5d0779b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0070.878] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0070.878] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0070.878] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b16d8 | out: lpFindFileData=0x38b16d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b2729cb, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b2729cb, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0070.878] wcscmp (_String1="Internet Explorer", _String2=".") returned 1 [0070.878] wcscmp (_String1="Internet Explorer", _String2="..") returned 1 [0070.878] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x46) returned 0x3892b60 [0070.878] wcscpy (in: _Dest=0x3892b60, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0070.878] wcscat (in: _Dest=0x3892b60, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0070.878] wcscat (in: _Dest=0x3892b60, _Source="Internet Explorer" | out: _Dest="C:\\Program Files\\Internet Explorer") returned="C:\\Program Files\\Internet Explorer" [0070.878] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3892b60) returned 1 [0070.878] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b16d8 | out: lpFindFileData=0x38b16d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3b2729cb, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b2729cb, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0070.878] wcscmp (_String1="Java", _String2=".") returned 1 [0070.878] wcscmp (_String1="Java", _String2="..") returned 1 [0070.878] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2c) returned 0x38aa238 [0070.878] wcscpy (in: _Dest=0x38aa238, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0070.878] wcscat (in: _Dest=0x38aa238, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0070.878] wcscat (in: _Dest=0x38aa238, _Source="Java" | out: _Dest="C:\\Program Files\\Java") returned="C:\\Program Files\\Java" [0070.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38aa238, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a0 [0070.879] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b16d8 | out: lpFindFileData=0x38b16d8*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x39fd2260, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39fd2260, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~2")) returned 1 [0070.879] wcscmp (_String1="Microsoft Office", _String2=".") returned 1 [0070.879] wcscmp (_String1="Microsoft Office", _String2="..") returned 1 [0070.879] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x3892b60 [0070.879] wcscpy (in: _Dest=0x3892b60, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0070.879] wcscat (in: _Dest=0x3892b60, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0070.879] wcscat (in: _Dest=0x3892b60, _Source="Microsoft Office" | out: _Dest="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0070.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3892b60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a4 [0070.880] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b16d8 | out: lpFindFileData=0x38b16d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b1d9def, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b1d9def, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office 15", cAlternateFileName="MICROS~1")) returned 1 [0070.880] wcscmp (_String1="Microsoft Office 15", _String2=".") returned 1 [0070.880] wcscmp (_String1="Microsoft Office 15", _String2="..") returned 1 [0070.880] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x5470f88 [0070.880] wcscpy (in: _Dest=0x5470f88, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0070.880] wcscat (in: _Dest=0x5470f88, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0070.880] wcscat (in: _Dest=0x5470f88, _Source="Microsoft Office 15" | out: _Dest="C:\\Program Files\\Microsoft Office 15") returned="C:\\Program Files\\Microsoft Office 15" [0070.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5470f88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a8 [0070.881] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b16d8 | out: lpFindFileData=0x38b16d8*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xe99e772e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa7154510, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf7d369cb, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1 [0070.881] wcscmp (_String1="Mozilla Firefox", _String2=".") returned 1 [0070.881] wcscmp (_String1="Mozilla Firefox", _String2="..") returned 1 [0070.881] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x42) returned 0x38b3368 [0070.881] wcscpy (in: _Dest=0x38b3368, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0070.881] wcscat (in: _Dest=0x38b3368, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0070.881] wcscat (in: _Dest=0x38b3368, _Source="Mozilla Firefox" | out: _Dest="C:\\Program Files\\Mozilla Firefox") returned="C:\\Program Files\\Mozilla Firefox" [0070.881] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b3368) returned 1 [0070.881] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b16d8 | out: lpFindFileData=0x38b16d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0x3b2261df, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b2261df, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0070.881] wcscmp (_String1="MSBuild", _String2=".") returned 1 [0070.881] wcscmp (_String1="MSBuild", _String2="..") returned 1 [0070.881] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x32) returned 0x389f400 [0070.881] wcscpy (in: _Dest=0x389f400, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0070.881] wcscat (in: _Dest=0x389f400, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0070.881] wcscat (in: _Dest=0x389f400, _Source="MSBuild" | out: _Dest="C:\\Program Files\\MSBuild") returned="C:\\Program Files\\MSBuild" [0070.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389f400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ac [0070.882] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b16d8 | out: lpFindFileData=0x38b16d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe795770f, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe795770f, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe795770f, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0070.882] wcscmp (_String1="Reference Assemblies", _String2=".") returned 1 [0070.882] wcscmp (_String1="Reference Assemblies", _String2="..") returned 1 [0070.882] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x3887bc0 [0070.882] wcscpy (in: _Dest=0x3887bc0, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0070.882] wcscat (in: _Dest=0x3887bc0, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0070.882] wcscat (in: _Dest=0x3887bc0, _Source="Reference Assemblies" | out: _Dest="C:\\Program Files\\Reference Assemblies") returned="C:\\Program Files\\Reference Assemblies" [0070.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3887bc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0 [0070.883] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b16d8 | out: lpFindFileData=0x38b16d8*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x59f2f4b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x39ff826d, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39ff826d, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rempl", cAlternateFileName="")) returned 1 [0070.883] wcscmp (_String1="rempl", _String2=".") returned 1 [0070.883] wcscmp (_String1="rempl", _String2="..") returned 1 [0070.883] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2e) returned 0x38aa158 [0070.883] wcscpy (in: _Dest=0x38aa158, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0070.883] wcscat (in: _Dest=0x38aa158, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0070.883] wcscat (in: _Dest=0x38aa158, _Source="rempl" | out: _Dest="C:\\Program Files\\rempl") returned="C:\\Program Files\\rempl" [0070.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38aa158, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b4 [0070.883] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b16d8 | out: lpFindFileData=0x38b16d8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xd2709a20, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xa747e827, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2709a20, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0070.883] wcscmp (_String1="Uninstall Information", _String2=".") returned 1 [0070.884] wcscmp (_String1="Uninstall Information", _String2="..") returned 1 [0070.884] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x38883d8 [0070.884] wcscpy (in: _Dest=0x38883d8, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0070.884] wcscat (in: _Dest=0x38883d8, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0070.884] wcscat (in: _Dest=0x38883d8, _Source="Uninstall Information" | out: _Dest="C:\\Program Files\\Uninstall Information") returned="C:\\Program Files\\Uninstall Information" [0070.884] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38883d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b8 [0070.884] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b16d8 | out: lpFindFileData=0x38b16d8*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4c509d45, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x39fd2260, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39fd2260, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UNP", cAlternateFileName="")) returned 1 [0070.884] wcscmp (_String1="UNP", _String2=".") returned 1 [0070.884] wcscmp (_String1="UNP", _String2="..") returned 1 [0070.884] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2a) returned 0x38a9d68 [0070.884] wcscpy (in: _Dest=0x38a9d68, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0070.884] wcscat (in: _Dest=0x38a9d68, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0070.884] wcscat (in: _Dest=0x38a9d68, _Source="UNP" | out: _Dest="C:\\Program Files\\UNP") returned="C:\\Program Files\\UNP" [0070.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a9d68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3bc [0070.885] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b16d8 | out: lpFindFileData=0x38b16d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b2261df, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b2261df, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0070.885] wcscmp (_String1="Windows Defender", _String2=".") returned 1 [0070.885] wcscmp (_String1="Windows Defender", _String2="..") returned 1 [0070.885] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x38b2dc8 [0070.888] wcscpy (in: _Dest=0x38b2dc8, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0070.888] wcscat (in: _Dest=0x38b2dc8, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0070.888] wcscat (in: _Dest=0x38b2dc8, _Source="Windows Defender" | out: _Dest="C:\\Program Files\\Windows Defender") returned="C:\\Program Files\\Windows Defender" [0070.888] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b2dc8) returned 1 [0070.888] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b16d8 | out: lpFindFileData=0x38b16d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x3b200123, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b200123, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender Advanced Threat Protection", cAlternateFileName="WIF4A9~1")) returned 1 [0070.888] wcscmp (_String1="Windows Defender Advanced Threat Protection", _String2=".") returned 1 [0070.888] wcscmp (_String1="Windows Defender Advanced Threat Protection", _String2="..") returned 1 [0070.888] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7a) returned 0x3889d00 [0070.888] wcscpy (in: _Dest=0x3889d00, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0070.888] wcscat (in: _Dest=0x3889d00, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0070.888] wcscat (in: _Dest=0x3889d00, _Source="Windows Defender Advanced Threat Protection" | out: _Dest="C:\\Program Files\\Windows Defender Advanced Threat Protection") returned="C:\\Program Files\\Windows Defender Advanced Threat Protection" [0070.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3889d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x394 [0070.889] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b16d8 | out: lpFindFileData=0x38b16d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b1b3cbc, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b1b3cbc, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~2")) returned 1 [0070.889] wcscmp (_String1="Windows Mail", _String2=".") returned 1 [0070.889] wcscmp (_String1="Windows Mail", _String2="..") returned 1 [0070.889] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3c) returned 0x38a6220 [0070.889] wcscpy (in: _Dest=0x38a6220, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0070.889] wcscat (in: _Dest=0x38a6220, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0070.889] wcscat (in: _Dest=0x38a6220, _Source="Windows Mail" | out: _Dest="C:\\Program Files\\Windows Mail") returned="C:\\Program Files\\Windows Mail" [0070.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a6220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c0 [0070.890] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b16d8 | out: lpFindFileData=0x38b16d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e4faee, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9123675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0070.890] wcscmp (_String1="Windows Media Player", _String2=".") returned 1 [0070.890] wcscmp (_String1="Windows Media Player", _String2="..") returned 1 [0070.890] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x3884a60 [0070.890] wcscpy (in: _Dest=0x3884a60, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0070.890] wcscat (in: _Dest=0x3884a60, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0070.890] wcscat (in: _Dest=0x3884a60, _Source="Windows Media Player" | out: _Dest="C:\\Program Files\\Windows Media Player") returned="C:\\Program Files\\Windows Media Player" [0070.890] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3884a60) returned 1 [0070.890] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b16d8 | out: lpFindFileData=0x38b16d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b11b239, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b11b239, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Multimedia Platform", cAlternateFileName="WINDOW~3")) returned 1 [0070.890] wcscmp (_String1="Windows Multimedia Platform", _String2=".") returned 1 [0070.890] wcscmp (_String1="Windows Multimedia Platform", _String2="..") returned 1 [0070.890] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x3884a60 [0070.890] wcscpy (in: _Dest=0x3884a60, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0070.890] wcscat (in: _Dest=0x3884a60, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0070.890] wcscat (in: _Dest=0x3884a60, _Source="Windows Multimedia Platform" | out: _Dest="C:\\Program Files\\Windows Multimedia Platform") returned="C:\\Program Files\\Windows Multimedia Platform" [0070.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3884a60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c4 [0070.891] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b16d8 | out: lpFindFileData=0x38b16d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c8710, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~4")) returned 1 [0070.891] wcscmp (_String1="Windows NT", _String2=".") returned 1 [0070.891] wcscmp (_String1="Windows NT", _String2="..") returned 1 [0070.891] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x38) returned 0x389f600 [0070.891] wcscpy (in: _Dest=0x389f600, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0070.891] wcscat (in: _Dest=0x389f600, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0070.891] wcscat (in: _Dest=0x389f600, _Source="Windows NT" | out: _Dest="C:\\Program Files\\Windows NT") returned="C:\\Program Files\\Windows NT" [0070.891] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f600) returned 1 [0070.891] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b16d8 | out: lpFindFileData=0x38b16d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b141433, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b141433, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WI8A19~1")) returned 1 [0070.891] wcscmp (_String1="Windows Photo Viewer", _String2=".") returned 1 [0070.891] wcscmp (_String1="Windows Photo Viewer", _String2="..") returned 1 [0070.891] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x38804a0 [0070.891] wcscpy (in: _Dest=0x38804a0, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0070.891] wcscat (in: _Dest=0x38804a0, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0070.891] wcscat (in: _Dest=0x38804a0, _Source="Windows Photo Viewer" | out: _Dest="C:\\Program Files\\Windows Photo Viewer") returned="C:\\Program Files\\Windows Photo Viewer" [0070.891] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38804a0) returned 1 [0070.891] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b16d8 | out: lpFindFileData=0x38b16d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b24c5d6, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b24c5d6, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0070.891] wcscmp (_String1="Windows Portable Devices", _String2=".") returned 1 [0070.891] wcscmp (_String1="Windows Portable Devices", _String2="..") returned 1 [0070.891] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x38804a0 [0070.891] wcscpy (in: _Dest=0x38804a0, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0070.891] wcscat (in: _Dest=0x38804a0, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0070.891] wcscat (in: _Dest=0x38804a0, _Source="Windows Portable Devices" | out: _Dest="C:\\Program Files\\Windows Portable Devices") returned="C:\\Program Files\\Windows Portable Devices" [0070.891] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38804a0) returned 1 [0070.891] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b16d8 | out: lpFindFileData=0x38b16d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b11b239, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b11b239, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Security", cAlternateFileName="WIDB62~1")) returned 1 [0070.891] wcscmp (_String1="Windows Security", _String2=".") returned 1 [0070.892] wcscmp (_String1="Windows Security", _String2="..") returned 1 [0070.892] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x3892b10 [0070.892] wcscpy (in: _Dest=0x3892b10, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0070.892] wcscat (in: _Dest=0x3892b10, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0070.892] wcscat (in: _Dest=0x3892b10, _Source="Windows Security" | out: _Dest="C:\\Program Files\\Windows Security") returned="C:\\Program Files\\Windows Security" [0070.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3892b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c8 [0070.892] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b16d8 | out: lpFindFileData=0x38b16d8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b200123, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b200123, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0070.892] wcscmp (_String1="Windows Sidebar", _String2=".") returned 1 [0070.892] wcscmp (_String1="Windows Sidebar", _String2="..") returned 1 [0070.892] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x42) returned 0x3892ca0 [0070.892] wcscpy (in: _Dest=0x3892ca0, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0070.893] wcscat (in: _Dest=0x3892ca0, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0070.893] wcscat (in: _Dest=0x3892ca0, _Source="Windows Sidebar" | out: _Dest="C:\\Program Files\\Windows Sidebar") returned="C:\\Program Files\\Windows Sidebar" [0070.893] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3892ca0) returned 1 [0070.893] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b16d8 | out: lpFindFileData=0x38b16d8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8da88b6d, ftLastAccessTime.dwHighDateTime=0x1d3274e, ftLastWriteTime.dwLowDateTime=0x8da88b6d, ftLastWriteTime.dwHighDateTime=0x1d3274e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsApps", cAlternateFileName="WI7DB9~1")) returned 1 [0070.893] wcscmp (_String1="WindowsApps", _String2=".") returned 1 [0070.893] wcscmp (_String1="WindowsApps", _String2="..") returned 1 [0070.893] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a62f8 [0070.893] wcscpy (in: _Dest=0x38a62f8, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0070.893] wcscat (in: _Dest=0x38a62f8, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0070.893] wcscat (in: _Dest=0x38a62f8, _Source="WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0070.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a62f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3cc [0070.893] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b16d8 | out: lpFindFileData=0x38b16d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b200123, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b200123, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1 [0070.893] wcscmp (_String1="WindowsPowerShell", _String2=".") returned 1 [0070.893] wcscmp (_String1="WindowsPowerShell", _String2="..") returned 1 [0070.894] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x46) returned 0x3892ca0 [0070.894] wcscpy (in: _Dest=0x3892ca0, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0070.894] wcscat (in: _Dest=0x3892ca0, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0070.894] wcscat (in: _Dest=0x3892ca0, _Source="WindowsPowerShell" | out: _Dest="C:\\Program Files\\WindowsPowerShell") returned="C:\\Program Files\\WindowsPowerShell" [0070.894] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3892ca0) returned 1 [0070.894] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b16d8 | out: lpFindFileData=0x38b16d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b200123, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b200123, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 0 [0070.894] FindClose (in: hFindFile=0x389f040 | out: hFindFile=0x389f040) returned 1 [0070.894] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b16d8) returned 1 [0070.894] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6880) returned 1 [0070.894] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6790) returned 1 Thread: id = 33 os_tid = 0xab0 [0070.895] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x32) returned 0x389f280 [0070.895] wcscpy (in: _Dest=0x389f280, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0070.895] wcscat (in: _Dest=0x389f280, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0070.895] wcscat (in: _Dest=0x389f280, _Source="*" | out: _Dest="C:\\Program Files (x86)\\*") returned="C:\\Program Files (x86)\\*" [0070.895] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x38b0df8 [0070.895] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*", lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xa1430415, ftLastWriteTime.dwHighDateTime=0x1d5e1e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f040 [0070.896] wcscmp (_String1=".", _String2=".") returned 0 [0070.896] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xa1430415, ftLastWriteTime.dwHighDateTime=0x1d5e1e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.896] wcscmp (_String1="..", _String2=".") returned 1 [0070.896] wcscmp (_String1="..", _String2="..") returned 0 [0070.896] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1430415, ftCreationTime.dwHighDateTime=0x1d5e1e4, ftLastAccessTime.dwLowDateTime=0xa1430415, ftLastAccessTime.dwHighDateTime=0x1d5e1e4, ftLastWriteTime.dwLowDateTime=0xa1430415, ftLastWriteTime.dwHighDateTime=0x1d5e1e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="a0a70290", cAlternateFileName="")) returned 1 [0070.896] wcscmp (_String1="a0a70290", _String2=".") returned 1 [0070.896] wcscmp (_String1="a0a70290", _String2="..") returned 1 [0070.896] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a6460 [0070.896] wcscpy (in: _Dest=0x38a6460, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0070.896] wcscat (in: _Dest=0x38a6460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0070.896] wcscat (in: _Dest=0x38a6460, _Source="a0a70290" | out: _Dest="C:\\Program Files (x86)\\a0a70290") returned="C:\\Program Files (x86)\\a0a70290" [0070.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a6460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0 [0070.897] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3b141433, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b141433, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0070.897] wcscmp (_String1="Adobe", _String2=".") returned 1 [0070.897] wcscmp (_String1="Adobe", _String2="..") returned 1 [0070.897] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a6340 [0070.897] wcscpy (in: _Dest=0x38a6340, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0070.897] wcscat (in: _Dest=0x38a6340, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0070.897] wcscat (in: _Dest=0x38a6340, _Source="Adobe" | out: _Dest="C:\\Program Files (x86)\\Adobe") returned="C:\\Program Files (x86)\\Adobe" [0070.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a6340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d4 [0070.897] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b18da3c, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b18da3c, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0070.897] wcscmp (_String1="Common Files", _String2=".") returned 1 [0070.898] wcscmp (_String1="Common Files", _String2="..") returned 1 [0070.898] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x3892ca0 [0070.898] wcscpy (in: _Dest=0x3892ca0, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0070.898] wcscat (in: _Dest=0x3892ca0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0070.898] wcscat (in: _Dest=0x3892ca0, _Source="Common Files" | out: _Dest="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0070.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3892ca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d8 [0070.898] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0070.898] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0070.898] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0070.898] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc5e5a66, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0x19640a8, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x19640a8, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1 [0070.898] wcscmp (_String1="Google", _String2=".") returned 1 [0070.898] wcscmp (_String1="Google", _String2="..") returned 1 [0070.898] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3c) returned 0x38a60b8 [0070.899] wcscpy (in: _Dest=0x38a60b8, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0070.899] wcscat (in: _Dest=0x38a60b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0070.899] wcscat (in: _Dest=0x38a60b8, _Source="Google" | out: _Dest="C:\\Program Files (x86)\\Google") returned="C:\\Program Files (x86)\\Google" [0070.899] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a60b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc [0070.899] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b2261df, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b2261df, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0070.899] wcscmp (_String1="Internet Explorer", _String2=".") returned 1 [0070.899] wcscmp (_String1="Internet Explorer", _String2="..") returned 1 [0070.899] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x38804a0 [0070.899] wcscpy (in: _Dest=0x38804a0, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0070.899] wcscat (in: _Dest=0x38804a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0070.899] wcscat (in: _Dest=0x38804a0, _Source="Internet Explorer" | out: _Dest="C:\\Program Files (x86)\\Internet Explorer") returned="C:\\Program Files (x86)\\Internet Explorer" [0070.899] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38804a0) returned 1 [0070.899] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc211eecb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3b2729cb, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b2729cb, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0070.899] wcscmp (_String1="Microsoft Office", _String2=".") returned 1 [0070.900] wcscmp (_String1="Microsoft Office", _String2="..") returned 1 [0070.900] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x38804a0 [0070.900] wcscpy (in: _Dest=0x38804a0, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0070.900] wcscat (in: _Dest=0x38804a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0070.900] wcscat (in: _Dest=0x38804a0, _Source="Microsoft Office" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office") returned="C:\\Program Files (x86)\\Microsoft Office" [0070.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38804a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0 [0070.900] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b18da3c, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b18da3c, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0070.900] wcscmp (_String1="Microsoft.NET", _String2=".") returned 1 [0070.900] wcscmp (_String1="Microsoft.NET", _String2="..") returned 1 [0070.900] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x38843c0 [0070.900] wcscpy (in: _Dest=0x38843c0, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0070.900] wcscat (in: _Dest=0x38843c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0070.900] wcscat (in: _Dest=0x38843c0, _Source="Microsoft.NET" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET") returned="C:\\Program Files (x86)\\Microsoft.NET" [0070.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38843c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4 [0070.901] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0dc4f7, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3b167912, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b167912, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Maintenance Service", cAlternateFileName="MOZILL~1")) returned 1 [0070.901] wcscmp (_String1="Mozilla Maintenance Service", _String2=".") returned 1 [0070.901] wcscmp (_String1="Mozilla Maintenance Service", _String2="..") returned 1 [0070.901] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x3883f40 [0070.901] wcscpy (in: _Dest=0x3883f40, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0070.901] wcscat (in: _Dest=0x3883f40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0070.901] wcscat (in: _Dest=0x3883f40, _Source="Mozilla Maintenance Service" | out: _Dest="C:\\Program Files (x86)\\Mozilla Maintenance Service") returned="C:\\Program Files (x86)\\Mozilla Maintenance Service" [0070.901] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3883f40) returned 1 [0070.901] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0x3d41f4f7, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3d41f4f7, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0070.901] wcscmp (_String1="MSBuild", _String2=".") returned 1 [0070.901] wcscmp (_String1="MSBuild", _String2="..") returned 1 [0070.901] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3e) returned 0x38a6580 [0070.901] wcscpy (in: _Dest=0x38a6580, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0070.902] wcscat (in: _Dest=0x38a6580, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0070.902] wcscat (in: _Dest=0x38a6580, _Source="MSBuild" | out: _Dest="C:\\Program Files (x86)\\MSBuild") returned="C:\\Program Files (x86)\\MSBuild" [0070.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a6580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e8 [0070.902] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a165b3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0x3b2729cb, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b2729cb, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0070.902] wcscmp (_String1="Reference Assemblies", _String2=".") returned 1 [0070.902] wcscmp (_String1="Reference Assemblies", _String2="..") returned 1 [0070.902] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x3883f40 [0070.902] wcscpy (in: _Dest=0x3883f40, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0070.902] wcscat (in: _Dest=0x3883f40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0070.902] wcscat (in: _Dest=0x3883f40, _Source="Reference Assemblies" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies") returned="C:\\Program Files (x86)\\Reference Assemblies" [0070.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3883f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ec [0070.903] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x39fabde1, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39fabde1, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0070.903] wcscmp (_String1="Windows Defender", _String2=".") returned 1 [0070.903] wcscmp (_String1="Windows Defender", _String2="..") returned 1 [0070.903] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x3882d60 [0070.903] wcscpy (in: _Dest=0x3882d60, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0070.903] wcscat (in: _Dest=0x3882d60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0070.903] wcscat (in: _Dest=0x3882d60, _Source="Windows Defender" | out: _Dest="C:\\Program Files (x86)\\Windows Defender") returned="C:\\Program Files (x86)\\Windows Defender" [0070.903] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3882d60) returned 1 [0070.903] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3d4454c7, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3d4454c7, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~2")) returned 1 [0070.903] wcscmp (_String1="Windows Mail", _String2=".") returned 1 [0070.903] wcscmp (_String1="Windows Mail", _String2="..") returned 1 [0070.903] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x38b2fa8 [0070.903] wcscpy (in: _Dest=0x38b2fa8, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0070.903] wcscat (in: _Dest=0x38b2fa8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0070.903] wcscat (in: _Dest=0x38b2fa8, _Source="Windows Mail" | out: _Dest="C:\\Program Files (x86)\\Windows Mail") returned="C:\\Program Files (x86)\\Windows Mail" [0070.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b2fa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f0 [0070.904] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x3b2729cb, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b2729cb, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0070.904] wcscmp (_String1="Windows Media Player", _String2=".") returned 1 [0070.904] wcscmp (_String1="Windows Media Player", _String2="..") returned 1 [0070.904] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x3882d60 [0070.904] wcscpy (in: _Dest=0x3882d60, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0070.904] wcscat (in: _Dest=0x3882d60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0070.904] wcscat (in: _Dest=0x3882d60, _Source="Windows Media Player" | out: _Dest="C:\\Program Files (x86)\\Windows Media Player") returned="C:\\Program Files (x86)\\Windows Media Player" [0070.904] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3882d60) returned 1 [0070.904] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b11b239, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b11b239, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Multimedia Platform", cAlternateFileName="WINDOW~3")) returned 1 [0070.904] wcscmp (_String1="Windows Multimedia Platform", _String2=".") returned 1 [0070.904] wcscmp (_String1="Windows Multimedia Platform", _String2="..") returned 1 [0070.904] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x3882d60 [0070.904] wcscpy (in: _Dest=0x3882d60, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0070.904] wcscat (in: _Dest=0x3882d60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0070.904] wcscat (in: _Dest=0x3882d60, _Source="Windows Multimedia Platform" | out: _Dest="C:\\Program Files (x86)\\Windows Multimedia Platform") returned="C:\\Program Files (x86)\\Windows Multimedia Platform" [0070.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3882d60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f4 [0070.940] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x39fd2260, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39fd2260, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~4")) returned 1 [0070.940] wcscmp (_String1="Windows NT", _String2=".") returned 1 [0070.940] wcscmp (_String1="Windows NT", _String2="..") returned 1 [0070.940] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x38b2af8 [0070.940] wcscpy (in: _Dest=0x38b2af8, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0070.940] wcscat (in: _Dest=0x38b2af8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0070.940] wcscat (in: _Dest=0x38b2af8, _Source="Windows NT" | out: _Dest="C:\\Program Files (x86)\\Windows NT") returned="C:\\Program Files (x86)\\Windows NT" [0070.940] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b2af8) returned 1 [0070.940] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b11b239, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b11b239, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WI8A19~1")) returned 1 [0070.940] wcscmp (_String1="Windows Photo Viewer", _String2=".") returned 1 [0070.940] wcscmp (_String1="Windows Photo Viewer", _String2="..") returned 1 [0070.940] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x388cd08 [0070.940] wcscpy (in: _Dest=0x388cd08, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0070.940] wcscat (in: _Dest=0x388cd08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0070.940] wcscat (in: _Dest=0x388cd08, _Source="Windows Photo Viewer" | out: _Dest="C:\\Program Files (x86)\\Windows Photo Viewer") returned="C:\\Program Files (x86)\\Windows Photo Viewer" [0070.940] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388cd08) returned 1 [0070.940] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65a42d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a75a324, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0070.940] wcscmp (_String1="Windows Portable Devices", _String2=".") returned 1 [0070.940] wcscmp (_String1="Windows Portable Devices", _String2="..") returned 1 [0070.940] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x388cd08 [0070.941] wcscpy (in: _Dest=0x388cd08, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0070.941] wcscat (in: _Dest=0x388cd08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0070.941] wcscat (in: _Dest=0x388cd08, _Source="Windows Portable Devices" | out: _Dest="C:\\Program Files (x86)\\Windows Portable Devices") returned="C:\\Program Files (x86)\\Windows Portable Devices" [0070.941] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388cd08) returned 1 [0070.941] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65a9e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0070.941] wcscmp (_String1="Windows Sidebar", _String2=".") returned 1 [0070.941] wcscmp (_String1="Windows Sidebar", _String2="..") returned 1 [0070.941] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x388cd08 [0070.941] wcscpy (in: _Dest=0x388cd08, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0070.941] wcscat (in: _Dest=0x388cd08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0070.941] wcscat (in: _Dest=0x388cd08, _Source="Windows Sidebar" | out: _Dest="C:\\Program Files (x86)\\Windows Sidebar") returned="C:\\Program Files (x86)\\Windows Sidebar" [0070.941] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388cd08) returned 1 [0070.941] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b1d9def, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b1d9def, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1 [0070.941] wcscmp (_String1="WindowsPowerShell", _String2=".") returned 1 [0070.941] wcscmp (_String1="WindowsPowerShell", _String2="..") returned 1 [0070.941] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x388cd08 [0070.941] wcscpy (in: _Dest=0x388cd08, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0070.941] wcscat (in: _Dest=0x388cd08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0070.941] wcscat (in: _Dest=0x388cd08, _Source="WindowsPowerShell" | out: _Dest="C:\\Program Files (x86)\\WindowsPowerShell") returned="C:\\Program Files (x86)\\WindowsPowerShell" [0070.941] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388cd08) returned 1 [0070.941] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b1d9def, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b1d9def, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 0 [0070.941] FindClose (in: hFindFile=0x389f040 | out: hFindFile=0x389f040) returned 1 [0070.941] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b0df8) returned 1 [0070.941] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f280) returned 1 [0070.941] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a9c88) returned 1 Thread: id = 34 os_tid = 0xa68 [0070.943] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x22) returned 0x38a6880 [0070.943] wcscpy (in: _Dest=0x38a6880, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0070.943] wcscat (in: _Dest=0x38a6880, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0070.943] wcscat (in: _Dest=0x38a6880, _Source="*" | out: _Dest="C:\\ProgramData\\*") returned="C:\\ProgramData\\*" [0070.943] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x38b0df8 [0070.943] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*", lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389eac0 [0071.052] wcscmp (_String1=".", _String2=".") returned 0 [0071.052] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.052] wcscmp (_String1="..", _String2=".") returned 1 [0071.052] wcscmp (_String1="..", _String2="..") returned 0 [0071.052] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4511a9a6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0071.053] wcscmp (_String1="Adobe", _String2=".") returned 1 [0071.053] wcscmp (_String1="Adobe", _String2="..") returned 1 [0071.053] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2a) returned 0x5408800 [0071.053] wcscpy (in: _Dest=0x5408800, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0071.053] wcscat (in: _Dest=0x5408800, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0071.053] wcscat (in: _Dest=0x5408800, _Source="Adobe" | out: _Dest="C:\\ProgramData\\Adobe") returned="C:\\ProgramData\\Adobe" [0071.053] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5408800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x374 [0071.053] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0071.054] wcscmp (_String1="Application Data", _String2=".") returned 1 [0071.054] wcscmp (_String1="Application Data", _String2="..") returned 1 [0071.054] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a56e0 [0071.054] wcscpy (in: _Dest=0x38a56e0, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0071.054] wcscat (in: _Dest=0x38a56e0, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0071.054] wcscat (in: _Dest=0x38a56e0, _Source="Application Data" | out: _Dest="C:\\ProgramData\\Application Data") returned="C:\\ProgramData\\Application Data" [0071.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a56e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x368 [0071.054] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Comms", cAlternateFileName="")) returned 1 [0071.054] wcscmp (_String1="Comms", _String2=".") returned 1 [0071.054] wcscmp (_String1="Comms", _String2="..") returned 1 [0071.054] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2a) returned 0x5408838 [0071.055] wcscpy (in: _Dest=0x5408838, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0071.055] wcscat (in: _Dest=0x5408838, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0071.055] wcscat (in: _Dest=0x5408838, _Source="Comms" | out: _Dest="C:\\ProgramData\\Comms") returned="C:\\ProgramData\\Comms" [0071.055] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5408838, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x360 [0071.055] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0071.055] wcscmp (_String1="Desktop", _String2=".") returned 1 [0071.055] wcscmp (_String1="Desktop", _String2="..") returned 1 [0071.055] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2e) returned 0x5408ad8 [0071.055] wcscpy (in: _Dest=0x5408ad8, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0071.055] wcscat (in: _Dest=0x5408ad8, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0071.055] wcscat (in: _Dest=0x5408ad8, _Source="Desktop" | out: _Dest="C:\\ProgramData\\Desktop") returned="C:\\ProgramData\\Desktop" [0071.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5408ad8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x35c [0071.056] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0071.056] wcscmp (_String1="Documents", _String2=".") returned 1 [0071.056] wcscmp (_String1="Documents", _String2="..") returned 1 [0071.056] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x32) returned 0x389e940 [0071.056] wcscpy (in: _Dest=0x389e940, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0071.056] wcscat (in: _Dest=0x389e940, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0071.056] wcscat (in: _Dest=0x389e940, _Source="Documents" | out: _Dest="C:\\ProgramData\\Documents") returned="C:\\ProgramData\\Documents" [0071.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389e940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x358 [0071.057] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0071.057] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0071.057] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0071.057] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x32) returned 0x389e780 [0071.057] wcscpy (in: _Dest=0x389e780, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0071.058] wcscat (in: _Dest=0x389e780, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0071.058] wcscat (in: _Dest=0x389e780, _Source="Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.058] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389e780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x398 [0071.058] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1 [0071.058] wcscmp (_String1="Microsoft OneDrive", _String2=".") returned 1 [0071.058] wcscmp (_String1="Microsoft OneDrive", _String2="..") returned 1 [0071.058] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x38b36d8 [0071.058] wcscpy (in: _Dest=0x38b36d8, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0071.058] wcscat (in: _Dest=0x38b36d8, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0071.059] wcscat (in: _Dest=0x38b36d8, _Source="Microsoft OneDrive" | out: _Dest="C:\\ProgramData\\Microsoft OneDrive") returned="C:\\ProgramData\\Microsoft OneDrive" [0071.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b36d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x47c [0071.059] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1 [0071.059] wcscmp (_String1="Oracle", _String2=".") returned 1 [0071.059] wcscmp (_String1="Oracle", _String2="..") returned 1 [0071.059] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2c) returned 0x5408870 [0071.059] wcscpy (in: _Dest=0x5408870, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0071.059] wcscat (in: _Dest=0x5408870, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0071.059] wcscat (in: _Dest=0x5408870, _Source="Oracle" | out: _Dest="C:\\ProgramData\\Oracle") returned="C:\\ProgramData\\Oracle" [0071.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5408870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x480 [0071.060] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0071.060] wcscmp (_String1="Package Cache", _String2=".") returned 1 [0071.060] wcscmp (_String1="Package Cache", _String2="..") returned 1 [0071.060] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a5e78 [0071.060] wcscpy (in: _Dest=0x38a5e78, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0071.060] wcscat (in: _Dest=0x38a5e78, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0071.060] wcscat (in: _Dest=0x38a5e78, _Source="Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0071.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a5e78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x484 [0071.061] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53fba98c, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft", cAlternateFileName="REGID1~1.MIC")) returned 1 [0071.061] wcscmp (_String1="regid.1991-06.com.microsoft", _String2=".") returned 1 [0071.061] wcscmp (_String1="regid.1991-06.com.microsoft", _String2="..") returned 1 [0071.061] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x388b810 [0071.061] wcscpy (in: _Dest=0x388b810, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0071.061] wcscat (in: _Dest=0x388b810, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0071.061] wcscat (in: _Dest=0x388b810, _Source="regid.1991-06.com.microsoft" | out: _Dest="C:\\ProgramData\\regid.1991-06.com.microsoft") returned="C:\\ProgramData\\regid.1991-06.com.microsoft" [0071.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x388b810, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x488 [0071.062] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SoftwareDistribution", cAlternateFileName="SOFTWA~1")) returned 1 [0071.062] wcscmp (_String1="SoftwareDistribution", _String2=".") returned 1 [0071.062] wcscmp (_String1="SoftwareDistribution", _String2="..") returned 1 [0071.062] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x38b3728 [0071.062] wcscpy (in: _Dest=0x38b3728, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0071.062] wcscat (in: _Dest=0x38b3728, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0071.062] wcscat (in: _Dest=0x38b3728, _Source="SoftwareDistribution" | out: _Dest="C:\\ProgramData\\SoftwareDistribution") returned="C:\\ProgramData\\SoftwareDistribution" [0071.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b3728, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x48c [0071.063] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0071.063] wcscmp (_String1="Start Menu", _String2=".") returned 1 [0071.063] wcscmp (_String1="Start Menu", _String2="..") returned 1 [0071.063] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x34) returned 0x389ed40 [0071.063] wcscpy (in: _Dest=0x389ed40, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0071.063] wcscat (in: _Dest=0x389ed40, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0071.063] wcscat (in: _Dest=0x389ed40, _Source="Start Menu" | out: _Dest="C:\\ProgramData\\Start Menu") returned="C:\\ProgramData\\Start Menu" [0071.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389ed40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490 [0071.064] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0071.064] wcscmp (_String1="Templates", _String2=".") returned 1 [0071.064] wcscmp (_String1="Templates", _String2="..") returned 1 [0071.064] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x32) returned 0x389e840 [0071.064] wcscpy (in: _Dest=0x389e840, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0071.064] wcscat (in: _Dest=0x389e840, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0071.064] wcscat (in: _Dest=0x389e840, _Source="Templates" | out: _Dest="C:\\ProgramData\\Templates") returned="C:\\ProgramData\\Templates" [0071.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389e840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0071.065] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1931975, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="USOPrivate", cAlternateFileName="USOPRI~1")) returned 1 [0071.065] wcscmp (_String1="USOPrivate", _String2=".") returned 1 [0071.065] wcscmp (_String1="USOPrivate", _String2="..") returned 1 [0071.065] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x34) returned 0x389ea80 [0071.065] wcscpy (in: _Dest=0x389ea80, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0071.065] wcscat (in: _Dest=0x389ea80, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0071.065] wcscat (in: _Dest=0x389ea80, _Source="USOPrivate" | out: _Dest="C:\\ProgramData\\USOPrivate") returned="C:\\ProgramData\\USOPrivate" [0071.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389ea80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x498 [0071.066] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="USOShared", cAlternateFileName="USOSHA~1")) returned 1 [0071.066] wcscmp (_String1="USOShared", _String2=".") returned 1 [0071.066] wcscmp (_String1="USOShared", _String2="..") returned 1 [0071.066] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x32) returned 0x389ea00 [0071.066] wcscpy (in: _Dest=0x389ea00, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0071.066] wcscat (in: _Dest=0x389ea00, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0071.066] wcscat (in: _Dest=0x389ea00, _Source="USOShared" | out: _Dest="C:\\ProgramData\\USOShared") returned="C:\\ProgramData\\USOShared" [0071.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389ea00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0071.067] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 1 [0071.067] wcscmp (_String1="WindowsHolographicDevices", _String2=".") returned 1 [0071.067] wcscmp (_String1="WindowsHolographicDevices", _String2="..") returned 1 [0071.067] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x388b870 [0071.067] wcscpy (in: _Dest=0x388b870, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0071.067] wcscat (in: _Dest=0x388b870, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0071.067] wcscat (in: _Dest=0x388b870, _Source="WindowsHolographicDevices" | out: _Dest="C:\\ProgramData\\WindowsHolographicDevices") returned="C:\\ProgramData\\WindowsHolographicDevices" [0071.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x388b870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a0 [0071.068] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x38b0df8 | out: lpFindFileData=0x38b0df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 0 [0071.068] FindClose (in: hFindFile=0x389eac0 | out: hFindFile=0x389eac0) returned 1 [0071.068] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b0df8) returned 1 [0071.068] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6880) returned 1 [0071.068] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4f68) returned 1 Thread: id = 35 os_tid = 0x1268 [0070.943] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1c) returned 0x38a5030 [0070.943] wcscpy (in: _Dest=0x38a5030, _Source="C:\\Recovery" | out: _Dest="C:\\Recovery") returned="C:\\Recovery" [0070.943] wcscat (in: _Dest=0x38a5030, _Source="\\" | out: _Dest="C:\\Recovery\\") returned="C:\\Recovery\\" [0070.943] wcscat (in: _Dest=0x38a5030, _Source="*" | out: _Dest="C:\\Recovery\\*") returned="C:\\Recovery\\*" [0070.943] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x38b1930 [0070.943] FindFirstFileW (in: lpFileName="C:\\Recovery\\*", lpFindFileData=0x38b1930 | out: lpFindFileData=0x38b1930*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ee80 [0071.140] wcscmp (_String1=".", _String2=".") returned 0 [0071.140] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x38b1930 | out: lpFindFileData=0x38b1930*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.141] wcscmp (_String1="..", _String2=".") returned 1 [0071.141] wcscmp (_String1="..", _String2="..") returned 0 [0071.141] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x38b1930 | out: lpFindFileData=0x38b1930*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x28e9c3a2, ftLastAccessTime.dwHighDateTime=0x1d32795, ftLastWriteTime.dwLowDateTime=0x28e9c3a2, ftLastWriteTime.dwHighDateTime=0x1d32795, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0071.141] wcscmp (_String1="Logs", _String2=".") returned 1 [0071.141] wcscmp (_String1="Logs", _String2="..") returned 1 [0071.141] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x22) returned 0x38a6880 [0071.141] wcscpy (in: _Dest=0x38a6880, _Source="C:\\Recovery" | out: _Dest="C:\\Recovery") returned="C:\\Recovery" [0071.141] wcscat (in: _Dest=0x38a6880, _Source="\\" | out: _Dest="C:\\Recovery\\") returned="C:\\Recovery\\" [0071.141] wcscat (in: _Dest=0x38a6880, _Source="Logs" | out: _Dest="C:\\Recovery\\Logs") returned="C:\\Recovery\\Logs" [0071.424] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a6880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x548 [0071.425] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x38b1930 | out: lpFindFileData=0x38b1930*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1044dfc5, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReAgentOld.xml", cAlternateFileName="REAGEN~1.XML")) returned 1 [0071.425] wcscmp (_String1="ReAgentOld.xml", _String2=".") returned 1 [0071.425] wcscmp (_String1="ReAgentOld.xml", _String2="..") returned 1 [0071.425] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x54452c0 [0071.425] wcscpy (in: _Dest=0x54452c0, _Source="C:\\Recovery" | out: _Dest="C:\\Recovery") returned="C:\\Recovery" [0071.425] wcscat (in: _Dest=0x54452c0, _Source="\\" | out: _Dest="C:\\Recovery\\") returned="C:\\Recovery\\" [0071.425] wcscat (in: _Dest=0x54452c0, _Source="ReAgentOld.xml" | out: _Dest="C:\\Recovery\\ReAgentOld.xml") returned="C:\\Recovery\\ReAgentOld.xml" [0071.425] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54452c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x374 [0071.425] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x38b1930 | out: lpFindFileData=0x38b1930*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1044dfc5, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReAgentOld.xml", cAlternateFileName="REAGEN~1.XML")) returned 0 [0071.426] FindClose (in: hFindFile=0x389ee80 | out: hFindFile=0x389ee80) returned 1 [0071.426] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b1930) returned 1 [0071.426] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5030) returned 1 [0071.426] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e78) returned 1 Thread: id = 36 os_tid = 0xf88 [0070.944] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x16) returned 0x38a81a0 [0070.944] wcscpy (in: _Dest=0x38a81a0, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0070.944] wcscat (in: _Dest=0x38a81a0, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0070.944] wcscat (in: _Dest=0x38a81a0, _Source="*" | out: _Dest="C:\\Users\\*") returned="C:\\Users\\*" [0070.944] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x38b4948 [0070.944] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x38b4948 | out: lpFindFileData=0x38b4948*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e7c0 [0071.069] wcscmp (_String1=".", _String2=".") returned 0 [0071.069] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x38b4948 | out: lpFindFileData=0x38b4948*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.069] wcscmp (_String1="..", _String2=".") returned 1 [0071.069] wcscmp (_String1="..", _String2="..") returned 0 [0071.069] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x38b4948 | out: lpFindFileData=0x38b4948*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0071.069] wcscmp (_String1="All Users", _String2=".") returned 1 [0071.069] wcscmp (_String1="All Users", _String2="..") returned 1 [0071.069] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x26) returned 0x38a66a0 [0071.069] wcscpy (in: _Dest=0x38a66a0, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0071.069] wcscat (in: _Dest=0x38a66a0, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0071.069] wcscat (in: _Dest=0x38a66a0, _Source="All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0071.069] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a66a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a4 [0071.070] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x38b4948 | out: lpFindFileData=0x38b4948*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0071.070] wcscmp (_String1="Default", _String2=".") returned 1 [0071.070] wcscmp (_String1="Default", _String2="..") returned 1 [0071.070] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x22) returned 0x38a6a60 [0071.070] wcscpy (in: _Dest=0x38a6a60, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0071.070] wcscat (in: _Dest=0x38a6a60, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0071.070] wcscat (in: _Dest=0x38a6a60, _Source="Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0071.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a6a60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a8 [0071.071] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x38b4948 | out: lpFindFileData=0x38b4948*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0071.071] wcscmp (_String1="Default User", _String2=".") returned 1 [0071.071] wcscmp (_String1="Default User", _String2="..") returned 1 [0071.071] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2c) returned 0x54088a8 [0071.071] wcscpy (in: _Dest=0x54088a8, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0071.071] wcscat (in: _Dest=0x54088a8, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0071.071] wcscat (in: _Dest=0x54088a8, _Source="Default User" | out: _Dest="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0071.071] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54088a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ac [0071.072] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x38b4948 | out: lpFindFileData=0x38b4948*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default.migrated", cAlternateFileName="DEFAUL~1.MIG")) returned 1 [0071.072] wcscmp (_String1="Default.migrated", _String2=".") returned 1 [0071.072] wcscmp (_String1="Default.migrated", _String2="..") returned 1 [0071.072] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x34) returned 0x389e800 [0071.072] wcscpy (in: _Dest=0x389e800, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0071.072] wcscat (in: _Dest=0x389e800, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0071.072] wcscat (in: _Dest=0x389e800, _Source="Default.migrated" | out: _Dest="C:\\Users\\Default.migrated") returned="C:\\Users\\Default.migrated" [0071.072] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389e800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0 [0071.073] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x38b4948 | out: lpFindFileData=0x38b4948*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9bc987, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0071.073] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0071.073] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0071.073] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x38b4948 | out: lpFindFileData=0x38b4948*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 1 [0071.073] wcscmp (_String1="FD1HVy", _String2=".") returned 1 [0071.073] wcscmp (_String1="FD1HVy", _String2="..") returned 1 [0071.073] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4e00 [0071.073] wcscpy (in: _Dest=0x38a4e00, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0071.073] wcscat (in: _Dest=0x38a4e00, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0071.073] wcscat (in: _Dest=0x38a4e00, _Source="FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0071.073] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a4e00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4 [0071.074] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x38b4948 | out: lpFindFileData=0x38b4948*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0071.074] wcscmp (_String1="Public", _String2=".") returned 1 [0071.074] wcscmp (_String1="Public", _String2="..") returned 1 [0071.074] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4f68 [0071.074] wcscpy (in: _Dest=0x38a4f68, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0071.074] wcscat (in: _Dest=0x38a4f68, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0071.074] wcscat (in: _Dest=0x38a4f68, _Source="Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0071.074] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a4f68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b8 [0071.075] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x38b4948 | out: lpFindFileData=0x38b4948*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0 [0071.075] FindClose (in: hFindFile=0x389e7c0 | out: hFindFile=0x389e7c0) returned 1 [0071.075] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b4948) returned 1 [0071.075] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a81a0) returned 1 [0071.075] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a8000) returned 1 Thread: id = 37 os_tid = 0xf84 [0070.944] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2c) returned 0x38aa270 [0070.944] wcscpy (in: _Dest=0x38aa270, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0070.944] wcscat (in: _Dest=0x38aa270, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0070.944] wcscat (in: _Dest=0x38aa270, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\*") returned="C:\\Windows10Upgrade\\*" [0070.945] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x38b5480 [0070.945] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\*", lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444e80 [0072.002] wcscmp (_String1=".", _String2=".") returned 0 [0072.002] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.002] wcscmp (_String1="..", _String2=".") returned 1 [0072.002] wcscmp (_String1="..", _String2="..") returned 0 [0072.002] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea35483d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea355be9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2052", cAlternateFileName="")) returned 1 [0072.002] wcscmp (_String1="2052", _String2=".") returned 1 [0072.002] wcscmp (_String1="2052", _String2="..") returned 1 [0072.002] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x32) returned 0x5444ec0 [0072.002] wcscpy (in: _Dest=0x5444ec0, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0072.002] wcscat (in: _Dest=0x5444ec0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0072.002] wcscat (in: _Dest=0x5444ec0, _Source="2052" | out: _Dest="C:\\Windows10Upgrade\\2052") returned="C:\\Windows10Upgrade\\2052" [0072.002] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5444ec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a0 [0072.007] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3659ec, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3659ec, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x704c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="appraiserxp.dll", cAlternateFileName="APPRAI~1.DLL")) returned 1 [0072.007] wcscmp (_String1="appraiserxp.dll", _String2=".") returned 1 [0072.007] wcscmp (_String1="appraiserxp.dll", _String2="..") returned 1 [0072.007] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea36cf08, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea36cf08, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x1cec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootsect.exe", cAlternateFileName="")) returned 1 [0072.007] wcscmp (_String1="bootsect.exe", _String2=".") returned 1 [0072.007] wcscmp (_String1="bootsect.exe", _String2="..") returned 1 [0072.007] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea350dad, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea350dad, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xb08c3ee, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Configuration.ini", cAlternateFileName="CONFIG~1.INI")) returned 1 [0072.007] wcscmp (_String1="Configuration.ini", _String2=".") returned 1 [0072.007] wcscmp (_String1="Configuration.ini", _String2="..") returned 1 [0072.007] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x5429108 [0072.007] wcscpy (in: _Dest=0x5429108, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0072.007] wcscat (in: _Dest=0x5429108, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0072.008] wcscat (in: _Dest=0x5429108, _Source="Configuration.ini" | out: _Dest="C:\\Windows10Upgrade\\Configuration.ini") returned="C:\\Windows10Upgrade\\Configuration.ini" [0072.008] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5429108, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a4 [0072.008] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea36e29e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea36e29e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xf0c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="cosquery.dll", cAlternateFileName="")) returned 1 [0072.008] wcscmp (_String1="cosquery.dll", _String2=".") returned 1 [0072.008] wcscmp (_String1="cosquery.dll", _String2="..") returned 1 [0072.008] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea370998, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea370998, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x508c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DevInv.dll", cAlternateFileName="")) returned 1 [0072.008] wcscmp (_String1="DevInv.dll", _String2=".") returned 1 [0072.008] wcscmp (_String1="DevInv.dll", _String2="..") returned 1 [0072.009] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3757e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea377ed3, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dll1", cAlternateFileName="")) returned 1 [0072.009] wcscmp (_String1="dll1", _String2=".") returned 1 [0072.009] wcscmp (_String1="dll1", _String2="..") returned 1 [0072.009] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x32) returned 0x54451c0 [0072.009] wcscpy (in: _Dest=0x54451c0, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0072.009] wcscat (in: _Dest=0x54451c0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0072.009] wcscat (in: _Dest=0x54451c0, _Source="dll1" | out: _Dest="C:\\Windows10Upgrade\\dll1") returned="C:\\Windows10Upgrade\\dll1" [0072.009] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54451c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a8 [0072.009] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea37cd05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37cd05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37cd05, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dll2", cAlternateFileName="")) returned 1 [0072.009] wcscmp (_String1="dll2", _String2=".") returned 1 [0072.010] wcscmp (_String1="dll2", _String2="..") returned 1 [0072.010] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x32) returned 0x5445040 [0072.010] wcscpy (in: _Dest=0x5445040, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0072.010] wcscat (in: _Dest=0x5445040, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0072.010] wcscat (in: _Dest=0x5445040, _Source="dll2" | out: _Dest="C:\\Windows10Upgrade\\dll2") returned="C:\\Windows10Upgrade\\dll2" [0072.010] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5445040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ac [0072.010] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea380798, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea380798, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x326c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="downloader.dll", cAlternateFileName="DOWNLO~1.DLL")) returned 1 [0072.010] wcscmp (_String1="downloader.dll", _String2=".") returned 1 [0072.010] wcscmp (_String1="downloader.dll", _String2="..") returned 1 [0072.010] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea381b2a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea381b2a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x9d2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0072.010] wcscmp (_String1="DW20.EXE", _String2=".") returned 1 [0072.011] wcscmp (_String1="DW20.EXE", _String2="..") returned 1 [0072.011] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea385605, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea385605, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xc2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWDCW20.DLL", cAlternateFileName="")) returned 1 [0072.011] wcscmp (_String1="DWDCW20.DLL", _String2=".") returned 1 [0072.011] wcscmp (_String1="DWDCW20.DLL", _String2="..") returned 1 [0072.011] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea386943, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea386943, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xb2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0072.011] wcscmp (_String1="DWTRIG20.EXE", _String2=".") returned 1 [0072.011] wcscmp (_String1="DWTRIG20.EXE", _String2="..") returned 1 [0072.011] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea387cd0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea387cd0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x2652, dwReserved0=0x0, dwReserved1=0x0, cFileName="EnableWiFiTracing.cmd", cAlternateFileName="ENABLE~1.CMD")) returned 1 [0072.011] wcscmp (_String1="EnableWiFiTracing.cmd", _String2=".") returned 1 [0072.011] wcscmp (_String1="EnableWiFiTracing.cmd", _String2="..") returned 1 [0072.011] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea389060, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea389060, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x10cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESDHelper.dll", cAlternateFileName="ESDHEL~1.DLL")) returned 1 [0072.011] wcscmp (_String1="ESDHelper.dll", _String2=".") returned 1 [0072.011] wcscmp (_String1="ESDHelper.dll", _String2="..") returned 1 [0072.011] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea38cadd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea38cadd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x9ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="esdstub.dll", cAlternateFileName="")) returned 1 [0072.011] wcscmp (_String1="esdstub.dll", _String2=".") returned 1 [0072.011] wcscmp (_String1="esdstub.dll", _String2="..") returned 1 [0072.011] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea38de7f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea38de7f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x89ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GatherOSState.EXE", cAlternateFileName="GATHER~1.EXE")) returned 1 [0072.011] wcscmp (_String1="GatherOSState.EXE", _String2=".") returned 1 [0072.011] wcscmp (_String1="GatherOSState.EXE", _String2="..") returned 1 [0072.011] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39058e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39058e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x83cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentDeploy.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0072.011] wcscmp (_String1="GetCurrentDeploy.dll", _String2=".") returned 1 [0072.011] wcscmp (_String1="GetCurrentDeploy.dll", _String2="..") returned 1 [0072.011] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea392ca4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea392ca4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~2.DLL")) returned 1 [0072.011] wcscmp (_String1="GetCurrentOOBE.dll", _String2=".") returned 1 [0072.011] wcscmp (_String1="GetCurrentOOBE.dll", _String2="..") returned 1 [0072.011] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39539e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39539e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x11ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.EXE", cAlternateFileName="GETCUR~1.EXE")) returned 1 [0072.011] wcscmp (_String1="GetCurrentRollback.EXE", _String2=".") returned 1 [0072.011] wcscmp (_String1="GetCurrentRollback.EXE", _String2="..") returned 1 [0072.011] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39673d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39673d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x6cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HttpHelper.exe", cAlternateFileName="HTTPHE~1.EXE")) returned 1 [0072.011] wcscmp (_String1="HttpHelper.exe", _String2=".") returned 1 [0072.011] wcscmp (_String1="HttpHelper.exe", _String2="..") returned 1 [0072.011] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PostOOBEScript.cmd", cAlternateFileName="POSTOO~1.CMD")) returned 1 [0072.011] wcscmp (_String1="PostOOBEScript.cmd", _String2=".") returned 1 [0072.011] wcscmp (_String1="PostOOBEScript.cmd", _String2="..") returned 1 [0072.011] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b3c1b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b3c1b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources", cAlternateFileName="RESOUR~1")) returned 1 [0072.012] wcscmp (_String1="resources", _String2=".") returned 1 [0072.012] wcscmp (_String1="resources", _String2="..") returned 1 [0072.012] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3c) returned 0x537bef0 [0072.012] wcscpy (in: _Dest=0x537bef0, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0072.012] wcscat (in: _Dest=0x537bef0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0072.012] wcscat (in: _Dest=0x537bef0, _Source="resources" | out: _Dest="C:\\Windows10Upgrade\\resources") returned="C:\\Windows10Upgrade\\resources" [0072.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x537bef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b0 [0072.012] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea9ef415, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea9ef415, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x624407ed, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0x3d14a, dwReserved0=0x0, dwReserved1=0x0, cFileName="upgrader_default.log", cAlternateFileName="UPGRAD~1.LOG")) returned 1 [0072.012] wcscmp (_String1="upgrader_default.log", _String2=".") returned 1 [0072.013] wcscmp (_String1="upgrader_default.log", _String2="..") returned 1 [0072.013] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x38b5888 [0072.013] wcscpy (in: _Dest=0x38b5888, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0072.013] wcscat (in: _Dest=0x38b5888, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0072.013] wcscat (in: _Dest=0x38b5888, _Source="upgrader_default.log" | out: _Dest="C:\\Windows10Upgrade\\upgrader_default.log") returned="C:\\Windows10Upgrade\\upgrader_default.log" [0072.013] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b5888, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b4 [0072.013] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccdc86a8, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x32fe02cc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x5044, dwReserved0=0x0, dwReserved1=0x0, cFileName="upgrader_win10.log", cAlternateFileName="UPGRAD~2.LOG")) returned 1 [0072.013] wcscmp (_String1="upgrader_win10.log", _String2=".") returned 1 [0072.013] wcscmp (_String1="upgrader_win10.log", _String2="..") returned 1 [0072.014] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x5429160 [0072.014] wcscpy (in: _Dest=0x5429160, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0072.014] wcscat (in: _Dest=0x5429160, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0072.014] wcscat (in: _Dest=0x5429160, _Source="upgrader_win10.log" | out: _Dest="C:\\Windows10Upgrade\\upgrader_win10.log") returned="C:\\Windows10Upgrade\\upgrader_win10.log" [0072.014] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5429160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b8 [0072.014] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea63f06a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63f06a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x880c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="wimgapi.dll", cAlternateFileName="")) returned 1 [0072.014] wcscmp (_String1="wimgapi.dll", _String2=".") returned 1 [0072.014] wcscmp (_String1="wimgapi.dll", _String2="..") returned 1 [0072.014] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea642af3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea642af3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xdf8c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="windlp.dll", cAlternateFileName="")) returned 1 [0072.014] wcscmp (_String1="windlp.dll", _String2=".") returned 1 [0072.014] wcscmp (_String1="windlp.dll", _String2="..") returned 1 [0072.014] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea64a022, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea64a022, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x159ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows10UpgraderApp.exe", cAlternateFileName="WINDOW~1.EXE")) returned 1 [0072.014] wcscmp (_String1="Windows10UpgraderApp.exe", _String2=".") returned 1 [0072.015] wcscmp (_String1="Windows10UpgraderApp.exe", _String2="..") returned 1 [0072.015] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea64ee41, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea64ee41, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x62c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinREBootApp32.exe", cAlternateFileName="WINREB~1.EXE")) returned 1 [0072.015] wcscmp (_String1="WinREBootApp32.exe", _String2=".") returned 1 [0072.015] wcscmp (_String1="WinREBootApp32.exe", _String2="..") returned 1 [0072.015] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6528e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6528e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x64c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinREBootApp64.exe", cAlternateFileName="WINREB~2.EXE")) returned 1 [0072.015] wcscmp (_String1="WinREBootApp64.exe", _String2=".") returned 1 [0072.015] wcscmp (_String1="WinREBootApp64.exe", _String2="..") returned 1 [0072.015] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x38b5480 | out: lpFindFileData=0x38b5480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6528e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6528e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x64c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinREBootApp64.exe", cAlternateFileName="WINREB~2.EXE")) returned 0 [0072.015] FindClose (in: hFindFile=0x5444e80 | out: hFindFile=0x5444e80) returned 1 [0072.016] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b5480) returned 1 [0072.016] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38aa270) returned 1 [0072.016] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a9d30) returned 1 Thread: id = 38 os_tid = 0x10a8 [0070.993] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2c) returned 0x38aa2a8 [0070.993] wcscpy (in: _Dest=0x38aa2a8, _Source="C:\\$GetCurrent\\Logs" | out: _Dest="C:\\$GetCurrent\\Logs") returned="C:\\$GetCurrent\\Logs" [0070.993] wcscat (in: _Dest=0x38aa2a8, _Source="\\" | out: _Dest="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\" [0070.993] wcscat (in: _Dest=0x38aa2a8, _Source="*" | out: _Dest="C:\\$GetCurrent\\Logs\\*") returned="C:\\$GetCurrent\\Logs\\*" [0070.993] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x38b5fb8 [0070.993] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x38b5fb8 | out: lpFindFileData=0x38b5fb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f280 [0071.181] wcscmp (_String1=".", _String2=".") returned 0 [0071.181] FindNextFileW (in: hFindFile=0x389f280, lpFindFileData=0x38b5fb8 | out: lpFindFileData=0x38b5fb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.182] wcscmp (_String1="..", _String2=".") returned 1 [0071.182] wcscmp (_String1="..", _String2="..") returned 0 [0071.182] FindNextFileW (in: hFindFile=0x389f280, lpFindFileData=0x38b5fb8 | out: lpFindFileData=0x38b5fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0071.182] wcscmp (_String1="downlevel_2017_09_07_02_02_39_766.log", _String2=".") returned 1 [0071.182] wcscmp (_String1="downlevel_2017_09_07_02_02_39_766.log", _String2="..") returned 1 [0071.182] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x74) returned 0x3890a20 [0071.182] wcscpy (in: _Dest=0x3890a20, _Source="C:\\$GetCurrent\\Logs" | out: _Dest="C:\\$GetCurrent\\Logs") returned="C:\\$GetCurrent\\Logs" [0071.182] wcscat (in: _Dest=0x3890a20, _Source="\\" | out: _Dest="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\" [0071.182] wcscat (in: _Dest=0x3890a20, _Source="downlevel_2017_09_07_02_02_39_766.log" | out: _Dest="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" [0071.419] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3890a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x354 [0071.420] FindNextFileW (in: hFindFile=0x389f280, lpFindFileData=0x38b5fb8 | out: lpFindFileData=0x38b5fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0071.420] wcscmp (_String1="oobe_2017_09_07_03_08_57_737.log", _String2=".") returned 1 [0071.420] wcscmp (_String1="oobe_2017_09_07_03_08_57_737.log", _String2="..") returned 1 [0071.420] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6a) returned 0x38aa450 [0071.420] wcscpy (in: _Dest=0x38aa450, _Source="C:\\$GetCurrent\\Logs" | out: _Dest="C:\\$GetCurrent\\Logs") returned="C:\\$GetCurrent\\Logs" [0071.420] wcscat (in: _Dest=0x38aa450, _Source="\\" | out: _Dest="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\" [0071.420] wcscat (in: _Dest=0x38aa450, _Source="oobe_2017_09_07_03_08_57_737.log" | out: _Dest="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" [0071.420] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38aa450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x360 [0071.421] FindNextFileW (in: hFindFile=0x389f280, lpFindFileData=0x38b5fb8 | out: lpFindFileData=0x38b5fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1 [0071.421] wcscmp (_String1="PartnerSetupCompleteResult.log", _String2=".") returned 1 [0071.421] wcscmp (_String1="PartnerSetupCompleteResult.log", _String2="..") returned 1 [0071.421] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x38b2488 [0071.421] wcscpy (in: _Dest=0x38b2488, _Source="C:\\$GetCurrent\\Logs" | out: _Dest="C:\\$GetCurrent\\Logs") returned="C:\\$GetCurrent\\Logs" [0071.421] wcscat (in: _Dest=0x38b2488, _Source="\\" | out: _Dest="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\" [0071.421] wcscat (in: _Dest=0x38b2488, _Source="PartnerSetupCompleteResult.log" | out: _Dest="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" [0071.421] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b2488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x368 [0071.422] FindNextFileW (in: hFindFile=0x389f280, lpFindFileData=0x38b5fb8 | out: lpFindFileData=0x38b5fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0 [0071.422] FindClose (in: hFindFile=0x389f280 | out: hFindFile=0x389f280) returned 1 [0071.423] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b5fb8) returned 1 [0071.423] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38aa2a8) returned 1 [0071.423] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6a30) returned 1 Thread: id = 39 os_tid = 0xfac [0070.994] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x30) returned 0x38aa2e0 [0070.994] wcscpy (in: _Dest=0x38aa2e0, _Source="C:\\$GetCurrent\\SafeOS" | out: _Dest="C:\\$GetCurrent\\SafeOS") returned="C:\\$GetCurrent\\SafeOS" [0070.994] wcscat (in: _Dest=0x38aa2e0, _Source="\\" | out: _Dest="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\" [0070.994] wcscat (in: _Dest=0x38aa2e0, _Source="*" | out: _Dest="C:\\$GetCurrent\\SafeOS\\*") returned="C:\\$GetCurrent\\SafeOS\\*" [0070.994] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x38b6af0 [0070.995] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x38b6af0 | out: lpFindFileData=0x38b6af0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ed00 [0071.185] wcscmp (_String1=".", _String2=".") returned 0 [0071.185] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x38b6af0 | out: lpFindFileData=0x38b6af0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.185] wcscmp (_String1="..", _String2=".") returned 1 [0071.185] wcscmp (_String1="..", _String2="..") returned 0 [0071.185] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x38b6af0 | out: lpFindFileData=0x38b6af0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0071.185] wcscmp (_String1="GetCurrentOOBE.dll", _String2=".") returned 1 [0071.186] wcscmp (_String1="GetCurrentOOBE.dll", _String2="..") returned 1 [0071.186] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x38b6af0 | out: lpFindFileData=0x38b6af0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1 [0071.186] wcscmp (_String1="GetCurrentRollback.ini", _String2=".") returned 1 [0071.186] wcscmp (_String1="GetCurrentRollback.ini", _String2="..") returned 1 [0071.186] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x541a9f8 [0071.186] wcscpy (in: _Dest=0x541a9f8, _Source="C:\\$GetCurrent\\SafeOS" | out: _Dest="C:\\$GetCurrent\\SafeOS") returned="C:\\$GetCurrent\\SafeOS" [0071.186] wcscat (in: _Dest=0x541a9f8, _Source="\\" | out: _Dest="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\" [0071.186] wcscat (in: _Dest=0x541a9f8, _Source="GetCurrentRollback.ini" | out: _Dest="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" [0071.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x541a9f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a4 [0071.388] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x38b6af0 | out: lpFindFileData=0x38b6af0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1 [0071.388] wcscmp (_String1="PartnerSetupComplete.cmd", _String2=".") returned 1 [0071.388] wcscmp (_String1="PartnerSetupComplete.cmd", _String2="..") returned 1 [0071.388] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x38b6af0 | out: lpFindFileData=0x38b6af0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1 [0071.388] wcscmp (_String1="preoobe.cmd", _String2=".") returned 1 [0071.388] wcscmp (_String1="preoobe.cmd", _String2="..") returned 1 [0071.388] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x38b6af0 | out: lpFindFileData=0x38b6af0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1 [0071.388] wcscmp (_String1="SetupComplete.cmd", _String2=".") returned 1 [0071.388] wcscmp (_String1="SetupComplete.cmd", _String2="..") returned 1 [0071.388] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x38b6af0 | out: lpFindFileData=0x38b6af0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0 [0071.388] FindClose (in: hFindFile=0x389ed00 | out: hFindFile=0x389ed00) returned 1 [0071.389] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b6af0) returned 1 [0071.389] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38aa2e0) returned 1 [0071.389] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38aa008) returned 1 Thread: id = 40 os_tid = 0xfa8 [0070.995] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389ebc0 [0070.995] wcscpy (in: _Dest=0x389ebc0, _Source="C:\\$Recycle.Bin\\S-1-5-18" | out: _Dest="C:\\$Recycle.Bin\\S-1-5-18") returned="C:\\$Recycle.Bin\\S-1-5-18" [0070.995] wcscat (in: _Dest=0x389ebc0, _Source="\\" | out: _Dest="C:\\$Recycle.Bin\\S-1-5-18\\") returned="C:\\$Recycle.Bin\\S-1-5-18\\" [0070.995] wcscat (in: _Dest=0x389ebc0, _Source="*" | out: _Dest="C:\\$Recycle.Bin\\S-1-5-18\\*") returned="C:\\$Recycle.Bin\\S-1-5-18\\*" [0070.995] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x38b7a30 [0070.995] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x38b7a30 | out: lpFindFileData=0x38b7a30*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ed80 [0071.086] wcscmp (_String1=".", _String2=".") returned 0 [0071.086] FindNextFileW (in: hFindFile=0x389ed80, lpFindFileData=0x38b7a30 | out: lpFindFileData=0x38b7a30*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.086] wcscmp (_String1="..", _String2=".") returned 1 [0071.086] wcscmp (_String1="..", _String2="..") returned 0 [0071.086] FindNextFileW (in: hFindFile=0x389ed80, lpFindFileData=0x38b7a30 | out: lpFindFileData=0x38b7a30*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0071.086] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0071.086] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0071.086] FindNextFileW (in: hFindFile=0x389ed80, lpFindFileData=0x38b7a30 | out: lpFindFileData=0x38b7a30*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0071.086] FindClose (in: hFindFile=0x389ed80 | out: hFindFile=0x389ed80) returned 1 [0071.086] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b7a30) returned 1 [0071.086] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389ebc0) returned 1 [0071.086] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f480) returned 1 Thread: id = 41 os_tid = 0xfa0 [0070.996] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x80) returned 0x388cd08 [0070.997] wcscpy (in: _Dest=0x388cd08, _Source="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000" | out: _Dest="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000") returned="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000" [0070.997] wcscat (in: _Dest=0x388cd08, _Source="\\" | out: _Dest="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\") returned="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\" [0070.997] wcscat (in: _Dest=0x388cd08, _Source="*" | out: _Dest="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*") returned="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*" [0070.998] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x38b8568 [0070.998] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x38b8568 | out: lpFindFileData=0x38b8568*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445480 [0071.542] wcscmp (_String1=".", _String2=".") returned 0 [0071.542] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x38b8568 | out: lpFindFileData=0x38b8568*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.542] wcscmp (_String1="..", _String2=".") returned 1 [0071.542] wcscmp (_String1="..", _String2="..") returned 0 [0071.542] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x38b8568 | out: lpFindFileData=0x38b8568*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0071.542] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0071.542] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0071.542] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x38b8568 | out: lpFindFileData=0x38b8568*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0071.542] FindClose (in: hFindFile=0x5445480 | out: hFindFile=0x5445480) returned 1 [0071.542] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b8568) returned 1 [0071.542] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388cd08) returned 1 [0071.542] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3887d40) returned 1 Thread: id = 42 os_tid = 0xf98 [0071.002] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a63d0 [0071.002] wcscpy (in: _Dest=0x38a63d0, _Source="C:\\Program Files\\Common Files" | out: _Dest="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0071.002] wcscat (in: _Dest=0x38a63d0, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\" [0071.002] wcscat (in: _Dest=0x38a63d0, _Source="*" | out: _Dest="C:\\Program Files\\Common Files\\*") returned="C:\\Program Files\\Common Files\\*" [0071.002] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53fe008 [0071.003] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\*", lpFindFileData=0x53fe008 | out: lpFindFileData=0x53fe008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0071.453] wcscmp (_String1=".", _String2=".") returned 0 [0071.453] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53fe008 | out: lpFindFileData=0x53fe008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.453] wcscmp (_String1="..", _String2=".") returned 1 [0071.453] wcscmp (_String1="..", _String2="..") returned 0 [0071.453] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53fe008 | out: lpFindFileData=0x53fe008*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0071.453] wcscmp (_String1="DESIGNER", _String2=".") returned 1 [0071.453] wcscmp (_String1="DESIGNER", _String2="..") returned 1 [0071.453] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x5428240 [0071.453] wcscpy (in: _Dest=0x5428240, _Source="C:\\Program Files\\Common Files" | out: _Dest="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0071.453] wcscat (in: _Dest=0x5428240, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\" [0071.453] wcscat (in: _Dest=0x5428240, _Source="DESIGNER" | out: _Dest="C:\\Program Files\\Common Files\\DESIGNER") returned="C:\\Program Files\\Common Files\\DESIGNER" [0071.458] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5428240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d8 [0071.459] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53fe008 | out: lpFindFileData=0x53fe008*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0071.459] wcscmp (_String1="microsoft shared", _String2=".") returned 1 [0071.459] wcscmp (_String1="microsoft shared", _String2="..") returned 1 [0071.459] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x541b078 [0071.459] wcscpy (in: _Dest=0x541b078, _Source="C:\\Program Files\\Common Files" | out: _Dest="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0071.459] wcscat (in: _Dest=0x541b078, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\" [0071.459] wcscat (in: _Dest=0x541b078, _Source="microsoft shared" | out: _Dest="C:\\Program Files\\Common Files\\microsoft shared") returned="C:\\Program Files\\Common Files\\microsoft shared" [0071.459] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541b078) returned 1 [0071.459] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53fe008 | out: lpFindFileData=0x53fe008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0071.459] wcscmp (_String1="Services", _String2=".") returned 1 [0071.459] wcscmp (_String1="Services", _String2="..") returned 1 [0071.459] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x54284a8 [0071.459] wcscpy (in: _Dest=0x54284a8, _Source="C:\\Program Files\\Common Files" | out: _Dest="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0071.459] wcscat (in: _Dest=0x54284a8, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\" [0071.460] wcscat (in: _Dest=0x54284a8, _Source="Services" | out: _Dest="C:\\Program Files\\Common Files\\Services") returned="C:\\Program Files\\Common Files\\Services" [0071.460] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54284a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6dc [0071.460] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53fe008 | out: lpFindFileData=0x53fe008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0071.460] wcscmp (_String1="System", _String2=".") returned 1 [0071.460] wcscmp (_String1="System", _String2="..") returned 1 [0071.460] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x54288c8 [0071.460] wcscpy (in: _Dest=0x54288c8, _Source="C:\\Program Files\\Common Files" | out: _Dest="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0071.460] wcscat (in: _Dest=0x54288c8, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\" [0071.460] wcscat (in: _Dest=0x54288c8, _Source="System" | out: _Dest="C:\\Program Files\\Common Files\\System") returned="C:\\Program Files\\Common Files\\System" [0071.461] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54288c8) returned 1 [0071.461] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53fe008 | out: lpFindFileData=0x53fe008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0071.461] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0071.461] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fe008) returned 1 [0071.461] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a63d0) returned 1 [0071.461] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6418) returned 1 Thread: id = 43 os_tid = 0xe8c [0071.004] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x30) returned 0x38a9c88 [0071.004] wcscpy (in: _Dest=0x38a9c88, _Source="C:\\Program Files\\Java" | out: _Dest="C:\\Program Files\\Java") returned="C:\\Program Files\\Java" [0071.004] wcscat (in: _Dest=0x38a9c88, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\") returned="C:\\Program Files\\Java\\" [0071.004] wcscat (in: _Dest=0x38a9c88, _Source="*" | out: _Dest="C:\\Program Files\\Java\\*") returned="C:\\Program Files\\Java\\*" [0071.004] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53feb40 [0071.004] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\*", lpFindFileData=0x53feb40 | out: lpFindFileData=0x53feb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3b2729cb, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b2729cb, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445580 [0071.905] wcscmp (_String1=".", _String2=".") returned 0 [0071.905] FindNextFileW (in: hFindFile=0x5445580, lpFindFileData=0x53feb40 | out: lpFindFileData=0x53feb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3b2729cb, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b2729cb, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.905] wcscmp (_String1="..", _String2=".") returned 1 [0071.905] wcscmp (_String1="..", _String2="..") returned 0 [0071.905] FindNextFileW (in: hFindFile=0x5445580, lpFindFileData=0x53feb40 | out: lpFindFileData=0x53feb40*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre1.8.0_144", cAlternateFileName="JRE18~1.0_1")) returned 1 [0071.905] wcscmp (_String1="jre1.8.0_144", _String2=".") returned 1 [0071.905] wcscmp (_String1="jre1.8.0_144", _String2="..") returned 1 [0071.905] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x46) returned 0x5466140 [0071.905] wcscpy (in: _Dest=0x5466140, _Source="C:\\Program Files\\Java" | out: _Dest="C:\\Program Files\\Java") returned="C:\\Program Files\\Java" [0071.906] wcscat (in: _Dest=0x5466140, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\") returned="C:\\Program Files\\Java\\" [0071.906] wcscat (in: _Dest=0x5466140, _Source="jre1.8.0_144" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144") returned="C:\\Program Files\\Java\\jre1.8.0_144" [0071.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5466140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c [0071.906] FindNextFileW (in: hFindFile=0x5445580, lpFindFileData=0x53feb40 | out: lpFindFileData=0x53feb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8c8e810, ftCreationTime.dwHighDateTime=0x1d5b64f, ftLastAccessTime.dwLowDateTime=0x91a61af0, ftLastAccessTime.dwHighDateTime=0x1d5a595, ftLastWriteTime.dwLowDateTime=0x91a61af0, ftLastWriteTime.dwHighDateTime=0x1d5a595, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="spcwin.exe", cAlternateFileName="")) returned 1 [0071.906] wcscmp (_String1="spcwin.exe", _String2=".") returned 1 [0071.906] wcscmp (_String1="spcwin.exe", _String2="..") returned 1 [0071.906] FindNextFileW (in: hFindFile=0x5445580, lpFindFileData=0x53feb40 | out: lpFindFileData=0x53feb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8c8e810, ftCreationTime.dwHighDateTime=0x1d5b64f, ftLastAccessTime.dwLowDateTime=0x91a61af0, ftLastAccessTime.dwHighDateTime=0x1d5a595, ftLastWriteTime.dwLowDateTime=0x91a61af0, ftLastWriteTime.dwHighDateTime=0x1d5a595, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="spcwin.exe", cAlternateFileName="")) returned 0 [0071.907] FindClose (in: hFindFile=0x5445580 | out: hFindFile=0x5445580) returned 1 [0071.907] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53feb40) returned 1 [0071.907] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a9c88) returned 1 [0071.907] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38aa238) returned 1 Thread: id = 44 os_tid = 0x1278 [0071.005] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x38b3048 [0071.005] wcscpy (in: _Dest=0x38b3048, _Source="C:\\Program Files\\Microsoft Office" | out: _Dest="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0071.005] wcscat (in: _Dest=0x38b3048, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0071.005] wcscat (in: _Dest=0x38b3048, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\*") returned="C:\\Program Files\\Microsoft Office\\*" [0071.005] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53ff678 [0071.005] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\*", lpFindFileData=0x53ff678 | out: lpFindFileData=0x53ff678*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x39fd2260, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39fd2260, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445980 [0071.453] wcscmp (_String1=".", _String2=".") returned 0 [0071.453] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x53ff678 | out: lpFindFileData=0x53ff678*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x39fd2260, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39fd2260, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.454] wcscmp (_String1="..", _String2=".") returned 1 [0071.454] wcscmp (_String1="..", _String2="..") returned 0 [0071.454] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x53ff678 | out: lpFindFileData=0x53ff678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d6778e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9dfb986, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf9e9425d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x5ab2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.xml", cAlternateFileName="APPXMA~1.XML")) returned 1 [0071.454] wcscmp (_String1="AppXManifest.xml", _String2=".") returned 1 [0071.454] wcscmp (_String1="AppXManifest.xml", _String2="..") returned 1 [0071.454] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x38b23a8 [0071.454] wcscpy (in: _Dest=0x38b23a8, _Source="C:\\Program Files\\Microsoft Office" | out: _Dest="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0071.454] wcscat (in: _Dest=0x38b23a8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0071.454] wcscat (in: _Dest=0x38b23a8, _Source="AppXManifest.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" [0071.467] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b23a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6cc [0071.468] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x53ff678 | out: lpFindFileData=0x53ff678*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x831d63af, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83543a09, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSystemMetadata.xml", cAlternateFileName="FILESY~1.XML")) returned 1 [0071.468] wcscmp (_String1="FileSystemMetadata.xml", _String2=".") returned 1 [0071.468] wcscmp (_String1="FileSystemMetadata.xml", _String2="..") returned 1 [0071.468] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x72) returned 0x388fba0 [0071.468] wcscpy (in: _Dest=0x388fba0, _Source="C:\\Program Files\\Microsoft Office" | out: _Dest="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0071.468] wcscat (in: _Dest=0x388fba0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0071.468] wcscat (in: _Dest=0x388fba0, _Source="FileSystemMetadata.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" [0071.468] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x388fba0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c4 [0071.469] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x53ff678 | out: lpFindFileData=0x53ff678*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9e7b530, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa146f18e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda9a8629, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office16", cAlternateFileName="")) returned 1 [0071.469] wcscmp (_String1="Office16", _String2=".") returned 1 [0071.469] wcscmp (_String1="Office16", _String2="..") returned 1 [0071.469] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x543d758 [0071.469] wcscpy (in: _Dest=0x543d758, _Source="C:\\Program Files\\Microsoft Office" | out: _Dest="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0071.469] wcscat (in: _Dest=0x543d758, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0071.469] wcscat (in: _Dest=0x543d758, _Source="Office16" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office16") returned="C:\\Program Files\\Microsoft Office\\Office16" [0071.469] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x543d758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e0 [0071.469] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x53ff678 | out: lpFindFileData=0x53ff678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf982bd9c, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManifests", cAlternateFileName="PACKAG~1")) returned 1 [0071.469] wcscmp (_String1="PackageManifests", _String2=".") returned 1 [0071.470] wcscmp (_String1="PackageManifests", _String2="..") returned 1 [0071.470] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x38b21e8 [0071.470] wcscpy (in: _Dest=0x38b21e8, _Source="C:\\Program Files\\Microsoft Office" | out: _Dest="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0071.470] wcscat (in: _Dest=0x38b21e8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0071.470] wcscat (in: _Dest=0x38b21e8, _Source="PackageManifests" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests") returned="C:\\Program Files\\Microsoft Office\\PackageManifests" [0071.470] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b21e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e4 [0071.470] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x53ff678 | out: lpFindFileData=0x53ff678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a6372d0, ftCreationTime.dwHighDateTime=0x1d58a65, ftLastAccessTime.dwLowDateTime=0xb2ca73a0, ftLastAccessTime.dwHighDateTime=0x1d5c414, ftLastWriteTime.dwLowDateTime=0xb2ca73a0, ftLastWriteTime.dwHighDateTime=0x1d5c414, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ride_australian_lanka.exe", cAlternateFileName="RIDE_A~1.EXE")) returned 1 [0071.470] wcscmp (_String1="ride_australian_lanka.exe", _String2=".") returned 1 [0071.470] wcscmp (_String1="ride_australian_lanka.exe", _String2="..") returned 1 [0071.470] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x53ff678 | out: lpFindFileData=0x53ff678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0071.470] wcscmp (_String1="root", _String2=".") returned 1 [0071.470] wcscmp (_String1="root", _String2="..") returned 1 [0071.470] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x54288c8 [0071.470] wcscpy (in: _Dest=0x54288c8, _Source="C:\\Program Files\\Microsoft Office" | out: _Dest="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0071.471] wcscat (in: _Dest=0x54288c8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0071.471] wcscat (in: _Dest=0x54288c8, _Source="root" | out: _Dest="C:\\Program Files\\Microsoft Office\\root") returned="C:\\Program Files\\Microsoft Office\\root" [0071.471] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54288c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e8 [0071.471] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x53ff678 | out: lpFindFileData=0x53ff678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 0 [0071.471] FindClose (in: hFindFile=0x5445980 | out: hFindFile=0x5445980) returned 1 [0071.471] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ff678) returned 1 [0071.471] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b3048) returned 1 [0071.471] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3892b60) returned 1 Thread: id = 45 os_tid = 0x880 [0071.006] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x3883c10 [0071.006] wcscpy (in: _Dest=0x3883c10, _Source="C:\\Program Files\\Microsoft Office 15" | out: _Dest="C:\\Program Files\\Microsoft Office 15") returned="C:\\Program Files\\Microsoft Office 15" [0071.006] wcscat (in: _Dest=0x3883c10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office 15\\") returned="C:\\Program Files\\Microsoft Office 15\\" [0071.006] wcscat (in: _Dest=0x3883c10, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office 15\\*") returned="C:\\Program Files\\Microsoft Office 15\\*" [0071.006] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54060e8 [0071.006] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office 15\\*", lpFindFileData=0x54060e8 | out: lpFindFileData=0x54060e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b1d9def, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b1d9def, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445800 [0071.908] wcscmp (_String1=".", _String2=".") returned 0 [0071.908] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x54060e8 | out: lpFindFileData=0x54060e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b1d9def, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b1d9def, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.908] wcscmp (_String1="..", _String2=".") returned 1 [0071.908] wcscmp (_String1="..", _String2="..") returned 0 [0071.908] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x54060e8 | out: lpFindFileData=0x54060e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e68d8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82e8efda, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClientX64", cAlternateFileName="CLIENT~1")) returned 1 [0071.908] wcscmp (_String1="ClientX64", _String2=".") returned 1 [0071.908] wcscmp (_String1="ClientX64", _String2="..") returned 1 [0071.908] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x542bb40 [0071.908] wcscpy (in: _Dest=0x542bb40, _Source="C:\\Program Files\\Microsoft Office 15" | out: _Dest="C:\\Program Files\\Microsoft Office 15") returned="C:\\Program Files\\Microsoft Office 15" [0071.908] wcscat (in: _Dest=0x542bb40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office 15\\") returned="C:\\Program Files\\Microsoft Office 15\\" [0071.908] wcscat (in: _Dest=0x542bb40, _Source="ClientX64" | out: _Dest="C:\\Program Files\\Microsoft Office 15\\ClientX64") returned="C:\\Program Files\\Microsoft Office 15\\ClientX64" [0071.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x542bb40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x840 [0071.909] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x54060e8 | out: lpFindFileData=0x54060e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913b80f0, ftCreationTime.dwHighDateTime=0x1d58907, ftLastAccessTime.dwLowDateTime=0x4c5597a0, ftLastAccessTime.dwHighDateTime=0x1d583fd, ftLastWriteTime.dwLowDateTime=0x4c5597a0, ftLastWriteTime.dwHighDateTime=0x1d583fd, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="operamail.exe", cAlternateFileName="OPERAM~1.EXE")) returned 1 [0071.909] wcscmp (_String1="operamail.exe", _String2=".") returned 1 [0071.909] wcscmp (_String1="operamail.exe", _String2="..") returned 1 [0071.909] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x54060e8 | out: lpFindFileData=0x54060e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0e87570, ftCreationTime.dwHighDateTime=0x1d59270, ftLastAccessTime.dwLowDateTime=0xdd8c61f0, ftLastAccessTime.dwHighDateTime=0x1d5cc81, ftLastWriteTime.dwLowDateTime=0xdd8c61f0, ftLastWriteTime.dwHighDateTime=0x1d5cc81, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="trillian.exe", cAlternateFileName="")) returned 1 [0071.909] wcscmp (_String1="trillian.exe", _String2=".") returned 1 [0071.909] wcscmp (_String1="trillian.exe", _String2="..") returned 1 [0071.909] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x54060e8 | out: lpFindFileData=0x54060e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52df1d70, ftCreationTime.dwHighDateTime=0x1d5834a, ftLastAccessTime.dwLowDateTime=0x15a70cd0, ftLastAccessTime.dwHighDateTime=0x1d5ca88, ftLastWriteTime.dwLowDateTime=0x15a70cd0, ftLastWriteTime.dwHighDateTime=0x1d5ca88, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="webdrive.exe", cAlternateFileName="")) returned 1 [0071.909] wcscmp (_String1="webdrive.exe", _String2=".") returned 1 [0071.909] wcscmp (_String1="webdrive.exe", _String2="..") returned 1 [0071.909] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x54060e8 | out: lpFindFileData=0x54060e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52df1d70, ftCreationTime.dwHighDateTime=0x1d5834a, ftLastAccessTime.dwLowDateTime=0x15a70cd0, ftLastAccessTime.dwHighDateTime=0x1d5ca88, ftLastWriteTime.dwLowDateTime=0x15a70cd0, ftLastWriteTime.dwHighDateTime=0x1d5ca88, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="webdrive.exe", cAlternateFileName="")) returned 0 [0071.909] FindClose (in: hFindFile=0x5445800 | out: hFindFile=0x5445800) returned 1 [0071.909] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54060e8) returned 1 [0071.909] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3883c10) returned 1 [0071.909] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5470f88) returned 1 Thread: id = 46 os_tid = 0x1318 [0071.006] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389ec00 [0071.006] wcscpy (in: _Dest=0x389ec00, _Source="C:\\Program Files\\MSBuild" | out: _Dest="C:\\Program Files\\MSBuild") returned="C:\\Program Files\\MSBuild" [0071.006] wcscat (in: _Dest=0x389ec00, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\") returned="C:\\Program Files\\MSBuild\\" [0071.006] wcscat (in: _Dest=0x389ec00, _Source="*" | out: _Dest="C:\\Program Files\\MSBuild\\*") returned="C:\\Program Files\\MSBuild\\*" [0071.006] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5406340 [0071.006] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\*", lpFindFileData=0x5406340 | out: lpFindFileData=0x5406340*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0x3b2261df, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b2261df, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445840 [0071.454] wcscmp (_String1=".", _String2=".") returned 0 [0071.454] FindNextFileW (in: hFindFile=0x5445840, lpFindFileData=0x5406340 | out: lpFindFileData=0x5406340*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0x3b2261df, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b2261df, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.454] wcscmp (_String1="..", _String2=".") returned 1 [0071.454] wcscmp (_String1="..", _String2="..") returned 0 [0071.454] FindNextFileW (in: hFindFile=0x5445840, lpFindFileData=0x5406340 | out: lpFindFileData=0x5406340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6f4f8d0, ftCreationTime.dwHighDateTime=0x1d55377, ftLastAccessTime.dwLowDateTime=0x66fe9760, ftLastAccessTime.dwHighDateTime=0x1d59db5, ftLastWriteTime.dwLowDateTime=0x66fe9760, ftLastWriteTime.dwHighDateTime=0x1d59db5, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="aldelo.exe", cAlternateFileName="")) returned 1 [0071.454] wcscmp (_String1="aldelo.exe", _String2=".") returned 1 [0071.454] wcscmp (_String1="aldelo.exe", _String2="..") returned 1 [0071.454] FindNextFileW (in: hFindFile=0x5445840, lpFindFileData=0x5406340 | out: lpFindFileData=0x5406340*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79312f8, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79312f8, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0071.454] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0071.454] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0071.454] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x46) returned 0x54430a0 [0071.454] wcscpy (in: _Dest=0x54430a0, _Source="C:\\Program Files\\MSBuild" | out: _Dest="C:\\Program Files\\MSBuild") returned="C:\\Program Files\\MSBuild" [0071.454] wcscat (in: _Dest=0x54430a0, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\") returned="C:\\Program Files\\MSBuild\\" [0071.454] wcscat (in: _Dest=0x54430a0, _Source="Microsoft" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft") returned="C:\\Program Files\\MSBuild\\Microsoft" [0071.466] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54430a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d0 [0071.466] FindNextFileW (in: hFindFile=0x5445840, lpFindFileData=0x5406340 | out: lpFindFileData=0x5406340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3abfbd60, ftCreationTime.dwHighDateTime=0x1d5b1e1, ftLastAccessTime.dwLowDateTime=0x6107adb0, ftLastAccessTime.dwHighDateTime=0x1d554b3, ftLastWriteTime.dwLowDateTime=0x6107adb0, ftLastWriteTime.dwHighDateTime=0x1d554b3, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="outlook.exe", cAlternateFileName="")) returned 1 [0071.466] wcscmp (_String1="outlook.exe", _String2=".") returned 1 [0071.466] wcscmp (_String1="outlook.exe", _String2="..") returned 1 [0071.466] FindNextFileW (in: hFindFile=0x5445840, lpFindFileData=0x5406340 | out: lpFindFileData=0x5406340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5493930, ftCreationTime.dwHighDateTime=0x1d5827f, ftLastAccessTime.dwLowDateTime=0x7df69070, ftLastAccessTime.dwHighDateTime=0x1d59889, ftLastWriteTime.dwLowDateTime=0x7df69070, ftLastWriteTime.dwHighDateTime=0x1d59889, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="paxil-tried.exe", cAlternateFileName="PAXIL-~1.EXE")) returned 1 [0071.466] wcscmp (_String1="paxil-tried.exe", _String2=".") returned 1 [0071.466] wcscmp (_String1="paxil-tried.exe", _String2="..") returned 1 [0071.466] FindNextFileW (in: hFindFile=0x5445840, lpFindFileData=0x5406340 | out: lpFindFileData=0x5406340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5493930, ftCreationTime.dwHighDateTime=0x1d5827f, ftLastAccessTime.dwLowDateTime=0x7df69070, ftLastAccessTime.dwHighDateTime=0x1d59889, ftLastWriteTime.dwLowDateTime=0x7df69070, ftLastWriteTime.dwHighDateTime=0x1d59889, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="paxil-tried.exe", cAlternateFileName="PAXIL-~1.EXE")) returned 0 [0071.466] FindClose (in: hFindFile=0x5445840 | out: hFindFile=0x5445840) returned 1 [0071.466] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5406340) returned 1 [0071.466] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389ec00) returned 1 [0071.466] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f400) returned 1 Thread: id = 47 os_tid = 0x1314 [0071.007] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x388a390 [0071.007] wcscpy (in: _Dest=0x388a390, _Source="C:\\Program Files\\Reference Assemblies" | out: _Dest="C:\\Program Files\\Reference Assemblies") returned="C:\\Program Files\\Reference Assemblies" [0071.007] wcscat (in: _Dest=0x388a390, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\") returned="C:\\Program Files\\Reference Assemblies\\" [0071.007] wcscat (in: _Dest=0x388a390, _Source="*" | out: _Dest="C:\\Program Files\\Reference Assemblies\\*") returned="C:\\Program Files\\Reference Assemblies\\*" [0071.007] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5407430 [0071.007] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\*", lpFindFileData=0x5407430 | out: lpFindFileData=0x5407430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe795770f, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe795770f, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe795770f, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ee00 [0071.139] wcscmp (_String1=".", _String2=".") returned 0 [0071.139] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x5407430 | out: lpFindFileData=0x5407430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe795770f, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe795770f, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe795770f, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.139] wcscmp (_String1="..", _String2=".") returned 1 [0071.139] wcscmp (_String1="..", _String2="..") returned 0 [0071.139] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x5407430 | out: lpFindFileData=0x5407430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe795770f, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe795770f, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe795770f, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0071.139] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0071.139] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0071.139] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x541ac00 [0071.139] wcscpy (in: _Dest=0x541ac00, _Source="C:\\Program Files\\Reference Assemblies" | out: _Dest="C:\\Program Files\\Reference Assemblies") returned="C:\\Program Files\\Reference Assemblies" [0071.139] wcscat (in: _Dest=0x541ac00, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\") returned="C:\\Program Files\\Reference Assemblies\\" [0071.139] wcscat (in: _Dest=0x541ac00, _Source="Microsoft" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft") returned="C:\\Program Files\\Reference Assemblies\\Microsoft" [0071.442] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x541ac00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac [0071.443] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x5407430 | out: lpFindFileData=0x5407430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe795770f, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe795770f, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe795770f, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0071.443] FindClose (in: hFindFile=0x389ee00 | out: hFindFile=0x389ee00) returned 1 [0071.443] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5407430) returned 1 [0071.443] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388a390) returned 1 [0071.443] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3887bc0) returned 1 Thread: id = 48 os_tid = 0x12bc [0071.008] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x32) returned 0x389ec40 [0071.008] wcscpy (in: _Dest=0x389ec40, _Source="C:\\Program Files\\rempl" | out: _Dest="C:\\Program Files\\rempl") returned="C:\\Program Files\\rempl" [0071.008] wcscat (in: _Dest=0x389ec40, _Source="\\" | out: _Dest="C:\\Program Files\\rempl\\") returned="C:\\Program Files\\rempl\\" [0071.008] wcscat (in: _Dest=0x389ec40, _Source="*" | out: _Dest="C:\\Program Files\\rempl\\*") returned="C:\\Program Files\\rempl\\*" [0071.008] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5407900 [0071.008] FindFirstFileW (in: lpFileName="C:\\Program Files\\rempl\\*", lpFindFileData=0x5407900 | out: lpFindFileData=0x5407900*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x59f2f4b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x39ff826d, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39ff826d, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54455c0 [0071.910] wcscmp (_String1=".", _String2=".") returned 0 [0071.910] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x5407900 | out: lpFindFileData=0x5407900*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x59f2f4b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x39ff826d, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39ff826d, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.910] wcscmp (_String1="..", _String2=".") returned 1 [0071.910] wcscmp (_String1="..", _String2="..") returned 0 [0071.910] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x5407900 | out: lpFindFileData=0x5407900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca020d30, ftCreationTime.dwHighDateTime=0x1d561b3, ftLastAccessTime.dwLowDateTime=0xf6d0b6f0, ftLastAccessTime.dwHighDateTime=0x1d57ca1, ftLastWriteTime.dwLowDateTime=0xf6d0b6f0, ftLastWriteTime.dwHighDateTime=0x1d57ca1, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="faq.exe", cAlternateFileName="")) returned 1 [0071.910] wcscmp (_String1="faq.exe", _String2=".") returned 1 [0071.910] wcscmp (_String1="faq.exe", _String2="..") returned 1 [0071.910] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x5407900 | out: lpFindFileData=0x5407900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8390c831, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x86e9cd10, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x86e9cd10, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0071.910] wcscmp (_String1="Logs", _String2=".") returned 1 [0071.910] wcscmp (_String1="Logs", _String2="..") returned 1 [0071.911] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x38) returned 0x5445700 [0071.911] wcscpy (in: _Dest=0x5445700, _Source="C:\\Program Files\\rempl" | out: _Dest="C:\\Program Files\\rempl") returned="C:\\Program Files\\rempl" [0071.911] wcscat (in: _Dest=0x5445700, _Source="\\" | out: _Dest="C:\\Program Files\\rempl\\") returned="C:\\Program Files\\rempl\\" [0071.911] wcscat (in: _Dest=0x5445700, _Source="Logs" | out: _Dest="C:\\Program Files\\rempl\\Logs") returned="C:\\Program Files\\rempl\\Logs" [0071.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5445700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x844 [0071.911] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x5407900 | out: lpFindFileData=0x5407900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76938800, ftCreationTime.dwHighDateTime=0x1d2e919, ftLastAccessTime.dwLowDateTime=0x59f55710, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x76938800, ftLastWriteTime.dwHighDateTime=0x1d2e919, nFileSizeHigh=0x0, nFileSizeLow=0xf2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="rempl.xml", cAlternateFileName="")) returned 1 [0071.911] wcscmp (_String1="rempl.xml", _String2=".") returned 1 [0071.911] wcscmp (_String1="rempl.xml", _String2="..") returned 1 [0071.911] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x42) returned 0x54669b0 [0071.911] wcscpy (in: _Dest=0x54669b0, _Source="C:\\Program Files\\rempl" | out: _Dest="C:\\Program Files\\rempl") returned="C:\\Program Files\\rempl" [0071.911] wcscat (in: _Dest=0x54669b0, _Source="\\" | out: _Dest="C:\\Program Files\\rempl\\") returned="C:\\Program Files\\rempl\\" [0071.912] wcscat (in: _Dest=0x54669b0, _Source="rempl.xml" | out: _Dest="C:\\Program Files\\rempl\\rempl.xml") returned="C:\\Program Files\\rempl\\rempl.xml" [0071.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54669b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x848 [0071.912] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x5407900 | out: lpFindFileData=0x5407900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58a4a100, ftCreationTime.dwHighDateTime=0x1d3176b, ftLastAccessTime.dwLowDateTime=0x59f55710, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x58a4a100, ftLastWriteTime.dwHighDateTime=0x1d3176b, nFileSizeHigh=0x0, nFileSizeLow=0x65008, dwReserved0=0x0, dwReserved1=0x0, cFileName="remsh.exe", cAlternateFileName="")) returned 1 [0071.912] wcscmp (_String1="remsh.exe", _String2=".") returned 1 [0071.912] wcscmp (_String1="remsh.exe", _String2="..") returned 1 [0071.912] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x5407900 | out: lpFindFileData=0x5407900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ce1400, ftCreationTime.dwHighDateTime=0x1d2f63b, ftLastAccessTime.dwLowDateTime=0x59f55710, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x71ce1400, ftLastWriteTime.dwHighDateTime=0x1d2f63b, nFileSizeHigh=0x0, nFileSizeLow=0x605, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unlock.xml", cAlternateFileName="")) returned 1 [0071.912] wcscmp (_String1="Unlock.xml", _String2=".") returned 1 [0071.912] wcscmp (_String1="Unlock.xml", _String2="..") returned 1 [0071.912] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x5466870 [0071.912] wcscpy (in: _Dest=0x5466870, _Source="C:\\Program Files\\rempl" | out: _Dest="C:\\Program Files\\rempl") returned="C:\\Program Files\\rempl" [0071.912] wcscat (in: _Dest=0x5466870, _Source="\\" | out: _Dest="C:\\Program Files\\rempl\\") returned="C:\\Program Files\\rempl\\" [0071.913] wcscat (in: _Dest=0x5466870, _Source="Unlock.xml" | out: _Dest="C:\\Program Files\\rempl\\Unlock.xml") returned="C:\\Program Files\\rempl\\Unlock.xml" [0071.913] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5466870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x84c [0071.913] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x5407900 | out: lpFindFileData=0x5407900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ce1400, ftCreationTime.dwHighDateTime=0x1d2f63b, ftLastAccessTime.dwLowDateTime=0x59f55710, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x71ce1400, ftLastWriteTime.dwHighDateTime=0x1d2f63b, nFileSizeHigh=0x0, nFileSizeLow=0x605, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unlock.xml", cAlternateFileName="")) returned 0 [0071.913] FindClose (in: hFindFile=0x54455c0 | out: hFindFile=0x54455c0) returned 1 [0071.913] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5407900) returned 1 [0071.913] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389ec40) returned 1 [0071.913] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38aa158) returned 1 Thread: id = 49 os_tid = 0x12c8 [0071.008] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x38b2870 [0071.008] wcscpy (in: _Dest=0x38b2870, _Source="C:\\Program Files\\Uninstall Information" | out: _Dest="C:\\Program Files\\Uninstall Information") returned="C:\\Program Files\\Uninstall Information" [0071.008] wcscat (in: _Dest=0x38b2870, _Source="\\" | out: _Dest="C:\\Program Files\\Uninstall Information\\") returned="C:\\Program Files\\Uninstall Information\\" [0071.008] wcscat (in: _Dest=0x38b2870, _Source="*" | out: _Dest="C:\\Program Files\\Uninstall Information\\*") returned="C:\\Program Files\\Uninstall Information\\*" [0071.008] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5407698 [0071.008] FindFirstFileW (in: lpFileName="C:\\Program Files\\Uninstall Information\\*", lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xd2709a20, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xa747e827, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2709a20, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389edc0 [0071.130] wcscmp (_String1=".", _String2=".") returned 0 [0071.130] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xd2709a20, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xa747e827, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2709a20, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.130] wcscmp (_String1="..", _String2=".") returned 1 [0071.130] wcscmp (_String1="..", _String2="..") returned 0 [0071.130] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xd2709a20, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xa747e827, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2709a20, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0071.130] FindClose (in: hFindFile=0x389edc0 | out: hFindFile=0x389edc0) returned 1 [0071.130] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5407698) returned 1 [0071.130] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b2870) returned 1 [0071.130] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38883d8) returned 1 Thread: id = 50 os_tid = 0x12dc [0071.009] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2e) returned 0x5408d40 [0071.009] wcscpy (in: _Dest=0x5408d40, _Source="C:\\Program Files\\UNP" | out: _Dest="C:\\Program Files\\UNP") returned="C:\\Program Files\\UNP" [0071.009] wcscat (in: _Dest=0x5408d40, _Source="\\" | out: _Dest="C:\\Program Files\\UNP\\") returned="C:\\Program Files\\UNP\\" [0071.009] wcscat (in: _Dest=0x5408d40, _Source="*" | out: _Dest="C:\\Program Files\\UNP\\*") returned="C:\\Program Files\\UNP\\*" [0071.009] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5407b68 [0071.009] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\*", lpFindFileData=0x5407b68 | out: lpFindFileData=0x5407b68*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4c509d45, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x39fd2260, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39fd2260, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445540 [0071.456] wcscmp (_String1=".", _String2=".") returned 0 [0071.456] FindNextFileW (in: hFindFile=0x5445540, lpFindFileData=0x5407b68 | out: lpFindFileData=0x5407b68*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4c509d45, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x39fd2260, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39fd2260, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.456] wcscmp (_String1="..", _String2=".") returned 1 [0071.456] wcscmp (_String1="..", _String2="..") returned 0 [0071.456] FindNextFileW (in: hFindFile=0x5445540, lpFindFileData=0x5407b68 | out: lpFindFileData=0x5407b68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x749f4454, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa747febb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CampaignManager", cAlternateFileName="CAMPAI~1")) returned 1 [0071.456] wcscmp (_String1="CampaignManager", _String2=".") returned 1 [0071.456] wcscmp (_String1="CampaignManager", _String2="..") returned 1 [0071.456] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x5428a80 [0071.456] wcscpy (in: _Dest=0x5428a80, _Source="C:\\Program Files\\UNP" | out: _Dest="C:\\Program Files\\UNP") returned="C:\\Program Files\\UNP" [0071.456] wcscat (in: _Dest=0x5428a80, _Source="\\" | out: _Dest="C:\\Program Files\\UNP\\") returned="C:\\Program Files\\UNP\\" [0071.456] wcscat (in: _Dest=0x5428a80, _Source="CampaignManager" | out: _Dest="C:\\Program Files\\UNP\\CampaignManager") returned="C:\\Program Files\\UNP\\CampaignManager" [0071.462] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5428a80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ec [0071.463] FindNextFileW (in: hFindFile=0x5445540, lpFindFileData=0x5407b68 | out: lpFindFileData=0x5407b68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c52ff94, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x9126a3e3, ftLastAccessTime.dwHighDateTime=0x1d5e1e4, ftLastWriteTime.dwLowDateTime=0x9126a3e3, ftLastWriteTime.dwHighDateTime=0x1d5e1e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0071.463] wcscmp (_String1="Logs", _String2=".") returned 1 [0071.463] wcscmp (_String1="Logs", _String2="..") returned 1 [0071.463] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x34) returned 0x54459c0 [0071.463] wcscpy (in: _Dest=0x54459c0, _Source="C:\\Program Files\\UNP" | out: _Dest="C:\\Program Files\\UNP") returned="C:\\Program Files\\UNP" [0071.463] wcscat (in: _Dest=0x54459c0, _Source="\\" | out: _Dest="C:\\Program Files\\UNP\\") returned="C:\\Program Files\\UNP\\" [0071.463] wcscat (in: _Dest=0x54459c0, _Source="Logs" | out: _Dest="C:\\Program Files\\UNP\\Logs") returned="C:\\Program Files\\UNP\\Logs" [0071.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54459c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0 [0071.464] FindNextFileW (in: hFindFile=0x5445540, lpFindFileData=0x5407b68 | out: lpFindFileData=0x5407b68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63f8eb60, ftCreationTime.dwHighDateTime=0x1d56052, ftLastAccessTime.dwLowDateTime=0xc64c4230, ftLastAccessTime.dwHighDateTime=0x1d5c1dc, ftLastWriteTime.dwLowDateTime=0xc64c4230, ftLastWriteTime.dwHighDateTime=0x1d5c1dc, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ranges-kerry.exe", cAlternateFileName="RANGES~1.EXE")) returned 1 [0071.464] wcscmp (_String1="ranges-kerry.exe", _String2=".") returned 1 [0071.464] wcscmp (_String1="ranges-kerry.exe", _String2="..") returned 1 [0071.464] FindNextFileW (in: hFindFile=0x5445540, lpFindFileData=0x5407b68 | out: lpFindFileData=0x5407b68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106b6e00, ftCreationTime.dwHighDateTime=0x1d2c1d0, ftLastAccessTime.dwLowDateTime=0x4c5561e0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x106b6e00, ftLastWriteTime.dwHighDateTime=0x1d2c1d0, nFileSizeHigh=0x0, nFileSizeLow=0xc86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task.xml", cAlternateFileName="")) returned 1 [0071.464] wcscmp (_String1="Task.xml", _String2=".") returned 1 [0071.464] wcscmp (_String1="Task.xml", _String2="..") returned 1 [0071.464] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3c) returned 0x537b290 [0071.464] wcscpy (in: _Dest=0x537b290, _Source="C:\\Program Files\\UNP" | out: _Dest="C:\\Program Files\\UNP") returned="C:\\Program Files\\UNP" [0071.464] wcscat (in: _Dest=0x537b290, _Source="\\" | out: _Dest="C:\\Program Files\\UNP\\") returned="C:\\Program Files\\UNP\\" [0071.464] wcscat (in: _Dest=0x537b290, _Source="Task.xml" | out: _Dest="C:\\Program Files\\UNP\\Task.xml") returned="C:\\Program Files\\UNP\\Task.xml" [0071.464] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x537b290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x39c [0071.465] FindNextFileW (in: hFindFile=0x5445540, lpFindFileData=0x5407b68 | out: lpFindFileData=0x5407b68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106b6e00, ftCreationTime.dwHighDateTime=0x1d2c1d0, ftLastAccessTime.dwLowDateTime=0x4c5561e0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x106b6e00, ftLastWriteTime.dwHighDateTime=0x1d2c1d0, nFileSizeHigh=0x0, nFileSizeLow=0xc86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task.xml", cAlternateFileName="")) returned 0 [0071.465] FindClose (in: hFindFile=0x5445540 | out: hFindFile=0x5445540) returned 1 [0071.465] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5407b68) returned 1 [0071.465] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5408d40) returned 1 [0071.465] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a9d68) returned 1 Thread: id = 51 os_tid = 0x12b4 [0071.010] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7e) returned 0x54099c8 [0071.010] wcscpy (in: _Dest=0x54099c8, _Source="C:\\Program Files\\Windows Defender Advanced Threat Protection" | out: _Dest="C:\\Program Files\\Windows Defender Advanced Threat Protection") returned="C:\\Program Files\\Windows Defender Advanced Threat Protection" [0071.010] wcscat (in: _Dest=0x54099c8, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Defender Advanced Threat Protection\\") returned="C:\\Program Files\\Windows Defender Advanced Threat Protection\\" [0071.010] wcscat (in: _Dest=0x54099c8, _Source="*" | out: _Dest="C:\\Program Files\\Windows Defender Advanced Threat Protection\\*") returned="C:\\Program Files\\Windows Defender Advanced Threat Protection\\*" [0071.010] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5406a90 [0071.010] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender Advanced Threat Protection\\*", lpFindFileData=0x5406a90 | out: lpFindFileData=0x5406a90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x3b200123, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b200123, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445540 [0071.480] wcscmp (_String1=".", _String2=".") returned 0 [0071.480] FindNextFileW (in: hFindFile=0x5445540, lpFindFileData=0x5406a90 | out: lpFindFileData=0x5406a90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x3b200123, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b200123, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.480] wcscmp (_String1="..", _String2=".") returned 1 [0071.480] wcscmp (_String1="..", _String2="..") returned 0 [0071.480] FindNextFileW (in: hFindFile=0x5445540, lpFindFileData=0x5406a90 | out: lpFindFileData=0x5406a90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9f2aa80, ftCreationTime.dwHighDateTime=0x1d59720, ftLastAccessTime.dwLowDateTime=0xe8c463a0, ftLastAccessTime.dwHighDateTime=0x1d58baf, ftLastWriteTime.dwLowDateTime=0xe8c463a0, ftLastWriteTime.dwHighDateTime=0x1d58baf, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="active-charge.exe", cAlternateFileName="ACTIVE~1.EXE")) returned 1 [0071.480] wcscmp (_String1="active-charge.exe", _String2=".") returned 1 [0071.480] wcscmp (_String1="active-charge.exe", _String2="..") returned 1 [0071.480] FindNextFileW (in: hFindFile=0x5445540, lpFindFileData=0x5406a90 | out: lpFindFileData=0x5406a90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe87cb4f0, ftCreationTime.dwHighDateTime=0x1d5659f, ftLastAccessTime.dwLowDateTime=0x8f0367e0, ftLastAccessTime.dwHighDateTime=0x1d592a2, ftLastWriteTime.dwLowDateTime=0x8f0367e0, ftLastWriteTime.dwHighDateTime=0x1d592a2, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="afr38.exe", cAlternateFileName="")) returned 1 [0071.480] wcscmp (_String1="afr38.exe", _String2=".") returned 1 [0071.480] wcscmp (_String1="afr38.exe", _String2="..") returned 1 [0071.480] FindNextFileW (in: hFindFile=0x5445540, lpFindFileData=0x5406a90 | out: lpFindFileData=0x5406a90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fde773, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0071.480] wcscmp (_String1="en-US", _String2=".") returned 1 [0071.480] wcscmp (_String1="en-US", _String2="..") returned 1 [0071.480] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x86) returned 0x38a95f8 [0071.480] wcscpy (in: _Dest=0x38a95f8, _Source="C:\\Program Files\\Windows Defender Advanced Threat Protection" | out: _Dest="C:\\Program Files\\Windows Defender Advanced Threat Protection") returned="C:\\Program Files\\Windows Defender Advanced Threat Protection" [0071.481] wcscat (in: _Dest=0x38a95f8, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Defender Advanced Threat Protection\\") returned="C:\\Program Files\\Windows Defender Advanced Threat Protection\\" [0071.481] wcscat (in: _Dest=0x38a95f8, _Source="en-US" | out: _Dest="C:\\Program Files\\Windows Defender Advanced Threat Protection\\en-US") returned="C:\\Program Files\\Windows Defender Advanced Threat Protection\\en-US" [0071.481] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a95f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x700 [0071.481] FindNextFileW (in: hFindFile=0x5445540, lpFindFileData=0x5406a90 | out: lpFindFileData=0x5406a90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2eab030, ftCreationTime.dwHighDateTime=0x1d57115, ftLastAccessTime.dwLowDateTime=0x3e55ce90, ftLastAccessTime.dwHighDateTime=0x1d54f4b, ftLastWriteTime.dwLowDateTime=0x3e55ce90, ftLastWriteTime.dwHighDateTime=0x1d54f4b, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="fur.exe", cAlternateFileName="")) returned 1 [0071.481] wcscmp (_String1="fur.exe", _String2=".") returned 1 [0071.481] wcscmp (_String1="fur.exe", _String2="..") returned 1 [0071.481] FindNextFileW (in: hFindFile=0x5445540, lpFindFileData=0x5406a90 | out: lpFindFileData=0x5406a90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7822b459, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe304e38c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe304e38c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3bb568, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsSense.exe", cAlternateFileName="")) returned 1 [0071.481] wcscmp (_String1="MsSense.exe", _String2=".") returned 1 [0071.481] wcscmp (_String1="MsSense.exe", _String2="..") returned 1 [0071.481] FindNextFileW (in: hFindFile=0x5445540, lpFindFileData=0x5406a90 | out: lpFindFileData=0x5406a90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d89d030, ftCreationTime.dwHighDateTime=0x1d571c0, ftLastAccessTime.dwLowDateTime=0x7996e640, ftLastAccessTime.dwHighDateTime=0x1d5955c, ftLastWriteTime.dwLowDateTime=0x7996e640, ftLastWriteTime.dwHighDateTime=0x1d5955c, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ncftp.exe", cAlternateFileName="")) returned 1 [0071.481] wcscmp (_String1="ncftp.exe", _String2=".") returned 1 [0071.481] wcscmp (_String1="ncftp.exe", _String2="..") returned 1 [0071.481] FindNextFileW (in: hFindFile=0x5445540, lpFindFileData=0x5406a90 | out: lpFindFileData=0x5406a90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7822b459, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe2f69567, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe2f69567, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xbcad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SenseCncProxy.exe", cAlternateFileName="")) returned 1 [0071.482] wcscmp (_String1="SenseCncProxy.exe", _String2=".") returned 1 [0071.482] wcscmp (_String1="SenseCncProxy.exe", _String2="..") returned 1 [0071.482] FindNextFileW (in: hFindFile=0x5445540, lpFindFileData=0x5406a90 | out: lpFindFileData=0x5406a90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7822b459, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe2f69567, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe2f69567, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SenseCncPS.dll", cAlternateFileName="")) returned 1 [0071.482] wcscmp (_String1="SenseCncPS.dll", _String2=".") returned 1 [0071.482] wcscmp (_String1="SenseCncPS.dll", _String2="..") returned 1 [0071.482] FindNextFileW (in: hFindFile=0x5445540, lpFindFileData=0x5406a90 | out: lpFindFileData=0x5406a90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7822b459, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe2fb5a1e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe2fb5a1e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x290800, dwReserved0=0x0, dwReserved1=0x0, cFileName="SenseSampleUploader.exe", cAlternateFileName="")) returned 1 [0071.482] wcscmp (_String1="SenseSampleUploader.exe", _String2=".") returned 1 [0071.482] wcscmp (_String1="SenseSampleUploader.exe", _String2="..") returned 1 [0071.482] FindNextFileW (in: hFindFile=0x5445540, lpFindFileData=0x5406a90 | out: lpFindFileData=0x5406a90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782516c0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd6d17d57, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd6d17d57, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x24800, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATPCSP.dll", cAlternateFileName="")) returned 1 [0071.482] wcscmp (_String1="WATPCSP.dll", _String2=".") returned 1 [0071.482] wcscmp (_String1="WATPCSP.dll", _String2="..") returned 1 [0071.482] FindNextFileW (in: hFindFile=0x5445540, lpFindFileData=0x5406a90 | out: lpFindFileData=0x5406a90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782516c0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd6d17d57, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd6d17d57, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x24800, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATPCSP.dll", cAlternateFileName="")) returned 0 [0071.482] FindClose (in: hFindFile=0x5445540 | out: hFindFile=0x5445540) returned 1 [0071.482] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5406a90) returned 1 [0071.482] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54099c8) returned 1 [0071.482] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3889d00) returned 1 Thread: id = 52 os_tid = 0x1348 [0071.010] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5fe0 [0071.010] wcscpy (in: _Dest=0x38a5fe0, _Source="C:\\Program Files\\Windows Mail" | out: _Dest="C:\\Program Files\\Windows Mail") returned="C:\\Program Files\\Windows Mail" [0071.010] wcscat (in: _Dest=0x38a5fe0, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Mail\\") returned="C:\\Program Files\\Windows Mail\\" [0071.010] wcscat (in: _Dest=0x38a5fe0, _Source="*" | out: _Dest="C:\\Program Files\\Windows Mail\\*") returned="C:\\Program Files\\Windows Mail\\*" [0071.010] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5406cf8 [0071.010] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Mail\\*", lpFindFileData=0x5406cf8 | out: lpFindFileData=0x5406cf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b1b3cbc, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b1b3cbc, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445500 [0071.483] wcscmp (_String1=".", _String2=".") returned 0 [0071.483] FindNextFileW (in: hFindFile=0x5445500, lpFindFileData=0x5406cf8 | out: lpFindFileData=0x5406cf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b1b3cbc, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b1b3cbc, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.483] wcscmp (_String1="..", _String2=".") returned 1 [0071.483] wcscmp (_String1="..", _String2="..") returned 0 [0071.483] FindNextFileW (in: hFindFile=0x5445500, lpFindFileData=0x5406cf8 | out: lpFindFileData=0x5406cf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa90b7e0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0071.483] wcscmp (_String1="en-US", _String2=".") returned 1 [0071.483] wcscmp (_String1="en-US", _String2="..") returned 1 [0071.483] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x5442d30 [0071.483] wcscpy (in: _Dest=0x5442d30, _Source="C:\\Program Files\\Windows Mail" | out: _Dest="C:\\Program Files\\Windows Mail") returned="C:\\Program Files\\Windows Mail" [0071.483] wcscat (in: _Dest=0x5442d30, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Mail\\") returned="C:\\Program Files\\Windows Mail\\" [0071.516] wcscat (in: _Dest=0x5442d30, _Source="en-US" | out: _Dest="C:\\Program Files\\Windows Mail\\en-US") returned="C:\\Program Files\\Windows Mail\\en-US" [0071.516] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5442d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x394 [0071.517] FindNextFileW (in: hFindFile=0x5445500, lpFindFileData=0x5406cf8 | out: lpFindFileData=0x5406cf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d342cc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d342cc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1f0a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoe.dll", cAlternateFileName="")) returned 1 [0071.517] wcscmp (_String1="msoe.dll", _String2=".") returned 1 [0071.517] wcscmp (_String1="msoe.dll", _String2="..") returned 1 [0071.517] FindNextFileW (in: hFindFile=0x5445500, lpFindFileData=0x5406cf8 | out: lpFindFileData=0x5406cf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x25f400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOERES.dll", cAlternateFileName="")) returned 1 [0071.517] wcscmp (_String1="MSOERES.dll", _String2=".") returned 1 [0071.517] wcscmp (_String1="MSOERES.dll", _String2="..") returned 1 [0071.517] FindNextFileW (in: hFindFile=0x5445500, lpFindFileData=0x5406cf8 | out: lpFindFileData=0x5406cf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oeimport.dll", cAlternateFileName="")) returned 1 [0071.517] wcscmp (_String1="oeimport.dll", _String2=".") returned 1 [0071.517] wcscmp (_String1="oeimport.dll", _String2="..") returned 1 [0071.517] FindNextFileW (in: hFindFile=0x5445500, lpFindFileData=0x5406cf8 | out: lpFindFileData=0x5406cf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0483e80, ftCreationTime.dwHighDateTime=0x1d5a247, ftLastAccessTime.dwLowDateTime=0x3beda480, ftLastAccessTime.dwHighDateTime=0x1d5a387, ftLastWriteTime.dwLowDateTime=0x3beda480, ftLastWriteTime.dwHighDateTime=0x1d5a387, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="totalcmd.exe", cAlternateFileName="")) returned 1 [0071.517] wcscmp (_String1="totalcmd.exe", _String2=".") returned 1 [0071.517] wcscmp (_String1="totalcmd.exe", _String2="..") returned 1 [0071.517] FindNextFileW (in: hFindFile=0x5445500, lpFindFileData=0x5406cf8 | out: lpFindFileData=0x5406cf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440ad34a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440ad34a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440ad34a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7e400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab.exe", cAlternateFileName="")) returned 1 [0071.517] wcscmp (_String1="wab.exe", _String2=".") returned 1 [0071.517] wcscmp (_String1="wab.exe", _String2="..") returned 1 [0071.517] FindNextFileW (in: hFindFile=0x5445500, lpFindFileData=0x5406cf8 | out: lpFindFileData=0x5406cf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabimp.dll", cAlternateFileName="")) returned 1 [0071.517] wcscmp (_String1="wabimp.dll", _String2=".") returned 1 [0071.517] wcscmp (_String1="wabimp.dll", _String2="..") returned 1 [0071.517] FindNextFileW (in: hFindFile=0x5445500, lpFindFileData=0x5406cf8 | out: lpFindFileData=0x5406cf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440ad34a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440ad34a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440ad34a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabmig.exe", cAlternateFileName="")) returned 1 [0071.517] wcscmp (_String1="wabmig.exe", _String2=".") returned 1 [0071.517] wcscmp (_String1="wabmig.exe", _String2="..") returned 1 [0071.517] FindNextFileW (in: hFindFile=0x5445500, lpFindFileData=0x5406cf8 | out: lpFindFileData=0x5406cf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x66600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 1 [0071.517] wcscmp (_String1="WinMail.exe", _String2=".") returned 1 [0071.517] wcscmp (_String1="WinMail.exe", _String2="..") returned 1 [0071.517] FindNextFileW (in: hFindFile=0x5445500, lpFindFileData=0x5406cf8 | out: lpFindFileData=0x5406cf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x66600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 0 [0071.517] FindClose (in: hFindFile=0x5445500 | out: hFindFile=0x5445500) returned 1 [0071.517] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5406cf8) returned 1 [0071.517] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5fe0) returned 1 [0071.518] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6220) returned 1 Thread: id = 53 os_tid = 0x137c [0071.011] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x3883a00 [0071.011] wcscpy (in: _Dest=0x3883a00, _Source="C:\\Program Files\\Windows Multimedia Platform" | out: _Dest="C:\\Program Files\\Windows Multimedia Platform") returned="C:\\Program Files\\Windows Multimedia Platform" [0071.011] wcscat (in: _Dest=0x3883a00, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Multimedia Platform\\") returned="C:\\Program Files\\Windows Multimedia Platform\\" [0071.011] wcscat (in: _Dest=0x3883a00, _Source="*" | out: _Dest="C:\\Program Files\\Windows Multimedia Platform\\*") returned="C:\\Program Files\\Windows Multimedia Platform\\*" [0071.011] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54071c8 [0071.011] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Multimedia Platform\\*", lpFindFileData=0x54071c8 | out: lpFindFileData=0x54071c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b11b239, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b11b239, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389edc0 [0071.131] wcscmp (_String1=".", _String2=".") returned 0 [0071.131] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x54071c8 | out: lpFindFileData=0x54071c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b11b239, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b11b239, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.131] wcscmp (_String1="..", _String2=".") returned 1 [0071.131] wcscmp (_String1="..", _String2="..") returned 0 [0071.131] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x54071c8 | out: lpFindFileData=0x54071c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50362250, ftCreationTime.dwHighDateTime=0x1d5a2ab, ftLastAccessTime.dwLowDateTime=0x50d81f60, ftLastAccessTime.dwHighDateTime=0x1d5c952, ftLastWriteTime.dwLowDateTime=0x50d81f60, ftLastWriteTime.dwHighDateTime=0x1d5c952, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="coreftp.exe", cAlternateFileName="")) returned 1 [0071.131] wcscmp (_String1="coreftp.exe", _String2=".") returned 1 [0071.132] wcscmp (_String1="coreftp.exe", _String2="..") returned 1 [0071.132] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x54071c8 | out: lpFindFileData=0x54071c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa6fc0b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2aa6fc0b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2aa6fc0b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0071.132] wcscmp (_String1="sqmapi.dll", _String2=".") returned 1 [0071.132] wcscmp (_String1="sqmapi.dll", _String2="..") returned 1 [0071.132] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x54071c8 | out: lpFindFileData=0x54071c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa6fc0b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2aa6fc0b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2aa6fc0b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0 [0071.132] FindClose (in: hFindFile=0x389edc0 | out: hFindFile=0x389edc0) returned 1 [0071.132] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54071c8) returned 1 [0071.132] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3883a00) returned 1 [0071.132] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3884a60) returned 1 Thread: id = 54 os_tid = 0x1344 [0071.012] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x38b2d78 [0071.012] wcscpy (in: _Dest=0x38b2d78, _Source="C:\\Program Files\\Windows Security" | out: _Dest="C:\\Program Files\\Windows Security") returned="C:\\Program Files\\Windows Security" [0071.012] wcscat (in: _Dest=0x38b2d78, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Security\\") returned="C:\\Program Files\\Windows Security\\" [0071.012] wcscat (in: _Dest=0x38b2d78, _Source="*" | out: _Dest="C:\\Program Files\\Windows Security\\*") returned="C:\\Program Files\\Windows Security\\*" [0071.012] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5408038 [0071.012] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Security\\*", lpFindFileData=0x5408038 | out: lpFindFileData=0x5408038*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b11b239, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b11b239, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445940 [0071.519] wcscmp (_String1=".", _String2=".") returned 0 [0071.519] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5408038 | out: lpFindFileData=0x5408038*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b11b239, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b11b239, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.519] wcscmp (_String1="..", _String2=".") returned 1 [0071.519] wcscmp (_String1="..", _String2="..") returned 0 [0071.519] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5408038 | out: lpFindFileData=0x5408038*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c509450, ftCreationTime.dwHighDateTime=0x1d564c4, ftLastAccessTime.dwLowDateTime=0xb1b49bb0, ftLastAccessTime.dwHighDateTime=0x1d56d81, ftLastWriteTime.dwLowDateTime=0xb1b49bb0, ftLastWriteTime.dwHighDateTime=0x1d56d81, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="alftp.exe", cAlternateFileName="")) returned 1 [0071.519] wcscmp (_String1="alftp.exe", _String2=".") returned 1 [0071.519] wcscmp (_String1="alftp.exe", _String2="..") returned 1 [0071.519] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5408038 | out: lpFindFileData=0x5408038*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42358f90, ftCreationTime.dwHighDateTime=0x1d572d3, ftLastAccessTime.dwLowDateTime=0x53d32400, ftLastAccessTime.dwHighDateTime=0x1d56064, ftLastWriteTime.dwLowDateTime=0x53d32400, ftLastWriteTime.dwHighDateTime=0x1d56064, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="barca.exe", cAlternateFileName="")) returned 1 [0071.519] wcscmp (_String1="barca.exe", _String2=".") returned 1 [0071.519] wcscmp (_String1="barca.exe", _String2="..") returned 1 [0071.519] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5408038 | out: lpFindFileData=0x5408038*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92ad688, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrowserCore", cAlternateFileName="BROWSE~1")) returned 1 [0071.519] wcscmp (_String1="BrowserCore", _String2=".") returned 1 [0071.519] wcscmp (_String1="BrowserCore", _String2="..") returned 1 [0071.519] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x541b078 [0071.519] wcscpy (in: _Dest=0x541b078, _Source="C:\\Program Files\\Windows Security" | out: _Dest="C:\\Program Files\\Windows Security") returned="C:\\Program Files\\Windows Security" [0071.519] wcscat (in: _Dest=0x541b078, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Security\\") returned="C:\\Program Files\\Windows Security\\" [0071.519] wcscat (in: _Dest=0x541b078, _Source="BrowserCore" | out: _Dest="C:\\Program Files\\Windows Security\\BrowserCore") returned="C:\\Program Files\\Windows Security\\BrowserCore" [0071.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x541b078, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x570 [0071.521] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5408038 | out: lpFindFileData=0x5408038*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x659b4910, ftCreationTime.dwHighDateTime=0x1d55f47, ftLastAccessTime.dwLowDateTime=0x93fae280, ftLastAccessTime.dwHighDateTime=0x1d55d2a, ftLastWriteTime.dwLowDateTime=0x93fae280, ftLastWriteTime.dwHighDateTime=0x1d55d2a, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="fling.exe", cAlternateFileName="")) returned 1 [0071.521] wcscmp (_String1="fling.exe", _String2=".") returned 1 [0071.521] wcscmp (_String1="fling.exe", _String2="..") returned 1 [0071.521] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5408038 | out: lpFindFileData=0x5408038*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4db19ac0, ftCreationTime.dwHighDateTime=0x1d5ae66, ftLastAccessTime.dwLowDateTime=0x10b0b480, ftLastAccessTime.dwHighDateTime=0x1d55d3a, ftLastWriteTime.dwLowDateTime=0x10b0b480, ftLastWriteTime.dwHighDateTime=0x1d55d3a, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="organic implications.exe", cAlternateFileName="ORGANI~1.EXE")) returned 1 [0071.521] wcscmp (_String1="organic implications.exe", _String2=".") returned 1 [0071.521] wcscmp (_String1="organic implications.exe", _String2="..") returned 1 [0071.521] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5408038 | out: lpFindFileData=0x5408038*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4db19ac0, ftCreationTime.dwHighDateTime=0x1d5ae66, ftLastAccessTime.dwLowDateTime=0x10b0b480, ftLastAccessTime.dwHighDateTime=0x1d55d3a, ftLastWriteTime.dwLowDateTime=0x10b0b480, ftLastWriteTime.dwHighDateTime=0x1d55d3a, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="organic implications.exe", cAlternateFileName="ORGANI~1.EXE")) returned 0 [0071.521] FindClose (in: hFindFile=0x5445940 | out: hFindFile=0x5445940) returned 1 [0071.521] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5408038) returned 1 [0071.521] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b2d78) returned 1 [0071.521] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3892b10) returned 1 Thread: id = 55 os_tid = 0x1288 [0071.012] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3e) returned 0x38a6028 [0071.012] wcscpy (in: _Dest=0x38a6028, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.012] wcscat (in: _Dest=0x38a6028, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.012] wcscat (in: _Dest=0x38a6028, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\*") returned="C:\\Program Files\\WindowsApps\\*" [0071.012] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5406f60 [0071.012] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\*", lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8da88b6d, ftLastAccessTime.dwHighDateTime=0x1d3274e, ftLastWriteTime.dwLowDateTime=0x8da88b6d, ftLastWriteTime.dwHighDateTime=0x1d3274e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389edc0 [0071.133] wcscmp (_String1=".", _String2=".") returned 0 [0071.133] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8da88b6d, ftLastAccessTime.dwHighDateTime=0x1d3274e, ftLastWriteTime.dwLowDateTime=0x8da88b6d, ftLastWriteTime.dwHighDateTime=0x1d3274e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.182] wcscmp (_String1="..", _String2=".") returned 1 [0071.182] wcscmp (_String1="..", _String2="..") returned 0 [0071.182] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x223c89ad, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa93a9ec0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3002ee68, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm", cAlternateFileName="9E2F88~1.0_X")) returned 1 [0071.182] wcscmp (_String1="9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm", _String2=".") returned 1 [0071.182] wcscmp (_String1="9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm", _String2="..") returned 1 [0071.182] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x92) returned 0x5426728 [0071.182] wcscpy (in: _Dest=0x5426728, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.182] wcscat (in: _Dest=0x5426728, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.182] wcscat (in: _Dest=0x5426728, _Source="9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm" [0071.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5426728, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x54c [0071.391] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa967d4bd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Deleted", cAlternateFileName="")) returned 1 [0071.391] wcscmp (_String1="Deleted", _String2=".") returned 1 [0071.391] wcscmp (_String1="Deleted", _String2="..") returned 1 [0071.391] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x5428500 [0071.391] wcscpy (in: _Dest=0x5428500, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.391] wcscat (in: _Dest=0x5428500, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.391] wcscat (in: _Dest=0x5428500, _Source="Deleted" | out: _Dest="C:\\Program Files\\WindowsApps\\Deleted") returned="C:\\Program Files\\WindowsApps\\Deleted" [0071.391] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5428500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0071.392] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96c0f12e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb3c9c41d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb3c9c41d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.0_N")) returned 1 [0071.392] wcscmp (_String1="Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe", _String2=".") returned 1 [0071.392] wcscmp (_String1="Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe", _String2="..") returned 1 [0071.392] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xac) returned 0x38a1d70 [0071.392] wcscpy (in: _Dest=0x38a1d70, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.392] wcscat (in: _Dest=0x38a1d70, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.392] wcscat (in: _Dest=0x38a1d70, _Source="Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe" [0071.392] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a1d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x498 [0071.392] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96dd8d87, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb3cc2682, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb3cc2682, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe", cAlternateFileName="MICROS~1.0_X")) returned 1 [0071.393] wcscmp (_String1="Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe", _String2=".") returned 1 [0071.393] wcscmp (_String1="Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe", _String2="..") returned 1 [0071.393] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa2) returned 0x388ecd0 [0071.393] wcscpy (in: _Dest=0x388ecd0, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.393] wcscat (in: _Dest=0x388ecd0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.393] wcscat (in: _Dest=0x388ecd0, _Source="Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe" [0071.393] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x388ecd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0071.393] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x339fb10b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb4a05954, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb4a05954, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe", cAlternateFileName="MICROS~2.0_X")) returned 1 [0071.393] wcscmp (_String1="Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe", _String2=".") returned 1 [0071.393] wcscmp (_String1="Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe", _String2="..") returned 1 [0071.394] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xae) returned 0x38a1ee0 [0071.394] wcscpy (in: _Dest=0x38a1ee0, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.394] wcscat (in: _Dest=0x38a1ee0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.394] wcscat (in: _Dest=0x38a1ee0, _Source="Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe" [0071.394] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a1ee0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490 [0071.394] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33d4dd68, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb523798b, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb523798b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe", cAlternateFileName="MICROS~3.0_X")) returned 1 [0071.394] wcscmp (_String1="Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe", _String2=".") returned 1 [0071.394] wcscmp (_String1="Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe", _String2="..") returned 1 [0071.395] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xae) returned 0x38a1588 [0071.395] wcscpy (in: _Dest=0x38a1588, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.395] wcscat (in: _Dest=0x38a1588, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.395] wcscat (in: _Dest=0x38a1588, _Source="Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe" [0071.395] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a1588, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x48c [0071.396] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfa8fd8, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa9f2aac4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5e205736, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe", cAlternateFileName="MIBC7F~1.0_N")) returned 1 [0071.396] wcscmp (_String1="Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe", _String2=".") returned 1 [0071.396] wcscmp (_String1="Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe", _String2="..") returned 1 [0071.396] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa6) returned 0x388ed80 [0071.396] wcscpy (in: _Dest=0x388ed80, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.396] wcscat (in: _Dest=0x388ed80, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.396] wcscat (in: _Dest=0x388ed80, _Source="Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe" [0071.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x388ed80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x488 [0071.397] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdf3689c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa041d8d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5e205736, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI0B0E~1.0_N")) returned 1 [0071.397] wcscmp (_String1="Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe", _String2=".") returned 1 [0071.397] wcscmp (_String1="Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe", _String2="..") returned 1 [0071.397] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb6) returned 0x388b7a0 [0071.397] wcscpy (in: _Dest=0x388b7a0, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.397] wcscat (in: _Dest=0x388b7a0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.397] wcscat (in: _Dest=0x388b7a0, _Source="Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe" [0071.397] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x388b7a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x484 [0071.398] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x773fa578, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa095f16, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eed6166, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MIACEC~1.0_N")) returned 1 [0071.398] wcscmp (_String1="Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe", _String2=".") returned 1 [0071.398] wcscmp (_String1="Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe", _String2="..") returned 1 [0071.398] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xaa) returned 0x38a1c00 [0071.398] wcscpy (in: _Dest=0x38a1c00, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.398] wcscat (in: _Dest=0x38a1c00, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.398] wcscat (in: _Dest=0x38a1c00, _Source="Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe" [0071.398] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a1c00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x480 [0071.399] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7746cb84, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa097cbe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eefc3c1, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe", cAlternateFileName="MI0B51~1.0_X")) returned 1 [0071.399] wcscmp (_String1="Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe", _String2=".") returned 1 [0071.399] wcscmp (_String1="Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe", _String2="..") returned 1 [0071.399] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa0) returned 0x38abbc0 [0071.399] wcscpy (in: _Dest=0x38abbc0, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.399] wcscat (in: _Dest=0x38abbc0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.399] wcscat (in: _Dest=0x38abbc0, _Source="Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" [0071.399] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38abbc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x47c [0071.400] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70454cf5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa293665, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MIADDF~1.0_N")) returned 1 [0071.400] wcscmp (_String1="Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe", _String2=".") returned 1 [0071.400] wcscmp (_String1="Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe", _String2="..") returned 1 [0071.400] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa4) returned 0x388f040 [0071.400] wcscpy (in: _Dest=0x388f040, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.400] wcscat (in: _Dest=0x388f040, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.400] wcscat (in: _Dest=0x388f040, _Source="Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe" [0071.400] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x388f040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4 [0071.401] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d4c9e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe", cAlternateFileName="MI13A6~1.0_X")) returned 1 [0071.401] wcscmp (_String1="Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe", _String2=".") returned 1 [0071.401] wcscmp (_String1="Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe", _String2="..") returned 1 [0071.401] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9a) returned 0x38ac100 [0071.401] wcscpy (in: _Dest=0x38ac100, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.401] wcscat (in: _Dest=0x38ac100, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.401] wcscat (in: _Dest=0x38ac100, _Source="Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" [0071.401] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38ac100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c4 [0071.402] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c254236, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa53d33a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608513a6, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI90D7~1.0_N")) returned 1 [0071.402] wcscmp (_String1="Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe", _String2=".") returned 1 [0071.402] wcscmp (_String1="Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe", _String2="..") returned 1 [0071.402] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa8) returned 0x388dfc0 [0071.402] wcscpy (in: _Dest=0x388dfc0, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.402] wcscat (in: _Dest=0x388dfc0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.402] wcscat (in: _Dest=0x388dfc0, _Source="Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe" [0071.402] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x388dfc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b8 [0071.403] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2a05a2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d0219, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608775e5, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe", cAlternateFileName="MI689D~1.0_X")) returned 1 [0071.403] wcscmp (_String1="Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe", _String2=".") returned 1 [0071.403] wcscmp (_String1="Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe", _String2="..") returned 1 [0071.403] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9e) returned 0x38abdb8 [0071.403] wcscpy (in: _Dest=0x38abdb8, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.403] wcscat (in: _Dest=0x38abdb8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.403] wcscat (in: _Dest=0x38abdb8, _Source="Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" [0071.403] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38abdb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x38c [0071.404] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e476601, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe", cAlternateFileName="MICROS~3.SCA")) returned 1 [0071.404] wcscmp (_String1="Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe", _String2=".") returned 1 [0071.404] wcscmp (_String1="Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe", _String2="..") returned 1 [0071.404] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x38b90a0 [0071.404] wcscpy (in: _Dest=0x38b90a0, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.404] wcscat (in: _Dest=0x38b90a0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.404] wcscat (in: _Dest=0x38b90a0, _Source="Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe" [0071.404] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b90a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384 [0071.405] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2cdd5a7d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.0_N")) returned 1 [0071.405] wcscmp (_String1="Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe", _String2=".") returned 1 [0071.405] wcscmp (_String1="Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe", _String2="..") returned 1 [0071.405] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xaa) returned 0x38a1418 [0071.405] wcscpy (in: _Dest=0x38a1418, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.405] wcscat (in: _Dest=0x38a1418, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.405] wcscat (in: _Dest=0x38a1418, _Source="Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe" [0071.405] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a1418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c [0071.406] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2ceba882, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe", cAlternateFileName="MICROS~4.0_X")) returned 1 [0071.406] wcscmp (_String1="Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe", _String2=".") returned 1 [0071.406] wcscmp (_String1="Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe", _String2="..") returned 1 [0071.406] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa0) returned 0x38abd10 [0071.406] wcscpy (in: _Dest=0x38abd10, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.406] wcscat (in: _Dest=0x38abd10, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.406] wcscat (in: _Dest=0x38abd10, _Source="Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe" [0071.406] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38abd10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x358 [0071.407] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68f377c2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaae3acdd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe", cAlternateFileName="MIBA67~1.SCA")) returned 1 [0071.407] wcscmp (_String1="Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe", _String2=".") returned 1 [0071.407] wcscmp (_String1="Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe", _String2="..") returned 1 [0071.407] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xca) returned 0x389c8b0 [0071.407] wcscpy (in: _Dest=0x389c8b0, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.407] wcscat (in: _Dest=0x389c8b0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.407] wcscat (in: _Dest=0x389c8b0, _Source="Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe" [0071.407] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389c8b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x36c [0071.408] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68a98ed8, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaaebc8e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MICC3B~1.0_N")) returned 1 [0071.408] wcscmp (_String1="Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe", _String2=".") returned 1 [0071.408] wcscmp (_String1="Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe", _String2="..") returned 1 [0071.408] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xae) returned 0x38a1868 [0071.408] wcscpy (in: _Dest=0x38a1868, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.408] wcscat (in: _Dest=0x38a1868, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.408] wcscat (in: _Dest=0x38a1868, _Source="Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe" [0071.408] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a1868, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x35c [0071.409] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ae5394, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaaf17e9e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe", cAlternateFileName="MIBB30~1.0_X")) returned 1 [0071.428] wcscmp (_String1="Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe", _String2=".") returned 1 [0071.428] wcscmp (_String1="Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe", _String2="..") returned 1 [0071.428] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa4) returned 0x388e5f0 [0071.428] wcscpy (in: _Dest=0x388e5f0, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.428] wcscat (in: _Dest=0x388e5f0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.428] wcscat (in: _Dest=0x388e5f0, _Source="Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe" [0071.428] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x388e5f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x380 [0071.429] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd526822a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab021835, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628cd443, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI2247~1.0_N")) returned 1 [0071.429] wcscmp (_String1="Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe", _String2=".") returned 1 [0071.429] wcscmp (_String1="Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe", _String2="..") returned 1 [0071.429] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb8) returned 0x38b2798 [0071.429] wcscpy (in: _Dest=0x38b2798, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.429] wcscat (in: _Dest=0x38b2798, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.429] wcscat (in: _Dest=0x38b2798, _Source="Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe" [0071.429] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b2798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x31c [0071.430] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5373138, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab088494, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628cd443, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe", cAlternateFileName="MIECF5~1.0_X")) returned 1 [0071.430] wcscmp (_String1="Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe", _String2=".") returned 1 [0071.430] wcscmp (_String1="Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe", _String2="..") returned 1 [0071.430] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xae) returned 0x38a19d8 [0071.430] wcscpy (in: _Dest=0x38a19d8, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.430] wcscat (in: _Dest=0x38a19d8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.430] wcscat (in: _Dest=0x38a19d8, _Source="Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe" [0071.430] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a19d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x544 [0071.431] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d296410, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb9355ef2, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb9355ef2, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe", cAlternateFileName="MIEB19~1.SCA")) returned 1 [0071.431] wcscmp (_String1="Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe", _String2=".") returned 1 [0071.431] wcscmp (_String1="Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe", _String2="..") returned 1 [0071.431] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x388aff8 [0071.431] wcscpy (in: _Dest=0x388aff8, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.431] wcscat (in: _Dest=0x388aff8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.431] wcscat (in: _Dest=0x388aff8, _Source="Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe" [0071.431] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x388aff8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x550 [0071.432] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c531351, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb932fcac, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb932fcac, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe", cAlternateFileName="MIE745~1.0_X")) returned 1 [0071.432] wcscmp (_String1="Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe", _String2=".") returned 1 [0071.432] wcscmp (_String1="Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe", _String2="..") returned 1 [0071.432] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb4) returned 0x388b0e0 [0071.432] wcscpy (in: _Dest=0x388b0e0, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.432] wcscat (in: _Dest=0x388b0e0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.432] wcscat (in: _Dest=0x388b0e0, _Source="Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe" [0071.432] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x388b0e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x68c [0071.433] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c3b24a6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb932fcac, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb932fcac, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MICROS~3.0_N")) returned 1 [0071.433] wcscmp (_String1="Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe", _String2=".") returned 1 [0071.433] wcscmp (_String1="Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe", _String2="..") returned 1 [0071.433] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x38b2858 [0071.433] wcscpy (in: _Dest=0x38b2858, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.433] wcscat (in: _Dest=0x38b2858, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.433] wcscat (in: _Dest=0x38b2858, _Source="Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe" [0071.433] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b2858, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x690 [0071.434] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fe54df6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbad8fd68, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad8fd68, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe", cAlternateFileName="MIAA8F~1.SCA")) returned 1 [0071.434] wcscmp (_String1="Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe", _String2=".") returned 1 [0071.434] wcscmp (_String1="Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe", _String2="..") returned 1 [0071.434] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x3883788 [0071.434] wcscpy (in: _Dest=0x3883788, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.434] wcscat (in: _Dest=0x3883788, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.434] wcscat (in: _Dest=0x3883788, _Source="Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe" [0071.434] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3883788, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694 [0071.436] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed19195, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbad4389d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad4389d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MICROS~4.0_N")) returned 1 [0071.436] wcscmp (_String1="Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe", _String2=".") returned 1 [0071.437] wcscmp (_String1="Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe", _String2="..") returned 1 [0071.437] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa4) returned 0x388f0f0 [0071.437] wcscpy (in: _Dest=0x388f0f0, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.437] wcscat (in: _Dest=0x388f0f0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.437] wcscat (in: _Dest=0x388f0f0, _Source="Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe" [0071.437] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x388f0f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x698 [0071.437] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7eee2de1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbad69af3, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad69af3, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI79E2~1.0_X")) returned 1 [0071.437] wcscmp (_String1="Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe", _String2=".") returned 1 [0071.437] wcscmp (_String1="Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe", _String2="..") returned 1 [0071.438] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9a) returned 0x38abf08 [0071.438] wcscpy (in: _Dest=0x38abf08, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.438] wcscat (in: _Dest=0x38abf08, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.438] wcscat (in: _Dest=0x38abf08, _Source="Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe" [0071.438] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38abf08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x69c [0071.438] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x287b925a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbd8a0611, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8a0611, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI5BB5~1.0_N")) returned 1 [0071.438] wcscmp (_String1="Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe", _String2=".") returned 1 [0071.438] wcscmp (_String1="Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe", _String2="..") returned 1 [0071.438] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xaa) returned 0x38a1640 [0071.439] wcscpy (in: _Dest=0x38a1640, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.439] wcscat (in: _Dest=0x38a1640, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.439] wcscat (in: _Dest=0x38a1640, _Source="Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe" [0071.439] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a1640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a0 [0071.439] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29a48b6f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbd8c685e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8c685e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe", cAlternateFileName="MID6EE~1.SCA")) returned 1 [0071.439] wcscmp (_String1="Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe", _String2=".") returned 1 [0071.439] wcscmp (_String1="Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe", _String2="..") returned 1 [0071.439] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x3883850 [0071.440] wcscpy (in: _Dest=0x3883850, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.440] wcscat (in: _Dest=0x3883850, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.440] wcscat (in: _Dest=0x3883850, _Source="Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe" [0071.440] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3883850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0071.440] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2889e07b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbd8a0611, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8a0611, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe", cAlternateFileName="MIE03D~1.0_X")) returned 1 [0071.440] wcscmp (_String1="Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe", _String2=".") returned 1 [0071.440] wcscmp (_String1="Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe", _String2="..") returned 1 [0071.440] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa2) returned 0x388e800 [0071.440] wcscpy (in: _Dest=0x388e800, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.441] wcscat (in: _Dest=0x388e800, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.441] wcscat (in: _Dest=0x388e800, _Source="Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" [0071.441] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x388e800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a8 [0071.441] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac06201d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbed30aaa, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbed30aaa, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MIAA72~1.0_N")) returned 1 [0071.441] wcscmp (_String1="Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe", _String2=".") returned 1 [0071.441] wcscmp (_String1="Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe", _String2="..") returned 1 [0071.441] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x388c5d8 [0071.441] wcscpy (in: _Dest=0x388c5d8, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.441] wcscat (in: _Dest=0x388c5d8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.441] wcscat (in: _Dest=0x388c5d8, _Source="Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe" [0071.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x388c5d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418 [0071.875] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac29e374, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbed30aaa, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbed30aaa, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI825E~1.0_X")) returned 1 [0071.875] wcscmp (_String1="Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe", _String2=".") returned 1 [0071.875] wcscmp (_String1="Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe", _String2="..") returned 1 [0071.875] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb6) returned 0x5461b28 [0071.875] wcscpy (in: _Dest=0x5461b28, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.875] wcscat (in: _Dest=0x5461b28, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.875] wcscat (in: _Dest=0x5461b28, _Source="Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe" [0071.875] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5461b28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7fc [0071.892] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62a7e361, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc3123ced, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc3123ced, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI476B~1.0_X")) returned 1 [0071.892] wcscmp (_String1="Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe", _String2=".") returned 1 [0071.892] wcscmp (_String1="Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe", _String2="..") returned 1 [0071.892] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb8) returned 0x5461468 [0071.892] wcscpy (in: _Dest=0x5461468, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.892] wcscat (in: _Dest=0x5461468, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.892] wcscat (in: _Dest=0x5461468, _Source="Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" [0071.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5461468, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a4 [0071.893] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628da999, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc3123ced, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc3123ced, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MIC168~1.0_N")) returned 1 [0071.893] wcscmp (_String1="Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe", _String2=".") returned 1 [0071.893] wcscmp (_String1="Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe", _String2="..") returned 1 [0071.893] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x53bbe38 [0071.893] wcscpy (in: _Dest=0x53bbe38, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.893] wcscat (in: _Dest=0x53bbe38, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.893] wcscat (in: _Dest=0x53bbe38, _Source="Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe" [0071.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53bbe38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x828 [0071.894] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x390dfd83, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc96ea5b4, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc96ea5b4, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe", cAlternateFileName="MI06F6~1.SCA")) returned 1 [0071.894] wcscmp (_String1="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe", _String2=".") returned 1 [0071.894] wcscmp (_String1="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe", _String2="..") returned 1 [0071.894] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x54501c8 [0071.894] wcscpy (in: _Dest=0x54501c8, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.894] wcscat (in: _Dest=0x54501c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.894] wcscat (in: _Dest=0x54501c8, _Source="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe" [0071.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54501c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x82c [0071.896] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33798b5a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc96c435e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc96c435e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI9806~1.0_N")) returned 1 [0071.896] wcscmp (_String1="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe", _String2=".") returned 1 [0071.896] wcscmp (_String1="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe", _String2="..") returned 1 [0071.896] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x53b9e10 [0071.896] wcscpy (in: _Dest=0x53b9e10, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0071.896] wcscat (in: _Dest=0x53b9e10, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0071.896] wcscat (in: _Dest=0x53b9e10, _Source="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe" [0071.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53b9e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x830 [0071.897] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34052404, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc96ea5b4, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc96ea5b4, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe", cAlternateFileName="MIEA86~1.0_X")) returned 1 [0074.582] wcscmp (_String1="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe", _String2=".") returned 1 [0074.583] wcscmp (_String1="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe", _String2="..") returned 1 [0074.583] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x53f8cd0 [0074.583] wcscpy (in: _Dest=0x53f8cd0, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0074.583] wcscat (in: _Dest=0x53f8cd0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0074.583] wcscat (in: _Dest=0x53f8cd0, _Source="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" [0074.583] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53f8cd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x46c [0074.584] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a98e846, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xcb314296, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcb314296, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe", cAlternateFileName="MIA5B6~1.SCA")) returned 1 [0074.584] wcscmp (_String1="Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe", _String2=".") returned 1 [0074.584] wcscmp (_String1="Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe", _String2="..") returned 1 [0074.584] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x3934728 [0074.584] wcscpy (in: _Dest=0x3934728, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0074.584] wcscat (in: _Dest=0x3934728, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0074.584] wcscat (in: _Dest=0x3934728, _Source="Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe" [0074.584] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3934728, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x668 [0074.585] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69c2543c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xcb2ee04f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcb2ee04f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MIFFC1~1.0_N")) returned 1 [0074.585] wcscmp (_String1="Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe", _String2=".") returned 1 [0074.585] wcscmp (_String1="Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe", _String2="..") returned 1 [0074.585] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x53fa258 [0074.585] wcscpy (in: _Dest=0x53fa258, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0074.585] wcscat (in: _Dest=0x53fa258, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0074.585] wcscat (in: _Dest=0x53fa258, _Source="Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe" [0074.585] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53fa258, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x57c [0074.586] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69e152fc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xcb2ee04f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcb2ee04f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe", cAlternateFileName="MIAB25~1.0_X")) returned 1 [0074.586] wcscmp (_String1="Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe", _String2=".") returned 1 [0074.586] wcscmp (_String1="Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe", _String2="..") returned 1 [0074.586] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb2) returned 0x3905920 [0074.586] wcscpy (in: _Dest=0x3905920, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0074.586] wcscat (in: _Dest=0x3905920, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0074.586] wcscat (in: _Dest=0x3905920, _Source="Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" [0074.586] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3905920, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x554 [0074.586] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa16112ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xcd2853a0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcd2853a0, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI34B5~1.0_N")) returned 1 [0074.586] wcscmp (_String1="Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe", _String2=".") returned 1 [0074.586] wcscmp (_String1="Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe", _String2="..") returned 1 [0074.586] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xac) returned 0x5446140 [0074.587] wcscpy (in: _Dest=0x5446140, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0074.587] wcscat (in: _Dest=0x5446140, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0074.587] wcscat (in: _Dest=0x5446140, _Source="Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe" [0074.587] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5446140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x364 [0074.587] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa17daefc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xcd2853a0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcd2853a0, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI21E8~1.0_X")) returned 1 [0074.587] wcscmp (_String1="Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe", _String2=".") returned 1 [0074.587] wcscmp (_String1="Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe", _String2="..") returned 1 [0074.587] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa2) returned 0x388e5f0 [0074.587] wcscpy (in: _Dest=0x388e5f0, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0074.587] wcscat (in: _Dest=0x388e5f0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0074.587] wcscat (in: _Dest=0x388e5f0, _Source="Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe" [0074.588] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x388e5f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x544 [0074.588] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb21852be, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae4c23b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69869570, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI052E~1.0_X")) returned 1 [0074.588] wcscmp (_String1="Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe", _String2=".") returned 1 [0074.588] wcscmp (_String1="Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe", _String2="..") returned 1 [0074.588] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53f9b50 [0074.588] wcscpy (in: _Dest=0x53f9b50, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0074.588] wcscat (in: _Dest=0x53f9b50, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0074.588] wcscat (in: _Dest=0x53f9b50, _Source="Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" [0074.588] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53f9b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4 [0074.590] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb23e79d9, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae58079f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69b6448c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe", cAlternateFileName="MI3AF7~1.0_X")) returned 1 [0074.590] wcscmp (_String1="Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe", _String2=".") returned 1 [0074.591] wcscmp (_String1="Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe", _String2="..") returned 1 [0074.591] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53f9e70 [0074.591] wcscpy (in: _Dest=0x53f9e70, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0074.591] wcscat (in: _Dest=0x53f9e70, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0074.591] wcscat (in: _Dest=0x53f9e70, _Source="Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe" [0074.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53f9e70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x38c [0074.591] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f97eba2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae61172a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5c39f778, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI4ACC~1.0_X")) returned 1 [0074.591] wcscmp (_String1="Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe", _String2=".") returned 1 [0074.591] wcscmp (_String1="Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe", _String2="..") returned 1 [0074.591] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53f9f38 [0074.591] wcscpy (in: _Dest=0x53f9f38, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0074.591] wcscat (in: _Dest=0x53f9f38, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0074.592] wcscat (in: _Dest=0x53f9f38, _Source="Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe" [0074.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53f9f38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c4 [0074.592] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fbe1144, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae652687, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5be1c081, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe", cAlternateFileName="MI0106~1.0_X")) returned 1 [0074.592] wcscmp (_String1="Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe", _String2=".") returned 1 [0074.592] wcscmp (_String1="Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe", _String2="..") returned 1 [0074.592] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53fa000 [0074.592] wcscpy (in: _Dest=0x53fa000, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0074.592] wcscat (in: _Dest=0x53fa000, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0074.592] wcscat (in: _Dest=0x53fa000, _Source="Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe" [0074.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53fa000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x468 [0074.593] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x569db5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb046ec20, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb046ec20, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI04D1~1.0_X")) returned 1 [0074.593] wcscmp (_String1="Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe", _String2=".") returned 1 [0074.593] wcscmp (_String1="Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe", _String2="..") returned 1 [0074.593] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53fa0c8 [0074.593] wcscpy (in: _Dest=0x53fa0c8, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0074.593] wcscat (in: _Dest=0x53fa0c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0074.593] wcscat (in: _Dest=0x53fa0c8, _Source="Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe" [0074.593] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53fa0c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x460 [0074.594] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf855c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf7c444d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xaf7c444d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe", cAlternateFileName="MIF51B~1.0_X")) returned 1 [0074.594] wcscmp (_String1="Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe", _String2=".") returned 1 [0074.594] wcscmp (_String1="Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe", _String2="..") returned 1 [0074.594] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53fa190 [0074.594] wcscpy (in: _Dest=0x53fa190, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0074.594] wcscat (in: _Dest=0x53fa190, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0074.594] wcscat (in: _Dest=0x53fa190, _Source="Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe" [0074.594] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53fa190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x45c [0074.595] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x115e8dfa, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xae7e244c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x12f3e2a7, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI67F0~1.0_X")) returned 1 [0074.595] wcscmp (_String1="Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe", _String2=".") returned 1 [0074.595] wcscmp (_String1="Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe", _String2="..") returned 1 [0074.595] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53fa320 [0074.595] wcscpy (in: _Dest=0x53fa320, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0074.595] wcscat (in: _Dest=0x53fa320, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0074.595] wcscat (in: _Dest=0x53fa320, _Source="Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe" [0074.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53fa320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x458 [0074.596] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13f7c62e, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xae87e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x164e3d2d, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe", cAlternateFileName="MI2C2E~1.0_X")) returned 1 [0074.596] wcscmp (_String1="Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe", _String2=".") returned 1 [0074.596] wcscmp (_String1="Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe", _String2="..") returned 1 [0074.596] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53fa3e8 [0074.596] wcscpy (in: _Dest=0x53fa3e8, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0074.596] wcscat (in: _Dest=0x53fa3e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0074.596] wcscat (in: _Dest=0x53fa3e8, _Source="Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe" [0074.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53fa3e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x454 [0074.597] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb26701cd, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae8ff986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69da07d7, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe", cAlternateFileName="MIEBDA~1.0_X")) returned 1 [0074.597] wcscmp (_String1="Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe", _String2=".") returned 1 [0074.597] wcscmp (_String1="Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe", _String2="..") returned 1 [0074.597] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x53fabb8 [0074.597] wcscpy (in: _Dest=0x53fabb8, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0074.597] wcscat (in: _Dest=0x53fabb8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0074.597] wcscat (in: _Dest=0x53fabb8, _Source="Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" [0074.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53fabb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450 [0074.598] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb26e2784, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae9b674b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69fb68e3, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe", cAlternateFileName="MIA018~1.0_X")) returned 1 [0074.598] wcscmp (_String1="Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe", _String2=".") returned 1 [0074.598] wcscmp (_String1="Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe", _String2="..") returned 1 [0074.598] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x53fac80 [0074.598] wcscpy (in: _Dest=0x53fac80, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0074.598] wcscat (in: _Dest=0x53fac80, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0074.598] wcscat (in: _Dest=0x53fac80, _Source="Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe" [0074.598] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53fac80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x44c [0074.598] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ff4e801, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaea38daa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5c77f49b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI7399~1.0_X")) returned 1 [0074.598] wcscmp (_String1="Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe", _String2=".") returned 1 [0074.598] wcscmp (_String1="Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe", _String2="..") returned 1 [0074.598] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x53fad48 [0074.599] wcscpy (in: _Dest=0x53fad48, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0074.599] wcscat (in: _Dest=0x53fad48, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0074.599] wcscat (in: _Dest=0x53fad48, _Source="Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe" [0074.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53fad48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448 [0074.599] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ffc0fdc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaeaf585c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5c58f618, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe", cAlternateFileName="MI38C6~1.0_X")) returned 1 [0074.599] wcscmp (_String1="Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe", _String2=".") returned 1 [0074.599] wcscmp (_String1="Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe", _String2="..") returned 1 [0074.599] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x53faaf0 [0074.599] wcscpy (in: _Dest=0x53faaf0, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0074.599] wcscat (in: _Dest=0x53faaf0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0074.599] wcscat (in: _Dest=0x53faaf0, _Source="Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe" [0074.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53faaf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x444 [0074.600] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1096e68, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae30dca7, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xae30dca7, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI7D40~1.0_X")) returned 1 [0076.208] wcscmp (_String1="Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe", _String2=".") returned 1 [0076.208] wcscmp (_String1="Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe", _String2="..") returned 1 [0076.208] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x3975b08 [0076.208] wcscpy (in: _Dest=0x3975b08, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0076.208] wcscat (in: _Dest=0x3975b08, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0076.208] wcscat (in: _Dest=0x3975b08, _Source="Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe" [0081.083] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3975b08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x110c [0081.084] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11c813b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad7e0bf4, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xad7e0bf4, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe", cAlternateFileName="MIA22A~1.0_X")) returned 1 [0081.084] wcscmp (_String1="Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe", _String2=".") returned 1 [0081.084] wcscmp (_String1="Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe", _String2="..") returned 1 [0081.084] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x39763a0 [0081.084] wcscpy (in: _Dest=0x39763a0, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0081.084] wcscat (in: _Dest=0x39763a0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0081.084] wcscat (in: _Dest=0x39763a0, _Source="Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe" [0081.084] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x39763a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a68 [0081.085] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f6d5e4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad0dfe61, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xad0dfe61, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe", cAlternateFileName="MIEC84~1.0_X")) returned 1 [0081.085] wcscmp (_String1="Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe", _String2=".") returned 1 [0081.085] wcscmp (_String1="Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe", _String2="..") returned 1 [0081.085] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x39765f8 [0081.085] wcscpy (in: _Dest=0x39765f8, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0081.085] wcscat (in: _Dest=0x39765f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0081.085] wcscat (in: _Dest=0x39765f8, _Source="Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe" [0081.085] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x39765f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a6c [0081.086] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33fb9a9b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaca2b3ac, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xaca2b3ac, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe", cAlternateFileName="MI6E3E~1.0_X")) returned 1 [0081.086] wcscmp (_String1="Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe", _String2=".") returned 1 [0081.086] wcscmp (_String1="Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe", _String2="..") returned 1 [0081.086] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x3976468 [0081.086] wcscpy (in: _Dest=0x3976468, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0081.086] wcscat (in: _Dest=0x3976468, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0081.086] wcscat (in: _Dest=0x3976468, _Source="Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe" [0081.086] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3976468, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a70 [0081.087] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b404f13, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xaee25a0f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c25330e, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe", cAlternateFileName="MIBE4A~1.0_X")) returned 1 [0081.087] wcscmp (_String1="Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe", _String2=".") returned 1 [0081.087] wcscmp (_String1="Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe", _String2="..") returned 1 [0081.087] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x53faa28 [0081.087] wcscpy (in: _Dest=0x53faa28, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0081.087] wcscat (in: _Dest=0x53faa28, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0081.087] wcscat (in: _Dest=0x53faa28, _Source="Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe" [0081.087] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53faa28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a74 [0081.087] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ac94c, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xaef00b37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1dc41199, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe", cAlternateFileName="MI7387~1.0_X")) returned 1 [0081.087] wcscmp (_String1="Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe", _String2=".") returned 1 [0081.087] wcscmp (_String1="Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe", _String2="..") returned 1 [0081.087] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x53fa960 [0081.088] wcscpy (in: _Dest=0x53fa960, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0081.088] wcscat (in: _Dest=0x53fa960, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0081.088] wcscat (in: _Dest=0x53fa960, _Source="Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe" [0081.088] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53fa960, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a78 [0081.088] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59460ee7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xd1ed095d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd1ed095d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI20CB~1.0_X")) returned 1 [0081.088] wcscmp (_String1="Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe", _String2=".") returned 1 [0081.088] wcscmp (_String1="Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe", _String2="..") returned 1 [0081.088] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb2) returned 0x5b16610 [0081.088] wcscpy (in: _Dest=0x5b16610, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0081.089] wcscat (in: _Dest=0x5b16610, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0081.089] wcscat (in: _Dest=0x5b16610, _Source="Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe" [0081.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5b16610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a7c [0081.089] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58fa379e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xd1eaa713, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd1eaa713, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MIAECB~1.0_N")) returned 1 [0081.089] wcscmp (_String1="Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe", _String2=".") returned 1 [0081.089] wcscmp (_String1="Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe", _String2="..") returned 1 [0081.089] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x53faaf0 [0081.089] wcscpy (in: _Dest=0x53faaf0, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0081.089] wcscat (in: _Dest=0x53faaf0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0081.089] wcscat (in: _Dest=0x53faaf0, _Source="Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe" [0081.090] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53faaf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a80 [0081.090] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa599a57e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaf561945, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6e6321cd, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI4126~1.0_X")) returned 1 [0081.090] wcscmp (_String1="Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe", _String2=".") returned 1 [0081.090] wcscmp (_String1="Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe", _String2="..") returned 1 [0081.090] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xac) returned 0x55c7530 [0081.090] wcscpy (in: _Dest=0x55c7530, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0081.090] wcscat (in: _Dest=0x55c7530, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0081.090] wcscat (in: _Dest=0x55c7530, _Source="Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe" [0081.090] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55c7530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a84 [0081.091] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa57d3c26, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xafabb342, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6e60bed5, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI01E4~1.0_N")) returned 1 [0081.091] wcscmp (_String1="Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe", _String2=".") returned 1 [0081.091] wcscmp (_String1="Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe", _String2="..") returned 1 [0081.091] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x53fabb8 [0081.091] wcscpy (in: _Dest=0x53fabb8, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0081.091] wcscat (in: _Dest=0x53fabb8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0081.091] wcscat (in: _Dest=0x53fabb8, _Source="Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe" [0081.091] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53fabb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a88 [0081.092] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ef508f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xd45db281, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd45db281, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe", cAlternateFileName="MI4988~1.SCA")) returned 1 [0081.092] wcscmp (_String1="Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe", _String2=".") returned 1 [0081.092] wcscmp (_String1="Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe", _String2="..") returned 1 [0081.092] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xca) returned 0x757fbb0 [0081.092] wcscpy (in: _Dest=0x757fbb0, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0081.092] wcscat (in: _Dest=0x757fbb0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0081.092] wcscat (in: _Dest=0x757fbb0, _Source="Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe" [0081.092] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x757fbb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a8c [0081.093] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f76a4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xd45db281, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd45db281, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.OneConnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI2A4A~1.0_N")) returned 1 [0081.093] wcscmp (_String1="Microsoft.OneConnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe", _String2=".") returned 1 [0081.093] wcscmp (_String1="Microsoft.OneConnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe", _String2="..") returned 1 [0081.093] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xae) returned 0x55c8500 [0081.093] wcscpy (in: _Dest=0x55c8500, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0081.093] wcscat (in: _Dest=0x55c8500, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0081.093] wcscat (in: _Dest=0x55c8500, _Source="Microsoft.OneConnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe" [0081.093] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55c8500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a90 [0081.094] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16dc6f6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xd45db281, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd45db281, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI5B43~1.0_X")) returned 1 [0081.094] wcscmp (_String1="Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe", _String2=".") returned 1 [0081.094] wcscmp (_String1="Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe", _String2="..") returned 1 [0081.094] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa4) returned 0x54def50 [0081.094] wcscpy (in: _Dest=0x54def50, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0081.094] wcscat (in: _Dest=0x54def50, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0081.094] wcscat (in: _Dest=0x54def50, _Source="Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe" [0081.094] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54def50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a94 [0081.094] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x255053c0, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xd61ded48, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd61ded48, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe", cAlternateFileName="MI155A~1.SCA")) returned 1 [0081.095] wcscmp (_String1="Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe", _String2=".") returned 1 [0081.095] wcscmp (_String1="Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe", _String2="..") returned 1 [0081.095] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x55fd128 [0081.095] wcscpy (in: _Dest=0x55fd128, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0081.095] wcscat (in: _Dest=0x55fd128, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0081.095] wcscat (in: _Dest=0x55fd128, _Source="Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe" [0081.095] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55fd128, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a98 [0081.096] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2499f315, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xd61ded48, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd61ded48, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI698D~1.0_X")) returned 1 [0081.096] wcscmp (_String1="Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe", _String2=".") returned 1 [0081.096] wcscmp (_String1="Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe", _String2="..") returned 1 [0081.096] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9c) returned 0x54a13e0 [0081.096] wcscpy (in: _Dest=0x54a13e0, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0081.096] wcscat (in: _Dest=0x54a13e0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0081.096] wcscat (in: _Dest=0x54a13e0, _Source="Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe" [0081.096] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54a13e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a9c [0081.096] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x248ba4f4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xd61ded48, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd61ded48, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.People_2017.222.1920.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI86E0~1.0_N")) returned 1 [0081.097] wcscmp (_String1="Microsoft.People_2017.222.1920.0_neutral_~_8wekyb3d8bbwe", _String2=".") returned 1 [0081.097] wcscmp (_String1="Microsoft.People_2017.222.1920.0_neutral_~_8wekyb3d8bbwe", _String2="..") returned 1 [0081.097] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xac) returned 0x55c75e8 [0081.097] wcscpy (in: _Dest=0x55c75e8, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0081.097] wcscat (in: _Dest=0x55c75e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0081.097] wcscat (in: _Dest=0x55c75e8, _Source="Microsoft.People_2017.222.1920.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.People_2017.222.1920.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.People_2017.222.1920.0_neutral_~_8wekyb3d8bbwe" [0081.097] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55c75e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aa0 [0081.097] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x367c081d, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xaff5073a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37eb3642, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI4486~1.0_X")) returned 1 [0081.097] wcscmp (_String1="Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe", _String2=".") returned 1 [0081.097] wcscmp (_String1="Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe", _String2="..") returned 1 [0081.097] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x53fad48 [0081.097] wcscpy (in: _Dest=0x53fad48, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0081.098] wcscat (in: _Dest=0x53fad48, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0081.098] wcscat (in: _Dest=0x53fad48, _Source="Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe" [0081.098] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53fad48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aa4 [0081.098] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3979638c, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xb00f9315, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a630d34, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe", cAlternateFileName="MI9817~1.0_X")) returned 1 [0081.098] wcscmp (_String1="Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe", _String2=".") returned 1 [0081.098] wcscmp (_String1="Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe", _String2="..") returned 1 [0081.098] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x53fac80 [0081.098] wcscpy (in: _Dest=0x53fac80, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0081.098] wcscat (in: _Dest=0x53fac80, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0081.098] wcscat (in: _Dest=0x53fac80, _Source="Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe" [0081.099] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53fac80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aa8 [0081.099] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbff4e2d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xdba3c24b, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xdba3c24b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c", cAlternateFileName="MI66C7~1.SCA")) returned 1 [0081.264] wcscmp (_String1="Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c", _String2=".") returned 1 [0081.264] wcscmp (_String1="Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c", _String2="..") returned 1 [0081.264] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x55fe718 [0081.264] wcscpy (in: _Dest=0x55fe718, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0081.264] wcscat (in: _Dest=0x55fe718, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0081.264] wcscat (in: _Dest=0x55fe718, _Source="Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c") returned="C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c" [0081.264] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55fe718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c1c [0081.265] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73778cb, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xdba15ff2, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xdba15ff2, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SkypeApp_11.8.204.0_neutral_~_kzf8qxf38zg5c", cAlternateFileName="MI29A2~1.0_N")) returned 1 [0081.265] wcscmp (_String1="Microsoft.SkypeApp_11.8.204.0_neutral_~_kzf8qxf38zg5c", _String2=".") returned 1 [0081.265] wcscmp (_String1="Microsoft.SkypeApp_11.8.204.0_neutral_~_kzf8qxf38zg5c", _String2="..") returned 1 [0081.265] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa6) returned 0x54df420 [0081.265] wcscpy (in: _Dest=0x54df420, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0081.265] wcscat (in: _Dest=0x54df420, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0081.265] wcscat (in: _Dest=0x54df420, _Source="Microsoft.SkypeApp_11.8.204.0_neutral_~_kzf8qxf38zg5c" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_11.8.204.0_neutral_~_kzf8qxf38zg5c") returned="C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_11.8.204.0_neutral_~_kzf8qxf38zg5c" [0081.265] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54df420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c20 [0081.266] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7410239, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xdba15ff2, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xdba15ff2, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c", cAlternateFileName="MIC69C~1.0_X")) returned 1 [0081.266] wcscmp (_String1="Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c", _String2=".") returned 1 [0081.266] wcscmp (_String1="Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c", _String2="..") returned 1 [0081.266] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9c) returned 0x54a2058 [0081.266] wcscpy (in: _Dest=0x54a2058, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0081.266] wcscat (in: _Dest=0x54a2058, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0081.266] wcscat (in: _Dest=0x54a2058, _Source="Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c") returned="C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c" [0081.266] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54a2058, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c24 [0081.266] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x137b8f21, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xdfec7dad, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xdfec7dad, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe", cAlternateFileName="MIC910~1.0_X")) returned 1 [0081.266] wcscmp (_String1="Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe", _String2=".") returned 1 [0081.267] wcscmp (_String1="Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe", _String2="..") returned 1 [0081.267] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa8) returned 0x54df000 [0081.267] wcscpy (in: _Dest=0x54df000, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0081.267] wcscat (in: _Dest=0x54df000, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0081.267] wcscat (in: _Dest=0x54df000, _Source="Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe" [0081.267] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54df000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c28 [0081.267] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1374681a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xdfea1b47, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xdfea1b47, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.StorePurchaseApp_1.0.454.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI3F66~1.0_N")) returned 1 [0081.267] wcscmp (_String1="Microsoft.StorePurchaseApp_1.0.454.0_neutral_~_8wekyb3d8bbwe", _String2=".") returned 1 [0081.267] wcscmp (_String1="Microsoft.StorePurchaseApp_1.0.454.0_neutral_~_8wekyb3d8bbwe", _String2="..") returned 1 [0081.267] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb4) returned 0x5b15b90 [0081.267] wcscpy (in: _Dest=0x5b15b90, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0081.267] wcscat (in: _Dest=0x5b15b90, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0081.267] wcscat (in: _Dest=0x5b15b90, _Source="Microsoft.StorePurchaseApp_1.0.454.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.StorePurchaseApp_1.0.454.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.StorePurchaseApp_1.0.454.0_neutral_~_8wekyb3d8bbwe" [0081.268] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5b15b90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c2c [0081.268] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9eace405, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb0a85441, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5b9575e3, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VCLibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe", cAlternateFileName="MICROS~1.1_X")) returned 1 [0081.268] wcscmp (_String1="Microsoft.VCLibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe", _String2=".") returned 1 [0081.269] wcscmp (_String1="Microsoft.VCLibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe", _String2="..") returned 1 [0081.269] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xaa) returned 0x55c7810 [0081.269] wcscpy (in: _Dest=0x55c7810, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0081.269] wcscat (in: _Dest=0x55c7810, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0081.269] wcscat (in: _Dest=0x55c7810, _Source="Microsoft.VCLibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.VCLibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.VCLibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe" [0081.269] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55c7810, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c30 [0081.269] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9eb8d19b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb0ace717, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5b6ced31, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VCLibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe", cAlternateFileName="MICROS~2.1_X")) returned 1 [0081.270] wcscmp (_String1="Microsoft.VCLibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe", _String2=".") returned 1 [0081.270] wcscmp (_String1="Microsoft.VCLibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe", _String2="..") returned 1 [0081.270] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xaa) returned 0x55c7758 [0081.270] wcscpy (in: _Dest=0x55c7758, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0081.270] wcscat (in: _Dest=0x55c7758, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0081.270] wcscat (in: _Dest=0x55c7758, _Source="Microsoft.VCLibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.VCLibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.VCLibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe" [0081.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55c7758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c34 [0081.270] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12fc9b2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb13a1d82, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb13a1d82, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VCLibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI72FF~1.0_X")) returned 1 [0081.270] wcscmp (_String1="Microsoft.VCLibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe", _String2=".") returned 1 [0081.270] wcscmp (_String1="Microsoft.VCLibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe", _String2="..") returned 1 [0081.270] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xaa) returned 0x55c78c8 [0081.270] wcscpy (in: _Dest=0x55c78c8, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0081.270] wcscat (in: _Dest=0x55c78c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0081.271] wcscat (in: _Dest=0x55c78c8, _Source="Microsoft.VCLibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.VCLibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.VCLibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe" [0081.271] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55c78c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c38 [0081.271] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1538d09, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb0d397aa, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb0d397aa, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe", cAlternateFileName="MIA7C9~1.0_X")) returned 1 [0081.271] wcscmp (_String1="Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe", _String2=".") returned 1 [0081.271] wcscmp (_String1="Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe", _String2="..") returned 1 [0081.271] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xaa) returned 0x55c7af0 [0081.271] wcscpy (in: _Dest=0x55c7af0, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0081.271] wcscat (in: _Dest=0x55c7af0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0081.271] wcscat (in: _Dest=0x55c7af0, _Source="Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe" [0081.271] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55c7af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c3c [0081.272] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7e7ba3c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xe09a894e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xe09a894e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MIB6B3~1.0_N")) returned 1 [0081.272] wcscmp (_String1="Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe", _String2=".") returned 1 [0081.272] wcscmp (_String1="Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe", _String2="..") returned 1 [0081.272] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa4) returned 0x54dfd10 [0081.272] wcscpy (in: _Dest=0x54dfd10, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0081.272] wcscat (in: _Dest=0x54dfd10, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0081.272] wcscat (in: _Dest=0x54dfd10, _Source="Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe" [0081.272] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54dfd10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c40 [0081.273] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8150701, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xe09a894e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xe09a894e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe", cAlternateFileName="MIF132~1.0_X")) returned 1 [0081.273] wcscmp (_String1="Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe", _String2=".") returned 1 [0081.273] wcscmp (_String1="Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe", _String2="..") returned 1 [0081.273] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9a) returned 0x54a2838 [0081.273] wcscpy (in: _Dest=0x54a2838, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0081.273] wcscat (in: _Dest=0x54a2838, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0081.273] wcscat (in: _Dest=0x54a2838, _Source="Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe" [0081.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54a2838, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c44 [0081.274] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe563d29, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb0e615f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x716c6041, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.Photos_15.1001.16470.0_neutral_split.scale-200_8wekyb3d8bbwe", cAlternateFileName="MI5B39~1.SCA")) returned 1 [0081.274] wcscmp (_String1="Microsoft.Windows.Photos_15.1001.16470.0_neutral_split.scale-200_8wekyb3d8bbwe", _String2=".") returned 1 [0081.274] wcscmp (_String1="Microsoft.Windows.Photos_15.1001.16470.0_neutral_split.scale-200_8wekyb3d8bbwe", _String2="..") returned 1 [0081.274] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x39350c8 [0081.274] wcscpy (in: _Dest=0x39350c8, _Source="C:\\Program Files\\WindowsApps" | out: _Dest="C:\\Program Files\\WindowsApps") returned="C:\\Program Files\\WindowsApps" [0081.274] wcscat (in: _Dest=0x39350c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\") returned="C:\\Program Files\\WindowsApps\\" [0081.274] wcscat (in: _Dest=0x39350c8, _Source="Microsoft.Windows.Photos_15.1001.16470.0_neutral_split.scale-200_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_15.1001.16470.0_neutral_split.scale-200_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_15.1001.16470.0_neutral_split.scale-200_8wekyb3d8bbwe" [0081.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x39350c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c48 [0081.275] FindNextFileW (in: hFindFile=0x389edc0, lpFindFileData=0x5406f60 | out: lpFindFileData=0x5406f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86d169f9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xe8ca3fa7, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xe8ca3fa7, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe", cAlternateFileName="MI10C6~1.SCA")) returned 1 [0081.275] wcscmp (_String1="Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe", _String2=".") returned 1 [0081.275] wcscmp (_String1="Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe", _String2="..") returned 1 [0081.275] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd4) Thread: id = 56 os_tid = 0x1294 [0071.044] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x38b3098 [0071.044] wcscpy (in: _Dest=0x38b3098, _Source="C:\\Program Files (x86)\\a0a70290" | out: _Dest="C:\\Program Files (x86)\\a0a70290") returned="C:\\Program Files (x86)\\a0a70290" [0071.044] wcscat (in: _Dest=0x38b3098, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\a0a70290\\") returned="C:\\Program Files (x86)\\a0a70290\\" [0071.044] wcscat (in: _Dest=0x38b3098, _Source="*" | out: _Dest="C:\\Program Files (x86)\\a0a70290\\*") returned="C:\\Program Files (x86)\\a0a70290\\*" [0071.044] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5407dd0 [0071.044] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\a0a70290\\*", lpFindFileData=0x5407dd0 | out: lpFindFileData=0x5407dd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1430415, ftCreationTime.dwHighDateTime=0x1d5e1e4, ftLastAccessTime.dwLowDateTime=0xa1430415, ftLastAccessTime.dwHighDateTime=0x1d5e1e4, ftLastWriteTime.dwLowDateTime=0xa1451956, ftLastWriteTime.dwHighDateTime=0x1d5e1e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445480 [0071.522] wcscmp (_String1=".", _String2=".") returned 0 [0071.522] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x5407dd0 | out: lpFindFileData=0x5407dd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1430415, ftCreationTime.dwHighDateTime=0x1d5e1e4, ftLastAccessTime.dwLowDateTime=0xa1430415, ftLastAccessTime.dwHighDateTime=0x1d5e1e4, ftLastWriteTime.dwLowDateTime=0xa1451956, ftLastWriteTime.dwHighDateTime=0x1d5e1e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.522] wcscmp (_String1="..", _String2=".") returned 1 [0071.522] wcscmp (_String1="..", _String2="..") returned 0 [0071.522] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x5407dd0 | out: lpFindFileData=0x5407dd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1451956, ftCreationTime.dwHighDateTime=0x1d5e1e4, ftLastAccessTime.dwLowDateTime=0xa1451956, ftLastAccessTime.dwHighDateTime=0x1d5e1e4, ftLastWriteTime.dwLowDateTime=0x7b9d5800, ftLastWriteTime.dwHighDateTime=0x1d5e1e4, nFileSizeHigh=0x0, nFileSizeLow=0x17800, dwReserved0=0x0, dwReserved1=0x0, cFileName="a0a70290.exe", cAlternateFileName="")) returned 1 [0071.522] wcscmp (_String1="a0a70290.exe", _String2=".") returned 1 [0071.522] wcscmp (_String1="a0a70290.exe", _String2="..") returned 1 [0071.522] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x5407dd0 | out: lpFindFileData=0x5407dd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1451956, ftCreationTime.dwHighDateTime=0x1d5e1e4, ftLastAccessTime.dwLowDateTime=0xa1451956, ftLastAccessTime.dwHighDateTime=0x1d5e1e4, ftLastWriteTime.dwLowDateTime=0x7b9d5800, ftLastWriteTime.dwHighDateTime=0x1d5e1e4, nFileSizeHigh=0x0, nFileSizeLow=0x17800, dwReserved0=0x0, dwReserved1=0x0, cFileName="a0a70290.exe", cAlternateFileName="")) returned 0 [0071.522] FindClose (in: hFindFile=0x5445480 | out: hFindFile=0x5445480) returned 1 [0071.522] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5407dd0) returned 1 [0071.522] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b3098) returned 1 [0071.522] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6460) returned 1 Thread: id = 57 os_tid = 0x129c [0071.044] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3e) returned 0x38a5968 [0071.044] wcscpy (in: _Dest=0x38a5968, _Source="C:\\Program Files (x86)\\Adobe" | out: _Dest="C:\\Program Files (x86)\\Adobe") returned="C:\\Program Files (x86)\\Adobe" [0071.044] wcscat (in: _Dest=0x38a5968, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\") returned="C:\\Program Files (x86)\\Adobe\\" [0071.044] wcscat (in: _Dest=0x38a5968, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\*") returned="C:\\Program Files (x86)\\Adobe\\*" [0071.044] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54082a0 [0071.044] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\*", lpFindFileData=0x54082a0 | out: lpFindFileData=0x54082a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3b141433, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b141433, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445640 [0071.523] wcscmp (_String1=".", _String2=".") returned 0 [0071.523] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x54082a0 | out: lpFindFileData=0x54082a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3b141433, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b141433, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.523] wcscmp (_String1="..", _String2=".") returned 1 [0071.523] wcscmp (_String1="..", _String2="..") returned 0 [0071.523] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x54082a0 | out: lpFindFileData=0x54082a0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdec183d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdec183d6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat Reader DC", cAlternateFileName="ACROBA~1")) returned 1 [0071.523] wcscmp (_String1="Acrobat Reader DC", _String2=".") returned 1 [0071.523] wcscmp (_String1="Acrobat Reader DC", _String2="..") returned 1 [0071.523] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x541ad38 [0071.523] wcscpy (in: _Dest=0x541ad38, _Source="C:\\Program Files (x86)\\Adobe" | out: _Dest="C:\\Program Files (x86)\\Adobe") returned="C:\\Program Files (x86)\\Adobe" [0071.523] wcscat (in: _Dest=0x541ad38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\") returned="C:\\Program Files (x86)\\Adobe\\" [0071.523] wcscat (in: _Dest=0x541ad38, _Source="Acrobat Reader DC" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC") returned="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC" [0071.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x541ad38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c0 [0071.524] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x54082a0 | out: lpFindFileData=0x54082a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc861fbe0, ftCreationTime.dwHighDateTime=0x1d5cd9a, ftLastAccessTime.dwLowDateTime=0xa436d520, ftLastAccessTime.dwHighDateTime=0x1d5c34e, ftLastWriteTime.dwLowDateTime=0xa436d520, ftLastWriteTime.dwHighDateTime=0x1d5c34e, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="gmailnotifierpro.exe", cAlternateFileName="GMAILN~1.EXE")) returned 1 [0071.524] wcscmp (_String1="gmailnotifierpro.exe", _String2=".") returned 1 [0071.524] wcscmp (_String1="gmailnotifierpro.exe", _String2="..") returned 1 [0071.524] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x54082a0 | out: lpFindFileData=0x54082a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc861fbe0, ftCreationTime.dwHighDateTime=0x1d5cd9a, ftLastAccessTime.dwLowDateTime=0xa436d520, ftLastAccessTime.dwHighDateTime=0x1d5c34e, ftLastWriteTime.dwLowDateTime=0xa436d520, ftLastWriteTime.dwHighDateTime=0x1d5c34e, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="gmailnotifierpro.exe", cAlternateFileName="GMAILN~1.EXE")) returned 0 [0071.524] FindClose (in: hFindFile=0x5445640 | out: hFindFile=0x5445640) returned 1 [0071.524] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54082a0) returned 1 [0071.524] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5968) returned 1 [0071.524] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6340) returned 1 Thread: id = 58 os_tid = 0x1298 [0071.045] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x3884790 [0071.045] wcscpy (in: _Dest=0x3884790, _Source="C:\\Program Files (x86)\\Common Files" | out: _Dest="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0071.045] wcscat (in: _Dest=0x3884790, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\") returned="C:\\Program Files (x86)\\Common Files\\" [0071.045] wcscat (in: _Dest=0x3884790, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\*") returned="C:\\Program Files (x86)\\Common Files\\*" [0071.045] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54065c0 [0071.045] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\*", lpFindFileData=0x54065c0 | out: lpFindFileData=0x54065c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b18da3c, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b18da3c, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445480 [0071.525] wcscmp (_String1=".", _String2=".") returned 0 [0071.525] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x54065c0 | out: lpFindFileData=0x54065c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b18da3c, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b18da3c, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.525] wcscmp (_String1="..", _String2=".") returned 1 [0071.525] wcscmp (_String1="..", _String2="..") returned 0 [0071.525] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x54065c0 | out: lpFindFileData=0x54065c0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xbb39c720, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3420de7a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0071.525] wcscmp (_String1="Adobe", _String2=".") returned 1 [0071.525] wcscmp (_String1="Adobe", _String2="..") returned 1 [0071.525] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x543d3f8 [0071.525] wcscpy (in: _Dest=0x543d3f8, _Source="C:\\Program Files (x86)\\Common Files" | out: _Dest="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0071.525] wcscat (in: _Dest=0x543d3f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\") returned="C:\\Program Files (x86)\\Common Files\\" [0071.525] wcscat (in: _Dest=0x543d3f8, _Source="Adobe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe") returned="C:\\Program Files (x86)\\Common Files\\Adobe" [0071.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x543d3f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x754 [0071.526] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x54065c0 | out: lpFindFileData=0x54065c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb2fbfbb9, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb2fe5e18, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb2fe5e18, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0071.526] wcscmp (_String1="Java", _String2=".") returned 1 [0071.526] wcscmp (_String1="Java", _String2="..") returned 1 [0071.526] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x543d6f8 [0071.526] wcscpy (in: _Dest=0x543d6f8, _Source="C:\\Program Files (x86)\\Common Files" | out: _Dest="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0071.526] wcscat (in: _Dest=0x543d6f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\") returned="C:\\Program Files (x86)\\Common Files\\" [0071.526] wcscat (in: _Dest=0x543d6f8, _Source="Java" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java") returned="C:\\Program Files (x86)\\Common Files\\Java" [0071.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x543d6f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x758 [0071.527] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x54065c0 | out: lpFindFileData=0x54065c0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb686ce0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a0e1ac1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0071.527] wcscmp (_String1="Microsoft Shared", _String2=".") returned 1 [0071.527] wcscmp (_String1="Microsoft Shared", _String2="..") returned 1 [0071.527] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6a) returned 0x38aaa68 [0071.527] wcscpy (in: _Dest=0x38aaa68, _Source="C:\\Program Files (x86)\\Common Files" | out: _Dest="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0071.527] wcscat (in: _Dest=0x38aaa68, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\") returned="C:\\Program Files (x86)\\Common Files\\" [0071.527] wcscat (in: _Dest=0x38aaa68, _Source="Microsoft Shared" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Microsoft Shared") returned="C:\\Program Files (x86)\\Common Files\\Microsoft Shared" [0071.527] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38aaa68) returned 1 [0071.527] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x54065c0 | out: lpFindFileData=0x54065c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d297e0, ftCreationTime.dwHighDateTime=0x1d562f1, ftLastAccessTime.dwLowDateTime=0x3d192be0, ftLastAccessTime.dwHighDateTime=0x1d593d3, ftLastWriteTime.dwLowDateTime=0x3d192be0, ftLastWriteTime.dwHighDateTime=0x1d593d3, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgin.exe", cAlternateFileName="")) returned 1 [0071.527] wcscmp (_String1="pidgin.exe", _String2=".") returned 1 [0071.527] wcscmp (_String1="pidgin.exe", _String2="..") returned 1 [0071.527] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x54065c0 | out: lpFindFileData=0x54065c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb9ebb45, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a6c1993, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0071.527] wcscmp (_String1="Services", _String2=".") returned 1 [0071.527] wcscmp (_String1="Services", _String2="..") returned 1 [0071.527] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x541b0e0 [0071.527] wcscpy (in: _Dest=0x541b0e0, _Source="C:\\Program Files (x86)\\Common Files" | out: _Dest="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0071.527] wcscat (in: _Dest=0x541b0e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\") returned="C:\\Program Files (x86)\\Common Files\\" [0071.527] wcscat (in: _Dest=0x541b0e0, _Source="Services" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Services") returned="C:\\Program Files (x86)\\Common Files\\Services" [0071.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x541b0e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x75c [0071.528] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x54065c0 | out: lpFindFileData=0x54065c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb9ecb1f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0071.528] wcscmp (_String1="System", _String2=".") returned 1 [0071.528] wcscmp (_String1="System", _String2="..") returned 1 [0071.528] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x543d818 [0071.528] wcscpy (in: _Dest=0x543d818, _Source="C:\\Program Files (x86)\\Common Files" | out: _Dest="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0071.528] wcscat (in: _Dest=0x543d818, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\") returned="C:\\Program Files (x86)\\Common Files\\" [0071.528] wcscat (in: _Dest=0x543d818, _Source="System" | out: _Dest="C:\\Program Files (x86)\\Common Files\\System") returned="C:\\Program Files (x86)\\Common Files\\System" [0071.528] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x543d818) returned 1 [0071.528] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x54065c0 | out: lpFindFileData=0x54065c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb9ecb1f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0071.528] FindClose (in: hFindFile=0x5445480 | out: hFindFile=0x5445480) returned 1 [0071.529] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54065c0) returned 1 [0071.529] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3884790) returned 1 [0071.529] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3892ca0) returned 1 Thread: id = 59 os_tid = 0x12d0 [0071.046] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5ad0 [0071.046] wcscpy (in: _Dest=0x38a5ad0, _Source="C:\\Program Files (x86)\\Google" | out: _Dest="C:\\Program Files (x86)\\Google") returned="C:\\Program Files (x86)\\Google" [0071.046] wcscat (in: _Dest=0x38a5ad0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\") returned="C:\\Program Files (x86)\\Google\\" [0071.046] wcscat (in: _Dest=0x38a5ad0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\*") returned="C:\\Program Files (x86)\\Google\\*" [0071.046] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5406828 [0071.046] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\*", lpFindFileData=0x5406828 | out: lpFindFileData=0x5406828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc5e5a66, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0x19640a8, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x19640a8, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445480 [0071.529] wcscmp (_String1=".", _String2=".") returned 0 [0071.529] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x5406828 | out: lpFindFileData=0x5406828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc5e5a66, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0x19640a8, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x19640a8, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.529] wcscmp (_String1="..", _String2=".") returned 1 [0071.530] wcscmp (_String1="..", _String2="..") returned 0 [0071.530] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x5406828 | out: lpFindFileData=0x5406828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe07d7559, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4cfb9d0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4cfb9d0, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chrome", cAlternateFileName="")) returned 1 [0071.530] wcscmp (_String1="Chrome", _String2=".") returned 1 [0071.530] wcscmp (_String1="Chrome", _String2="..") returned 1 [0071.530] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x54283a0 [0071.530] wcscpy (in: _Dest=0x54283a0, _Source="C:\\Program Files (x86)\\Google" | out: _Dest="C:\\Program Files (x86)\\Google") returned="C:\\Program Files (x86)\\Google" [0071.530] wcscat (in: _Dest=0x54283a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\") returned="C:\\Program Files (x86)\\Google\\" [0071.530] wcscat (in: _Dest=0x54283a0, _Source="Chrome" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome") returned="C:\\Program Files (x86)\\Google\\Chrome" [0071.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54283a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x760 [0071.530] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x5406828 | out: lpFindFileData=0x5406828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc5e5a66, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbf7b2f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcc5e5a66, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1 [0071.530] wcscmp (_String1="CrashReports", _String2=".") returned 1 [0071.530] wcscmp (_String1="CrashReports", _String2="..") returned 1 [0071.531] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x543d7b8 [0071.531] wcscpy (in: _Dest=0x543d7b8, _Source="C:\\Program Files (x86)\\Google" | out: _Dest="C:\\Program Files (x86)\\Google") returned="C:\\Program Files (x86)\\Google" [0071.531] wcscat (in: _Dest=0x543d7b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\") returned="C:\\Program Files (x86)\\Google\\" [0071.531] wcscat (in: _Dest=0x543d7b8, _Source="CrashReports" | out: _Dest="C:\\Program Files (x86)\\Google\\CrashReports") returned="C:\\Program Files (x86)\\Google\\CrashReports" [0071.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x543d7b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x764 [0071.531] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x5406828 | out: lpFindFileData=0x5406828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc631f07, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbfd0b02, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcda0384e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Update2", cAlternateFileName="")) returned 1 [0071.531] wcscmp (_String1="Update2", _String2=".") returned 1 [0071.531] wcscmp (_String1="Update2", _String2="..") returned 1 [0071.531] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x54287c0 [0071.531] wcscpy (in: _Dest=0x54287c0, _Source="C:\\Program Files (x86)\\Google" | out: _Dest="C:\\Program Files (x86)\\Google") returned="C:\\Program Files (x86)\\Google" [0071.531] wcscat (in: _Dest=0x54287c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\") returned="C:\\Program Files (x86)\\Google\\" [0071.531] wcscat (in: _Dest=0x54287c0, _Source="Update2" | out: _Dest="C:\\Program Files (x86)\\Google\\Update2") returned="C:\\Program Files (x86)\\Google\\Update2" [0071.532] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54287c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x768 [0071.532] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x5406828 | out: lpFindFileData=0x5406828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc631f07, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbfd0b02, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcda0384e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Update2", cAlternateFileName="")) returned 0 [0071.532] FindClose (in: hFindFile=0x5445480 | out: hFindFile=0x5445480) returned 1 [0071.532] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5406828) returned 1 [0071.532] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5ad0) returned 1 [0071.532] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a60b8) returned 1 Thread: id = 60 os_tid = 0x12b0 [0071.047] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x388b210 [0071.047] wcscpy (in: _Dest=0x388b210, _Source="C:\\Program Files (x86)\\Microsoft Office" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office") returned="C:\\Program Files (x86)\\Microsoft Office" [0071.047] wcscat (in: _Dest=0x388b210, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\") returned="C:\\Program Files (x86)\\Microsoft Office\\" [0071.047] wcscat (in: _Dest=0x388b210, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\*") returned="C:\\Program Files (x86)\\Microsoft Office\\*" [0071.047] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x541a148 [0071.047] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\*", lpFindFileData=0x541a148 | out: lpFindFileData=0x541a148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc211eecb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3b2729cb, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b2729cb, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445940 [0071.533] wcscmp (_String1=".", _String2=".") returned 0 [0071.533] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x541a148 | out: lpFindFileData=0x541a148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc211eecb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3b2729cb, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b2729cb, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.533] wcscmp (_String1="..", _String2=".") returned 1 [0071.533] wcscmp (_String1="..", _String2="..") returned 0 [0071.533] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x541a148 | out: lpFindFileData=0x541a148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe22930, ftCreationTime.dwHighDateTime=0x1d5c8c0, ftLastAccessTime.dwLowDateTime=0xdded2b70, ftLastAccessTime.dwHighDateTime=0x1d5b78c, ftLastWriteTime.dwLowDateTime=0xdded2b70, ftLastWriteTime.dwHighDateTime=0x1d5b78c, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="spgagentservice.exe", cAlternateFileName="SPGAGE~1.EXE")) returned 1 [0071.533] wcscmp (_String1="spgagentservice.exe", _String2=".") returned 1 [0071.534] wcscmp (_String1="spgagentservice.exe", _String2="..") returned 1 [0071.534] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x541a148 | out: lpFindFileData=0x541a148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa968d710, ftCreationTime.dwHighDateTime=0x1d5c555, ftLastAccessTime.dwLowDateTime=0xf5ddba80, ftLastAccessTime.dwHighDateTime=0x1d55cdb, ftLastWriteTime.dwLowDateTime=0xf5ddba80, ftLastWriteTime.dwHighDateTime=0x1d55cdb, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="thunderbird.exe", cAlternateFileName="THUNDE~1.EXE")) returned 1 [0071.534] wcscmp (_String1="thunderbird.exe", _String2=".") returned 1 [0071.534] wcscmp (_String1="thunderbird.exe", _String2="..") returned 1 [0071.534] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x541a148 | out: lpFindFileData=0x541a148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa968d710, ftCreationTime.dwHighDateTime=0x1d5c555, ftLastAccessTime.dwLowDateTime=0xf5ddba80, ftLastAccessTime.dwHighDateTime=0x1d55cdb, ftLastWriteTime.dwLowDateTime=0xf5ddba80, ftLastWriteTime.dwHighDateTime=0x1d55cdb, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="thunderbird.exe", cAlternateFileName="THUNDE~1.EXE")) returned 0 [0071.534] FindClose (in: hFindFile=0x5445940 | out: hFindFile=0x5445940) returned 1 [0071.534] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541a148) returned 1 [0071.534] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388b210) returned 1 [0071.534] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38804a0) returned 1 Thread: id = 61 os_tid = 0x12a0 [0071.047] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x541b2b0 [0071.048] wcscpy (in: _Dest=0x541b2b0, _Source="C:\\Program Files (x86)\\Microsoft.NET" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET") returned="C:\\Program Files (x86)\\Microsoft.NET" [0071.048] wcscat (in: _Dest=0x541b2b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\") returned="C:\\Program Files (x86)\\Microsoft.NET\\" [0071.048] wcscat (in: _Dest=0x541b2b0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\*") returned="C:\\Program Files (x86)\\Microsoft.NET\\*" [0071.048] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5419540 [0071.048] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\*", lpFindFileData=0x5419540 | out: lpFindFileData=0x5419540*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b18da3c, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b18da3c, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389eac0 [0071.136] wcscmp (_String1=".", _String2=".") returned 0 [0071.136] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x5419540 | out: lpFindFileData=0x5419540*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b18da3c, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b18da3c, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.136] wcscmp (_String1="..", _String2=".") returned 1 [0071.136] wcscmp (_String1="..", _String2="..") returned 0 [0071.136] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x5419540 | out: lpFindFileData=0x5419540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac34e970, ftCreationTime.dwHighDateTime=0x1d5bd80, ftLastAccessTime.dwLowDateTime=0x777df440, ftLastAccessTime.dwHighDateTime=0x1d58c3b, ftLastWriteTime.dwLowDateTime=0x777df440, ftLastWriteTime.dwHighDateTime=0x1d58c3b, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="absolutetelnet.exe", cAlternateFileName="ABSOLU~1.EXE")) returned 1 [0071.136] wcscmp (_String1="absolutetelnet.exe", _String2=".") returned 1 [0071.136] wcscmp (_String1="absolutetelnet.exe", _String2="..") returned 1 [0071.136] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x5419540 | out: lpFindFileData=0x5419540*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xbc17eb24, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4adfea18, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Primary Interop Assemblies", cAlternateFileName="PRIMAR~1")) returned 1 [0071.136] wcscmp (_String1="Primary Interop Assemblies", _String2=".") returned 1 [0071.136] wcscmp (_String1="Primary Interop Assemblies", _String2="..") returned 1 [0071.136] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x80) returned 0x5409258 [0071.136] wcscpy (in: _Dest=0x5409258, _Source="C:\\Program Files (x86)\\Microsoft.NET" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET") returned="C:\\Program Files (x86)\\Microsoft.NET" [0071.136] wcscat (in: _Dest=0x5409258, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\") returned="C:\\Program Files (x86)\\Microsoft.NET\\" [0071.137] wcscat (in: _Dest=0x5409258, _Source="Primary Interop Assemblies" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies") returned="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies" [0071.291] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5409258, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x57c [0071.291] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x5419540 | out: lpFindFileData=0x5419540*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc17f062, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7340c2, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 1 [0071.291] wcscmp (_String1="RedistList", _String2=".") returned 1 [0071.291] wcscmp (_String1="RedistList", _String2="..") returned 1 [0071.291] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x541afa8 [0071.291] wcscpy (in: _Dest=0x541afa8, _Source="C:\\Program Files (x86)\\Microsoft.NET" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET") returned="C:\\Program Files (x86)\\Microsoft.NET" [0071.292] wcscat (in: _Dest=0x541afa8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\") returned="C:\\Program Files (x86)\\Microsoft.NET\\" [0071.292] wcscat (in: _Dest=0x541afa8, _Source="RedistList" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList" [0071.292] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x541afa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x580 [0071.292] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x5419540 | out: lpFindFileData=0x5419540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49343b40, ftCreationTime.dwHighDateTime=0x1d5bae3, ftLastAccessTime.dwLowDateTime=0x98b73ec0, ftLastAccessTime.dwHighDateTime=0x1d5cbdb, ftLastWriteTime.dwLowDateTime=0x98b73ec0, ftLastWriteTime.dwHighDateTime=0x1d5cbdb, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="smartftp.exe", cAlternateFileName="")) returned 1 [0071.292] wcscmp (_String1="smartftp.exe", _String2=".") returned 1 [0071.292] wcscmp (_String1="smartftp.exe", _String2="..") returned 1 [0071.292] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x5419540 | out: lpFindFileData=0x5419540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49343b40, ftCreationTime.dwHighDateTime=0x1d5bae3, ftLastAccessTime.dwLowDateTime=0x98b73ec0, ftLastAccessTime.dwHighDateTime=0x1d5cbdb, ftLastWriteTime.dwLowDateTime=0x98b73ec0, ftLastWriteTime.dwHighDateTime=0x1d5cbdb, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="smartftp.exe", cAlternateFileName="")) returned 0 [0071.292] FindClose (in: hFindFile=0x389eac0 | out: hFindFile=0x389eac0) returned 1 [0071.293] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5419540) returned 1 [0071.293] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541b2b0) returned 1 [0071.293] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38843c0) returned 1 Thread: id = 62 os_tid = 0x1290 [0071.048] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x42) returned 0x38b34f8 [0071.048] wcscpy (in: _Dest=0x38b34f8, _Source="C:\\Program Files (x86)\\MSBuild" | out: _Dest="C:\\Program Files (x86)\\MSBuild") returned="C:\\Program Files (x86)\\MSBuild" [0071.048] wcscat (in: _Dest=0x38b34f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\") returned="C:\\Program Files (x86)\\MSBuild\\" [0071.048] wcscat (in: _Dest=0x38b34f8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\*") returned="C:\\Program Files (x86)\\MSBuild\\*" [0071.048] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5419ee0 [0071.048] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\*", lpFindFileData=0x5419ee0 | out: lpFindFileData=0x5419ee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0x3d41f4f7, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3d41f4f7, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445640 [0071.535] wcscmp (_String1=".", _String2=".") returned 0 [0071.535] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x5419ee0 | out: lpFindFileData=0x5419ee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0x3d41f4f7, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3d41f4f7, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.535] wcscmp (_String1="..", _String2=".") returned 1 [0071.535] wcscmp (_String1="..", _String2="..") returned 0 [0071.535] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x5419ee0 | out: lpFindFileData=0x5419ee0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd56e8a0, ftCreationTime.dwHighDateTime=0x1d5c922, ftLastAccessTime.dwLowDateTime=0x244a7ef0, ftLastAccessTime.dwHighDateTime=0x1d5b928, ftLastWriteTime.dwLowDateTime=0x244a7ef0, ftLastWriteTime.dwHighDateTime=0x1d5b928, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="isspos.exe", cAlternateFileName="")) returned 1 [0071.535] wcscmp (_String1="isspos.exe", _String2=".") returned 1 [0071.535] wcscmp (_String1="isspos.exe", _String2="..") returned 1 [0071.535] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x5419ee0 | out: lpFindFileData=0x5419ee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79effb3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79effb3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0071.535] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0071.535] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0071.535] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x543d458 [0071.535] wcscpy (in: _Dest=0x543d458, _Source="C:\\Program Files (x86)\\MSBuild" | out: _Dest="C:\\Program Files (x86)\\MSBuild") returned="C:\\Program Files (x86)\\MSBuild" [0071.535] wcscat (in: _Dest=0x543d458, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\") returned="C:\\Program Files (x86)\\MSBuild\\" [0071.535] wcscat (in: _Dest=0x543d458, _Source="Microsoft" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft" [0071.536] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x543d458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x76c [0071.537] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x5419ee0 | out: lpFindFileData=0x5419ee0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1cd9030, ftCreationTime.dwHighDateTime=0x1d5c628, ftLastAccessTime.dwLowDateTime=0xce50ad90, ftLastAccessTime.dwHighDateTime=0x1d5758d, ftLastWriteTime.dwLowDateTime=0xce50ad90, ftLastWriteTime.dwHighDateTime=0x1d5758d, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="therapeutic-tried.exe", cAlternateFileName="THERAP~1.EXE")) returned 1 [0071.537] wcscmp (_String1="therapeutic-tried.exe", _String2=".") returned 1 [0071.537] wcscmp (_String1="therapeutic-tried.exe", _String2="..") returned 1 [0071.537] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x5419ee0 | out: lpFindFileData=0x5419ee0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1cd9030, ftCreationTime.dwHighDateTime=0x1d5c628, ftLastAccessTime.dwLowDateTime=0xce50ad90, ftLastAccessTime.dwHighDateTime=0x1d5758d, ftLastWriteTime.dwLowDateTime=0xce50ad90, ftLastWriteTime.dwHighDateTime=0x1d5758d, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="therapeutic-tried.exe", cAlternateFileName="THERAP~1.EXE")) returned 0 [0071.537] FindClose (in: hFindFile=0x5445640 | out: hFindFile=0x5445640) returned 1 [0071.537] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5419ee0) returned 1 [0071.537] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b34f8) returned 1 [0071.537] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6580) returned 1 Thread: id = 63 os_tid = 0x12a8 [0071.049] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x541aac8 [0071.049] wcscpy (in: _Dest=0x541aac8, _Source="C:\\Program Files (x86)\\Reference Assemblies" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies") returned="C:\\Program Files (x86)\\Reference Assemblies" [0071.049] wcscat (in: _Dest=0x541aac8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\" [0071.049] wcscat (in: _Dest=0x541aac8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\*") returned="C:\\Program Files (x86)\\Reference Assemblies\\*" [0071.049] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54197a8 [0071.049] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\*", lpFindFileData=0x54197a8 | out: lpFindFileData=0x54197a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a165b3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0x3b2729cb, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b2729cb, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389eb00 [0071.137] wcscmp (_String1=".", _String2=".") returned 0 [0071.137] FindNextFileW (in: hFindFile=0x389eb00, lpFindFileData=0x54197a8 | out: lpFindFileData=0x54197a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a165b3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0x3b2729cb, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b2729cb, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.137] wcscmp (_String1="..", _String2=".") returned 1 [0071.137] wcscmp (_String1="..", _String2="..") returned 0 [0071.137] FindNextFileW (in: hFindFile=0x389eb00, lpFindFileData=0x54197a8 | out: lpFindFileData=0x54197a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dfafe00, ftCreationTime.dwHighDateTime=0x1d5b3f8, ftLastAccessTime.dwLowDateTime=0xffd13c50, ftLastAccessTime.dwHighDateTime=0x1d568cb, ftLastWriteTime.dwLowDateTime=0xffd13c50, ftLastWriteTime.dwHighDateTime=0x1d568cb, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="honors-shoe.exe", cAlternateFileName="HONORS~1.EXE")) returned 1 [0071.137] wcscmp (_String1="honors-shoe.exe", _String2=".") returned 1 [0071.137] wcscmp (_String1="honors-shoe.exe", _String2="..") returned 1 [0071.137] FindNextFileW (in: hFindFile=0x389eb00, lpFindFileData=0x54197a8 | out: lpFindFileData=0x54197a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a165b3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0071.137] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0071.137] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0071.137] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6c) returned 0x38aa4c8 [0071.137] wcscpy (in: _Dest=0x38aa4c8, _Source="C:\\Program Files (x86)\\Reference Assemblies" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies") returned="C:\\Program Files (x86)\\Reference Assemblies" [0071.137] wcscat (in: _Dest=0x38aa4c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\" [0071.137] wcscat (in: _Dest=0x38aa4c8, _Source="Microsoft" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft" [0071.444] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38aa4c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x540 [0071.445] FindNextFileW (in: hFindFile=0x389eb00, lpFindFileData=0x54197a8 | out: lpFindFileData=0x54197a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8032b270, ftCreationTime.dwHighDateTime=0x1d57e2a, ftLastAccessTime.dwLowDateTime=0xce0b82d0, ftLastAccessTime.dwHighDateTime=0x1d5cbf3, ftLastWriteTime.dwLowDateTime=0xce0b82d0, ftLastWriteTime.dwHighDateTime=0x1d5cbf3, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="omnipos.exe", cAlternateFileName="")) returned 1 [0071.445] wcscmp (_String1="omnipos.exe", _String2=".") returned 1 [0071.445] wcscmp (_String1="omnipos.exe", _String2="..") returned 1 [0071.445] FindNextFileW (in: hFindFile=0x389eb00, lpFindFileData=0x54197a8 | out: lpFindFileData=0x54197a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8032b270, ftCreationTime.dwHighDateTime=0x1d57e2a, ftLastAccessTime.dwLowDateTime=0xce0b82d0, ftLastAccessTime.dwHighDateTime=0x1d5cbf3, ftLastWriteTime.dwLowDateTime=0xce0b82d0, ftLastWriteTime.dwHighDateTime=0x1d5cbf3, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="omnipos.exe", cAlternateFileName="")) returned 0 [0071.445] FindClose (in: hFindFile=0x389eb00 | out: hFindFile=0x389eb00) returned 1 [0071.445] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54197a8) returned 1 [0071.445] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541aac8) returned 1 [0071.445] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3883f40) returned 1 Thread: id = 64 os_tid = 0x134c [0071.050] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x541b8e0 [0071.050] wcscpy (in: _Dest=0x541b8e0, _Source="C:\\Program Files (x86)\\Windows Mail" | out: _Dest="C:\\Program Files (x86)\\Windows Mail") returned="C:\\Program Files (x86)\\Windows Mail" [0071.050] wcscat (in: _Dest=0x541b8e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\") returned="C:\\Program Files (x86)\\Windows Mail\\" [0071.050] wcscat (in: _Dest=0x541b8e0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\*") returned="C:\\Program Files (x86)\\Windows Mail\\*" [0071.050] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5416ec0 [0071.050] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Mail\\*", lpFindFileData=0x5416ec0 | out: lpFindFileData=0x5416ec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3d4454c7, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3d4454c7, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445480 [0071.538] wcscmp (_String1=".", _String2=".") returned 0 [0071.538] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x5416ec0 | out: lpFindFileData=0x5416ec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3d4454c7, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3d4454c7, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.538] wcscmp (_String1="..", _String2=".") returned 1 [0071.538] wcscmp (_String1="..", _String2="..") returned 0 [0071.538] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x5416ec0 | out: lpFindFileData=0x5416ec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc4b24d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0071.538] wcscmp (_String1="en-US", _String2=".") returned 1 [0071.538] wcscmp (_String1="en-US", _String2="..") returned 1 [0071.538] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x543d818 [0071.538] wcscpy (in: _Dest=0x543d818, _Source="C:\\Program Files (x86)\\Windows Mail" | out: _Dest="C:\\Program Files (x86)\\Windows Mail") returned="C:\\Program Files (x86)\\Windows Mail" [0071.538] wcscat (in: _Dest=0x543d818, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\") returned="C:\\Program Files (x86)\\Windows Mail\\" [0071.538] wcscat (in: _Dest=0x543d818, _Source="en-US" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\en-US") returned="C:\\Program Files (x86)\\Windows Mail\\en-US" [0071.538] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x543d818, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0 [0071.539] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x5416ec0 | out: lpFindFileData=0x5416ec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f0bd740, ftCreationTime.dwHighDateTime=0x1d566d4, ftLastAccessTime.dwLowDateTime=0x38751970, ftLastAccessTime.dwHighDateTime=0x1d54d6d, ftLastWriteTime.dwLowDateTime=0x38751970, ftLastWriteTime.dwHighDateTime=0x1d54d6d, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="gotta openings earliest.exe", cAlternateFileName="GOTTAO~1.EXE")) returned 1 [0071.539] wcscmp (_String1="gotta openings earliest.exe", _String2=".") returned 1 [0071.539] wcscmp (_String1="gotta openings earliest.exe", _String2="..") returned 1 [0071.539] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x5416ec0 | out: lpFindFileData=0x5416ec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d728c0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97d728c0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97d728c0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoe.dll", cAlternateFileName="")) returned 1 [0071.539] wcscmp (_String1="msoe.dll", _String2=".") returned 1 [0071.539] wcscmp (_String1="msoe.dll", _String2="..") returned 1 [0071.539] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x5416ec0 | out: lpFindFileData=0x5416ec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d728c0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97d728c0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97d728c0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x25f400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOERES.dll", cAlternateFileName="")) returned 1 [0071.539] wcscmp (_String1="MSOERES.dll", _String2=".") returned 1 [0071.539] wcscmp (_String1="MSOERES.dll", _String2="..") returned 1 [0071.539] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x5416ec0 | out: lpFindFileData=0x5416ec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d728c0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97d728c0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97d728c0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xde00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oeimport.dll", cAlternateFileName="")) returned 1 [0071.539] wcscmp (_String1="oeimport.dll", _String2=".") returned 1 [0071.539] wcscmp (_String1="oeimport.dll", _String2="..") returned 1 [0071.539] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x5416ec0 | out: lpFindFileData=0x5416ec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6dd2e40, ftCreationTime.dwHighDateTime=0x1d5ab11, ftLastAccessTime.dwLowDateTime=0xd328de10, ftLastAccessTime.dwHighDateTime=0x1d56b0f, ftLastWriteTime.dwLowDateTime=0xd328de10, ftLastWriteTime.dwHighDateTime=0x1d56b0f, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunshine.exe", cAlternateFileName="")) returned 1 [0071.539] wcscmp (_String1="sunshine.exe", _String2=".") returned 1 [0071.539] wcscmp (_String1="sunshine.exe", _String2="..") returned 1 [0071.539] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x5416ec0 | out: lpFindFileData=0x5416ec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dfbb8d0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6dfbb8d0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6dfbb8d0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7dc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab.exe", cAlternateFileName="")) returned 1 [0071.539] wcscmp (_String1="wab.exe", _String2=".") returned 1 [0071.539] wcscmp (_String1="wab.exe", _String2="..") returned 1 [0071.539] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x5416ec0 | out: lpFindFileData=0x5416ec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dfbb8d0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6dfbb8d0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6dfbb8d0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabimp.dll", cAlternateFileName="")) returned 1 [0071.539] wcscmp (_String1="wabimp.dll", _String2=".") returned 1 [0071.540] wcscmp (_String1="wabimp.dll", _String2="..") returned 1 [0071.540] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x5416ec0 | out: lpFindFileData=0x5416ec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dfbb8d0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6dfbb8d0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6dfbb8d0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabmig.exe", cAlternateFileName="")) returned 1 [0071.540] wcscmp (_String1="wabmig.exe", _String2=".") returned 1 [0071.540] wcscmp (_String1="wabmig.exe", _String2="..") returned 1 [0071.540] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x5416ec0 | out: lpFindFileData=0x5416ec0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x97d98b2b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97d98b2b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97d98b2b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x63c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 1 [0071.540] wcscmp (_String1="WinMail.exe", _String2=".") returned 1 [0071.540] wcscmp (_String1="WinMail.exe", _String2="..") returned 1 [0071.540] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x5416ec0 | out: lpFindFileData=0x5416ec0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x97d98b2b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97d98b2b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97d98b2b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x63c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 0 [0071.540] FindClose (in: hFindFile=0x5445480 | out: hFindFile=0x5445480) returned 1 [0071.540] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5416ec0) returned 1 [0071.540] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541b8e0) returned 1 [0071.540] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b2fa8) returned 1 Thread: id = 65 os_tid = 0x12a4 [0071.050] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6a) returned 0x38aaae0 [0071.050] wcscpy (in: _Dest=0x38aaae0, _Source="C:\\Program Files (x86)\\Windows Multimedia Platform" | out: _Dest="C:\\Program Files (x86)\\Windows Multimedia Platform") returned="C:\\Program Files (x86)\\Windows Multimedia Platform" [0071.050] wcscat (in: _Dest=0x38aaae0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Windows Multimedia Platform\\") returned="C:\\Program Files (x86)\\Windows Multimedia Platform\\" [0071.050] wcscat (in: _Dest=0x38aaae0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Windows Multimedia Platform\\*") returned="C:\\Program Files (x86)\\Windows Multimedia Platform\\*" [0071.051] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5417128 [0071.051] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Multimedia Platform\\*", lpFindFileData=0x5417128 | out: lpFindFileData=0x5417128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b11b239, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b11b239, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445640 [0071.541] wcscmp (_String1=".", _String2=".") returned 0 [0071.541] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x5417128 | out: lpFindFileData=0x5417128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b11b239, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b11b239, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.541] wcscmp (_String1="..", _String2=".") returned 1 [0071.541] wcscmp (_String1="..", _String2="..") returned 0 [0071.541] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x5417128 | out: lpFindFileData=0x5417128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2e289d0, ftCreationTime.dwHighDateTime=0x1d56172, ftLastAccessTime.dwLowDateTime=0xa3dc5040, ftLastAccessTime.dwHighDateTime=0x1d5bef4, ftLastWriteTime.dwLowDateTime=0xa3dc5040, ftLastWriteTime.dwHighDateTime=0x1d5bef4, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="far.exe", cAlternateFileName="")) returned 1 [0071.541] wcscmp (_String1="far.exe", _String2=".") returned 1 [0071.541] wcscmp (_String1="far.exe", _String2="..") returned 1 [0071.541] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x5417128 | out: lpFindFileData=0x5417128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954773d8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x954773d8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x954773d8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa7d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0071.541] wcscmp (_String1="sqmapi.dll", _String2=".") returned 1 [0071.541] wcscmp (_String1="sqmapi.dll", _String2="..") returned 1 [0071.541] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x5417128 | out: lpFindFileData=0x5417128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954773d8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x954773d8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x954773d8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa7d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0 [0071.541] FindClose (in: hFindFile=0x5445640 | out: hFindFile=0x5445640) returned 1 [0071.541] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5417128) returned 1 [0071.541] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38aaae0) returned 1 [0071.541] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3882d60) returned 1 Thread: id = 66 os_tid = 0x128c [0071.051] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a5e30 [0071.051] wcscpy (in: _Dest=0x38a5e30, _Source="C:\\588bce7c90097ed212\\1025" | out: _Dest="C:\\588bce7c90097ed212\\1025") returned="C:\\588bce7c90097ed212\\1025" [0071.051] wcscat (in: _Dest=0x38a5e30, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1025\\") returned="C:\\588bce7c90097ed212\\1025\\" [0071.052] wcscat (in: _Dest=0x38a5e30, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1025\\*") returned="C:\\588bce7c90097ed212\\1025\\*" [0071.052] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5417390 [0071.052] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x5417390 | out: lpFindFileData=0x5417390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445080 [0072.091] wcscmp (_String1=".", _String2=".") returned 0 [0072.091] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5417390 | out: lpFindFileData=0x5417390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.091] wcscmp (_String1="..", _String2=".") returned 1 [0072.091] wcscmp (_String1="..", _String2="..") returned 0 [0072.091] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5417390 | out: lpFindFileData=0x5417390*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0072.091] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0072.091] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0072.091] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x546d7f0 [0072.091] wcscpy (in: _Dest=0x546d7f0, _Source="C:\\588bce7c90097ed212\\1025" | out: _Dest="C:\\588bce7c90097ed212\\1025") returned="C:\\588bce7c90097ed212\\1025" [0072.091] wcscat (in: _Dest=0x546d7f0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1025\\") returned="C:\\588bce7c90097ed212\\1025\\" [0072.091] wcscat (in: _Dest=0x546d7f0, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned="C:\\588bce7c90097ed212\\1025\\eula.rtf" [0072.091] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x546d7f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x908 [0072.092] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5417390 | out: lpFindFileData=0x5417390*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0072.092] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0072.092] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0072.092] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x542bee8 [0072.092] wcscpy (in: _Dest=0x542bee8, _Source="C:\\588bce7c90097ed212\\1025" | out: _Dest="C:\\588bce7c90097ed212\\1025") returned="C:\\588bce7c90097ed212\\1025" [0072.092] wcscat (in: _Dest=0x542bee8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1025\\") returned="C:\\588bce7c90097ed212\\1025\\" [0072.092] wcscat (in: _Dest=0x542bee8, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" [0072.092] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x542bee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x90c [0072.093] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5417390 | out: lpFindFileData=0x5417390*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0072.093] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0072.093] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0072.093] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5417390 | out: lpFindFileData=0x5417390*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0072.093] FindClose (in: hFindFile=0x5445080 | out: hFindFile=0x5445080) returned 1 [0072.093] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5417390) returned 1 [0072.093] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5e30) returned 1 [0072.093] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f580) returned 1 Thread: id = 67 os_tid = 0x1284 [0071.077] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a5ec0 [0071.077] wcscpy (in: _Dest=0x38a5ec0, _Source="C:\\588bce7c90097ed212\\1028" | out: _Dest="C:\\588bce7c90097ed212\\1028") returned="C:\\588bce7c90097ed212\\1028" [0071.077] wcscat (in: _Dest=0x38a5ec0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1028\\") returned="C:\\588bce7c90097ed212\\1028\\" [0071.077] wcscat (in: _Dest=0x38a5ec0, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1028\\*") returned="C:\\588bce7c90097ed212\\1028\\*" [0071.077] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54175f8 [0071.077] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x54175f8 | out: lpFindFileData=0x54175f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445080 [0072.088] wcscmp (_String1=".", _String2=".") returned 0 [0072.088] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x54175f8 | out: lpFindFileData=0x54175f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.088] wcscmp (_String1="..", _String2=".") returned 1 [0072.088] wcscmp (_String1="..", _String2="..") returned 0 [0072.088] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x54175f8 | out: lpFindFileData=0x54175f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0072.088] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0072.088] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0072.088] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x546d020 [0072.088] wcscpy (in: _Dest=0x546d020, _Source="C:\\588bce7c90097ed212\\1028" | out: _Dest="C:\\588bce7c90097ed212\\1028") returned="C:\\588bce7c90097ed212\\1028" [0072.088] wcscat (in: _Dest=0x546d020, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1028\\") returned="C:\\588bce7c90097ed212\\1028\\" [0072.089] wcscat (in: _Dest=0x546d020, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned="C:\\588bce7c90097ed212\\1028\\eula.rtf" [0072.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x546d020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x900 [0072.089] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x54175f8 | out: lpFindFileData=0x54175f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0072.089] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0072.089] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0072.089] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x542bdb0 [0072.089] wcscpy (in: _Dest=0x542bdb0, _Source="C:\\588bce7c90097ed212\\1028" | out: _Dest="C:\\588bce7c90097ed212\\1028") returned="C:\\588bce7c90097ed212\\1028" [0072.089] wcscat (in: _Dest=0x542bdb0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1028\\") returned="C:\\588bce7c90097ed212\\1028\\" [0072.089] wcscat (in: _Dest=0x542bdb0, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" [0072.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x542bdb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x904 [0072.090] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x54175f8 | out: lpFindFileData=0x54175f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0072.090] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0072.090] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0072.090] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x54175f8 | out: lpFindFileData=0x54175f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0072.090] FindClose (in: hFindFile=0x5445080 | out: hFindFile=0x5445080) returned 1 [0072.090] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54175f8) returned 1 [0072.090] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5ec0) returned 1 [0072.090] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f100) returned 1 Thread: id = 68 os_tid = 0x12d8 [0071.078] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a5608 [0071.078] wcscpy (in: _Dest=0x38a5608, _Source="C:\\588bce7c90097ed212\\1029" | out: _Dest="C:\\588bce7c90097ed212\\1029") returned="C:\\588bce7c90097ed212\\1029" [0071.078] wcscat (in: _Dest=0x38a5608, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1029\\") returned="C:\\588bce7c90097ed212\\1029\\" [0071.078] wcscat (in: _Dest=0x38a5608, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1029\\*") returned="C:\\588bce7c90097ed212\\1029\\*" [0071.078] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5417860 [0071.078] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x5417860 | out: lpFindFileData=0x5417860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444b80 [0072.435] wcscmp (_String1=".", _String2=".") returned 0 [0072.435] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x5417860 | out: lpFindFileData=0x5417860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.435] wcscmp (_String1="..", _String2=".") returned 1 [0072.436] wcscmp (_String1="..", _String2="..") returned 0 [0072.436] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x5417860 | out: lpFindFileData=0x5417860*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0072.436] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0072.436] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0072.436] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x38fa9b0 [0072.436] wcscpy (in: _Dest=0x38fa9b0, _Source="C:\\588bce7c90097ed212\\1029" | out: _Dest="C:\\588bce7c90097ed212\\1029") returned="C:\\588bce7c90097ed212\\1029" [0072.436] wcscat (in: _Dest=0x38fa9b0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1029\\") returned="C:\\588bce7c90097ed212\\1029\\" [0072.436] wcscat (in: _Dest=0x38fa9b0, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned="C:\\588bce7c90097ed212\\1029\\eula.rtf" [0072.436] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fa9b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb04 [0072.436] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x5417860 | out: lpFindFileData=0x5417860*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0072.437] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0072.437] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0072.437] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x38fcec8 [0072.437] wcscpy (in: _Dest=0x38fcec8, _Source="C:\\588bce7c90097ed212\\1029" | out: _Dest="C:\\588bce7c90097ed212\\1029") returned="C:\\588bce7c90097ed212\\1029" [0072.437] wcscat (in: _Dest=0x38fcec8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1029\\") returned="C:\\588bce7c90097ed212\\1029\\" [0072.437] wcscat (in: _Dest=0x38fcec8, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" [0072.437] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fcec8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb08 [0072.437] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x5417860 | out: lpFindFileData=0x5417860*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0072.437] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0072.437] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0072.437] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x5417860 | out: lpFindFileData=0x5417860*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0072.437] FindClose (in: hFindFile=0x5444b80 | out: hFindFile=0x5444b80) returned 1 [0072.438] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5417860) returned 1 [0072.438] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5608) returned 1 [0072.438] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f5c0) returned 1 Thread: id = 69 os_tid = 0x12d4 [0071.079] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a5650 [0071.079] wcscpy (in: _Dest=0x38a5650, _Source="C:\\588bce7c90097ed212\\1030" | out: _Dest="C:\\588bce7c90097ed212\\1030") returned="C:\\588bce7c90097ed212\\1030" [0071.079] wcscat (in: _Dest=0x38a5650, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1030\\") returned="C:\\588bce7c90097ed212\\1030\\" [0071.079] wcscat (in: _Dest=0x38a5650, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1030\\*") returned="C:\\588bce7c90097ed212\\1030\\*" [0071.079] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5417ac8 [0071.079] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x5417ac8 | out: lpFindFileData=0x5417ac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445080 [0072.084] wcscmp (_String1=".", _String2=".") returned 0 [0072.084] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5417ac8 | out: lpFindFileData=0x5417ac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.084] wcscmp (_String1="..", _String2=".") returned 1 [0072.084] wcscmp (_String1="..", _String2="..") returned 0 [0072.084] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5417ac8 | out: lpFindFileData=0x5417ac8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0072.084] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0072.084] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0072.085] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x546d930 [0072.085] wcscpy (in: _Dest=0x546d930, _Source="C:\\588bce7c90097ed212\\1030" | out: _Dest="C:\\588bce7c90097ed212\\1030") returned="C:\\588bce7c90097ed212\\1030" [0072.085] wcscat (in: _Dest=0x546d930, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1030\\") returned="C:\\588bce7c90097ed212\\1030\\" [0072.085] wcscat (in: _Dest=0x546d930, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned="C:\\588bce7c90097ed212\\1030\\eula.rtf" [0072.085] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x546d930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f8 [0072.085] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5417ac8 | out: lpFindFileData=0x5417ac8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0072.085] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0072.085] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0072.085] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x542bd48 [0072.085] wcscpy (in: _Dest=0x542bd48, _Source="C:\\588bce7c90097ed212\\1030" | out: _Dest="C:\\588bce7c90097ed212\\1030") returned="C:\\588bce7c90097ed212\\1030" [0072.085] wcscat (in: _Dest=0x542bd48, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1030\\") returned="C:\\588bce7c90097ed212\\1030\\" [0072.085] wcscat (in: _Dest=0x542bd48, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" [0072.085] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x542bd48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8fc [0072.086] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5417ac8 | out: lpFindFileData=0x5417ac8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0072.086] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0072.086] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0072.086] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5417ac8 | out: lpFindFileData=0x5417ac8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0072.086] FindClose (in: hFindFile=0x5445080 | out: hFindFile=0x5445080) returned 1 [0072.086] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5417ac8) returned 1 [0072.086] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5650) returned 1 [0072.086] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f140) returned 1 Thread: id = 70 os_tid = 0x12e0 [0071.080] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a5728 [0071.080] wcscpy (in: _Dest=0x38a5728, _Source="C:\\588bce7c90097ed212\\1031" | out: _Dest="C:\\588bce7c90097ed212\\1031") returned="C:\\588bce7c90097ed212\\1031" [0071.080] wcscat (in: _Dest=0x38a5728, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1031\\") returned="C:\\588bce7c90097ed212\\1031\\" [0071.080] wcscat (in: _Dest=0x38a5728, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1031\\*") returned="C:\\588bce7c90097ed212\\1031\\*" [0071.080] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5419a10 [0071.080] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x5419a10 | out: lpFindFileData=0x5419a10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389eac0 [0077.100] wcscmp (_String1=".", _String2=".") returned 0 [0077.100] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x5419a10 | out: lpFindFileData=0x5419a10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.101] wcscmp (_String1="..", _String2=".") returned 1 [0077.101] wcscmp (_String1="..", _String2="..") returned 0 [0077.101] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x5419a10 | out: lpFindFileData=0x5419a10*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0077.101] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0077.101] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0077.101] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x5532120 [0077.101] wcscpy (in: _Dest=0x5532120, _Source="C:\\588bce7c90097ed212\\1031" | out: _Dest="C:\\588bce7c90097ed212\\1031") returned="C:\\588bce7c90097ed212\\1031" [0077.101] wcscat (in: _Dest=0x5532120, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1031\\") returned="C:\\588bce7c90097ed212\\1031\\" [0077.101] wcscat (in: _Dest=0x5532120, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned="C:\\588bce7c90097ed212\\1031\\eula.rtf" [0081.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5532120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19fc [0081.044] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x5419a10 | out: lpFindFileData=0x5419a10*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0081.045] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0081.045] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0081.045] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x6e962b8 [0081.045] wcscpy (in: _Dest=0x6e962b8, _Source="C:\\588bce7c90097ed212\\1031" | out: _Dest="C:\\588bce7c90097ed212\\1031") returned="C:\\588bce7c90097ed212\\1031" [0081.045] wcscat (in: _Dest=0x6e962b8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1031\\") returned="C:\\588bce7c90097ed212\\1031\\" [0081.045] wcscat (in: _Dest=0x6e962b8, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" [0081.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x6e962b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a00 [0081.045] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x5419a10 | out: lpFindFileData=0x5419a10*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0081.045] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0081.045] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0081.045] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x5419a10 | out: lpFindFileData=0x5419a10*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0081.045] FindClose (in: hFindFile=0x389eac0 | out: hFindFile=0x389eac0) returned 1 [0081.046] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5419a10) returned 1 [0081.046] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5728) returned 1 [0081.046] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389ef00) returned 1 Thread: id = 71 os_tid = 0x12c4 [0071.081] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a5698 [0071.081] wcscpy (in: _Dest=0x38a5698, _Source="C:\\588bce7c90097ed212\\1032" | out: _Dest="C:\\588bce7c90097ed212\\1032") returned="C:\\588bce7c90097ed212\\1032" [0071.081] wcscat (in: _Dest=0x38a5698, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1032\\") returned="C:\\588bce7c90097ed212\\1032\\" [0071.081] wcscat (in: _Dest=0x38a5698, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1032\\*") returned="C:\\588bce7c90097ed212\\1032\\*" [0071.081] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5417d30 [0071.081] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x5417d30 | out: lpFindFileData=0x5417d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444d00 [0072.058] wcscmp (_String1=".", _String2=".") returned 0 [0072.058] FindNextFileW (in: hFindFile=0x5444d00, lpFindFileData=0x5417d30 | out: lpFindFileData=0x5417d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.058] wcscmp (_String1="..", _String2=".") returned 1 [0072.058] wcscmp (_String1="..", _String2="..") returned 0 [0072.058] FindNextFileW (in: hFindFile=0x5444d00, lpFindFileData=0x5417d30 | out: lpFindFileData=0x5417d30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0072.058] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0072.058] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0072.058] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x546d7a0 [0072.059] wcscpy (in: _Dest=0x546d7a0, _Source="C:\\588bce7c90097ed212\\1032" | out: _Dest="C:\\588bce7c90097ed212\\1032") returned="C:\\588bce7c90097ed212\\1032" [0072.059] wcscat (in: _Dest=0x546d7a0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1032\\") returned="C:\\588bce7c90097ed212\\1032\\" [0072.059] wcscat (in: _Dest=0x546d7a0, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned="C:\\588bce7c90097ed212\\1032\\eula.rtf" [0072.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x546d7a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c4 [0072.081] FindNextFileW (in: hFindFile=0x5444d00, lpFindFileData=0x5417d30 | out: lpFindFileData=0x5417d30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0072.081] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0072.081] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0072.081] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x542bce0 [0072.081] wcscpy (in: _Dest=0x542bce0, _Source="C:\\588bce7c90097ed212\\1032" | out: _Dest="C:\\588bce7c90097ed212\\1032") returned="C:\\588bce7c90097ed212\\1032" [0072.081] wcscat (in: _Dest=0x542bce0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1032\\") returned="C:\\588bce7c90097ed212\\1032\\" [0072.081] wcscat (in: _Dest=0x542bce0, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" [0072.081] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x542bce0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x770 [0072.083] FindNextFileW (in: hFindFile=0x5444d00, lpFindFileData=0x5417d30 | out: lpFindFileData=0x5417d30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0072.083] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0072.083] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0072.083] FindNextFileW (in: hFindFile=0x5444d00, lpFindFileData=0x5417d30 | out: lpFindFileData=0x5417d30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0072.083] FindClose (in: hFindFile=0x5444d00 | out: hFindFile=0x5444d00) returned 1 [0072.083] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5417d30) returned 1 [0072.084] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5698) returned 1 [0072.084] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f600) returned 1 Thread: id = 72 os_tid = 0x12ac [0071.082] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a5770 [0071.082] wcscpy (in: _Dest=0x38a5770, _Source="C:\\588bce7c90097ed212\\1033" | out: _Dest="C:\\588bce7c90097ed212\\1033") returned="C:\\588bce7c90097ed212\\1033" [0071.082] wcscat (in: _Dest=0x38a5770, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1033\\") returned="C:\\588bce7c90097ed212\\1033\\" [0071.082] wcscat (in: _Dest=0x38a5770, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1033\\*") returned="C:\\588bce7c90097ed212\\1033\\*" [0071.082] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5419c78 [0071.082] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x5419c78 | out: lpFindFileData=0x5419c78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445080 [0072.055] wcscmp (_String1=".", _String2=".") returned 0 [0072.055] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5419c78 | out: lpFindFileData=0x5419c78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.055] wcscmp (_String1="..", _String2=".") returned 1 [0072.055] wcscmp (_String1="..", _String2="..") returned 0 [0072.055] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5419c78 | out: lpFindFileData=0x5419c78*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0072.055] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0072.055] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0072.055] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x546d750 [0072.055] wcscpy (in: _Dest=0x546d750, _Source="C:\\588bce7c90097ed212\\1033" | out: _Dest="C:\\588bce7c90097ed212\\1033") returned="C:\\588bce7c90097ed212\\1033" [0072.055] wcscat (in: _Dest=0x546d750, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1033\\") returned="C:\\588bce7c90097ed212\\1033\\" [0072.055] wcscat (in: _Dest=0x546d750, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned="C:\\588bce7c90097ed212\\1033\\eula.rtf" [0072.055] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x546d750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8bc [0072.056] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5419c78 | out: lpFindFileData=0x5419c78*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0072.056] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0072.056] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0072.056] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x542bc78 [0072.056] wcscpy (in: _Dest=0x542bc78, _Source="C:\\588bce7c90097ed212\\1033" | out: _Dest="C:\\588bce7c90097ed212\\1033") returned="C:\\588bce7c90097ed212\\1033" [0072.056] wcscat (in: _Dest=0x542bc78, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1033\\") returned="C:\\588bce7c90097ed212\\1033\\" [0072.056] wcscat (in: _Dest=0x542bc78, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" [0072.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x542bc78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c0 [0072.057] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5419c78 | out: lpFindFileData=0x5419c78*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0072.057] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0072.057] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0072.057] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5419c78 | out: lpFindFileData=0x5419c78*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0072.057] FindClose (in: hFindFile=0x5445080 | out: hFindFile=0x5445080) returned 1 [0072.057] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5419c78) returned 1 [0072.057] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0072.057] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f440) returned 1 Thread: id = 73 os_tid = 0x1350 [0071.083] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a59b0 [0071.083] wcscpy (in: _Dest=0x38a59b0, _Source="C:\\588bce7c90097ed212\\1035" | out: _Dest="C:\\588bce7c90097ed212\\1035") returned="C:\\588bce7c90097ed212\\1035" [0071.083] wcscat (in: _Dest=0x38a59b0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1035\\") returned="C:\\588bce7c90097ed212\\1035\\" [0071.084] wcscat (in: _Dest=0x38a59b0, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1035\\*") returned="C:\\588bce7c90097ed212\\1035\\*" [0071.084] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x541a3b0 [0071.084] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x541a3b0 | out: lpFindFileData=0x541a3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445640 [0071.554] wcscmp (_String1=".", _String2=".") returned 0 [0071.554] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x541a3b0 | out: lpFindFileData=0x541a3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.555] wcscmp (_String1="..", _String2=".") returned 1 [0071.555] wcscmp (_String1="..", _String2="..") returned 0 [0071.555] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x541a3b0 | out: lpFindFileData=0x541a3b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0071.555] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0071.555] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0071.555] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x5442d80 [0071.555] wcscpy (in: _Dest=0x5442d80, _Source="C:\\588bce7c90097ed212\\1035" | out: _Dest="C:\\588bce7c90097ed212\\1035") returned="C:\\588bce7c90097ed212\\1035" [0071.555] wcscat (in: _Dest=0x5442d80, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1035\\") returned="C:\\588bce7c90097ed212\\1035\\" [0071.555] wcscat (in: _Dest=0x5442d80, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned="C:\\588bce7c90097ed212\\1035\\eula.rtf" [0071.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5442d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f0 [0071.555] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x541a3b0 | out: lpFindFileData=0x541a3b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0071.556] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0071.556] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0071.556] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x541aed8 [0071.556] wcscpy (in: _Dest=0x541aed8, _Source="C:\\588bce7c90097ed212\\1035" | out: _Dest="C:\\588bce7c90097ed212\\1035") returned="C:\\588bce7c90097ed212\\1035" [0071.556] wcscat (in: _Dest=0x541aed8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1035\\") returned="C:\\588bce7c90097ed212\\1035\\" [0071.556] wcscat (in: _Dest=0x541aed8, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" [0071.556] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x541aed8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e8 [0071.556] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x541a3b0 | out: lpFindFileData=0x541a3b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0071.556] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0071.556] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0071.556] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x541a3b0 | out: lpFindFileData=0x541a3b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0071.557] FindClose (in: hFindFile=0x5445640 | out: hFindFile=0x5445640) returned 1 [0071.557] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541a3b0) returned 1 [0071.557] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a59b0) returned 1 [0071.557] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f0c0) returned 1 Thread: id = 74 os_tid = 0x12c0 [0071.141] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a59f8 [0071.141] wcscpy (in: _Dest=0x38a59f8, _Source="C:\\588bce7c90097ed212\\1036" | out: _Dest="C:\\588bce7c90097ed212\\1036") returned="C:\\588bce7c90097ed212\\1036" [0071.141] wcscat (in: _Dest=0x38a59f8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1036\\") returned="C:\\588bce7c90097ed212\\1036\\" [0071.141] wcscat (in: _Dest=0x38a59f8, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1036\\*") returned="C:\\588bce7c90097ed212\\1036\\*" [0071.141] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x541a618 [0071.141] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x541a618 | out: lpFindFileData=0x541a618*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444b80 [0072.423] wcscmp (_String1=".", _String2=".") returned 0 [0072.423] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x541a618 | out: lpFindFileData=0x541a618*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.423] wcscmp (_String1="..", _String2=".") returned 1 [0072.423] wcscmp (_String1="..", _String2="..") returned 0 [0072.423] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x541a618 | out: lpFindFileData=0x541a618*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0072.423] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0072.423] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0072.423] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x38fa870 [0072.423] wcscpy (in: _Dest=0x38fa870, _Source="C:\\588bce7c90097ed212\\1036" | out: _Dest="C:\\588bce7c90097ed212\\1036") returned="C:\\588bce7c90097ed212\\1036" [0072.423] wcscat (in: _Dest=0x38fa870, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1036\\") returned="C:\\588bce7c90097ed212\\1036\\" [0072.423] wcscat (in: _Dest=0x38fa870, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned="C:\\588bce7c90097ed212\\1036\\eula.rtf" [0072.423] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fa870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae4 [0072.424] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x541a618 | out: lpFindFileData=0x541a618*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0072.424] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0072.424] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0072.424] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x38fccc0 [0072.424] wcscpy (in: _Dest=0x38fccc0, _Source="C:\\588bce7c90097ed212\\1036" | out: _Dest="C:\\588bce7c90097ed212\\1036") returned="C:\\588bce7c90097ed212\\1036" [0072.424] wcscat (in: _Dest=0x38fccc0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1036\\") returned="C:\\588bce7c90097ed212\\1036\\" [0072.424] wcscat (in: _Dest=0x38fccc0, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" [0072.424] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fccc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae8 [0072.425] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x541a618 | out: lpFindFileData=0x541a618*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0072.425] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0072.425] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0072.425] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x541a618 | out: lpFindFileData=0x541a618*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0072.425] FindClose (in: hFindFile=0x5444b80 | out: hFindFile=0x5444b80) returned 1 [0072.425] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541a618) returned 1 [0072.425] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a59f8) returned 1 [0072.425] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f000) returned 1 Thread: id = 75 os_tid = 0xe88 [0071.142] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a5a40 [0071.142] wcscpy (in: _Dest=0x38a5a40, _Source="C:\\588bce7c90097ed212\\1037" | out: _Dest="C:\\588bce7c90097ed212\\1037") returned="C:\\588bce7c90097ed212\\1037" [0071.142] wcscat (in: _Dest=0x38a5a40, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1037\\") returned="C:\\588bce7c90097ed212\\1037\\" [0071.142] wcscat (in: _Dest=0x38a5a40, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1037\\*") returned="C:\\588bce7c90097ed212\\1037\\*" [0071.142] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54169f0 [0071.142] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x54169f0 | out: lpFindFileData=0x54169f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444b80 [0072.432] wcscmp (_String1=".", _String2=".") returned 0 [0072.432] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x54169f0 | out: lpFindFileData=0x54169f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.433] wcscmp (_String1="..", _String2=".") returned 1 [0072.433] wcscmp (_String1="..", _String2="..") returned 0 [0072.433] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x54169f0 | out: lpFindFileData=0x54169f0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0072.433] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0072.433] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0072.433] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x38fa960 [0072.433] wcscpy (in: _Dest=0x38fa960, _Source="C:\\588bce7c90097ed212\\1037" | out: _Dest="C:\\588bce7c90097ed212\\1037") returned="C:\\588bce7c90097ed212\\1037" [0072.433] wcscat (in: _Dest=0x38fa960, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1037\\") returned="C:\\588bce7c90097ed212\\1037\\" [0072.433] wcscat (in: _Dest=0x38fa960, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned="C:\\588bce7c90097ed212\\1037\\eula.rtf" [0072.433] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fa960, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xafc [0072.433] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x54169f0 | out: lpFindFileData=0x54169f0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0072.433] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0072.434] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0072.434] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x38fce60 [0072.434] wcscpy (in: _Dest=0x38fce60, _Source="C:\\588bce7c90097ed212\\1037" | out: _Dest="C:\\588bce7c90097ed212\\1037") returned="C:\\588bce7c90097ed212\\1037" [0072.434] wcscat (in: _Dest=0x38fce60, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1037\\") returned="C:\\588bce7c90097ed212\\1037\\" [0072.434] wcscat (in: _Dest=0x38fce60, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" [0072.434] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fce60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb00 [0072.434] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x54169f0 | out: lpFindFileData=0x54169f0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0072.434] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0072.434] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0072.434] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x54169f0 | out: lpFindFileData=0x54169f0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0072.434] FindClose (in: hFindFile=0x5444b80 | out: hFindFile=0x5444b80) returned 1 [0072.435] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54169f0) returned 1 [0072.435] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5a40) returned 1 [0072.435] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f640) returned 1 Thread: id = 76 os_tid = 0x1280 [0071.142] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a5a88 [0071.142] wcscpy (in: _Dest=0x38a5a88, _Source="C:\\588bce7c90097ed212\\1038" | out: _Dest="C:\\588bce7c90097ed212\\1038") returned="C:\\588bce7c90097ed212\\1038" [0071.142] wcscat (in: _Dest=0x38a5a88, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1038\\") returned="C:\\588bce7c90097ed212\\1038\\" [0071.142] wcscat (in: _Dest=0x38a5a88, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1038\\*") returned="C:\\588bce7c90097ed212\\1038\\*" [0071.142] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5416c58 [0071.142] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x5416c58 | out: lpFindFileData=0x5416c58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444b80 [0072.430] wcscmp (_String1=".", _String2=".") returned 0 [0072.430] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x5416c58 | out: lpFindFileData=0x5416c58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.430] wcscmp (_String1="..", _String2=".") returned 1 [0072.430] wcscmp (_String1="..", _String2="..") returned 0 [0072.430] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x5416c58 | out: lpFindFileData=0x5416c58*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0072.430] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0072.430] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0072.430] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x38fa910 [0072.430] wcscpy (in: _Dest=0x38fa910, _Source="C:\\588bce7c90097ed212\\1038" | out: _Dest="C:\\588bce7c90097ed212\\1038") returned="C:\\588bce7c90097ed212\\1038" [0072.430] wcscat (in: _Dest=0x38fa910, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1038\\") returned="C:\\588bce7c90097ed212\\1038\\" [0072.430] wcscat (in: _Dest=0x38fa910, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned="C:\\588bce7c90097ed212\\1038\\eula.rtf" [0072.430] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fa910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf4 [0072.431] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x5416c58 | out: lpFindFileData=0x5416c58*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0072.431] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0072.431] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0072.431] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x38fcd90 [0072.431] wcscpy (in: _Dest=0x38fcd90, _Source="C:\\588bce7c90097ed212\\1038" | out: _Dest="C:\\588bce7c90097ed212\\1038") returned="C:\\588bce7c90097ed212\\1038" [0072.431] wcscat (in: _Dest=0x38fcd90, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1038\\") returned="C:\\588bce7c90097ed212\\1038\\" [0072.431] wcscat (in: _Dest=0x38fcd90, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" [0072.431] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fcd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf8 [0072.431] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x5416c58 | out: lpFindFileData=0x5416c58*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0072.431] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0072.431] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0072.432] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x5416c58 | out: lpFindFileData=0x5416c58*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0072.432] FindClose (in: hFindFile=0x5444b80 | out: hFindFile=0x5444b80) returned 1 [0072.432] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5416c58) returned 1 [0072.432] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5a88) returned 1 [0072.432] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f180) returned 1 Thread: id = 77 os_tid = 0x130c [0071.143] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a5b18 [0071.143] wcscpy (in: _Dest=0x38a5b18, _Source="C:\\588bce7c90097ed212\\1040" | out: _Dest="C:\\588bce7c90097ed212\\1040") returned="C:\\588bce7c90097ed212\\1040" [0071.143] wcscat (in: _Dest=0x38a5b18, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1040\\") returned="C:\\588bce7c90097ed212\\1040\\" [0071.143] wcscat (in: _Dest=0x38a5b18, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1040\\*") returned="C:\\588bce7c90097ed212\\1040\\*" [0071.143] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5417f98 [0071.143] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x5417f98 | out: lpFindFileData=0x5417f98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f40 [0072.420] wcscmp (_String1=".", _String2=".") returned 0 [0072.420] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5417f98 | out: lpFindFileData=0x5417f98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.420] wcscmp (_String1="..", _String2=".") returned 1 [0072.420] wcscmp (_String1="..", _String2="..") returned 0 [0072.420] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5417f98 | out: lpFindFileData=0x5417f98*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0072.420] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0072.420] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0072.420] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x38fae60 [0072.420] wcscpy (in: _Dest=0x38fae60, _Source="C:\\588bce7c90097ed212\\1040" | out: _Dest="C:\\588bce7c90097ed212\\1040") returned="C:\\588bce7c90097ed212\\1040" [0072.420] wcscat (in: _Dest=0x38fae60, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1040\\") returned="C:\\588bce7c90097ed212\\1040\\" [0072.420] wcscat (in: _Dest=0x38fae60, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned="C:\\588bce7c90097ed212\\1040\\eula.rtf" [0072.420] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fae60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xadc [0072.421] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5417f98 | out: lpFindFileData=0x5417f98*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0072.421] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0072.421] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0072.421] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x38fcdf8 [0072.421] wcscpy (in: _Dest=0x38fcdf8, _Source="C:\\588bce7c90097ed212\\1040" | out: _Dest="C:\\588bce7c90097ed212\\1040") returned="C:\\588bce7c90097ed212\\1040" [0072.421] wcscat (in: _Dest=0x38fcdf8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1040\\") returned="C:\\588bce7c90097ed212\\1040\\" [0072.421] wcscat (in: _Dest=0x38fcdf8, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" [0072.421] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fcdf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae0 [0072.422] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5417f98 | out: lpFindFileData=0x5417f98*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0072.422] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0072.422] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0072.422] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5417f98 | out: lpFindFileData=0x5417f98*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0072.422] FindClose (in: hFindFile=0x5444f40 | out: hFindFile=0x5444f40) returned 1 [0072.422] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5417f98) returned 1 [0072.422] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5b18) returned 1 [0072.422] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f300) returned 1 Thread: id = 78 os_tid = 0x1310 [0071.143] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a5b60 [0071.143] wcscpy (in: _Dest=0x38a5b60, _Source="C:\\588bce7c90097ed212\\1041" | out: _Dest="C:\\588bce7c90097ed212\\1041") returned="C:\\588bce7c90097ed212\\1041" [0071.143] wcscat (in: _Dest=0x38a5b60, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1041\\") returned="C:\\588bce7c90097ed212\\1041\\" [0071.143] wcscat (in: _Dest=0x38a5b60, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1041\\*") returned="C:\\588bce7c90097ed212\\1041\\*" [0071.143] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5418200 [0071.143] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x5418200 | out: lpFindFileData=0x5418200*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f40 [0072.407] wcscmp (_String1=".", _String2=".") returned 0 [0072.407] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5418200 | out: lpFindFileData=0x5418200*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.407] wcscmp (_String1="..", _String2=".") returned 1 [0072.407] wcscmp (_String1="..", _String2="..") returned 0 [0072.407] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5418200 | out: lpFindFileData=0x5418200*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0072.407] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0072.407] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0072.407] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x38fae10 [0072.407] wcscpy (in: _Dest=0x38fae10, _Source="C:\\588bce7c90097ed212\\1041" | out: _Dest="C:\\588bce7c90097ed212\\1041") returned="C:\\588bce7c90097ed212\\1041" [0072.407] wcscat (in: _Dest=0x38fae10, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1041\\") returned="C:\\588bce7c90097ed212\\1041\\" [0072.407] wcscat (in: _Dest=0x38fae10, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned="C:\\588bce7c90097ed212\\1041\\eula.rtf" [0072.407] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fae10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad4 [0072.408] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5418200 | out: lpFindFileData=0x5418200*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0072.408] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0072.408] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0072.408] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x542c158 [0072.408] wcscpy (in: _Dest=0x542c158, _Source="C:\\588bce7c90097ed212\\1041" | out: _Dest="C:\\588bce7c90097ed212\\1041") returned="C:\\588bce7c90097ed212\\1041" [0072.408] wcscat (in: _Dest=0x542c158, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1041\\") returned="C:\\588bce7c90097ed212\\1041\\" [0072.408] wcscat (in: _Dest=0x542c158, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" [0072.408] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x542c158, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad8 [0072.409] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5418200 | out: lpFindFileData=0x5418200*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0072.409] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0072.409] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0072.409] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5418200 | out: lpFindFileData=0x5418200*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0072.409] FindClose (in: hFindFile=0x5444f40 | out: hFindFile=0x5444f40) returned 1 [0072.409] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5418200) returned 1 [0072.409] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5b60) returned 1 [0072.409] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f380) returned 1 Thread: id = 79 os_tid = 0x127c [0071.144] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a57b8 [0071.144] wcscpy (in: _Dest=0x38a57b8, _Source="C:\\588bce7c90097ed212\\1042" | out: _Dest="C:\\588bce7c90097ed212\\1042") returned="C:\\588bce7c90097ed212\\1042" [0071.144] wcscat (in: _Dest=0x38a57b8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1042\\") returned="C:\\588bce7c90097ed212\\1042\\" [0071.144] wcscat (in: _Dest=0x38a57b8, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1042\\*") returned="C:\\588bce7c90097ed212\\1042\\*" [0071.144] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5418468 [0071.144] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x5418468 | out: lpFindFileData=0x5418468*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f40 [0072.404] wcscmp (_String1=".", _String2=".") returned 0 [0072.404] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5418468 | out: lpFindFileData=0x5418468*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.404] wcscmp (_String1="..", _String2=".") returned 1 [0072.404] wcscmp (_String1="..", _String2="..") returned 0 [0072.404] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5418468 | out: lpFindFileData=0x5418468*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0072.404] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0072.404] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0072.404] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x38fa730 [0072.404] wcscpy (in: _Dest=0x38fa730, _Source="C:\\588bce7c90097ed212\\1042" | out: _Dest="C:\\588bce7c90097ed212\\1042") returned="C:\\588bce7c90097ed212\\1042" [0072.404] wcscat (in: _Dest=0x38fa730, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1042\\") returned="C:\\588bce7c90097ed212\\1042\\" [0072.404] wcscat (in: _Dest=0x38fa730, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned="C:\\588bce7c90097ed212\\1042\\eula.rtf" [0072.404] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fa730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xacc [0072.405] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5418468 | out: lpFindFileData=0x5418468*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0072.405] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0072.405] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0072.405] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x542c0f0 [0072.405] wcscpy (in: _Dest=0x542c0f0, _Source="C:\\588bce7c90097ed212\\1042" | out: _Dest="C:\\588bce7c90097ed212\\1042") returned="C:\\588bce7c90097ed212\\1042" [0072.405] wcscat (in: _Dest=0x542c0f0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1042\\") returned="C:\\588bce7c90097ed212\\1042\\" [0072.405] wcscat (in: _Dest=0x542c0f0, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" [0072.405] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x542c0f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad0 [0072.406] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5418468 | out: lpFindFileData=0x5418468*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0072.406] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0072.406] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0072.406] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5418468 | out: lpFindFileData=0x5418468*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0072.406] FindClose (in: hFindFile=0x5444f40 | out: hFindFile=0x5444f40) returned 1 [0072.406] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5418468) returned 1 [0072.406] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a57b8) returned 1 [0072.406] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f680) returned 1 Thread: id = 80 os_tid = 0x13a4 [0071.144] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a5ba8 [0071.144] wcscpy (in: _Dest=0x38a5ba8, _Source="C:\\588bce7c90097ed212\\1043" | out: _Dest="C:\\588bce7c90097ed212\\1043") returned="C:\\588bce7c90097ed212\\1043" [0071.144] wcscat (in: _Dest=0x38a5ba8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1043\\") returned="C:\\588bce7c90097ed212\\1043\\" [0071.144] wcscat (in: _Dest=0x38a5ba8, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1043\\*") returned="C:\\588bce7c90097ed212\\1043\\*" [0071.144] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54186d0 [0071.144] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x54186d0 | out: lpFindFileData=0x54186d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f40 [0072.401] wcscmp (_String1=".", _String2=".") returned 0 [0072.401] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x54186d0 | out: lpFindFileData=0x54186d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.401] wcscmp (_String1="..", _String2=".") returned 1 [0072.401] wcscmp (_String1="..", _String2="..") returned 0 [0072.401] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x54186d0 | out: lpFindFileData=0x54186d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0072.401] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0072.401] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0072.401] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x38fadc0 [0072.401] wcscpy (in: _Dest=0x38fadc0, _Source="C:\\588bce7c90097ed212\\1043" | out: _Dest="C:\\588bce7c90097ed212\\1043") returned="C:\\588bce7c90097ed212\\1043" [0072.401] wcscat (in: _Dest=0x38fadc0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1043\\") returned="C:\\588bce7c90097ed212\\1043\\" [0072.401] wcscat (in: _Dest=0x38fadc0, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned="C:\\588bce7c90097ed212\\1043\\eula.rtf" [0072.401] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fadc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac4 [0072.402] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x54186d0 | out: lpFindFileData=0x54186d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0072.402] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0072.402] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0072.402] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x542c088 [0072.402] wcscpy (in: _Dest=0x542c088, _Source="C:\\588bce7c90097ed212\\1043" | out: _Dest="C:\\588bce7c90097ed212\\1043") returned="C:\\588bce7c90097ed212\\1043" [0072.402] wcscat (in: _Dest=0x542c088, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1043\\") returned="C:\\588bce7c90097ed212\\1043\\" [0072.402] wcscat (in: _Dest=0x542c088, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" [0072.402] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x542c088, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac8 [0072.403] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x54186d0 | out: lpFindFileData=0x54186d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0072.403] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0072.403] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0072.403] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x54186d0 | out: lpFindFileData=0x54186d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0072.403] FindClose (in: hFindFile=0x5444f40 | out: hFindFile=0x5444f40) returned 1 [0072.403] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54186d0) returned 1 [0072.403] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5ba8) returned 1 [0072.403] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389ef40) returned 1 Thread: id = 81 os_tid = 0x1248 [0071.145] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a5bf0 [0071.145] wcscpy (in: _Dest=0x38a5bf0, _Source="C:\\588bce7c90097ed212\\1044" | out: _Dest="C:\\588bce7c90097ed212\\1044") returned="C:\\588bce7c90097ed212\\1044" [0071.145] wcscat (in: _Dest=0x38a5bf0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1044\\") returned="C:\\588bce7c90097ed212\\1044\\" [0071.145] wcscat (in: _Dest=0x38a5bf0, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1044\\*") returned="C:\\588bce7c90097ed212\\1044\\*" [0071.145] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5418938 [0071.145] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f40 [0072.398] wcscmp (_String1=".", _String2=".") returned 0 [0072.398] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.398] wcscmp (_String1="..", _String2=".") returned 1 [0072.398] wcscmp (_String1="..", _String2="..") returned 0 [0072.398] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0072.398] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0072.398] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0072.399] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x38fad70 [0072.399] wcscpy (in: _Dest=0x38fad70, _Source="C:\\588bce7c90097ed212\\1044" | out: _Dest="C:\\588bce7c90097ed212\\1044") returned="C:\\588bce7c90097ed212\\1044" [0072.399] wcscat (in: _Dest=0x38fad70, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1044\\") returned="C:\\588bce7c90097ed212\\1044\\" [0072.399] wcscat (in: _Dest=0x38fad70, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned="C:\\588bce7c90097ed212\\1044\\eula.rtf" [0072.399] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fad70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xabc [0072.399] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0072.399] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0072.399] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0072.399] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x542c020 [0072.399] wcscpy (in: _Dest=0x542c020, _Source="C:\\588bce7c90097ed212\\1044" | out: _Dest="C:\\588bce7c90097ed212\\1044") returned="C:\\588bce7c90097ed212\\1044" [0072.399] wcscat (in: _Dest=0x542c020, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1044\\") returned="C:\\588bce7c90097ed212\\1044\\" [0072.399] wcscat (in: _Dest=0x542c020, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" [0072.399] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x542c020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac0 [0072.400] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0072.400] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0072.400] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0072.400] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0072.400] FindClose (in: hFindFile=0x5444f40 | out: hFindFile=0x5444f40) returned 1 [0072.400] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5418938) returned 1 [0072.400] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5bf0) returned 1 [0072.400] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f3c0) returned 1 Thread: id = 82 os_tid = 0xf1c [0071.146] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a5c38 [0071.146] wcscpy (in: _Dest=0x38a5c38, _Source="C:\\588bce7c90097ed212\\1045" | out: _Dest="C:\\588bce7c90097ed212\\1045") returned="C:\\588bce7c90097ed212\\1045" [0071.146] wcscat (in: _Dest=0x38a5c38, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1045\\") returned="C:\\588bce7c90097ed212\\1045\\" [0071.146] wcscat (in: _Dest=0x38a5c38, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1045\\*") returned="C:\\588bce7c90097ed212\\1045\\*" [0071.146] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5418ba0 [0071.146] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x5418ba0 | out: lpFindFileData=0x5418ba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f40 [0072.395] wcscmp (_String1=".", _String2=".") returned 0 [0072.395] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5418ba0 | out: lpFindFileData=0x5418ba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.395] wcscmp (_String1="..", _String2=".") returned 1 [0072.395] wcscmp (_String1="..", _String2="..") returned 0 [0072.395] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5418ba0 | out: lpFindFileData=0x5418ba0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0072.395] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0072.395] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0072.395] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x38fad20 [0072.395] wcscpy (in: _Dest=0x38fad20, _Source="C:\\588bce7c90097ed212\\1045" | out: _Dest="C:\\588bce7c90097ed212\\1045") returned="C:\\588bce7c90097ed212\\1045" [0072.395] wcscat (in: _Dest=0x38fad20, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1045\\") returned="C:\\588bce7c90097ed212\\1045\\" [0072.395] wcscat (in: _Dest=0x38fad20, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned="C:\\588bce7c90097ed212\\1045\\eula.rtf" [0072.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fad20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab4 [0072.396] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5418ba0 | out: lpFindFileData=0x5418ba0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0072.396] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0072.396] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0072.396] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x542bfb8 [0072.396] wcscpy (in: _Dest=0x542bfb8, _Source="C:\\588bce7c90097ed212\\1045" | out: _Dest="C:\\588bce7c90097ed212\\1045") returned="C:\\588bce7c90097ed212\\1045" [0072.396] wcscat (in: _Dest=0x542bfb8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1045\\") returned="C:\\588bce7c90097ed212\\1045\\" [0072.396] wcscat (in: _Dest=0x542bfb8, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" [0072.397] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x542bfb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab8 [0072.397] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5418ba0 | out: lpFindFileData=0x5418ba0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0072.397] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0072.397] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0072.397] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5418ba0 | out: lpFindFileData=0x5418ba0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0072.397] FindClose (in: hFindFile=0x5444f40 | out: hFindFile=0x5444f40) returned 1 [0072.397] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5418ba0) returned 1 [0072.397] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5c38) returned 1 [0072.397] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389ef80) returned 1 Thread: id = 83 os_tid = 0xf18 [0071.146] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a5c80 [0071.146] wcscpy (in: _Dest=0x38a5c80, _Source="C:\\588bce7c90097ed212\\1046" | out: _Dest="C:\\588bce7c90097ed212\\1046") returned="C:\\588bce7c90097ed212\\1046" [0071.146] wcscat (in: _Dest=0x38a5c80, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1046\\") returned="C:\\588bce7c90097ed212\\1046\\" [0071.146] wcscat (in: _Dest=0x38a5c80, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1046\\*") returned="C:\\588bce7c90097ed212\\1046\\*" [0071.146] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5418e08 [0071.146] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f40 [0072.392] wcscmp (_String1=".", _String2=".") returned 0 [0072.392] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.392] wcscmp (_String1="..", _String2=".") returned 1 [0072.392] wcscmp (_String1="..", _String2="..") returned 0 [0072.392] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0072.392] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0072.392] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0072.392] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x38facd0 [0072.392] wcscpy (in: _Dest=0x38facd0, _Source="C:\\588bce7c90097ed212\\1046" | out: _Dest="C:\\588bce7c90097ed212\\1046") returned="C:\\588bce7c90097ed212\\1046" [0072.392] wcscat (in: _Dest=0x38facd0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1046\\") returned="C:\\588bce7c90097ed212\\1046\\" [0072.392] wcscat (in: _Dest=0x38facd0, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned="C:\\588bce7c90097ed212\\1046\\eula.rtf" [0072.393] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38facd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaac [0072.393] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0072.393] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0072.393] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0072.393] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x542bf50 [0072.393] wcscpy (in: _Dest=0x542bf50, _Source="C:\\588bce7c90097ed212\\1046" | out: _Dest="C:\\588bce7c90097ed212\\1046") returned="C:\\588bce7c90097ed212\\1046" [0072.393] wcscat (in: _Dest=0x542bf50, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1046\\") returned="C:\\588bce7c90097ed212\\1046\\" [0072.393] wcscat (in: _Dest=0x542bf50, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" [0072.393] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x542bf50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab0 [0072.394] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0072.394] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0072.394] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0072.394] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0072.394] FindClose (in: hFindFile=0x5444f40 | out: hFindFile=0x5444f40) returned 1 [0072.394] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5418e08) returned 1 [0072.394] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5c80) returned 1 [0072.394] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389efc0) returned 1 Thread: id = 84 os_tid = 0x360 [0071.147] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a5cc8 [0071.147] wcscpy (in: _Dest=0x38a5cc8, _Source="C:\\588bce7c90097ed212\\1049" | out: _Dest="C:\\588bce7c90097ed212\\1049") returned="C:\\588bce7c90097ed212\\1049" [0071.147] wcscat (in: _Dest=0x38a5cc8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1049\\") returned="C:\\588bce7c90097ed212\\1049\\" [0071.147] wcscat (in: _Dest=0x38a5cc8, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1049\\*") returned="C:\\588bce7c90097ed212\\1049\\*" [0071.147] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5419070 [0071.147] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x5419070 | out: lpFindFileData=0x5419070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f40 [0072.389] wcscmp (_String1=".", _String2=".") returned 0 [0072.389] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5419070 | out: lpFindFileData=0x5419070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.389] wcscmp (_String1="..", _String2=".") returned 1 [0072.389] wcscmp (_String1="..", _String2="..") returned 0 [0072.389] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5419070 | out: lpFindFileData=0x5419070*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0072.389] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0072.389] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0072.389] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x38fac80 [0072.389] wcscpy (in: _Dest=0x38fac80, _Source="C:\\588bce7c90097ed212\\1049" | out: _Dest="C:\\588bce7c90097ed212\\1049") returned="C:\\588bce7c90097ed212\\1049" [0072.390] wcscat (in: _Dest=0x38fac80, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1049\\") returned="C:\\588bce7c90097ed212\\1049\\" [0072.390] wcscat (in: _Dest=0x38fac80, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned="C:\\588bce7c90097ed212\\1049\\eula.rtf" [0072.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fac80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa4 [0072.390] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5419070 | out: lpFindFileData=0x5419070*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0072.390] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0072.390] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0072.390] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x542c1c0 [0072.390] wcscpy (in: _Dest=0x542c1c0, _Source="C:\\588bce7c90097ed212\\1049" | out: _Dest="C:\\588bce7c90097ed212\\1049") returned="C:\\588bce7c90097ed212\\1049" [0072.390] wcscat (in: _Dest=0x542c1c0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1049\\") returned="C:\\588bce7c90097ed212\\1049\\" [0072.390] wcscat (in: _Dest=0x542c1c0, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" [0072.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x542c1c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa8 [0072.391] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5419070 | out: lpFindFileData=0x5419070*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0072.391] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0072.391] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0072.391] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5419070 | out: lpFindFileData=0x5419070*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0072.391] FindClose (in: hFindFile=0x5444f40 | out: hFindFile=0x5444f40) returned 1 [0072.391] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5419070) returned 1 [0072.391] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5cc8) returned 1 [0072.391] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389eb80) returned 1 Thread: id = 85 os_tid = 0xfe8 [0071.147] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a5d10 [0071.147] wcscpy (in: _Dest=0x38a5d10, _Source="C:\\588bce7c90097ed212\\1053" | out: _Dest="C:\\588bce7c90097ed212\\1053") returned="C:\\588bce7c90097ed212\\1053" [0071.147] wcscat (in: _Dest=0x38a5d10, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1053\\") returned="C:\\588bce7c90097ed212\\1053\\" [0071.147] wcscat (in: _Dest=0x38a5d10, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1053\\*") returned="C:\\588bce7c90097ed212\\1053\\*" [0071.147] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54192d8 [0071.147] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x54192d8 | out: lpFindFileData=0x54192d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f40 [0072.386] wcscmp (_String1=".", _String2=".") returned 0 [0072.386] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x54192d8 | out: lpFindFileData=0x54192d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.386] wcscmp (_String1="..", _String2=".") returned 1 [0072.386] wcscmp (_String1="..", _String2="..") returned 0 [0072.386] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x54192d8 | out: lpFindFileData=0x54192d8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0072.387] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0072.387] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0072.387] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x38fac30 [0072.387] wcscpy (in: _Dest=0x38fac30, _Source="C:\\588bce7c90097ed212\\1053" | out: _Dest="C:\\588bce7c90097ed212\\1053") returned="C:\\588bce7c90097ed212\\1053" [0072.387] wcscat (in: _Dest=0x38fac30, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1053\\") returned="C:\\588bce7c90097ed212\\1053\\" [0072.387] wcscat (in: _Dest=0x38fac30, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned="C:\\588bce7c90097ed212\\1053\\eula.rtf" [0072.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fac30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa9c [0072.387] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x54192d8 | out: lpFindFileData=0x54192d8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0072.387] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0072.387] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0072.387] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x542b5f8 [0072.387] wcscpy (in: _Dest=0x542b5f8, _Source="C:\\588bce7c90097ed212\\1053" | out: _Dest="C:\\588bce7c90097ed212\\1053") returned="C:\\588bce7c90097ed212\\1053" [0072.387] wcscat (in: _Dest=0x542b5f8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1053\\") returned="C:\\588bce7c90097ed212\\1053\\" [0072.387] wcscat (in: _Dest=0x542b5f8, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" [0072.388] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x542b5f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa0 [0072.388] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x54192d8 | out: lpFindFileData=0x54192d8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0072.388] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0072.388] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0072.388] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x54192d8 | out: lpFindFileData=0x54192d8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0072.388] FindClose (in: hFindFile=0x5444f40 | out: hFindFile=0x5444f40) returned 1 [0072.388] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54192d8) returned 1 [0072.388] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5d10) returned 1 [0072.389] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389ec80) returned 1 Thread: id = 86 os_tid = 0xffc [0071.148] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a5800 [0071.148] wcscpy (in: _Dest=0x38a5800, _Source="C:\\588bce7c90097ed212\\1055" | out: _Dest="C:\\588bce7c90097ed212\\1055") returned="C:\\588bce7c90097ed212\\1055" [0071.148] wcscat (in: _Dest=0x38a5800, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1055\\") returned="C:\\588bce7c90097ed212\\1055\\" [0071.148] wcscat (in: _Dest=0x38a5800, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1055\\*") returned="C:\\588bce7c90097ed212\\1055\\*" [0071.148] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54071c8 [0071.148] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x54071c8 | out: lpFindFileData=0x54071c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f40 [0072.383] wcscmp (_String1=".", _String2=".") returned 0 [0072.383] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x54071c8 | out: lpFindFileData=0x54071c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.383] wcscmp (_String1="..", _String2=".") returned 1 [0072.383] wcscmp (_String1="..", _String2="..") returned 0 [0072.383] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x54071c8 | out: lpFindFileData=0x54071c8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0072.383] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0072.383] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0072.383] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x38fa6e0 [0072.384] wcscpy (in: _Dest=0x38fa6e0, _Source="C:\\588bce7c90097ed212\\1055" | out: _Dest="C:\\588bce7c90097ed212\\1055") returned="C:\\588bce7c90097ed212\\1055" [0072.384] wcscat (in: _Dest=0x38fa6e0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1055\\") returned="C:\\588bce7c90097ed212\\1055\\" [0072.384] wcscat (in: _Dest=0x38fa6e0, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned="C:\\588bce7c90097ed212\\1055\\eula.rtf" [0072.384] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fa6e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa94 [0072.384] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x54071c8 | out: lpFindFileData=0x54071c8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0072.384] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0072.384] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0072.384] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x542b528 [0072.384] wcscpy (in: _Dest=0x542b528, _Source="C:\\588bce7c90097ed212\\1055" | out: _Dest="C:\\588bce7c90097ed212\\1055") returned="C:\\588bce7c90097ed212\\1055" [0072.385] wcscat (in: _Dest=0x542b528, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1055\\") returned="C:\\588bce7c90097ed212\\1055\\" [0072.385] wcscat (in: _Dest=0x542b528, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" [0072.385] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x542b528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa98 [0072.385] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x54071c8 | out: lpFindFileData=0x54071c8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0072.385] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0072.385] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0072.385] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x54071c8 | out: lpFindFileData=0x54071c8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0072.385] FindClose (in: hFindFile=0x5444f40 | out: hFindFile=0x5444f40) returned 1 [0072.385] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54071c8) returned 1 [0072.386] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5800) returned 1 [0072.386] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389e700) returned 1 Thread: id = 87 os_tid = 0x520 [0071.149] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a5d58 [0071.149] wcscpy (in: _Dest=0x38a5d58, _Source="C:\\588bce7c90097ed212\\2052" | out: _Dest="C:\\588bce7c90097ed212\\2052") returned="C:\\588bce7c90097ed212\\2052" [0071.149] wcscat (in: _Dest=0x38a5d58, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\2052\\") returned="C:\\588bce7c90097ed212\\2052\\" [0071.149] wcscat (in: _Dest=0x38a5d58, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\2052\\*") returned="C:\\588bce7c90097ed212\\2052\\*" [0071.149] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5407698 [0071.149] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444b80 [0072.426] wcscmp (_String1=".", _String2=".") returned 0 [0072.426] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.426] wcscmp (_String1="..", _String2=".") returned 1 [0072.426] wcscmp (_String1="..", _String2="..") returned 0 [0072.427] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0072.427] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0072.427] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0072.427] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x38fa8c0 [0072.427] wcscpy (in: _Dest=0x38fa8c0, _Source="C:\\588bce7c90097ed212\\2052" | out: _Dest="C:\\588bce7c90097ed212\\2052") returned="C:\\588bce7c90097ed212\\2052" [0072.427] wcscat (in: _Dest=0x38fa8c0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\2052\\") returned="C:\\588bce7c90097ed212\\2052\\" [0072.427] wcscat (in: _Dest=0x38fa8c0, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned="C:\\588bce7c90097ed212\\2052\\eula.rtf" [0072.427] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fa8c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaec [0072.427] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0072.427] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0072.428] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0072.428] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x38fcd28 [0072.428] wcscpy (in: _Dest=0x38fcd28, _Source="C:\\588bce7c90097ed212\\2052" | out: _Dest="C:\\588bce7c90097ed212\\2052") returned="C:\\588bce7c90097ed212\\2052" [0072.428] wcscat (in: _Dest=0x38fcd28, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\2052\\") returned="C:\\588bce7c90097ed212\\2052\\" [0072.428] wcscat (in: _Dest=0x38fcd28, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" [0072.428] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fcd28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf0 [0072.428] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0072.428] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0072.428] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0072.428] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0072.429] FindClose (in: hFindFile=0x5444b80 | out: hFindFile=0x5444b80) returned 1 [0072.429] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5407698) returned 1 [0072.429] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5d58) returned 1 [0072.429] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389e9c0) returned 1 Thread: id = 88 os_tid = 0xce4 [0071.150] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a5848 [0071.150] wcscpy (in: _Dest=0x38a5848, _Source="C:\\588bce7c90097ed212\\2070" | out: _Dest="C:\\588bce7c90097ed212\\2070") returned="C:\\588bce7c90097ed212\\2070" [0071.150] wcscat (in: _Dest=0x38a5848, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\2070\\") returned="C:\\588bce7c90097ed212\\2070\\" [0071.150] wcscat (in: _Dest=0x38a5848, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\2070\\*") returned="C:\\588bce7c90097ed212\\2070\\*" [0071.150] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54309b8 [0071.150] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444b80 [0072.380] wcscmp (_String1=".", _String2=".") returned 0 [0072.380] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.380] wcscmp (_String1="..", _String2=".") returned 1 [0072.381] wcscmp (_String1="..", _String2="..") returned 0 [0072.381] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0072.381] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0072.381] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0072.381] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x38faff0 [0072.381] wcscpy (in: _Dest=0x38faff0, _Source="C:\\588bce7c90097ed212\\2070" | out: _Dest="C:\\588bce7c90097ed212\\2070") returned="C:\\588bce7c90097ed212\\2070" [0072.381] wcscat (in: _Dest=0x38faff0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\2070\\") returned="C:\\588bce7c90097ed212\\2070\\" [0072.381] wcscat (in: _Dest=0x38faff0, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned="C:\\588bce7c90097ed212\\2070\\eula.rtf" [0072.381] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38faff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa8c [0072.381] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0072.381] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0072.381] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0072.381] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x542b458 [0072.382] wcscpy (in: _Dest=0x542b458, _Source="C:\\588bce7c90097ed212\\2070" | out: _Dest="C:\\588bce7c90097ed212\\2070") returned="C:\\588bce7c90097ed212\\2070" [0072.382] wcscat (in: _Dest=0x542b458, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\2070\\") returned="C:\\588bce7c90097ed212\\2070\\" [0072.382] wcscat (in: _Dest=0x542b458, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" [0072.382] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x542b458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa90 [0072.382] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0072.382] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0072.382] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0072.382] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0072.382] FindClose (in: hFindFile=0x5444b80 | out: hFindFile=0x5444b80) returned 1 [0072.383] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54309b8) returned 1 [0072.383] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5848) returned 1 [0072.383] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389ecc0) returned 1 Thread: id = 89 os_tid = 0x4c0 [0071.150] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a5da0 [0071.150] wcscpy (in: _Dest=0x38a5da0, _Source="C:\\588bce7c90097ed212\\3076" | out: _Dest="C:\\588bce7c90097ed212\\3076") returned="C:\\588bce7c90097ed212\\3076" [0071.150] wcscat (in: _Dest=0x38a5da0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\3076\\") returned="C:\\588bce7c90097ed212\\3076\\" [0071.150] wcscat (in: _Dest=0x38a5da0, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\3076\\*") returned="C:\\588bce7c90097ed212\\3076\\*" [0071.150] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542d730 [0071.150] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x542d730 | out: lpFindFileData=0x542d730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f40 [0072.377] wcscmp (_String1=".", _String2=".") returned 0 [0072.377] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x542d730 | out: lpFindFileData=0x542d730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.377] wcscmp (_String1="..", _String2=".") returned 1 [0072.377] wcscmp (_String1="..", _String2="..") returned 0 [0072.377] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x542d730 | out: lpFindFileData=0x542d730*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0072.377] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0072.377] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0072.377] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x38fabe0 [0072.377] wcscpy (in: _Dest=0x38fabe0, _Source="C:\\588bce7c90097ed212\\3076" | out: _Dest="C:\\588bce7c90097ed212\\3076") returned="C:\\588bce7c90097ed212\\3076" [0072.377] wcscat (in: _Dest=0x38fabe0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\3076\\") returned="C:\\588bce7c90097ed212\\3076\\" [0072.377] wcscat (in: _Dest=0x38fabe0, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned="C:\\588bce7c90097ed212\\3076\\eula.rtf" [0072.377] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fabe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa84 [0072.378] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x542d730 | out: lpFindFileData=0x542d730*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0072.378] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0072.378] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0072.378] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x542b3f0 [0072.378] wcscpy (in: _Dest=0x542b3f0, _Source="C:\\588bce7c90097ed212\\3076" | out: _Dest="C:\\588bce7c90097ed212\\3076") returned="C:\\588bce7c90097ed212\\3076" [0072.378] wcscat (in: _Dest=0x542b3f0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\3076\\") returned="C:\\588bce7c90097ed212\\3076\\" [0072.378] wcscat (in: _Dest=0x542b3f0, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" [0072.378] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x542b3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa88 [0072.379] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x542d730 | out: lpFindFileData=0x542d730*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0072.379] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0072.379] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0072.379] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x542d730 | out: lpFindFileData=0x542d730*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0072.379] FindClose (in: hFindFile=0x5444f40 | out: hFindFile=0x5444f40) returned 1 [0072.380] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542d730) returned 1 [0072.380] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5da0) returned 1 [0072.380] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389e980) returned 1 Thread: id = 90 os_tid = 0x4bc [0071.151] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a58d8 [0071.151] wcscpy (in: _Dest=0x38a58d8, _Source="C:\\588bce7c90097ed212\\3082" | out: _Dest="C:\\588bce7c90097ed212\\3082") returned="C:\\588bce7c90097ed212\\3082" [0071.151] wcscat (in: _Dest=0x38a58d8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\3082\\") returned="C:\\588bce7c90097ed212\\3082\\" [0071.151] wcscat (in: _Dest=0x38a58d8, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\3082\\*") returned="C:\\588bce7c90097ed212\\3082\\*" [0071.151] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542de68 [0071.151] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x542de68 | out: lpFindFileData=0x542de68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444b80 [0072.372] wcscmp (_String1=".", _String2=".") returned 0 [0072.372] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x542de68 | out: lpFindFileData=0x542de68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.372] wcscmp (_String1="..", _String2=".") returned 1 [0072.372] wcscmp (_String1="..", _String2="..") returned 0 [0072.372] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x542de68 | out: lpFindFileData=0x542de68*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0072.372] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0072.372] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0072.372] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x38fafa0 [0072.372] wcscpy (in: _Dest=0x38fafa0, _Source="C:\\588bce7c90097ed212\\3082" | out: _Dest="C:\\588bce7c90097ed212\\3082") returned="C:\\588bce7c90097ed212\\3082" [0072.372] wcscat (in: _Dest=0x38fafa0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\3082\\") returned="C:\\588bce7c90097ed212\\3082\\" [0072.372] wcscat (in: _Dest=0x38fafa0, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned="C:\\588bce7c90097ed212\\3082\\eula.rtf" [0072.372] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fafa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa7c [0072.372] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x542de68 | out: lpFindFileData=0x542de68*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0072.373] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0072.373] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0072.373] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x542b388 [0072.373] wcscpy (in: _Dest=0x542b388, _Source="C:\\588bce7c90097ed212\\3082" | out: _Dest="C:\\588bce7c90097ed212\\3082") returned="C:\\588bce7c90097ed212\\3082" [0072.373] wcscat (in: _Dest=0x542b388, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\3082\\") returned="C:\\588bce7c90097ed212\\3082\\" [0072.373] wcscat (in: _Dest=0x542b388, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" [0072.373] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x542b388, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa80 [0072.376] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x542de68 | out: lpFindFileData=0x542de68*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0072.376] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0072.376] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0072.376] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x542de68 | out: lpFindFileData=0x542de68*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0072.376] FindClose (in: hFindFile=0x5444b80 | out: hFindFile=0x5444b80) returned 1 [0072.376] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542de68) returned 1 [0072.376] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a58d8) returned 1 [0072.376] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389e740) returned 1 Thread: id = 91 os_tid = 0xcdc [0071.152] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3e) returned 0x38a5890 [0071.152] wcscpy (in: _Dest=0x38a5890, _Source="C:\\588bce7c90097ed212\\Client" | out: _Dest="C:\\588bce7c90097ed212\\Client") returned="C:\\588bce7c90097ed212\\Client" [0071.152] wcscat (in: _Dest=0x38a5890, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\Client\\") returned="C:\\588bce7c90097ed212\\Client\\" [0071.152] wcscat (in: _Dest=0x38a5890, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\Client\\*") returned="C:\\588bce7c90097ed212\\Client\\*" [0071.152] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542f1a8 [0071.152] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x542f1a8 | out: lpFindFileData=0x542f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f40 [0072.369] wcscmp (_String1=".", _String2=".") returned 0 [0072.369] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x542f1a8 | out: lpFindFileData=0x542f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.369] wcscmp (_String1="..", _String2=".") returned 1 [0072.369] wcscmp (_String1="..", _String2="..") returned 0 [0072.369] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x542f1a8 | out: lpFindFileData=0x542f1a8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0072.369] wcscmp (_String1="Parameterinfo.xml", _String2=".") returned 1 [0072.369] wcscmp (_String1="Parameterinfo.xml", _String2="..") returned 1 [0072.369] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x542b320 [0072.369] wcscpy (in: _Dest=0x542b320, _Source="C:\\588bce7c90097ed212\\Client" | out: _Dest="C:\\588bce7c90097ed212\\Client") returned="C:\\588bce7c90097ed212\\Client" [0072.369] wcscat (in: _Dest=0x542b320, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\Client\\") returned="C:\\588bce7c90097ed212\\Client\\" [0072.369] wcscat (in: _Dest=0x542b320, _Source="Parameterinfo.xml" | out: _Dest="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" [0072.369] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x542b320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa74 [0072.370] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x542f1a8 | out: lpFindFileData=0x542f1a8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0072.370] wcscmp (_String1="UiInfo.xml", _String2=".") returned 1 [0072.370] wcscmp (_String1="UiInfo.xml", _String2="..") returned 1 [0072.370] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x541b6d0 [0072.370] wcscpy (in: _Dest=0x541b6d0, _Source="C:\\588bce7c90097ed212\\Client" | out: _Dest="C:\\588bce7c90097ed212\\Client") returned="C:\\588bce7c90097ed212\\Client" [0072.370] wcscat (in: _Dest=0x541b6d0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\Client\\") returned="C:\\588bce7c90097ed212\\Client\\" [0072.370] wcscat (in: _Dest=0x541b6d0, _Source="UiInfo.xml" | out: _Dest="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" [0072.370] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x541b6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa78 [0072.371] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x542f1a8 | out: lpFindFileData=0x542f1a8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0072.371] FindClose (in: hFindFile=0x5444f40 | out: hFindFile=0x5444f40) returned 1 [0072.371] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542f1a8) returned 1 [0072.371] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5890) returned 1 [0072.371] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6388) returned 1 Thread: id = 92 os_tid = 0x75c [0071.153] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 0x80 [0072.368] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html", dwFileAttributes=0x20) returned 1 [0075.551] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xca0 [0075.551] GetFileSizeEx (in: hFile=0xca0, lpFileSize=0x796fb80 | out: lpFileSize=0x796fb80*=16118) returned 1 [0075.551] SetFilePointerEx (in: hFile=0xca0, liDistanceToMove=0x3ef2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.551] ReadFile (in: hFile=0xca0, lpBuffer=0x796fb04, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x796fb00, lpOverlapped=0x0 | out: lpBuffer=0x796fb04*, lpNumberOfBytesRead=0x796fb00*=0x4, lpOverlapped=0x0) returned 1 [0075.615] SetFilePointerEx (in: hFile=0xca0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.615] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559898 [0075.615] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559ca8 [0075.615] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559938 [0075.615] NtQuerySystemTime (in: CurrentTime=0x796fae0 | out: CurrentTime=0x796fae0*=132260136327772770) returned 0x0 [0075.615] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0x333ab65b [0075.615] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0xb4c7eaae [0075.615] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0xef41a4d9 [0075.615] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0xfa0b21f5 [0075.615] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0x89a8b0e1 [0075.616] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0x98c52201 [0075.616] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0xea7503af [0075.616] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0x861317e6 [0075.616] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0xbdaa3c0 [0075.616] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0x83e9d33c [0075.616] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0xbbf6a038 [0075.616] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0x1f0f560c [0075.616] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0x74b1753b [0075.616] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0x7b813305 [0075.616] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0x51cc5d76 [0075.616] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0xdfca6b5c [0075.616] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0xfb963905 [0075.616] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0x48407b7a [0075.616] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0x3feb43d7 [0075.616] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0xd6ce4a9b [0075.616] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0x536c7b6f [0075.616] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0x2826bf9e [0075.616] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0x9f4e934f [0075.616] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0xa5fb4e3f [0075.616] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0xd5e6e43b [0075.616] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0x29eb5874 [0075.616] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0xa7670dd7 [0075.616] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0x294ecd1 [0075.616] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0x9d91e64f [0075.616] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0xc9eae649 [0075.616] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0x94b4b6a4 [0075.616] RtlRandom (in: Seed=0x796faec | out: Seed=0x796faec) returned 0x541750d5 [0075.626] ReadFile (in: hFile=0xca0, lpBuffer=0x5573080, nNumberOfBytesToRead=0x3ef6, lpNumberOfBytesRead=0x796fadc, lpOverlapped=0x0 | out: lpBuffer=0x5573080*, lpNumberOfBytesRead=0x796fadc*=0x3ef6, lpOverlapped=0x0) returned 1 [0075.646] SetFilePointerEx (in: hFile=0xca0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.646] WriteFile (in: hFile=0xca0, lpBuffer=0x557f888*, nNumberOfBytesToWrite=0x3ef6, lpNumberOfBytesWritten=0x796fad8, lpOverlapped=0x0 | out: lpBuffer=0x557f888*, lpNumberOfBytesWritten=0x796fad8*=0x3ef6, lpOverlapped=0x0) returned 1 [0076.180] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c08 [0076.180] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559d48 [0076.180] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559d48) returned 1 [0076.180] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x557f888) returned 1 [0076.183] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5573080) returned 1 [0076.186] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496bc0) returned 1 [0076.186] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6340) returned 1 [0076.186] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2d) returned 0x5531ee0 [0076.186] SetFilePointerEx (in: hFile=0xca0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.186] WriteFile (in: hFile=0xca0, lpBuffer=0x54a2b30*, nNumberOfBytesToWrite=0x111, lpNumberOfBytesWritten=0x796fb40, lpOverlapped=0x0 | out: lpBuffer=0x54a2b30*, lpNumberOfBytesWritten=0x796fb40*=0x111, lpOverlapped=0x0) returned 1 [0076.190] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a2b30) returned 1 [0076.190] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5531e70) returned 1 [0076.190] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559898) returned 1 [0076.190] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5531ee0) returned 1 [0076.190] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559c08) returned 1 [0076.190] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ca8) returned 1 [0076.190] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559cd0) returned 1 [0076.190] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559b90) returned 1 [0076.190] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8e) returned 0x549f010 [0076.190] wcscpy (in: _Dest=0x549f010, _Source="C:\\588bce7c90097ed212\\DHtmlHeader.html" | out: _Dest="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned="C:\\588bce7c90097ed212\\DHtmlHeader.html" [0076.190] wcscat (in: _Dest=0x549f010, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\588bce7c90097ed212\\DHtmlHeader.html.mailto[knoocknoo@cock.li].a0a70") returned="C:\\588bce7c90097ed212\\DHtmlHeader.html.mailto[knoocknoo@cock.li].a0a70" [0076.190] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\588bce7c90097ed212\\DHtmlHeader.html.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x796faf8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\588bce7c90097ed212\\DHtmlHeader.html.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.190] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa4) returned 0x54de870 Thread: id = 93 os_tid = 0xa1c [0071.153] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x42) returned 0x38b2cd8 [0071.153] wcscpy (in: _Dest=0x38b2cd8, _Source="C:\\588bce7c90097ed212\\Extended" | out: _Dest="C:\\588bce7c90097ed212\\Extended") returned="C:\\588bce7c90097ed212\\Extended" [0071.153] wcscat (in: _Dest=0x38b2cd8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\") returned="C:\\588bce7c90097ed212\\Extended\\" [0071.153] wcscat (in: _Dest=0x38b2cd8, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\*") returned="C:\\588bce7c90097ed212\\Extended\\*" [0071.153] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542d4c8 [0071.153] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x542d4c8 | out: lpFindFileData=0x542d4c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f40 [0072.365] wcscmp (_String1=".", _String2=".") returned 0 [0072.365] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x542d4c8 | out: lpFindFileData=0x542d4c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.365] wcscmp (_String1="..", _String2=".") returned 1 [0072.365] wcscmp (_String1="..", _String2="..") returned 0 [0072.366] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x542d4c8 | out: lpFindFileData=0x542d4c8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0072.366] wcscmp (_String1="Parameterinfo.xml", _String2=".") returned 1 [0072.366] wcscmp (_String1="Parameterinfo.xml", _String2="..") returned 1 [0072.366] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x5468940 [0072.366] wcscpy (in: _Dest=0x5468940, _Source="C:\\588bce7c90097ed212\\Extended" | out: _Dest="C:\\588bce7c90097ed212\\Extended") returned="C:\\588bce7c90097ed212\\Extended" [0072.366] wcscat (in: _Dest=0x5468940, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\") returned="C:\\588bce7c90097ed212\\Extended\\" [0072.366] wcscat (in: _Dest=0x5468940, _Source="Parameterinfo.xml" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" [0072.366] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5468940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa6c [0072.366] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x542d4c8 | out: lpFindFileData=0x542d4c8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0072.367] wcscmp (_String1="UiInfo.xml", _String2=".") returned 1 [0072.367] wcscmp (_String1="UiInfo.xml", _String2="..") returned 1 [0072.367] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x38b61e8 [0072.367] wcscpy (in: _Dest=0x38b61e8, _Source="C:\\588bce7c90097ed212\\Extended" | out: _Dest="C:\\588bce7c90097ed212\\Extended") returned="C:\\588bce7c90097ed212\\Extended" [0072.367] wcscat (in: _Dest=0x38b61e8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\") returned="C:\\588bce7c90097ed212\\Extended\\" [0072.367] wcscat (in: _Dest=0x38b61e8, _Source="UiInfo.xml" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" [0072.367] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b61e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa70 [0072.367] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x542d4c8 | out: lpFindFileData=0x542d4c8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0072.367] FindClose (in: hFindFile=0x5444f40 | out: hFindFile=0x5444f40) returned 1 [0072.368] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542d4c8) returned 1 [0072.368] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b2cd8) returned 1 [0072.368] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a64a8) returned 1 Thread: id = 94 os_tid = 0xd1c [0071.154] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x42) returned 0x38b3228 [0071.154] wcscpy (in: _Dest=0x38b3228, _Source="C:\\588bce7c90097ed212\\Graphics" | out: _Dest="C:\\588bce7c90097ed212\\Graphics") returned="C:\\588bce7c90097ed212\\Graphics" [0071.154] wcscat (in: _Dest=0x38b3228, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0071.154] wcscat (in: _Dest=0x38b3228, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\Graphics\\*") returned="C:\\588bce7c90097ed212\\Graphics\\*" [0071.154] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542d998 [0071.154] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x542d998 | out: lpFindFileData=0x542d998*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f380 [0074.084] wcscmp (_String1=".", _String2=".") returned 0 [0074.084] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x542d998 | out: lpFindFileData=0x542d998*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.084] wcscmp (_String1="..", _String2=".") returned 1 [0074.084] wcscmp (_String1="..", _String2="..") returned 0 [0074.084] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x542d998 | out: lpFindFileData=0x542d998*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0074.084] wcscmp (_String1="Print.ico", _String2=".") returned 1 [0074.084] wcscmp (_String1="Print.ico", _String2="..") returned 1 [0074.085] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x542d998 | out: lpFindFileData=0x542d998*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0074.085] wcscmp (_String1="Rotate1.ico", _String2=".") returned 1 [0074.085] wcscmp (_String1="Rotate1.ico", _String2="..") returned 1 [0074.085] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x542d998 | out: lpFindFileData=0x542d998*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0074.085] wcscmp (_String1="Rotate2.ico", _String2=".") returned 1 [0074.086] wcscmp (_String1="Rotate2.ico", _String2="..") returned 1 [0074.086] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x542d998 | out: lpFindFileData=0x542d998*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0074.086] wcscmp (_String1="Rotate3.ico", _String2=".") returned 1 [0074.086] wcscmp (_String1="Rotate3.ico", _String2="..") returned 1 [0074.086] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x542d998 | out: lpFindFileData=0x542d998*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0074.086] wcscmp (_String1="Rotate4.ico", _String2=".") returned 1 [0074.086] wcscmp (_String1="Rotate4.ico", _String2="..") returned 1 [0074.086] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x542d998 | out: lpFindFileData=0x542d998*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0074.086] wcscmp (_String1="Rotate5.ico", _String2=".") returned 1 [0074.086] wcscmp (_String1="Rotate5.ico", _String2="..") returned 1 [0074.086] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x542d998 | out: lpFindFileData=0x542d998*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0074.086] wcscmp (_String1="Rotate6.ico", _String2=".") returned 1 [0074.086] wcscmp (_String1="Rotate6.ico", _String2="..") returned 1 [0074.086] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x542d998 | out: lpFindFileData=0x542d998*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0074.086] wcscmp (_String1="Rotate7.ico", _String2=".") returned 1 [0074.086] wcscmp (_String1="Rotate7.ico", _String2="..") returned 1 [0074.086] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x542d998 | out: lpFindFileData=0x542d998*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0074.086] wcscmp (_String1="Rotate8.ico", _String2=".") returned 1 [0074.086] wcscmp (_String1="Rotate8.ico", _String2="..") returned 1 [0074.086] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x542d998 | out: lpFindFileData=0x542d998*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0074.086] wcscmp (_String1="Save.ico", _String2=".") returned 1 [0074.086] wcscmp (_String1="Save.ico", _String2="..") returned 1 [0074.086] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x542d998 | out: lpFindFileData=0x542d998*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0074.086] wcscmp (_String1="Setup.ico", _String2=".") returned 1 [0074.086] wcscmp (_String1="Setup.ico", _String2="..") returned 1 [0074.087] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x542d998 | out: lpFindFileData=0x542d998*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0074.087] wcscmp (_String1="stop.ico", _String2=".") returned 1 [0074.087] wcscmp (_String1="stop.ico", _String2="..") returned 1 [0074.087] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x542d998 | out: lpFindFileData=0x542d998*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0074.087] wcscmp (_String1="SysReqMet.ico", _String2=".") returned 1 [0074.087] wcscmp (_String1="SysReqMet.ico", _String2="..") returned 1 [0074.087] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x542d998 | out: lpFindFileData=0x542d998*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0074.087] wcscmp (_String1="SysReqNotMet.ico", _String2=".") returned 1 [0074.087] wcscmp (_String1="SysReqNotMet.ico", _String2="..") returned 1 [0074.087] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x542d998 | out: lpFindFileData=0x542d998*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0074.087] wcscmp (_String1="warn.ico", _String2=".") returned 1 [0074.087] wcscmp (_String1="warn.ico", _String2="..") returned 1 [0074.087] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x542d998 | out: lpFindFileData=0x542d998*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0074.087] FindClose (in: hFindFile=0x389f380 | out: hFindFile=0x389f380) returned 1 [0074.088] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542d998) returned 1 [0074.088] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b3228) returned 1 [0074.088] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6148) returned 1 Thread: id = 95 os_tid = 0xd24 [0071.154] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 0x80 [0072.364] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp", dwFileAttributes=0x20) returned 1 [0075.549] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xc9c [0075.549] GetFileSizeEx (in: hFile=0xc9c, lpFileSize=0x7aefc18 | out: lpFileSize=0x7aefc18*=3628) returned 1 [0075.549] SetFilePointerEx (in: hFile=0xc9c, liDistanceToMove=0xe28, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.550] ReadFile (in: hFile=0xc9c, lpBuffer=0x7aefb9c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x7aefb98, lpOverlapped=0x0 | out: lpBuffer=0x7aefb9c*, lpNumberOfBytesRead=0x7aefb98*=0x4, lpOverlapped=0x0) returned 1 [0075.603] SetFilePointerEx (in: hFile=0xc9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.603] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5260 [0075.603] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4fe0 [0075.603] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559898 [0075.603] NtQuerySystemTime (in: CurrentTime=0x7aefb78 | out: CurrentTime=0x7aefb78*=132260136327616437) returned 0x0 [0075.603] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0x60610309 [0075.603] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0x2db19486 [0075.603] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0xc4bde280 [0075.603] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0x43d96f61 [0075.603] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0xb0f15cdc [0075.603] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0x341af63c [0075.603] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0x1f966d22 [0075.603] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0x624f3329 [0075.603] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0x2c7d6579 [0075.603] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0xb0d26ec4 [0075.603] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0xba001c58 [0075.603] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0x89fb2d71 [0075.603] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0x4557b79a [0075.603] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0xd9d40c6c [0075.603] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0x667eaea1 [0075.603] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0xb6a2ba9c [0075.603] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0x130a618a [0075.603] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0xb88b9061 [0075.603] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0xbd7afdb8 [0075.603] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0xc0d87469 [0075.603] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0xfd4dd19a [0075.603] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0x6a00eb8d [0075.603] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0x8dc41ae5 [0075.603] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0xe09a0bbf [0075.603] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0xbabcbe4b [0075.604] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0xd7c77469 [0075.604] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0xaedbcbf6 [0075.604] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0xa418bb50 [0075.604] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0x584cb6f [0075.604] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0x118b004b [0075.604] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0x7c324b24 [0075.604] RtlRandom (in: Seed=0x7aefb84 | out: Seed=0x7aefb84) returned 0x221a3cce [0075.614] ReadFile (in: hFile=0xc9c, lpBuffer=0x555a070, nNumberOfBytesToRead=0xe2c, lpNumberOfBytesRead=0x7aefb74, lpOverlapped=0x0 | out: lpBuffer=0x555a070*, lpNumberOfBytesRead=0x7aefb74*=0xe2c, lpOverlapped=0x0) returned 1 [0075.614] SetFilePointerEx (in: hFile=0xc9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.614] WriteFile (in: hFile=0xc9c, lpBuffer=0x5566878*, nNumberOfBytesToWrite=0xe2c, lpNumberOfBytesWritten=0x7aefb70, lpOverlapped=0x0 | out: lpBuffer=0x5566878*, lpNumberOfBytesWritten=0x7aefb70*=0xe2c, lpOverlapped=0x0) returned 1 [0076.128] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55599d8 [0076.128] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559ac8 [0076.128] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ac8) returned 1 [0076.128] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5566878) returned 1 [0076.128] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x555a070) returned 1 [0076.128] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54970e8) returned 1 [0076.128] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a60b8) returned 1 [0076.128] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x21) returned 0x38a69a0 [0076.128] SetFilePointerEx (in: hFile=0xc9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.128] WriteFile (in: hFile=0xc9c, lpBuffer=0x549cb18*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x7aefbd8, lpOverlapped=0x0 | out: lpBuffer=0x549cb18*, lpNumberOfBytesWritten=0x7aefbd8*=0x105, lpOverlapped=0x0) returned 1 [0076.130] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549cb18) returned 1 [0076.130] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a66d0) returned 1 [0076.130] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a28) returned 1 [0076.130] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a69a0) returned 1 [0076.130] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55599d8) returned 1 [0076.130] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4fe0) returned 1 [0076.130] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559c58) returned 1 [0076.130] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559c80) returned 1 [0076.130] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x82) returned 0x38a8a28 [0076.130] wcscpy (in: _Dest=0x38a8a28, _Source="C:\\588bce7c90097ed212\\header.bmp" | out: _Dest="C:\\588bce7c90097ed212\\header.bmp") returned="C:\\588bce7c90097ed212\\header.bmp" [0076.130] wcscat (in: _Dest=0x38a8a28, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\588bce7c90097ed212\\header.bmp.mailto[knoocknoo@cock.li].a0a70") returned="C:\\588bce7c90097ed212\\header.bmp.mailto[knoocknoo@cock.li].a0a70" [0076.130] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\588bce7c90097ed212\\header.bmp.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x7aefb90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\588bce7c90097ed212\\header.bmp.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.130] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x98) returned 0x5426368 Thread: id = 96 os_tid = 0xd0c [0071.155] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz")) returned 0x80 [0072.426] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz", dwFileAttributes=0x20) returned 1 [0075.552] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xca8 [0075.552] GetFileSizeEx (in: hFile=0xca8, lpFileSize=0x7b6fc1c | out: lpFileSize=0x7b6fc1c*=181483595) returned 1 [0075.552] SetFilePointerEx (in: hFile=0xca8, liDistanceToMove=0xad13847, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.552] ReadFile (in: hFile=0xca8, lpBuffer=0x7b6fba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x7b6fb9c, lpOverlapped=0x0 | out: lpBuffer=0x7b6fba0*, lpNumberOfBytesRead=0x7b6fb9c*=0x4, lpOverlapped=0x0) returned 1 [0075.556] SetFilePointerEx (in: hFile=0xca8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.556] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4fe0 [0075.556] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5058 [0075.556] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5260 [0075.556] NtQuerySystemTime (in: CurrentTime=0x7b6fb7c | out: CurrentTime=0x7b6fb7c*=132260136327147589) returned 0x0 [0075.556] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0x792a3594 [0075.556] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0x141e77e [0075.556] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0x9222d5f1 [0075.557] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0x97e5ec37 [0075.557] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0xba9fd6a4 [0075.557] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0x2e4f05cb [0075.557] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0xf4a94246 [0075.557] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0x466cbdc1 [0075.557] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0x38a381fc [0075.557] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0xc6856e89 [0075.557] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0x3fc4746f [0075.557] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0xd154fd45 [0075.557] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0xe369cda7 [0075.557] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0x9b215ebd [0075.557] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0xa52a4d2a [0075.557] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0x15973867 [0075.557] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0x8be6e621 [0075.557] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0xafbcecfb [0075.557] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0x1528f5c1 [0075.557] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0x8d035e76 [0075.557] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0xfbd70300 [0075.557] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0xc05de4bd [0075.557] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0x6eb6661c [0075.557] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0xe66ea69e [0075.557] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0x6449fff2 [0075.557] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0x4e5ed420 [0075.557] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0xd87b6ad [0075.557] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0xf2284e17 [0075.557] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0x92c69c84 [0075.557] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0xf801993 [0075.557] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0xe5e37991 [0075.557] RtlRandom (in: Seed=0x7b6fb88 | out: Seed=0x7b6fb88) returned 0xb1f18f54 [0075.567] SetFilePointerEx (in: hFile=0xca8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.567] ReadFile (in: hFile=0xca8, lpBuffer=0x54a4fe8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x7b6fb34, lpOverlapped=0x0 | out: lpBuffer=0x54a4fe8*, lpNumberOfBytesRead=0x7b6fb34*=0xc800, lpOverlapped=0x0) returned 1 [0075.627] SetFilePointerEx (in: hFile=0xca8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.627] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a6388 [0075.627] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497160 [0075.627] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559bb8 [0075.627] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559bb8) returned 1 [0075.628] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x558c090 [0075.631] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55599b0 [0075.631] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559ac8 [0075.631] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ac8) returned 1 [0075.631] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497160) returned 1 [0075.631] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6388) returned 1 [0075.631] WriteFile (in: hFile=0xca8, lpBuffer=0x558c090*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x7b6fb34, lpOverlapped=0x0 | out: lpBuffer=0x558c090*, lpNumberOfBytesWritten=0x7b6fb34*=0xc800, lpOverlapped=0x0) returned 1 [0076.146] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x558c090) returned 1 [0076.149] SetFilePointerEx (in: hFile=0xca8, liDistanceToMove=0x5692800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.149] ReadFile (in: hFile=0xca8, lpBuffer=0x54a4fe8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x7b6fb34, lpOverlapped=0x0 | out: lpBuffer=0x54a4fe8*, lpNumberOfBytesRead=0x7b6fb34*=0xc800, lpOverlapped=0x0) returned 1 [0076.166] SetFilePointerEx (in: hFile=0xca8, liDistanceToMove=0x5692800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.166] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a63d0 [0076.166] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0076.166] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c30 [0076.166] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559c30) returned 1 [0076.167] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x54b17f0 [0076.170] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a50 [0076.170] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c80 [0076.170] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559c80) returned 1 [0076.170] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.170] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a63d0) returned 1 [0076.170] WriteFile (in: hFile=0xca8, lpBuffer=0x54b17f0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x7b6fb34, lpOverlapped=0x0 | out: lpBuffer=0x54b17f0*, lpNumberOfBytesWritten=0x7b6fb34*=0xc800, lpOverlapped=0x0) returned 1 [0076.176] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b17f0) returned 1 [0076.176] SetFilePointerEx (in: hFile=0xca8, liDistanceToMove=0xad0704b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.176] ReadFile (in: hFile=0xca8, lpBuffer=0x54a4fe8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x7b6fb34, lpOverlapped=0x0 | out: lpBuffer=0x54a4fe8*, lpNumberOfBytesRead=0x7b6fb34*=0xc800, lpOverlapped=0x0) returned 1 [0076.178] SetFilePointerEx (in: hFile=0xca8, liDistanceToMove=0xad0704b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.178] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a63d0 [0076.178] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5496e90 [0076.178] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559898 [0076.178] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559898) returned 1 [0076.179] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x54b17f0 [0076.179] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c30 [0076.179] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55599d8 [0076.180] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55599d8) returned 1 [0076.180] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496e90) returned 1 [0076.180] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a63d0) returned 1 [0076.180] WriteFile (in: hFile=0xca8, lpBuffer=0x54b17f0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x7b6fb34, lpOverlapped=0x0 | out: lpBuffer=0x54b17f0*, lpNumberOfBytesWritten=0x7b6fb34*=0xc800, lpOverlapped=0x0) returned 1 [0076.188] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b17f0) returned 1 [0076.188] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x54b1d68 [0076.188] SetFilePointerEx (in: hFile=0xca8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.188] WriteFile (in: hFile=0xca8, lpBuffer=0x54a2c50*, nNumberOfBytesToWrite=0x14d, lpNumberOfBytesWritten=0x7b6fbdc, lpOverlapped=0x0 | out: lpBuffer=0x54a2c50*, lpNumberOfBytesWritten=0x7b6fbdc*=0x14d, lpOverlapped=0x0) returned 1 [0076.191] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a2c50) returned 1 [0076.191] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5531fc0) returned 1 [0076.191] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a50) returned 1 [0076.191] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5531f18) returned 1 [0076.191] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b1d68) returned 1 [0076.191] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5058) returned 1 [0076.191] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5170) returned 1 [0076.191] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a50f8) returned 1 [0076.191] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8a) returned 0x549f990 [0076.191] wcscpy (in: _Dest=0x549f990, _Source="C:\\588bce7c90097ed212\\netfx_Core.mzz" | out: _Dest="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned="C:\\588bce7c90097ed212\\netfx_Core.mzz" [0076.191] wcscat (in: _Dest=0x549f990, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\588bce7c90097ed212\\netfx_Core.mzz.mailto[knoocknoo@cock.li].a0a70") returned="C:\\588bce7c90097ed212\\netfx_Core.mzz.mailto[knoocknoo@cock.li].a0a70" [0076.191] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\588bce7c90097ed212\\netfx_Core.mzz.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x7b6fb94, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\588bce7c90097ed212\\netfx_Core.mzz.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.191] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa0) returned 0x54a0d50 Thread: id = 97 os_tid = 0xd6c [0071.155] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz")) returned 0x20 [0072.426] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz", dwFileAttributes=0x20) returned 1 [0075.182] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xca4 [0075.182] GetFileSizeEx (in: hFile=0xca4, lpFileSize=0x7bef8e4 | out: lpFileSize=0x7bef8e4*=43131591) returned 1 [0075.182] SetFilePointerEx (in: hFile=0xca4, liDistanceToMove=0x29222c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.182] ReadFile (in: hFile=0xca4, lpBuffer=0x7bef868, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x7bef864, lpOverlapped=0x0 | out: lpBuffer=0x7bef868*, lpNumberOfBytesRead=0x7bef864*=0x4, lpOverlapped=0x0) returned 1 [0075.184] SetFilePointerEx (in: hFile=0xca4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.184] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a50a8 [0075.184] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a51c0 [0075.184] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5030 [0075.184] NtQuerySystemTime (in: CurrentTime=0x7bef844 | out: CurrentTime=0x7bef844*=132260136323397636) returned 0x0 [0075.184] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0xebe2185d [0075.184] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0x3d5118aa [0075.184] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0xbea3e528 [0075.184] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0xa2a1acaf [0075.184] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0xf1ca66fa [0075.184] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0x348e8275 [0075.184] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0x620ecc65 [0075.184] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0xa05d8035 [0075.184] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0x49ea61a5 [0075.184] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0xbd9cc7f4 [0075.184] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0x8061a2cb [0075.184] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0xdebc22e3 [0075.184] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0xa97d9a20 [0075.184] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0xa0dcf3bc [0075.184] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0xd76e8a2c [0075.184] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0xdeda05d1 [0075.184] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0x230bfb76 [0075.184] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0x11f9eafe [0075.184] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0xfeb0a0d9 [0075.184] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0x22c8aeb6 [0075.185] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0x9508f5d5 [0075.185] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0xe10e3262 [0075.185] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0x4443afd1 [0075.185] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0xbe18a0ae [0075.185] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0xf7344b2c [0075.185] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0xb17c842a [0075.185] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0x73835086 [0075.185] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0x32831e51 [0075.185] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0xad12a1ea [0075.185] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0x9ff8ed2b [0075.185] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0x2f2c4aaf [0075.185] RtlRandom (in: Seed=0x7bef850 | out: Seed=0x7bef850) returned 0x80be7c07 [0075.196] SetFilePointerEx (in: hFile=0xca4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.196] ReadFile (in: hFile=0xca4, lpBuffer=0x54f2018, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x7bef7fc, lpOverlapped=0x0 | out: lpBuffer=0x54f2018*, lpNumberOfBytesRead=0x7bef7fc*=0xc800, lpOverlapped=0x0) returned 1 [0075.198] SetFilePointerEx (in: hFile=0xca4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.198] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5da0 [0075.198] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5467d28 [0075.198] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5030 [0075.198] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5030) returned 1 [0075.199] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x54fe820 [0075.202] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a51e8 [0075.202] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5210 [0075.202] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5210) returned 1 [0075.202] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5467d28) returned 1 [0075.202] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5da0) returned 1 [0075.202] WriteFile (in: hFile=0xca4, lpBuffer=0x54fe820*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x7bef7fc, lpOverlapped=0x0 | out: lpBuffer=0x54fe820*, lpNumberOfBytesWritten=0x7bef7fc*=0xc800, lpOverlapped=0x0) returned 1 [0075.213] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54fe820) returned 1 [0075.213] SetFilePointerEx (in: hFile=0xca4, liDistanceToMove=0x149b000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.213] ReadFile (in: hFile=0xca4, lpBuffer=0x54f2018, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x7bef7fc, lpOverlapped=0x0 | out: lpBuffer=0x54f2018*, lpNumberOfBytesRead=0x7bef7fc*=0xc800, lpOverlapped=0x0) returned 1 [0075.214] SetFilePointerEx (in: hFile=0xca4, liDistanceToMove=0x149b000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.214] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a64f0 [0075.214] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5467d28 [0075.215] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4fb8 [0075.215] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4fb8) returned 1 [0075.215] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x54fe820 [0075.216] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a50a8 [0075.216] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4e00 [0075.216] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e00) returned 1 [0075.216] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5467d28) returned 1 [0075.216] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a64f0) returned 1 [0075.216] WriteFile (in: hFile=0xca4, lpBuffer=0x54fe820*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x7bef7fc, lpOverlapped=0x0 | out: lpBuffer=0x54fe820*, lpNumberOfBytesWritten=0x7bef7fc*=0xc800, lpOverlapped=0x0) returned 1 [0075.218] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54fe820) returned 1 [0075.218] SetFilePointerEx (in: hFile=0xca4, liDistanceToMove=0x2915ac7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.218] ReadFile (in: hFile=0xca4, lpBuffer=0x54f2018, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x7bef7fc, lpOverlapped=0x0 | out: lpBuffer=0x54f2018*, lpNumberOfBytesRead=0x7bef7fc*=0xc800, lpOverlapped=0x0) returned 1 [0075.229] SetFilePointerEx (in: hFile=0xca4, liDistanceToMove=0x2915ac7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.229] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a6340 [0075.229] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x54679e0 [0075.229] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4fb8 [0075.229] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4fb8) returned 1 [0075.230] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x54fe820 [0075.230] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4fb8 [0075.230] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5148 [0075.230] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5148) returned 1 [0075.230] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54679e0) returned 1 [0075.230] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6340) returned 1 [0075.230] WriteFile (in: hFile=0xca4, lpBuffer=0x54fe820*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x7bef7fc, lpOverlapped=0x0 | out: lpBuffer=0x54fe820*, lpNumberOfBytesWritten=0x7bef7fc*=0xc800, lpOverlapped=0x0) returned 1 [0076.076] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54fe820) returned 1 [0076.076] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x549c0f0 [0076.076] SetFilePointerEx (in: hFile=0xca4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.076] WriteFile (in: hFile=0xca4, lpBuffer=0x549cb18*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x7bef8a4, lpOverlapped=0x0 | out: lpBuffer=0x549cb18*, lpNumberOfBytesWritten=0x7bef8a4*=0x155, lpOverlapped=0x0) returned 1 [0076.077] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549cb18) returned 1 [0076.077] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389e8c0) returned 1 [0076.077] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559b40) returned 1 [0076.077] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389ebc0) returned 1 [0076.077] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549c0f0) returned 1 [0076.077] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a51c0) returned 1 [0076.077] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a50d0) returned 1 [0076.077] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5120) returned 1 [0076.077] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x92) returned 0x5426f48 [0076.077] wcscpy (in: _Dest=0x5426f48, _Source="C:\\588bce7c90097ed212\\netfx_Extended.mzz" | out: _Dest="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned="C:\\588bce7c90097ed212\\netfx_Extended.mzz" [0076.078] wcscat (in: _Dest=0x5426f48, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\588bce7c90097ed212\\netfx_Extended.mzz.mailto[knoocknoo@cock.li].a0a70") returned="C:\\588bce7c90097ed212\\netfx_Extended.mzz.mailto[knoocknoo@cock.li].a0a70" [0076.078] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x7bef85c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\588bce7c90097ed212\\netfx_Extended.mzz.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.078] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa8) returned 0x54df0b0 Thread: id = 98 os_tid = 0x126c [0071.227] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2e) returned 0x38b7810 [0071.227] wcscpy (in: _Dest=0x38b7810, _Source="C:\\ProgramData\\Adobe" | out: _Dest="C:\\ProgramData\\Adobe") returned="C:\\ProgramData\\Adobe" [0071.227] wcscat (in: _Dest=0x38b7810, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\") returned="C:\\ProgramData\\Adobe\\" [0071.227] wcscat (in: _Dest=0x38b7810, _Source="*" | out: _Dest="C:\\ProgramData\\Adobe\\*") returned="C:\\ProgramData\\Adobe\\*" [0071.227] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542dc00 [0071.228] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\*", lpFindFileData=0x542dc00 | out: lpFindFileData=0x542dc00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4511a9a6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e7c0 [0071.228] wcscmp (_String1=".", _String2=".") returned 0 [0071.228] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x542dc00 | out: lpFindFileData=0x542dc00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4511a9a6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.228] wcscmp (_String1="..", _String2=".") returned 1 [0071.228] wcscmp (_String1="..", _String2="..") returned 0 [0071.228] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x542dc00 | out: lpFindFileData=0x542dc00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 1 [0071.228] wcscmp (_String1="ARM", _String2=".") returned 1 [0071.228] wcscmp (_String1="ARM", _String2="..") returned 1 [0071.228] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x32) returned 0x389eb40 [0071.228] wcscpy (in: _Dest=0x389eb40, _Source="C:\\ProgramData\\Adobe" | out: _Dest="C:\\ProgramData\\Adobe") returned="C:\\ProgramData\\Adobe" [0071.228] wcscat (in: _Dest=0x389eb40, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\") returned="C:\\ProgramData\\Adobe\\" [0071.228] wcscat (in: _Dest=0x389eb40, _Source="ARM" | out: _Dest="C:\\ProgramData\\Adobe\\ARM") returned="C:\\ProgramData\\Adobe\\ARM" [0071.377] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389eb40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x554 [0071.378] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x542dc00 | out: lpFindFileData=0x542dc00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 0 [0071.378] FindClose (in: hFindFile=0x389e7c0 | out: hFindFile=0x389e7c0) returned 1 [0071.378] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542dc00) returned 1 [0071.378] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b7810) returned 1 [0071.378] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5408800) returned 1 Thread: id = 99 os_tid = 0x37c [0071.229] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x543e9d8 [0071.229] wcscpy (in: _Dest=0x543e9d8, _Source="C:\\ProgramData\\Application Data" | out: _Dest="C:\\ProgramData\\Application Data") returned="C:\\ProgramData\\Application Data" [0071.229] wcscat (in: _Dest=0x543e9d8, _Source="\\" | out: _Dest="C:\\ProgramData\\Application Data\\") returned="C:\\ProgramData\\Application Data\\" [0071.229] wcscat (in: _Dest=0x543e9d8, _Source="*" | out: _Dest="C:\\ProgramData\\Application Data\\*") returned="C:\\ProgramData\\Application Data\\*" [0071.229] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542e0d0 [0071.229] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Application Data\\*", lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0071.229] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542e0d0) returned 1 [0071.229] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x543e9d8) returned 1 [0071.229] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a56e0) returned 1 Thread: id = 100 os_tid = 0x11e8 [0071.230] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2e) returned 0x38b7848 [0071.230] wcscpy (in: _Dest=0x38b7848, _Source="C:\\ProgramData\\Comms" | out: _Dest="C:\\ProgramData\\Comms") returned="C:\\ProgramData\\Comms" [0071.230] wcscat (in: _Dest=0x38b7848, _Source="\\" | out: _Dest="C:\\ProgramData\\Comms\\") returned="C:\\ProgramData\\Comms\\" [0071.230] wcscat (in: _Dest=0x38b7848, _Source="*" | out: _Dest="C:\\ProgramData\\Comms\\*") returned="C:\\ProgramData\\Comms\\*" [0071.230] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542e0d0 [0071.230] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Comms\\*", lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e8c0 [0071.231] wcscmp (_String1=".", _String2=".") returned 0 [0071.231] FindNextFileW (in: hFindFile=0x389e8c0, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.231] wcscmp (_String1="..", _String2=".") returned 1 [0071.231] wcscmp (_String1="..", _String2="..") returned 0 [0071.231] FindNextFileW (in: hFindFile=0x389e8c0, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0071.231] FindClose (in: hFindFile=0x389e8c0 | out: hFindFile=0x389e8c0) returned 1 [0071.231] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542e0d0) returned 1 [0071.231] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b7848) returned 1 [0071.231] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5408838) returned 1 Thread: id = 101 os_tid = 0x11ec [0071.232] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x32) returned 0x389e8c0 [0071.232] wcscpy (in: _Dest=0x389e8c0, _Source="C:\\ProgramData\\Desktop" | out: _Dest="C:\\ProgramData\\Desktop") returned="C:\\ProgramData\\Desktop" [0071.232] wcscat (in: _Dest=0x389e8c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Desktop\\") returned="C:\\ProgramData\\Desktop\\" [0071.232] wcscat (in: _Dest=0x389e8c0, _Source="*" | out: _Dest="C:\\ProgramData\\Desktop\\*") returned="C:\\ProgramData\\Desktop\\*" [0071.232] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542e0d0 [0071.232] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Desktop\\*", lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0071.233] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542e0d0) returned 1 [0071.233] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389e8c0) returned 1 [0071.233] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5408ad8) returned 1 Thread: id = 102 os_tid = 0x11e0 [0071.234] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389e8c0 [0071.234] wcscpy (in: _Dest=0x389e8c0, _Source="C:\\ProgramData\\Documents" | out: _Dest="C:\\ProgramData\\Documents") returned="C:\\ProgramData\\Documents" [0071.234] wcscat (in: _Dest=0x389e8c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Documents\\") returned="C:\\ProgramData\\Documents\\" [0071.234] wcscat (in: _Dest=0x389e8c0, _Source="*" | out: _Dest="C:\\ProgramData\\Documents\\*") returned="C:\\ProgramData\\Documents\\*" [0071.234] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542e0d0 [0071.234] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Documents\\*", lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0071.234] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542e0d0) returned 1 [0071.234] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389e8c0) returned 1 [0071.234] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389e940) returned 1 Thread: id = 103 os_tid = 0x11e4 [0071.235] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389e8c0 [0071.235] wcscpy (in: _Dest=0x389e8c0, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.235] wcscat (in: _Dest=0x389e8c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.235] wcscat (in: _Dest=0x389e8c0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\*") returned="C:\\ProgramData\\Microsoft\\*" [0071.235] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542e0d0 [0071.235] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\*", lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e900 [0071.235] wcscmp (_String1=".", _String2=".") returned 0 [0071.235] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.235] wcscmp (_String1="..", _String2=".") returned 1 [0071.235] wcscmp (_String1="..", _String2="..") returned 0 [0071.235] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppV", cAlternateFileName="")) returned 1 [0071.235] wcscmp (_String1="AppV", _String2=".") returned 1 [0071.235] wcscmp (_String1="AppV", _String2="..") returned 1 [0071.235] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3c) returned 0x38a5920 [0071.235] wcscpy (in: _Dest=0x38a5920, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.235] wcscat (in: _Dest=0x38a5920, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.235] wcscat (in: _Dest=0x38a5920, _Source="AppV" | out: _Dest="C:\\ProgramData\\Microsoft\\AppV") returned="C:\\ProgramData\\Microsoft\\AppV" [0071.344] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a5920, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x558 [0071.344] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfa011b19, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfa011b19, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1 [0071.344] wcscmp (_String1="ClickToRun", _String2=".") returned 1 [0071.345] wcscmp (_String1="ClickToRun", _String2="..") returned 1 [0071.345] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x38b36d8 [0071.345] wcscpy (in: _Dest=0x38b36d8, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.345] wcscat (in: _Dest=0x38b36d8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.345] wcscat (in: _Dest=0x38b36d8, _Source="ClickToRun" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun") returned="C:\\ProgramData\\Microsoft\\ClickToRun" [0071.345] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b36d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x610 [0071.345] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1 [0071.345] wcscmp (_String1="Crypto", _String2=".") returned 1 [0071.345] wcscmp (_String1="Crypto", _String2="..") returned 1 [0071.345] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x537b5f0 [0071.346] wcscpy (in: _Dest=0x537b5f0, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.346] wcscat (in: _Dest=0x537b5f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.346] wcscat (in: _Dest=0x537b5f0, _Source="Crypto" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto" [0071.346] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x537b5f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x614 [0071.346] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataMart", cAlternateFileName="")) returned 1 [0071.346] wcscmp (_String1="DataMart", _String2=".") returned 1 [0071.346] wcscmp (_String1="DataMart", _String2="..") returned 1 [0071.346] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x38b3728 [0071.346] wcscpy (in: _Dest=0x38b3728, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.346] wcscat (in: _Dest=0x38b3728, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.346] wcscat (in: _Dest=0x38b3728, _Source="DataMart" | out: _Dest="C:\\ProgramData\\Microsoft\\DataMart") returned="C:\\ProgramData\\Microsoft\\DataMart" [0071.347] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b3728, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x618 [0071.347] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1 [0071.347] wcscmp (_String1="Device Stage", _String2=".") returned 1 [0071.347] wcscmp (_String1="Device Stage", _String2="..") returned 1 [0071.347] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x541b888 [0071.347] wcscpy (in: _Dest=0x541b888, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.347] wcscat (in: _Dest=0x541b888, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.347] wcscat (in: _Dest=0x541b888, _Source="Device Stage" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage") returned="C:\\ProgramData\\Microsoft\\Device Stage" [0071.347] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x541b888, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x61c [0071.348] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1 [0071.348] wcscmp (_String1="DeviceSync", _String2=".") returned 1 [0071.348] wcscmp (_String1="DeviceSync", _String2="..") returned 1 [0071.348] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x543e708 [0071.348] wcscpy (in: _Dest=0x543e708, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.348] wcscat (in: _Dest=0x543e708, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.348] wcscat (in: _Dest=0x543e708, _Source="DeviceSync" | out: _Dest="C:\\ProgramData\\Microsoft\\DeviceSync") returned="C:\\ProgramData\\Microsoft\\DeviceSync" [0071.348] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x543e708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620 [0071.349] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnosis", cAlternateFileName="DIAGNO~1")) returned 1 [0071.349] wcscmp (_String1="Diagnosis", _String2=".") returned 1 [0071.349] wcscmp (_String1="Diagnosis", _String2="..") returned 1 [0071.349] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x46) returned 0x543e668 [0071.349] wcscpy (in: _Dest=0x543e668, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.349] wcscat (in: _Dest=0x543e668, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.349] wcscat (in: _Dest=0x543e668, _Source="Diagnosis" | out: _Dest="C:\\ProgramData\\Microsoft\\Diagnosis") returned="C:\\ProgramData\\Microsoft\\Diagnosis" [0071.349] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x543e668, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x624 [0071.350] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1 [0071.350] wcscmp (_String1="DRM", _String2=".") returned 1 [0071.350] wcscmp (_String1="DRM", _String2="..") returned 1 [0071.350] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x537b518 [0071.350] wcscpy (in: _Dest=0x537b518, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.350] wcscat (in: _Dest=0x537b518, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.350] wcscat (in: _Dest=0x537b518, _Source="DRM" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM") returned="C:\\ProgramData\\Microsoft\\DRM" [0071.350] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x537b518, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x628 [0071.351] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x40368daa, ftLastAccessTime.dwHighDateTime=0x1d39f5f, ftLastWriteTime.dwLowDateTime=0x40368daa, ftLastWriteTime.dwHighDateTime=0x1d39f5f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0071.351] wcscmp (_String1="Event Viewer", _String2=".") returned 1 [0071.351] wcscmp (_String1="Event Viewer", _String2="..") returned 1 [0071.351] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x541b2b0 [0071.351] wcscpy (in: _Dest=0x541b2b0, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.351] wcscat (in: _Dest=0x541b2b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.351] wcscat (in: _Dest=0x541b2b0, _Source="Event Viewer" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer") returned="C:\\ProgramData\\Microsoft\\Event Viewer" [0071.351] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x541b2b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x62c [0071.352] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1 [0071.352] wcscmp (_String1="IdentityCRL", _String2=".") returned 1 [0071.352] wcscmp (_String1="IdentityCRL", _String2="..") returned 1 [0071.352] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x541b468 [0071.352] wcscpy (in: _Dest=0x541b468, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.352] wcscat (in: _Dest=0x541b468, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.352] wcscat (in: _Dest=0x541b468, _Source="IdentityCRL" | out: _Dest="C:\\ProgramData\\Microsoft\\IdentityCRL") returned="C:\\ProgramData\\Microsoft\\IdentityCRL" [0071.352] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x541b468, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x630 [0071.353] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MapData", cAlternateFileName="")) returned 1 [0071.353] wcscmp (_String1="MapData", _String2=".") returned 1 [0071.353] wcscmp (_String1="MapData", _String2="..") returned 1 [0071.353] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x42) returned 0x543e7f8 [0071.353] wcscpy (in: _Dest=0x543e7f8, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.353] wcscat (in: _Dest=0x543e7f8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.353] wcscat (in: _Dest=0x543e7f8, _Source="MapData" | out: _Dest="C:\\ProgramData\\Microsoft\\MapData") returned="C:\\ProgramData\\Microsoft\\MapData" [0071.353] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x543e7f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x634 [0071.354] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80d7aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MF", cAlternateFileName="")) returned 1 [0071.354] wcscmp (_String1="MF", _String2=".") returned 1 [0071.354] wcscmp (_String1="MF", _String2="..") returned 1 [0071.354] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x38) returned 0x5445400 [0071.354] wcscpy (in: _Dest=0x5445400, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.354] wcscat (in: _Dest=0x5445400, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.354] wcscat (in: _Dest=0x5445400, _Source="MF" | out: _Dest="C:\\ProgramData\\Microsoft\\MF") returned="C:\\ProgramData\\Microsoft\\MF" [0071.354] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5445400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x638 [0071.355] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1 [0071.355] wcscmp (_String1="NetFramework", _String2=".") returned 1 [0071.355] wcscmp (_String1="NetFramework", _String2="..") returned 1 [0071.355] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x541b570 [0071.355] wcscpy (in: _Dest=0x541b570, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.355] wcscat (in: _Dest=0x541b570, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.355] wcscat (in: _Dest=0x541b570, _Source="NetFramework" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework") returned="C:\\ProgramData\\Microsoft\\NetFramework" [0071.355] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x541b570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x63c [0071.356] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0071.356] wcscmp (_String1="Network", _String2=".") returned 1 [0071.356] wcscmp (_String1="Network", _String2="..") returned 1 [0071.356] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x42) returned 0x543e6b8 [0071.356] wcscpy (in: _Dest=0x543e6b8, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.356] wcscat (in: _Dest=0x543e6b8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.356] wcscat (in: _Dest=0x543e6b8, _Source="Network" | out: _Dest="C:\\ProgramData\\Microsoft\\Network") returned="C:\\ProgramData\\Microsoft\\Network" [0071.356] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x543e6b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x640 [0071.356] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0071.356] wcscmp (_String1="Office", _String2=".") returned 1 [0071.356] wcscmp (_String1="Office", _String2="..") returned 1 [0071.357] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x537b170 [0071.357] wcscpy (in: _Dest=0x537b170, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.357] wcscat (in: _Dest=0x537b170, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.357] wcscat (in: _Dest=0x537b170, _Source="Office" | out: _Dest="C:\\ProgramData\\Microsoft\\Office") returned="C:\\ProgramData\\Microsoft\\Office" [0071.357] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x537b170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x644 [0071.357] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfee8021d, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfee8021d, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Provisioning", cAlternateFileName="PROVIS~1")) returned 1 [0071.357] wcscmp (_String1="Provisioning", _String2=".") returned 1 [0071.357] wcscmp (_String1="Provisioning", _String2="..") returned 1 [0071.357] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x541b518 [0071.357] wcscpy (in: _Dest=0x541b518, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.357] wcscat (in: _Dest=0x541b518, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.357] wcscat (in: _Dest=0x541b518, _Source="Provisioning" | out: _Dest="C:\\ProgramData\\Microsoft\\Provisioning") returned="C:\\ProgramData\\Microsoft\\Provisioning" [0071.358] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541b518) returned 1 [0071.358] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb79dd84e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb7a500e7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb7a500e7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1 [0071.358] wcscmp (_String1="Search", _String2=".") returned 1 [0071.358] wcscmp (_String1="Search", _String2="..") returned 1 [0071.358] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x537b200 [0071.358] wcscpy (in: _Dest=0x537b200, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.358] wcscat (in: _Dest=0x537b200, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.358] wcscat (in: _Dest=0x537b200, _Source="Search" | out: _Dest="C:\\ProgramData\\Microsoft\\Search") returned="C:\\ProgramData\\Microsoft\\Search" [0071.358] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x537b200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x648 [0071.359] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30e3b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0071.359] wcscmp (_String1="Settings", _String2=".") returned 1 [0071.359] wcscmp (_String1="Settings", _String2="..") returned 1 [0071.359] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x543e9d8 [0071.359] wcscpy (in: _Dest=0x543e9d8, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.359] wcscat (in: _Dest=0x543e9d8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.359] wcscat (in: _Dest=0x543e9d8, _Source="Settings" | out: _Dest="C:\\ProgramData\\Microsoft\\Settings") returned="C:\\ProgramData\\Microsoft\\Settings" [0071.359] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x543e9d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64c [0071.359] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dcfea0a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1dcfea0a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmsRouter", cAlternateFileName="SMSROU~1")) returned 1 [0071.360] wcscmp (_String1="SmsRouter", _String2=".") returned 1 [0071.360] wcscmp (_String1="SmsRouter", _String2="..") returned 1 [0071.360] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x46) returned 0x543e898 [0071.360] wcscpy (in: _Dest=0x543e898, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.360] wcscat (in: _Dest=0x543e898, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.360] wcscat (in: _Dest=0x543e898, _Source="SmsRouter" | out: _Dest="C:\\ProgramData\\Microsoft\\SmsRouter") returned="C:\\ProgramData\\Microsoft\\SmsRouter" [0071.360] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x543e898, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x650 [0071.360] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spectrum", cAlternateFileName="")) returned 1 [0071.360] wcscmp (_String1="Spectrum", _String2=".") returned 1 [0071.360] wcscmp (_String1="Spectrum", _String2="..") returned 1 [0071.360] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x543e758 [0071.361] wcscpy (in: _Dest=0x543e758, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.361] wcscat (in: _Dest=0x543e758, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.361] wcscat (in: _Dest=0x543e758, _Source="Spectrum" | out: _Dest="C:\\ProgramData\\Microsoft\\Spectrum") returned="C:\\ProgramData\\Microsoft\\Spectrum" [0071.361] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x543e758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x654 [0071.361] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech_OneCore", cAlternateFileName="SPEECH~1")) returned 1 [0071.361] wcscmp (_String1="Speech_OneCore", _String2=".") returned 1 [0071.361] wcscmp (_String1="Speech_OneCore", _String2="..") returned 1 [0071.361] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x541b518 [0071.361] wcscpy (in: _Dest=0x541b518, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.361] wcscat (in: _Dest=0x541b518, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.361] wcscat (in: _Dest=0x541b518, _Source="Speech_OneCore" | out: _Dest="C:\\ProgramData\\Microsoft\\Speech_OneCore") returned="C:\\ProgramData\\Microsoft\\Speech_OneCore" [0071.362] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x541b518, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x658 [0071.362] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xcb4dcad0, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Storage Health", cAlternateFileName="STORAG~1")) returned 1 [0071.362] wcscmp (_String1="Storage Health", _String2=".") returned 1 [0071.362] wcscmp (_String1="Storage Health", _String2="..") returned 1 [0071.362] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x541b5c8 [0071.362] wcscpy (in: _Dest=0x541b5c8, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.362] wcscat (in: _Dest=0x541b5c8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.363] wcscat (in: _Dest=0x541b5c8, _Source="Storage Health" | out: _Dest="C:\\ProgramData\\Microsoft\\Storage Health") returned="C:\\ProgramData\\Microsoft\\Storage Health" [0071.363] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x541b5c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c [0071.364] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe3615f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UEV", cAlternateFileName="")) returned 1 [0071.364] wcscmp (_String1="UEV", _String2=".") returned 1 [0071.364] wcscmp (_String1="UEV", _String2="..") returned 1 [0071.364] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x537b3b0 [0071.364] wcscpy (in: _Dest=0x537b3b0, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.364] wcscat (in: _Dest=0x537b3b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.364] wcscat (in: _Dest=0x537b3b0, _Source="UEV" | out: _Dest="C:\\ProgramData\\Microsoft\\UEV") returned="C:\\ProgramData\\Microsoft\\UEV" [0071.364] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x537b3b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x660 [0071.365] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbaae4059, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xbaae4059, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1 [0071.365] wcscmp (_String1="User Account Pictures", _String2=".") returned 1 [0071.365] wcscmp (_String1="User Account Pictures", _String2="..") returned 1 [0071.365] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x541b010 [0071.365] wcscpy (in: _Dest=0x541b010, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.365] wcscat (in: _Dest=0x541b010, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.365] wcscat (in: _Dest=0x541b010, _Source="User Account Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures" [0071.365] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x541b010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x664 [0071.366] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4bcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x448126f7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0071.366] wcscmp (_String1="Vault", _String2=".") returned 1 [0071.366] wcscmp (_String1="Vault", _String2="..") returned 1 [0071.366] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3e) returned 0x537b368 [0071.366] wcscpy (in: _Dest=0x537b368, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.366] wcscat (in: _Dest=0x537b368, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.366] wcscat (in: _Dest=0x537b368, _Source="Vault" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault") returned="C:\\ProgramData\\Microsoft\\Vault" [0071.366] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x537b368, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x668 [0071.367] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDF", cAlternateFileName="")) returned 1 [0071.367] wcscmp (_String1="WDF", _String2=".") returned 1 [0071.367] wcscmp (_String1="WDF", _String2="..") returned 1 [0071.367] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x537b248 [0071.367] wcscpy (in: _Dest=0x537b248, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.367] wcscat (in: _Dest=0x537b248, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.367] wcscat (in: _Dest=0x537b248, _Source="WDF" | out: _Dest="C:\\ProgramData\\Microsoft\\WDF") returned="C:\\ProgramData\\Microsoft\\WDF" [0071.367] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x537b248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0071.368] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xedcf5f61, ftLastAccessTime.dwHighDateTime=0x1d336d9, ftLastWriteTime.dwLowDateTime=0xedcf5f61, ftLastWriteTime.dwHighDateTime=0x1d336d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0071.368] wcscmp (_String1="Windows", _String2=".") returned 1 [0071.368] wcscmp (_String1="Windows", _String2="..") returned 1 [0071.368] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x42) returned 0x543e7a8 [0071.368] wcscpy (in: _Dest=0x543e7a8, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.368] wcscat (in: _Dest=0x543e7a8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.368] wcscat (in: _Dest=0x543e7a8, _Source="Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0071.368] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x543e7a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x670 [0071.369] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d4e74, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb320aac5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0071.369] wcscmp (_String1="Windows Defender", _String2=".") returned 1 [0071.369] wcscmp (_String1="Windows Defender", _String2="..") returned 1 [0071.369] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x543d5d8 [0071.369] wcscpy (in: _Dest=0x543d5d8, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.369] wcscat (in: _Dest=0x543d5d8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.369] wcscat (in: _Dest=0x543d5d8, _Source="Windows Defender" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows Defender") returned="C:\\ProgramData\\Microsoft\\Windows Defender" [0071.369] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x543d5d8) returned 1 [0071.369] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a90a48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender Advanced Threat Protection", cAlternateFileName="WIF4A9~1")) returned 1 [0071.369] wcscmp (_String1="Windows Defender Advanced Threat Protection", _String2=".") returned 1 [0071.369] wcscmp (_String1="Windows Defender Advanced Threat Protection", _String2="..") returned 1 [0071.369] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8a) returned 0x38a76f8 [0071.369] wcscpy (in: _Dest=0x38a76f8, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.369] wcscat (in: _Dest=0x38a76f8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.369] wcscat (in: _Dest=0x38a76f8, _Source="Windows Defender Advanced Threat Protection" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection") returned="C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection" [0071.369] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a76f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x674 [0071.371] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a928fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~2")) returned 1 [0071.371] wcscmp (_String1="Windows Live", _String2=".") returned 1 [0071.371] wcscmp (_String1="Windows Live", _String2="..") returned 1 [0071.371] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x5428768 [0071.372] wcscpy (in: _Dest=0x5428768, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.372] wcscat (in: _Dest=0x5428768, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.372] wcscat (in: _Dest=0x5428768, _Source="Windows Live" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows Live") returned="C:\\ProgramData\\Microsoft\\Windows Live" [0071.372] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5428768, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x678 [0071.372] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a93496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~3")) returned 1 [0071.372] wcscmp (_String1="Windows NT", _String2=".") returned 1 [0071.372] wcscmp (_String1="Windows NT", _String2="..") returned 1 [0071.373] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x5442ec0 [0071.373] wcscpy (in: _Dest=0x5442ec0, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.373] wcscat (in: _Dest=0x5442ec0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.373] wcscat (in: _Dest=0x5442ec0, _Source="Windows NT" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT") returned="C:\\ProgramData\\Microsoft\\Windows NT" [0071.373] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5442ec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x67c [0071.373] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0ef6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Security Health", cAlternateFileName="WINDOW~4")) returned 1 [0071.373] wcscmp (_String1="Windows Security Health", _String2=".") returned 1 [0071.373] wcscmp (_String1="Windows Security Health", _String2="..") returned 1 [0071.373] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x38b2258 [0071.373] wcscpy (in: _Dest=0x38b2258, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.374] wcscat (in: _Dest=0x38b2258, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.374] wcscat (in: _Dest=0x38b2258, _Source="Windows Security Health" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows Security Health") returned="C:\\ProgramData\\Microsoft\\Windows Security Health" [0071.374] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b2258, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x680 [0071.374] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMSIPC", cAlternateFileName="")) returned 1 [0071.374] wcscmp (_String1="WinMSIPC", _String2=".") returned 1 [0071.374] wcscmp (_String1="WinMSIPC", _String2="..") returned 1 [0071.374] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x5442dd0 [0071.374] wcscpy (in: _Dest=0x5442dd0, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.374] wcscat (in: _Dest=0x5442dd0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.374] wcscat (in: _Dest=0x5442dd0, _Source="WinMSIPC" | out: _Dest="C:\\ProgramData\\Microsoft\\WinMSIPC") returned="C:\\ProgramData\\Microsoft\\WinMSIPC" [0071.375] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5442dd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x684 [0071.375] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 1 [0071.375] wcscmp (_String1="WwanSvc", _String2=".") returned 1 [0071.375] wcscmp (_String1="WwanSvc", _String2="..") returned 1 [0071.375] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x42) returned 0x5442f10 [0071.375] wcscpy (in: _Dest=0x5442f10, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0071.375] wcscat (in: _Dest=0x5442f10, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0071.375] wcscat (in: _Dest=0x5442f10, _Source="WwanSvc" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc") returned="C:\\ProgramData\\Microsoft\\WwanSvc" [0071.375] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5442f10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x688 [0071.376] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 0 [0071.376] FindClose (in: hFindFile=0x389e900 | out: hFindFile=0x389e900) returned 1 [0071.376] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542e0d0) returned 1 [0071.376] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389e8c0) returned 1 [0071.376] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389e780) returned 1 Thread: id = 104 os_tid = 0xd90 [0071.236] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x543e9d8 [0071.236] wcscpy (in: _Dest=0x543e9d8, _Source="C:\\ProgramData\\Microsoft OneDrive" | out: _Dest="C:\\ProgramData\\Microsoft OneDrive") returned="C:\\ProgramData\\Microsoft OneDrive" [0071.236] wcscat (in: _Dest=0x543e9d8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft OneDrive\\") returned="C:\\ProgramData\\Microsoft OneDrive\\" [0071.236] wcscat (in: _Dest=0x543e9d8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft OneDrive\\*") returned="C:\\ProgramData\\Microsoft OneDrive\\*" [0071.236] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542e338 [0071.236] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft OneDrive\\*", lpFindFileData=0x542e338 | out: lpFindFileData=0x542e338*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e940 [0071.237] wcscmp (_String1=".", _String2=".") returned 0 [0071.237] FindNextFileW (in: hFindFile=0x389e940, lpFindFileData=0x542e338 | out: lpFindFileData=0x542e338*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.237] wcscmp (_String1="..", _String2=".") returned 1 [0071.237] wcscmp (_String1="..", _String2="..") returned 0 [0071.237] FindNextFileW (in: hFindFile=0x389e940, lpFindFileData=0x542e338 | out: lpFindFileData=0x542e338*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup", cAlternateFileName="")) returned 1 [0071.237] wcscmp (_String1="setup", _String2=".") returned 1 [0071.237] wcscmp (_String1="setup", _String2="..") returned 1 [0071.237] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x541b620 [0071.237] wcscpy (in: _Dest=0x541b620, _Source="C:\\ProgramData\\Microsoft OneDrive" | out: _Dest="C:\\ProgramData\\Microsoft OneDrive") returned="C:\\ProgramData\\Microsoft OneDrive" [0071.237] wcscat (in: _Dest=0x541b620, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft OneDrive\\") returned="C:\\ProgramData\\Microsoft OneDrive\\" [0071.237] wcscat (in: _Dest=0x541b620, _Source="setup" | out: _Dest="C:\\ProgramData\\Microsoft OneDrive\\setup") returned="C:\\ProgramData\\Microsoft OneDrive\\setup" [0071.342] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x541b620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x55c [0071.343] FindNextFileW (in: hFindFile=0x389e940, lpFindFileData=0x542e338 | out: lpFindFileData=0x542e338*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup", cAlternateFileName="")) returned 0 [0071.343] FindClose (in: hFindFile=0x389e940 | out: hFindFile=0x389e940) returned 1 [0071.343] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542e338) returned 1 [0071.343] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x543e9d8) returned 1 [0071.343] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b36d8) returned 1 Thread: id = 105 os_tid = 0xd34 [0071.237] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x30) returned 0x38b7848 [0071.237] wcscpy (in: _Dest=0x38b7848, _Source="C:\\ProgramData\\Oracle" | out: _Dest="C:\\ProgramData\\Oracle") returned="C:\\ProgramData\\Oracle" [0071.237] wcscat (in: _Dest=0x38b7848, _Source="\\" | out: _Dest="C:\\ProgramData\\Oracle\\") returned="C:\\ProgramData\\Oracle\\" [0071.237] wcscat (in: _Dest=0x38b7848, _Source="*" | out: _Dest="C:\\ProgramData\\Oracle\\*") returned="C:\\ProgramData\\Oracle\\*" [0071.237] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542e5a0 [0071.237] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\*", lpFindFileData=0x542e5a0 | out: lpFindFileData=0x542e5a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ebc0 [0071.238] wcscmp (_String1=".", _String2=".") returned 0 [0071.238] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x542e5a0 | out: lpFindFileData=0x542e5a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.238] wcscmp (_String1="..", _String2=".") returned 1 [0071.238] wcscmp (_String1="..", _String2="..") returned 0 [0071.238] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x542e5a0 | out: lpFindFileData=0x542e5a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0071.238] wcscmp (_String1="Java", _String2=".") returned 1 [0071.238] wcscmp (_String1="Java", _String2="..") returned 1 [0071.238] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389ee40 [0071.238] wcscpy (in: _Dest=0x389ee40, _Source="C:\\ProgramData\\Oracle" | out: _Dest="C:\\ProgramData\\Oracle") returned="C:\\ProgramData\\Oracle" [0071.238] wcscat (in: _Dest=0x389ee40, _Source="\\" | out: _Dest="C:\\ProgramData\\Oracle\\") returned="C:\\ProgramData\\Oracle\\" [0071.238] wcscat (in: _Dest=0x389ee40, _Source="Java" | out: _Dest="C:\\ProgramData\\Oracle\\Java") returned="C:\\ProgramData\\Oracle\\Java" [0071.341] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389ee40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x560 [0071.341] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x542e5a0 | out: lpFindFileData=0x542e5a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0 [0071.342] FindClose (in: hFindFile=0x389ebc0 | out: hFindFile=0x389ebc0) returned 1 [0071.342] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542e5a0) returned 1 [0071.342] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b7848) returned 1 [0071.342] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5408870) returned 1 Thread: id = 106 os_tid = 0x9f0 [0071.238] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3e) returned 0x38a56e0 [0071.238] wcscpy (in: _Dest=0x38a56e0, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0071.238] wcscat (in: _Dest=0x38a56e0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0071.238] wcscat (in: _Dest=0x38a56e0, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\*") returned="C:\\ProgramData\\Package Cache\\*" [0071.238] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542e808 [0071.238] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\*", lpFindFileData=0x542e808 | out: lpFindFileData=0x542e808*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445980 [0071.239] wcscmp (_String1=".", _String2=".") returned 0 [0071.239] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x542e808 | out: lpFindFileData=0x542e808*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.240] wcscmp (_String1="..", _String2=".") returned 1 [0071.240] wcscmp (_String1="..", _String2="..") returned 0 [0071.240] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x542e808 | out: lpFindFileData=0x542e808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", cAlternateFileName="{13A4E~1.210")) returned 1 [0071.240] wcscmp (_String1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", _String2=".") returned 1 [0071.240] wcscmp (_String1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", _String2="..") returned 1 [0071.240] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9e) returned 0x38ac2f8 [0071.240] wcscpy (in: _Dest=0x38ac2f8, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0071.240] wcscat (in: _Dest=0x38ac2f8, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0071.240] wcscat (in: _Dest=0x38ac2f8, _Source="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" [0071.321] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38ac2f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568 [0071.322] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x542e808 | out: lpFindFileData=0x542e808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf03b3d5, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1 [0071.322] wcscmp (_String1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", _String2=".") returned 1 [0071.322] wcscmp (_String1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", _String2="..") returned 1 [0071.322] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x88) returned 0x38a9718 [0071.322] wcscpy (in: _Dest=0x38a9718, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0071.322] wcscat (in: _Dest=0x38a9718, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0071.322] wcscat (in: _Dest=0x38a9718, _Source="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: _Dest="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0071.322] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a9718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5cc [0071.323] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x542e808 | out: lpFindFileData=0x542e808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1 [0071.323] wcscmp (_String1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", _String2=".") returned 1 [0071.323] wcscmp (_String1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", _String2="..") returned 1 [0071.323] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9e) returned 0x38ac3a0 [0071.323] wcscpy (in: _Dest=0x38ac3a0, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0071.323] wcscat (in: _Dest=0x38ac3a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0071.323] wcscat (in: _Dest=0x38ac3a0, _Source="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" [0071.323] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38ac3a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d0 [0071.324] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x542e808 | out: lpFindFileData=0x542e808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd40b2b5b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1 [0071.324] wcscmp (_String1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", _String2=".") returned 1 [0071.324] wcscmp (_String1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", _String2="..") returned 1 [0071.324] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x88) returned 0x38a8bd8 [0071.324] wcscpy (in: _Dest=0x38a8bd8, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0071.324] wcscat (in: _Dest=0x38a8bd8, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0071.324] wcscat (in: _Dest=0x38a8bd8, _Source="{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: _Dest="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0071.324] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a8bd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d4 [0071.325] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x542e808 | out: lpFindFileData=0x542e808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", cAlternateFileName="{582EA~1.250")) returned 1 [0071.325] wcscmp (_String1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", _String2=".") returned 1 [0071.325] wcscmp (_String1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", _String2="..") returned 1 [0071.325] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa0) returned 0x38ac448 [0071.325] wcscpy (in: _Dest=0x38ac448, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0071.325] wcscat (in: _Dest=0x38ac448, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0071.325] wcscat (in: _Dest=0x38ac448, _Source="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" [0071.325] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38ac448, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d8 [0071.326] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x542e808 | out: lpFindFileData=0x542e808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", cAlternateFileName="{68306~1.250")) returned 1 [0071.326] wcscmp (_String1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", _String2=".") returned 1 [0071.326] wcscmp (_String1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", _String2="..") returned 1 [0071.326] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa0) returned 0x38ac250 [0071.326] wcscpy (in: _Dest=0x38ac250, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0071.326] wcscat (in: _Dest=0x38ac250, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0071.326] wcscat (in: _Dest=0x38ac250, _Source="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" [0071.326] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38ac250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5dc [0071.327] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x542e808 | out: lpFindFileData=0x542e808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", cAlternateFileName="{8D4F7~1.250")) returned 1 [0071.327] wcscmp (_String1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", _String2=".") returned 1 [0071.327] wcscmp (_String1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", _String2="..") returned 1 [0071.327] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa0) returned 0x38ab9c8 [0071.327] wcscpy (in: _Dest=0x38ab9c8, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0071.327] wcscat (in: _Dest=0x38ab9c8, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0071.327] wcscat (in: _Dest=0x38ab9c8, _Source="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" [0071.327] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38ab9c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e0 [0071.328] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x542e808 | out: lpFindFileData=0x542e808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1 [0071.328] wcscmp (_String1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", _String2=".") returned 1 [0071.328] wcscmp (_String1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", _String2="..") returned 1 [0071.328] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9e) returned 0x38ac4f0 [0071.328] wcscpy (in: _Dest=0x38ac4f0, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0071.328] wcscat (in: _Dest=0x38ac4f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0071.328] wcscat (in: _Dest=0x38ac4f0, _Source="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" [0071.328] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38ac4f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4 [0071.329] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x542e808 | out: lpFindFileData=0x542e808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1 [0071.329] wcscmp (_String1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", _String2=".") returned 1 [0071.329] wcscmp (_String1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", _String2="..") returned 1 [0071.329] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9e) returned 0x38abe60 [0071.329] wcscpy (in: _Dest=0x38abe60, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0071.329] wcscat (in: _Dest=0x38abe60, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0071.329] wcscat (in: _Dest=0x38abe60, _Source="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" [0071.329] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38abe60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e8 [0071.330] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x542e808 | out: lpFindFileData=0x542e808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1 [0071.330] wcscmp (_String1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", _String2=".") returned 1 [0071.330] wcscmp (_String1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", _String2="..") returned 1 [0071.330] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9e) returned 0x38abc68 [0071.330] wcscpy (in: _Dest=0x38abc68, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0071.330] wcscat (in: _Dest=0x38abc68, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0071.330] wcscat (in: _Dest=0x38abc68, _Source="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" [0071.330] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38abc68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ec [0071.331] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x542e808 | out: lpFindFileData=0x542e808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1 [0071.331] wcscmp (_String1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", _String2=".") returned 1 [0071.331] wcscmp (_String1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", _String2="..") returned 1 [0071.331] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9e) returned 0x38abb18 [0071.331] wcscpy (in: _Dest=0x38abb18, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0071.331] wcscat (in: _Dest=0x38abb18, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0071.331] wcscat (in: _Dest=0x38abb18, _Source="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" [0071.331] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38abb18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f0 [0071.332] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x542e808 | out: lpFindFileData=0x542e808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0a28d82, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1 [0071.332] wcscmp (_String1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", _String2=".") returned 1 [0071.332] wcscmp (_String1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", _String2="..") returned 1 [0071.332] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x88) returned 0x38a8c68 [0071.332] wcscpy (in: _Dest=0x38a8c68, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0071.332] wcscat (in: _Dest=0x38a8c68, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0071.332] wcscat (in: _Dest=0x38a8c68, _Source="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: _Dest="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0071.332] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a8c68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f4 [0071.333] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x542e808 | out: lpFindFileData=0x542e808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", cAlternateFileName="{CF2BE~1.610")) returned 1 [0071.333] wcscmp (_String1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", _String2=".") returned 1 [0071.333] wcscmp (_String1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", _String2="..") returned 1 [0071.333] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9e) returned 0x38aba70 [0071.333] wcscpy (in: _Dest=0x38aba70, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0071.333] wcscat (in: _Dest=0x38aba70, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0071.333] wcscat (in: _Dest=0x38aba70, _Source="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" [0071.333] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38aba70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f8 [0071.334] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x542e808 | out: lpFindFileData=0x542e808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", cAlternateFileName="{E5127~1.250")) returned 1 [0071.334] wcscmp (_String1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", _String2=".") returned 1 [0071.334] wcscmp (_String1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", _String2="..") returned 1 [0071.334] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa0) returned 0x38ac598 [0071.334] wcscpy (in: _Dest=0x38ac598, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0071.334] wcscat (in: _Dest=0x38ac598, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0071.334] wcscat (in: _Dest=0x38ac598, _Source="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" [0071.334] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38ac598, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5fc [0071.335] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x542e808 | out: lpFindFileData=0x542e808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc767be9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e52a6842-b0ac-476e-b48f-378a97a67346}", cAlternateFileName="{E52A6~1")) returned 1 [0071.335] wcscmp (_String1="{e52a6842-b0ac-476e-b48f-378a97a67346}", _String2=".") returned 1 [0071.335] wcscmp (_String1="{e52a6842-b0ac-476e-b48f-378a97a67346}", _String2="..") returned 1 [0071.335] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x88) returned 0x38a8cf8 [0071.335] wcscpy (in: _Dest=0x38a8cf8, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0071.335] wcscat (in: _Dest=0x38a8cf8, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0071.335] wcscat (in: _Dest=0x38a8cf8, _Source="{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: _Dest="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" [0071.335] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a8cf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x600 [0071.336] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x542e808 | out: lpFindFileData=0x542e808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2593ec2, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", cAlternateFileName="{E6E75~1")) returned 1 [0071.336] wcscmp (_String1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", _String2=".") returned 1 [0071.336] wcscmp (_String1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", _String2="..") returned 1 [0071.336] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x88) returned 0x38a8f38 [0071.336] wcscpy (in: _Dest=0x38a8f38, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0071.336] wcscat (in: _Dest=0x38a8f38, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0071.336] wcscat (in: _Dest=0x38a8f38, _Source="{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: _Dest="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0071.336] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a8f38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x604 [0071.337] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x542e808 | out: lpFindFileData=0x542e808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9a674c8, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", cAlternateFileName="{F325F~1")) returned 1 [0071.337] wcscmp (_String1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", _String2=".") returned 1 [0071.337] wcscmp (_String1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", _String2="..") returned 1 [0071.337] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x88) returned 0x38a8d88 [0071.337] wcscpy (in: _Dest=0x38a8d88, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0071.337] wcscat (in: _Dest=0x38a8d88, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0071.337] wcscat (in: _Dest=0x38a8d88, _Source="{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: _Dest="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0071.337] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a8d88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x608 [0071.338] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x542e808 | out: lpFindFileData=0x542e808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 1 [0071.338] wcscmp (_String1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", _String2=".") returned 1 [0071.338] wcscmp (_String1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", _String2="..") returned 1 [0071.338] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9e) returned 0x38ac6e8 [0071.338] wcscpy (in: _Dest=0x38ac6e8, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0071.338] wcscat (in: _Dest=0x38ac6e8, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0071.338] wcscat (in: _Dest=0x38ac6e8, _Source="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" [0071.338] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38ac6e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x60c [0071.339] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x542e808 | out: lpFindFileData=0x542e808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 0 [0071.339] FindClose (in: hFindFile=0x5445980 | out: hFindFile=0x5445980) returned 1 [0071.340] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542e808) returned 1 [0071.340] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a56e0) returned 1 [0071.340] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5e78) returned 1 Thread: id = 107 os_tid = 0x60 [0071.240] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x541aa60 [0071.240] wcscpy (in: _Dest=0x541aa60, _Source="C:\\ProgramData\\regid.1991-06.com.microsoft" | out: _Dest="C:\\ProgramData\\regid.1991-06.com.microsoft") returned="C:\\ProgramData\\regid.1991-06.com.microsoft" [0071.240] wcscat (in: _Dest=0x541aa60, _Source="\\" | out: _Dest="C:\\ProgramData\\regid.1991-06.com.microsoft\\") returned="C:\\ProgramData\\regid.1991-06.com.microsoft\\" [0071.240] wcscat (in: _Dest=0x541aa60, _Source="*" | out: _Dest="C:\\ProgramData\\regid.1991-06.com.microsoft\\*") returned="C:\\ProgramData\\regid.1991-06.com.microsoft\\*" [0071.240] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542ea70 [0071.240] FindFirstFileW (in: lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\*", lpFindFileData=0x542ea70 | out: lpFindFileData=0x542ea70*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53fba98c, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445680 [0071.253] wcscmp (_String1=".", _String2=".") returned 0 [0071.253] FindNextFileW (in: hFindFile=0x5445680, lpFindFileData=0x542ea70 | out: lpFindFileData=0x542ea70*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53fba98c, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.253] wcscmp (_String1="..", _String2=".") returned 1 [0071.253] wcscmp (_String1="..", _String2="..") returned 0 [0071.253] FindNextFileW (in: hFindFile=0x5445680, lpFindFileData=0x542ea70 | out: lpFindFileData=0x542ea70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1446700, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0x4af5600b, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf1446700, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x430, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", cAlternateFileName="REGID1~3.SWI")) returned 1 [0071.253] wcscmp (_String1="regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", _String2=".") returned 1 [0071.253] wcscmp (_String1="regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", _String2="..") returned 1 [0071.253] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x3890b80 [0071.253] wcscpy (in: _Dest=0x3890b80, _Source="C:\\ProgramData\\regid.1991-06.com.microsoft" | out: _Dest="C:\\ProgramData\\regid.1991-06.com.microsoft") returned="C:\\ProgramData\\regid.1991-06.com.microsoft" [0071.253] wcscat (in: _Dest=0x3890b80, _Source="\\" | out: _Dest="C:\\ProgramData\\regid.1991-06.com.microsoft\\") returned="C:\\ProgramData\\regid.1991-06.com.microsoft\\" [0071.253] wcscat (in: _Dest=0x3890b80, _Source="regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag" | out: _Dest="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag") returned="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag" [0071.313] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3890b80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x574 [0071.314] FindNextFileW (in: hFindFile=0x5445680, lpFindFileData=0x542ea70 | out: lpFindFileData=0x542ea70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbfefc00, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0xda9f4a95, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbfefc00, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x42c, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", cAlternateFileName="REGID1~2.SWI")) returned 1 [0071.314] wcscmp (_String1="regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", _String2=".") returned 1 [0071.314] wcscmp (_String1="regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", _String2="..") returned 1 [0071.314] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf4) returned 0x5447ea8 [0071.314] wcscpy (in: _Dest=0x5447ea8, _Source="C:\\ProgramData\\regid.1991-06.com.microsoft" | out: _Dest="C:\\ProgramData\\regid.1991-06.com.microsoft") returned="C:\\ProgramData\\regid.1991-06.com.microsoft" [0071.314] wcscat (in: _Dest=0x5447ea8, _Source="\\" | out: _Dest="C:\\ProgramData\\regid.1991-06.com.microsoft\\") returned="C:\\ProgramData\\regid.1991-06.com.microsoft\\" [0071.314] wcscat (in: _Dest=0x5447ea8, _Source="regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag" | out: _Dest="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag") returned="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag" [0071.314] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5447ea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c0 [0071.315] FindNextFileW (in: hFindFile=0x5445680, lpFindFileData=0x542ea70 | out: lpFindFileData=0x542ea70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1446700, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0x53fba98c, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf1446700, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x42f, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", cAlternateFileName="REGID1~4.SWI")) returned 1 [0071.315] wcscmp (_String1="regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", _String2=".") returned 1 [0071.315] wcscmp (_String1="regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", _String2="..") returned 1 [0071.315] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfa) returned 0x388ae30 [0071.315] wcscpy (in: _Dest=0x388ae30, _Source="C:\\ProgramData\\regid.1991-06.com.microsoft" | out: _Dest="C:\\ProgramData\\regid.1991-06.com.microsoft") returned="C:\\ProgramData\\regid.1991-06.com.microsoft" [0071.315] wcscat (in: _Dest=0x388ae30, _Source="\\" | out: _Dest="C:\\ProgramData\\regid.1991-06.com.microsoft\\") returned="C:\\ProgramData\\regid.1991-06.com.microsoft\\" [0071.315] wcscat (in: _Dest=0x388ae30, _Source="regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag" | out: _Dest="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag") returned="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag" [0071.315] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x388ae30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c4 [0071.316] FindNextFileW (in: hFindFile=0x5445680, lpFindFileData=0x542ea70 | out: lpFindFileData=0x542ea70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7be169cf, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x6f2e8f23, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f2e8f23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", cAlternateFileName="REGID1~1.SWI")) returned 1 [0071.316] wcscmp (_String1="regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", _String2=".") returned 1 [0071.316] wcscmp (_String1="regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", _String2="..") returned 1 [0071.316] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x3883a00 [0071.316] wcscpy (in: _Dest=0x3883a00, _Source="C:\\ProgramData\\regid.1991-06.com.microsoft" | out: _Dest="C:\\ProgramData\\regid.1991-06.com.microsoft") returned="C:\\ProgramData\\regid.1991-06.com.microsoft" [0071.316] wcscat (in: _Dest=0x3883a00, _Source="\\" | out: _Dest="C:\\ProgramData\\regid.1991-06.com.microsoft\\") returned="C:\\ProgramData\\regid.1991-06.com.microsoft\\" [0071.316] wcscat (in: _Dest=0x3883a00, _Source="regid.1991-06.com.microsoft_Windows-10-Pro.swidtag" | out: _Dest="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag") returned="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag" [0071.316] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3883a00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c8 [0071.317] FindNextFileW (in: hFindFile=0x5445680, lpFindFileData=0x542ea70 | out: lpFindFileData=0x542ea70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7be169cf, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x6f2e8f23, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f2e8f23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", cAlternateFileName="REGID1~1.SWI")) returned 0 [0071.317] FindClose (in: hFindFile=0x5445680 | out: hFindFile=0x5445680) returned 1 [0071.318] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542ea70) returned 1 [0071.318] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541aa60) returned 1 [0071.318] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388b810) returned 1 Thread: id = 108 os_tid = 0xb58 [0071.243] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x541b3b8 [0071.243] wcscpy (in: _Dest=0x541b3b8, _Source="C:\\ProgramData\\SoftwareDistribution" | out: _Dest="C:\\ProgramData\\SoftwareDistribution") returned="C:\\ProgramData\\SoftwareDistribution" [0071.243] wcscat (in: _Dest=0x541b3b8, _Source="\\" | out: _Dest="C:\\ProgramData\\SoftwareDistribution\\") returned="C:\\ProgramData\\SoftwareDistribution\\" [0071.243] wcscat (in: _Dest=0x541b3b8, _Source="*" | out: _Dest="C:\\ProgramData\\SoftwareDistribution\\*") returned="C:\\ProgramData\\SoftwareDistribution\\*" [0071.243] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542ecd8 [0071.243] FindFirstFileW (in: lpFileName="C:\\ProgramData\\SoftwareDistribution\\*", lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445600 [0071.243] wcscmp (_String1=".", _String2=".") returned 0 [0071.243] FindNextFileW (in: hFindFile=0x5445600, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.243] wcscmp (_String1="..", _String2=".") returned 1 [0071.243] wcscmp (_String1="..", _String2="..") returned 0 [0071.243] FindNextFileW (in: hFindFile=0x5445600, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0071.243] FindClose (in: hFindFile=0x5445600 | out: hFindFile=0x5445600) returned 1 [0071.243] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542ecd8) returned 1 [0071.243] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541b3b8) returned 1 [0071.243] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b3728) returned 1 Thread: id = 109 os_tid = 0xce8 [0071.245] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x38) returned 0x5445a00 [0071.245] wcscpy (in: _Dest=0x5445a00, _Source="C:\\ProgramData\\Start Menu" | out: _Dest="C:\\ProgramData\\Start Menu") returned="C:\\ProgramData\\Start Menu" [0071.245] wcscat (in: _Dest=0x5445a00, _Source="\\" | out: _Dest="C:\\ProgramData\\Start Menu\\") returned="C:\\ProgramData\\Start Menu\\" [0071.246] wcscat (in: _Dest=0x5445a00, _Source="*" | out: _Dest="C:\\ProgramData\\Start Menu\\*") returned="C:\\ProgramData\\Start Menu\\*" [0071.246] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542ecd8 [0071.246] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Start Menu\\*", lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0071.246] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542ecd8) returned 1 [0071.246] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445a00) returned 1 [0071.246] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389ed40) returned 1 Thread: id = 110 os_tid = 0xdd4 [0071.247] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x5445a00 [0071.247] wcscpy (in: _Dest=0x5445a00, _Source="C:\\ProgramData\\Templates" | out: _Dest="C:\\ProgramData\\Templates") returned="C:\\ProgramData\\Templates" [0071.247] wcscat (in: _Dest=0x5445a00, _Source="\\" | out: _Dest="C:\\ProgramData\\Templates\\") returned="C:\\ProgramData\\Templates\\" [0071.247] wcscat (in: _Dest=0x5445a00, _Source="*" | out: _Dest="C:\\ProgramData\\Templates\\*") returned="C:\\ProgramData\\Templates\\*" [0071.247] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542ecd8 [0071.247] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Templates\\*", lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0071.247] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542ecd8) returned 1 [0071.247] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445a00) returned 1 [0071.247] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389e840) returned 1 Thread: id = 111 os_tid = 0xdc4 [0071.248] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x38) returned 0x5445a00 [0071.248] wcscpy (in: _Dest=0x5445a00, _Source="C:\\ProgramData\\USOPrivate" | out: _Dest="C:\\ProgramData\\USOPrivate") returned="C:\\ProgramData\\USOPrivate" [0071.248] wcscat (in: _Dest=0x5445a00, _Source="\\" | out: _Dest="C:\\ProgramData\\USOPrivate\\") returned="C:\\ProgramData\\USOPrivate\\" [0071.248] wcscat (in: _Dest=0x5445a00, _Source="*" | out: _Dest="C:\\ProgramData\\USOPrivate\\*") returned="C:\\ProgramData\\USOPrivate\\*" [0071.248] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542ecd8 [0071.248] FindFirstFileW (in: lpFileName="C:\\ProgramData\\USOPrivate\\*", lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1931975, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445600 [0071.248] wcscmp (_String1=".", _String2=".") returned 0 [0071.248] FindNextFileW (in: hFindFile=0x5445600, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1931975, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.248] wcscmp (_String1="..", _String2=".") returned 1 [0071.248] wcscmp (_String1="..", _String2="..") returned 0 [0071.248] FindNextFileW (in: hFindFile=0x5445600, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x91f4ffc6, ftLastAccessTime.dwHighDateTime=0x1d5d815, ftLastWriteTime.dwLowDateTime=0x91f4ffc6, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateStore", cAlternateFileName="UPDATE~1")) returned 1 [0071.248] wcscmp (_String1="UpdateStore", _String2=".") returned 1 [0071.249] wcscmp (_String1="UpdateStore", _String2="..") returned 1 [0071.249] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x541b780 [0071.249] wcscpy (in: _Dest=0x541b780, _Source="C:\\ProgramData\\USOPrivate" | out: _Dest="C:\\ProgramData\\USOPrivate") returned="C:\\ProgramData\\USOPrivate" [0071.249] wcscat (in: _Dest=0x541b780, _Source="\\" | out: _Dest="C:\\ProgramData\\USOPrivate\\") returned="C:\\ProgramData\\USOPrivate\\" [0071.249] wcscat (in: _Dest=0x541b780, _Source="UpdateStore" | out: _Dest="C:\\ProgramData\\USOPrivate\\UpdateStore") returned="C:\\ProgramData\\USOPrivate\\UpdateStore" [0071.320] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x541b780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x56c [0071.321] FindNextFileW (in: hFindFile=0x5445600, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x91f4ffc6, ftLastAccessTime.dwHighDateTime=0x1d5d815, ftLastWriteTime.dwLowDateTime=0x91f4ffc6, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateStore", cAlternateFileName="UPDATE~1")) returned 0 [0071.321] FindClose (in: hFindFile=0x5445600 | out: hFindFile=0x5445600) returned 1 [0071.321] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542ecd8) returned 1 [0071.321] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445a00) returned 1 [0071.321] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389ea80) returned 1 Thread: id = 112 os_tid = 0xc20 [0071.249] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x5445a40 [0071.249] wcscpy (in: _Dest=0x5445a40, _Source="C:\\ProgramData\\USOShared" | out: _Dest="C:\\ProgramData\\USOShared") returned="C:\\ProgramData\\USOShared" [0071.249] wcscat (in: _Dest=0x5445a40, _Source="\\" | out: _Dest="C:\\ProgramData\\USOShared\\") returned="C:\\ProgramData\\USOShared\\" [0071.249] wcscat (in: _Dest=0x5445a40, _Source="*" | out: _Dest="C:\\ProgramData\\USOShared\\*") returned="C:\\ProgramData\\USOShared\\*" [0071.249] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542ef40 [0071.249] FindFirstFileW (in: lpFileName="C:\\ProgramData\\USOShared\\*", lpFindFileData=0x542ef40 | out: lpFindFileData=0x542ef40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445640 [0071.249] wcscmp (_String1=".", _String2=".") returned 0 [0071.249] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x542ef40 | out: lpFindFileData=0x542ef40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.252] wcscmp (_String1="..", _String2=".") returned 1 [0071.252] wcscmp (_String1="..", _String2="..") returned 0 [0071.252] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x542ef40 | out: lpFindFileData=0x542ef40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa872976f, ftLastAccessTime.dwHighDateTime=0x1d5e1e4, ftLastWriteTime.dwLowDateTime=0xa872976f, ftLastWriteTime.dwHighDateTime=0x1d5e1e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0071.252] wcscmp (_String1="Logs", _String2=".") returned 1 [0071.252] wcscmp (_String1="Logs", _String2="..") returned 1 [0071.252] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3c) returned 0x38a5de8 [0071.252] wcscpy (in: _Dest=0x38a5de8, _Source="C:\\ProgramData\\USOShared" | out: _Dest="C:\\ProgramData\\USOShared") returned="C:\\ProgramData\\USOShared" [0071.252] wcscat (in: _Dest=0x38a5de8, _Source="\\" | out: _Dest="C:\\ProgramData\\USOShared\\") returned="C:\\ProgramData\\USOShared\\" [0071.252] wcscat (in: _Dest=0x38a5de8, _Source="Logs" | out: _Dest="C:\\ProgramData\\USOShared\\Logs") returned="C:\\ProgramData\\USOShared\\Logs" [0071.318] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a5de8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x564 [0071.319] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x542ef40 | out: lpFindFileData=0x542ef40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa872976f, ftLastAccessTime.dwHighDateTime=0x1d5e1e4, ftLastWriteTime.dwLowDateTime=0xa872976f, ftLastWriteTime.dwHighDateTime=0x1d5e1e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 0 [0071.319] FindClose (in: hFindFile=0x5445640 | out: hFindFile=0x5445640) returned 1 [0071.319] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542ef40) returned 1 [0071.319] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445a40) returned 1 [0071.319] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389ea00) returned 1 Thread: id = 113 os_tid = 0xc28 [0071.254] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x543d878 [0071.254] wcscpy (in: _Dest=0x543d878, _Source="C:\\ProgramData\\WindowsHolographicDevices" | out: _Dest="C:\\ProgramData\\WindowsHolographicDevices") returned="C:\\ProgramData\\WindowsHolographicDevices" [0071.254] wcscat (in: _Dest=0x543d878, _Source="\\" | out: _Dest="C:\\ProgramData\\WindowsHolographicDevices\\") returned="C:\\ProgramData\\WindowsHolographicDevices\\" [0071.254] wcscat (in: _Dest=0x543d878, _Source="*" | out: _Dest="C:\\ProgramData\\WindowsHolographicDevices\\*") returned="C:\\ProgramData\\WindowsHolographicDevices\\*" [0071.254] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542f410 [0071.254] FindFirstFileW (in: lpFileName="C:\\ProgramData\\WindowsHolographicDevices\\*", lpFindFileData=0x542f410 | out: lpFindFileData=0x542f410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445340 [0081.241] wcscmp (_String1=".", _String2=".") returned 0 [0081.241] FindNextFileW (in: hFindFile=0x5445340, lpFindFileData=0x542f410 | out: lpFindFileData=0x542f410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.241] wcscmp (_String1="..", _String2=".") returned 1 [0081.241] wcscmp (_String1="..", _String2="..") returned 0 [0081.241] FindNextFileW (in: hFindFile=0x5445340, lpFindFileData=0x542f410 | out: lpFindFileData=0x542f410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c147a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpatialStore", cAlternateFileName="SPATIA~1")) returned 1 [0081.241] wcscmp (_String1="SpatialStore", _String2=".") returned 1 [0081.241] wcscmp (_String1="SpatialStore", _String2="..") returned 1 [0081.241] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6c) Thread: id = 114 os_tid = 0xc10 [0071.254] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2a) returned 0x38b7730 [0071.254] wcscpy (in: _Dest=0x38b7730, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0071.254] wcscat (in: _Dest=0x38b7730, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0071.254] wcscat (in: _Dest=0x38b7730, _Source="*" | out: _Dest="C:\\Users\\All Users\\*") returned="C:\\Users\\All Users\\*" [0071.254] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542fdb0 [0071.254] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*", lpFindFileData=0x542fdb0 | out: lpFindFileData=0x542fdb0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445480 [0071.268] wcscmp (_String1=".", _String2=".") returned 0 [0071.268] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x542fdb0 | out: lpFindFileData=0x542fdb0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.268] wcscmp (_String1="..", _String2=".") returned 1 [0071.268] wcscmp (_String1="..", _String2="..") returned 0 [0071.268] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x542fdb0 | out: lpFindFileData=0x542fdb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4511a9a6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0071.268] wcscmp (_String1="Adobe", _String2=".") returned 1 [0071.268] wcscmp (_String1="Adobe", _String2="..") returned 1 [0071.268] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x32) returned 0x54454c0 [0071.268] wcscpy (in: _Dest=0x54454c0, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0071.268] wcscat (in: _Dest=0x54454c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0071.268] wcscat (in: _Dest=0x54454c0, _Source="Adobe" | out: _Dest="C:\\Users\\All Users\\Adobe") returned="C:\\Users\\All Users\\Adobe" [0071.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54454c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x538 [0071.294] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x542fdb0 | out: lpFindFileData=0x542fdb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0071.294] wcscmp (_String1="Application Data", _String2=".") returned 1 [0071.294] wcscmp (_String1="Application Data", _String2="..") returned 1 [0071.294] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x543dc18 [0071.294] wcscpy (in: _Dest=0x543dc18, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0071.294] wcscat (in: _Dest=0x543dc18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0071.294] wcscat (in: _Dest=0x543dc18, _Source="Application Data" | out: _Dest="C:\\Users\\All Users\\Application Data") returned="C:\\Users\\All Users\\Application Data" [0071.294] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x543dc18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x584 [0071.295] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x542fdb0 | out: lpFindFileData=0x542fdb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Comms", cAlternateFileName="")) returned 1 [0071.295] wcscmp (_String1="Comms", _String2=".") returned 1 [0071.295] wcscmp (_String1="Comms", _String2="..") returned 1 [0071.295] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x32) returned 0x5445880 [0071.296] wcscpy (in: _Dest=0x5445880, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0071.296] wcscat (in: _Dest=0x5445880, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0071.296] wcscat (in: _Dest=0x5445880, _Source="Comms" | out: _Dest="C:\\Users\\All Users\\Comms") returned="C:\\Users\\All Users\\Comms" [0071.296] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5445880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588 [0071.296] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x542fdb0 | out: lpFindFileData=0x542fdb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0071.296] wcscmp (_String1="Desktop", _String2=".") returned 1 [0071.296] wcscmp (_String1="Desktop", _String2="..") returned 1 [0071.296] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x54457c0 [0071.296] wcscpy (in: _Dest=0x54457c0, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0071.296] wcscat (in: _Dest=0x54457c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0071.297] wcscat (in: _Dest=0x54457c0, _Source="Desktop" | out: _Dest="C:\\Users\\All Users\\Desktop") returned="C:\\Users\\All Users\\Desktop" [0071.297] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54457c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c [0071.297] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x542fdb0 | out: lpFindFileData=0x542fdb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0071.297] wcscmp (_String1="Documents", _String2=".") returned 1 [0071.297] wcscmp (_String1="Documents", _String2="..") returned 1 [0071.297] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x537b1b8 [0071.297] wcscpy (in: _Dest=0x537b1b8, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0071.297] wcscat (in: _Dest=0x537b1b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0071.297] wcscat (in: _Dest=0x537b1b8, _Source="Documents" | out: _Dest="C:\\Users\\All Users\\Documents") returned="C:\\Users\\All Users\\Documents" [0071.297] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x537b1b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x590 [0071.298] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x542fdb0 | out: lpFindFileData=0x542fdb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0071.298] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0071.298] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0071.298] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x537b6c8 [0071.298] wcscpy (in: _Dest=0x537b6c8, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0071.298] wcscat (in: _Dest=0x537b6c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0071.298] wcscat (in: _Dest=0x537b6c8, _Source="Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0071.298] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x537b6c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x594 [0071.299] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x542fdb0 | out: lpFindFileData=0x542fdb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1 [0071.299] wcscmp (_String1="Microsoft OneDrive", _String2=".") returned 1 [0071.299] wcscmp (_String1="Microsoft OneDrive", _String2="..") returned 1 [0071.299] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x541b830 [0071.299] wcscpy (in: _Dest=0x541b830, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0071.299] wcscat (in: _Dest=0x541b830, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0071.299] wcscat (in: _Dest=0x541b830, _Source="Microsoft OneDrive" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive") returned="C:\\Users\\All Users\\Microsoft OneDrive" [0071.300] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x541b830, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x598 [0071.301] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x542fdb0 | out: lpFindFileData=0x542fdb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1 [0071.301] wcscmp (_String1="Oracle", _String2=".") returned 1 [0071.301] wcscmp (_String1="Oracle", _String2="..") returned 1 [0071.301] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x34) returned 0x5445300 [0071.301] wcscpy (in: _Dest=0x5445300, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0071.301] wcscat (in: _Dest=0x5445300, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0071.301] wcscat (in: _Dest=0x5445300, _Source="Oracle" | out: _Dest="C:\\Users\\All Users\\Oracle") returned="C:\\Users\\All Users\\Oracle" [0071.301] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5445300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x59c [0071.302] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x542fdb0 | out: lpFindFileData=0x542fdb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0071.302] wcscmp (_String1="Package Cache", _String2=".") returned 1 [0071.302] wcscmp (_String1="Package Cache", _String2="..") returned 1 [0071.302] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x42) returned 0x38b3408 [0071.302] wcscpy (in: _Dest=0x38b3408, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0071.302] wcscat (in: _Dest=0x38b3408, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0071.302] wcscat (in: _Dest=0x38b3408, _Source="Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0071.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b3408, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a0 [0071.303] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x542fdb0 | out: lpFindFileData=0x542fdb0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53fba98c, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft", cAlternateFileName="REGID1~1.MIC")) returned 1 [0071.303] wcscmp (_String1="regid.1991-06.com.microsoft", _String2=".") returned 1 [0071.303] wcscmp (_String1="regid.1991-06.com.microsoft", _String2="..") returned 1 [0071.303] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x541acd0 [0071.303] wcscpy (in: _Dest=0x541acd0, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0071.303] wcscat (in: _Dest=0x541acd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0071.303] wcscat (in: _Dest=0x541acd0, _Source="regid.1991-06.com.microsoft" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft" [0071.303] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x541acd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a4 [0071.304] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x542fdb0 | out: lpFindFileData=0x542fdb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SoftwareDistribution", cAlternateFileName="SOFTWA~1")) returned 1 [0071.304] wcscmp (_String1="SoftwareDistribution", _String2=".") returned 1 [0071.304] wcscmp (_String1="SoftwareDistribution", _String2="..") returned 1 [0071.304] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x541b410 [0071.304] wcscpy (in: _Dest=0x541b410, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0071.304] wcscat (in: _Dest=0x541b410, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0071.304] wcscat (in: _Dest=0x541b410, _Source="SoftwareDistribution" | out: _Dest="C:\\Users\\All Users\\SoftwareDistribution") returned="C:\\Users\\All Users\\SoftwareDistribution" [0071.304] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x541b410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a8 [0071.306] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x542fdb0 | out: lpFindFileData=0x542fdb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0071.306] wcscmp (_String1="Start Menu", _String2=".") returned 1 [0071.306] wcscmp (_String1="Start Menu", _String2="..") returned 1 [0071.306] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3c) returned 0x537b128 [0071.306] wcscpy (in: _Dest=0x537b128, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0071.306] wcscat (in: _Dest=0x537b128, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0071.307] wcscat (in: _Dest=0x537b128, _Source="Start Menu" | out: _Dest="C:\\Users\\All Users\\Start Menu") returned="C:\\Users\\All Users\\Start Menu" [0071.307] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x537b128, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ac [0071.307] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x542fdb0 | out: lpFindFileData=0x542fdb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0071.307] wcscmp (_String1="Templates", _String2=".") returned 1 [0071.307] wcscmp (_String1="Templates", _String2="..") returned 1 [0071.307] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x537b0e0 [0071.307] wcscpy (in: _Dest=0x537b0e0, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0071.307] wcscat (in: _Dest=0x537b0e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0071.307] wcscat (in: _Dest=0x537b0e0, _Source="Templates" | out: _Dest="C:\\Users\\All Users\\Templates") returned="C:\\Users\\All Users\\Templates" [0071.308] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x537b0e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b0 [0071.308] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x542fdb0 | out: lpFindFileData=0x542fdb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1931975, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="USOPrivate", cAlternateFileName="USOPRI~1")) returned 1 [0071.308] wcscmp (_String1="USOPrivate", _String2=".") returned 1 [0071.308] wcscmp (_String1="USOPrivate", _String2="..") returned 1 [0071.308] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3c) returned 0x537b098 [0071.308] wcscpy (in: _Dest=0x537b098, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0071.308] wcscat (in: _Dest=0x537b098, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0071.308] wcscat (in: _Dest=0x537b098, _Source="USOPrivate" | out: _Dest="C:\\Users\\All Users\\USOPrivate") returned="C:\\Users\\All Users\\USOPrivate" [0071.308] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x537b098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b4 [0071.309] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x542fdb0 | out: lpFindFileData=0x542fdb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="USOShared", cAlternateFileName="USOSHA~1")) returned 1 [0071.309] wcscmp (_String1="USOShared", _String2=".") returned 1 [0071.309] wcscmp (_String1="USOShared", _String2="..") returned 1 [0071.309] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x537b440 [0071.309] wcscpy (in: _Dest=0x537b440, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0071.309] wcscat (in: _Dest=0x537b440, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0071.309] wcscat (in: _Dest=0x537b440, _Source="USOShared" | out: _Dest="C:\\Users\\All Users\\USOShared") returned="C:\\Users\\All Users\\USOShared" [0071.309] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x537b440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b8 [0071.310] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x542fdb0 | out: lpFindFileData=0x542fdb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 1 [0071.310] wcscmp (_String1="WindowsHolographicDevices", _String2=".") returned 1 [0071.310] wcscmp (_String1="WindowsHolographicDevices", _String2="..") returned 1 [0071.310] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x541ac68 [0071.310] wcscpy (in: _Dest=0x541ac68, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0071.310] wcscat (in: _Dest=0x541ac68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0071.310] wcscat (in: _Dest=0x541ac68, _Source="WindowsHolographicDevices" | out: _Dest="C:\\Users\\All Users\\WindowsHolographicDevices") returned="C:\\Users\\All Users\\WindowsHolographicDevices" [0071.310] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x541ac68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5bc [0071.311] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x542fdb0 | out: lpFindFileData=0x542fdb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 0 [0071.311] FindClose (in: hFindFile=0x5445480 | out: hFindFile=0x5445480) returned 1 [0071.311] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542fdb0) returned 1 [0071.311] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b7730) returned 1 [0071.311] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a66a0) returned 1 Thread: id = 115 os_tid = 0xc18 [0071.255] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x26) returned 0x38a6af0 [0071.255] wcscpy (in: _Dest=0x38a6af0, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0071.255] wcscat (in: _Dest=0x38a6af0, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0071.255] wcscat (in: _Dest=0x38a6af0, _Source="*" | out: _Dest="C:\\Users\\Default\\*") returned="C:\\Users\\Default\\*" [0071.255] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5430018 [0071.255] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*", lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445940 [0071.266] wcscmp (_String1=".", _String2=".") returned 0 [0071.266] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.483] wcscmp (_String1="..", _String2=".") returned 1 [0071.484] wcscmp (_String1="..", _String2="..") returned 0 [0071.484] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3aee4d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0071.484] wcscmp (_String1="AppData", _String2=".") returned 1 [0071.484] wcscmp (_String1="AppData", _String2="..") returned 1 [0071.484] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x32) returned 0x5445980 [0071.484] wcscpy (in: _Dest=0x5445980, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0071.484] wcscat (in: _Dest=0x5445980, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0071.484] wcscat (in: _Dest=0x5445980, _Source="AppData" | out: _Dest="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0071.484] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5445980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x704 [0071.484] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0071.485] wcscmp (_String1="Application Data", _String2=".") returned 1 [0071.485] wcscmp (_String1="Application Data", _String2="..") returned 1 [0071.485] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x5443140 [0071.485] wcscpy (in: _Dest=0x5443140, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0071.485] wcscat (in: _Dest=0x5443140, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0071.485] wcscat (in: _Dest=0x5443140, _Source="Application Data" | out: _Dest="C:\\Users\\Default\\Application Data") returned="C:\\Users\\Default\\Application Data" [0071.485] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5443140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x708 [0071.485] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0071.485] wcscmp (_String1="Cookies", _String2=".") returned 1 [0071.485] wcscmp (_String1="Cookies", _String2="..") returned 1 [0071.485] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x32) returned 0x5445440 [0071.485] wcscpy (in: _Dest=0x5445440, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0071.485] wcscat (in: _Dest=0x5445440, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0071.485] wcscat (in: _Dest=0x5445440, _Source="Cookies" | out: _Dest="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0071.486] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5445440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x70c [0071.486] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0071.486] wcscmp (_String1="Desktop", _String2=".") returned 1 [0071.486] wcscmp (_String1="Desktop", _String2="..") returned 1 [0071.486] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x32) returned 0x5445a00 [0071.486] wcscpy (in: _Dest=0x5445a00, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0071.486] wcscat (in: _Dest=0x5445a00, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0071.486] wcscat (in: _Dest=0x5445a00, _Source="Desktop" | out: _Dest="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0071.486] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5445a00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x710 [0071.487] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0071.487] wcscmp (_String1="Documents", _String2=".") returned 1 [0071.487] wcscmp (_String1="Documents", _String2="..") returned 1 [0071.487] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x5445740 [0071.487] wcscpy (in: _Dest=0x5445740, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0071.487] wcscat (in: _Dest=0x5445740, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0071.487] wcscat (in: _Dest=0x5445740, _Source="Documents" | out: _Dest="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0071.487] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5445740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x714 [0071.488] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0071.488] wcscmp (_String1="Downloads", _String2=".") returned 1 [0071.488] wcscmp (_String1="Downloads", _String2="..") returned 1 [0071.488] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x5445380 [0071.488] wcscpy (in: _Dest=0x5445380, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0071.488] wcscat (in: _Dest=0x5445380, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0071.488] wcscat (in: _Dest=0x5445380, _Source="Downloads" | out: _Dest="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0071.488] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5445380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x718 [0071.501] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0071.501] wcscmp (_String1="Favorites", _String2=".") returned 1 [0071.501] wcscmp (_String1="Favorites", _String2="..") returned 1 [0071.501] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x5445840 [0071.501] wcscpy (in: _Dest=0x5445840, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0071.501] wcscat (in: _Dest=0x5445840, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0071.501] wcscat (in: _Dest=0x5445840, _Source="Favorites" | out: _Dest="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0071.501] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5445840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x71c [0071.502] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0071.502] wcscmp (_String1="Links", _String2=".") returned 1 [0071.502] wcscmp (_String1="Links", _String2="..") returned 1 [0071.502] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2e) returned 0x537c688 [0071.502] wcscpy (in: _Dest=0x537c688, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0071.502] wcscat (in: _Dest=0x537c688, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0071.502] wcscat (in: _Dest=0x537c688, _Source="Links" | out: _Dest="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0071.502] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x537c688, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x720 [0071.503] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0071.503] wcscmp (_String1="Local Settings", _String2=".") returned 1 [0071.503] wcscmp (_String1="Local Settings", _String2="..") returned 1 [0071.503] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x537b2d8 [0071.503] wcscpy (in: _Dest=0x537b2d8, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0071.503] wcscat (in: _Dest=0x537b2d8, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0071.503] wcscat (in: _Dest=0x537b2d8, _Source="Local Settings" | out: _Dest="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0071.503] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x537b2d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x724 [0071.504] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0071.504] wcscmp (_String1="Music", _String2=".") returned 1 [0071.504] wcscmp (_String1="Music", _String2="..") returned 1 [0071.504] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2e) returned 0x537c6c0 [0071.504] wcscpy (in: _Dest=0x537c6c0, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0071.504] wcscat (in: _Dest=0x537c6c0, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0071.504] wcscat (in: _Dest=0x537c6c0, _Source="Music" | out: _Dest="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0071.504] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x537c6c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x728 [0071.505] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0071.505] wcscmp (_String1="My Documents", _String2=".") returned 1 [0071.505] wcscmp (_String1="My Documents", _String2="..") returned 1 [0071.505] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3c) returned 0x537b320 [0071.505] wcscpy (in: _Dest=0x537b320, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0071.505] wcscat (in: _Dest=0x537b320, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0071.505] wcscat (in: _Dest=0x537b320, _Source="My Documents" | out: _Dest="C:\\Users\\Default\\My Documents") returned="C:\\Users\\Default\\My Documents" [0071.505] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x537b320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x72c [0071.506] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0071.506] wcscmp (_String1="NetHood", _String2=".") returned 1 [0071.506] wcscmp (_String1="NetHood", _String2="..") returned 1 [0071.506] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x32) returned 0x5445340 [0071.506] wcscpy (in: _Dest=0x5445340, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0071.506] wcscat (in: _Dest=0x5445340, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0071.506] wcscat (in: _Dest=0x5445340, _Source="NetHood" | out: _Dest="C:\\Users\\Default\\NetHood") returned="C:\\Users\\Default\\NetHood" [0071.506] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5445340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x730 [0071.507] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c4aac40, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x19fa8eb, ftLastAccessTime.dwHighDateTime=0x1d5d811, ftLastWriteTime.dwLowDateTime=0x19fa8eb, ftLastWriteTime.dwHighDateTime=0x1d5d811, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0071.507] wcscmp (_String1="NTUSER.DAT", _String2=".") returned 1 [0071.507] wcscmp (_String1="NTUSER.DAT", _String2="..") returned 1 [0071.507] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6c6021fd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x6c6021fd, ftLastAccessTime.dwHighDateTime=0x1d29fdc, ftLastWriteTime.dwLowDateTime=0x6c6021fd, ftLastWriteTime.dwHighDateTime=0x1d29fdc, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0071.507] wcscmp (_String1="NTUSER.DAT.LOG1", _String2=".") returned 1 [0071.507] wcscmp (_String1="NTUSER.DAT.LOG1", _String2="..") returned 1 [0071.507] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6c6021fd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x6c6021fd, ftLastAccessTime.dwHighDateTime=0x1d29fdc, ftLastWriteTime.dwLowDateTime=0x6c6021fd, ftLastWriteTime.dwHighDateTime=0x1d29fdc, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0071.507] wcscmp (_String1="NTUSER.DAT.LOG2", _String2=".") returned 1 [0071.507] wcscmp (_String1="NTUSER.DAT.LOG2", _String2="..") returned 1 [0071.507] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7dab84ff, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0xacbd1187, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x855f639a, ftLastWriteTime.dwHighDateTime=0x1d2fa07, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0071.507] wcscmp (_String1="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf", _String2=".") returned 1 [0071.507] wcscmp (_String1="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf", _String2="..") returned 1 [0071.507] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7ddd9675, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0xacbd1187, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x855d0141, ftLastWriteTime.dwHighDateTime=0x1d2fa07, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0071.507] wcscmp (_String1="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms", _String2=".") returned 1 [0071.507] wcscmp (_String1="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms", _String2="..") returned 1 [0071.507] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7de71fdf, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0x855d0141, ftLastAccessTime.dwHighDateTime=0x1d2fa07, ftLastWriteTime.dwLowDateTime=0x855d0141, ftLastWriteTime.dwHighDateTime=0x1d2fa07, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0071.507] wcscmp (_String1="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms", _String2=".") returned 1 [0071.507] wcscmp (_String1="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms", _String2="..") returned 1 [0071.507] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b6f06dc, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b6f06dc, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b762e4b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", cAlternateFileName="NTUSER~2.BLF")) returned 1 [0071.507] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", _String2=".") returned 1 [0071.507] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", _String2="..") returned 1 [0071.507] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b6f06dc, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b6f06dc, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b762e4b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~3.REG")) returned 1 [0071.507] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", _String2=".") returned 1 [0071.507] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", _String2="..") returned 1 [0071.507] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b716935, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b716935, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b762e4b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~4.REG")) returned 1 [0071.507] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", _String2=".") returned 1 [0071.507] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", _String2="..") returned 1 [0071.507] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0071.507] wcscmp (_String1="Pictures", _String2=".") returned 1 [0071.507] wcscmp (_String1="Pictures", _String2="..") returned 1 [0071.507] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x34) returned 0x54456c0 [0071.508] wcscpy (in: _Dest=0x54456c0, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0071.508] wcscat (in: _Dest=0x54456c0, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0071.508] wcscat (in: _Dest=0x54456c0, _Source="Pictures" | out: _Dest="C:\\Users\\Default\\Pictures") returned="C:\\Users\\Default\\Pictures" [0071.508] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54456c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x734 [0071.508] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0071.508] wcscmp (_String1="PrintHood", _String2=".") returned 1 [0071.508] wcscmp (_String1="PrintHood", _String2="..") returned 1 [0071.508] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x5445540 [0071.509] wcscpy (in: _Dest=0x5445540, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0071.509] wcscat (in: _Dest=0x5445540, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0071.509] wcscat (in: _Dest=0x5445540, _Source="PrintHood" | out: _Dest="C:\\Users\\Default\\PrintHood") returned="C:\\Users\\Default\\PrintHood" [0071.509] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5445540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x738 [0071.509] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0071.509] wcscmp (_String1="Recent", _String2=".") returned 1 [0071.509] wcscmp (_String1="Recent", _String2="..") returned 1 [0071.509] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x30) returned 0x537c6f8 [0071.509] wcscpy (in: _Dest=0x537c6f8, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0071.509] wcscat (in: _Dest=0x537c6f8, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0071.509] wcscat (in: _Dest=0x537c6f8, _Source="Recent" | out: _Dest="C:\\Users\\Default\\Recent") returned="C:\\Users\\Default\\Recent" [0071.510] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x537c6f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x73c [0071.510] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0071.510] wcscmp (_String1="Saved Games", _String2=".") returned 1 [0071.510] wcscmp (_String1="Saved Games", _String2="..") returned 1 [0071.510] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x537b3f8 [0071.510] wcscpy (in: _Dest=0x537b3f8, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0071.510] wcscat (in: _Dest=0x537b3f8, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0071.510] wcscat (in: _Dest=0x537b3f8, _Source="Saved Games" | out: _Dest="C:\\Users\\Default\\Saved Games") returned="C:\\Users\\Default\\Saved Games" [0071.510] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x537b3f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x740 [0071.511] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0071.511] wcscmp (_String1="SendTo", _String2=".") returned 1 [0071.511] wcscmp (_String1="SendTo", _String2="..") returned 1 [0071.511] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x30) returned 0x537c730 [0071.511] wcscpy (in: _Dest=0x537c730, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0071.511] wcscat (in: _Dest=0x537c730, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0071.511] wcscat (in: _Dest=0x537c730, _Source="SendTo" | out: _Dest="C:\\Users\\Default\\SendTo") returned="C:\\Users\\Default\\SendTo" [0071.511] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x537c730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x744 [0071.512] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0071.512] wcscmp (_String1="Start Menu", _String2=".") returned 1 [0071.512] wcscmp (_String1="Start Menu", _String2="..") returned 1 [0071.512] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x38) returned 0x5445a40 [0071.512] wcscpy (in: _Dest=0x5445a40, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0071.512] wcscat (in: _Dest=0x5445a40, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0071.512] wcscat (in: _Dest=0x5445a40, _Source="Start Menu" | out: _Dest="C:\\Users\\Default\\Start Menu") returned="C:\\Users\\Default\\Start Menu" [0071.512] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5445a40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x748 [0071.513] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0071.513] wcscmp (_String1="Templates", _String2=".") returned 1 [0071.513] wcscmp (_String1="Templates", _String2="..") returned 1 [0071.513] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x54453c0 [0071.513] wcscpy (in: _Dest=0x54453c0, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0071.513] wcscat (in: _Dest=0x54453c0, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0071.513] wcscat (in: _Dest=0x54453c0, _Source="Templates" | out: _Dest="C:\\Users\\Default\\Templates") returned="C:\\Users\\Default\\Templates" [0071.513] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54453c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x74c [0071.514] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0071.514] wcscmp (_String1="Videos", _String2=".") returned 1 [0071.514] wcscmp (_String1="Videos", _String2="..") returned 1 [0071.514] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x30) returned 0x537c768 [0071.514] wcscpy (in: _Dest=0x537c768, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0071.514] wcscat (in: _Dest=0x537c768, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0071.514] wcscat (in: _Dest=0x537c768, _Source="Videos" | out: _Dest="C:\\Users\\Default\\Videos") returned="C:\\Users\\Default\\Videos" [0071.514] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x537c768, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x750 [0071.515] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0071.515] FindClose (in: hFindFile=0x5445940 | out: hFindFile=0x5445940) returned 1 [0071.515] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5430018) returned 1 [0071.515] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6af0) returned 1 [0071.515] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6a60) returned 1 Thread: id = 116 os_tid = 0xa54 [0071.255] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x30) returned 0x38b7768 [0071.255] wcscpy (in: _Dest=0x38b7768, _Source="C:\\Users\\Default User" | out: _Dest="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0071.255] wcscat (in: _Dest=0x38b7768, _Source="\\" | out: _Dest="C:\\Users\\Default User\\") returned="C:\\Users\\Default User\\" [0071.255] wcscat (in: _Dest=0x38b7768, _Source="*" | out: _Dest="C:\\Users\\Default User\\*") returned="C:\\Users\\Default User\\*" [0071.255] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5430280 [0071.255] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\*", lpFindFileData=0x5430280 | out: lpFindFileData=0x5430280*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0071.764] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5430280) returned 1 [0071.764] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b7768) returned 1 [0071.764] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54088a8) returned 1 Thread: id = 117 os_tid = 0xe10 [0071.256] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x38) returned 0x5445900 [0071.256] wcscpy (in: _Dest=0x5445900, _Source="C:\\Users\\Default.migrated" | out: _Dest="C:\\Users\\Default.migrated") returned="C:\\Users\\Default.migrated" [0071.256] wcscat (in: _Dest=0x5445900, _Source="\\" | out: _Dest="C:\\Users\\Default.migrated\\") returned="C:\\Users\\Default.migrated\\" [0071.256] wcscat (in: _Dest=0x5445900, _Source="*" | out: _Dest="C:\\Users\\Default.migrated\\*") returned="C:\\Users\\Default.migrated\\*" [0071.256] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542f678 [0071.256] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\*", lpFindFileData=0x542f678 | out: lpFindFileData=0x542f678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54455c0 [0071.788] wcscmp (_String1=".", _String2=".") returned 0 [0071.788] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x542f678 | out: lpFindFileData=0x542f678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.788] wcscmp (_String1="..", _String2=".") returned 1 [0071.788] wcscmp (_String1="..", _String2="..") returned 0 [0071.788] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x542f678 | out: lpFindFileData=0x542f678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7205420a, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0071.788] wcscmp (_String1="AppData", _String2=".") returned 1 [0071.788] wcscmp (_String1="AppData", _String2="..") returned 1 [0071.788] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x38b81f8 [0071.788] wcscpy (in: _Dest=0x38b81f8, _Source="C:\\Users\\Default.migrated" | out: _Dest="C:\\Users\\Default.migrated") returned="C:\\Users\\Default.migrated" [0071.788] wcscat (in: _Dest=0x38b81f8, _Source="\\" | out: _Dest="C:\\Users\\Default.migrated\\") returned="C:\\Users\\Default.migrated\\" [0071.788] wcscat (in: _Dest=0x38b81f8, _Source="AppData" | out: _Dest="C:\\Users\\Default.migrated\\AppData") returned="C:\\Users\\Default.migrated\\AppData" [0071.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b81f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f4 [0071.789] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x542f678 | out: lpFindFileData=0x542f678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0071.789] wcscmp (_String1="Documents", _String2=".") returned 1 [0071.789] wcscmp (_String1="Documents", _String2="..") returned 1 [0071.789] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x38b8068 [0071.789] wcscpy (in: _Dest=0x38b8068, _Source="C:\\Users\\Default.migrated" | out: _Dest="C:\\Users\\Default.migrated") returned="C:\\Users\\Default.migrated" [0071.789] wcscat (in: _Dest=0x38b8068, _Source="\\" | out: _Dest="C:\\Users\\Default.migrated\\") returned="C:\\Users\\Default.migrated\\" [0071.789] wcscat (in: _Dest=0x38b8068, _Source="Documents" | out: _Dest="C:\\Users\\Default.migrated\\Documents") returned="C:\\Users\\Default.migrated\\Documents" [0071.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b8068, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0 [0071.790] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x542f678 | out: lpFindFileData=0x542f678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 0 [0071.790] FindClose (in: hFindFile=0x54455c0 | out: hFindFile=0x54455c0) returned 1 [0071.790] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542f678) returned 1 [0071.790] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445900) returned 1 [0071.791] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389e800) returned 1 Thread: id = 118 os_tid = 0x7c8 [0071.257] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x24) returned 0x38a67f0 [0071.257] wcscpy (in: _Dest=0x38a67f0, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0071.257] wcscat (in: _Dest=0x38a67f0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0071.257] wcscat (in: _Dest=0x38a67f0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\*") returned="C:\\Users\\FD1HVy\\*" [0071.257] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542f8e0 [0071.257] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\*", lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445080 [0072.117] wcscmp (_String1=".", _String2=".") returned 0 [0072.117] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.117] wcscmp (_String1="..", _String2=".") returned 1 [0072.117] wcscmp (_String1="..", _String2="..") returned 0 [0072.117] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0072.117] wcscmp (_String1="AppData", _String2=".") returned 1 [0072.117] wcscmp (_String1="AppData", _String2="..") returned 1 [0072.117] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x30) returned 0x53e65b8 [0072.117] wcscpy (in: _Dest=0x53e65b8, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0072.117] wcscat (in: _Dest=0x53e65b8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0072.117] wcscat (in: _Dest=0x53e65b8, _Source="AppData" | out: _Dest="C:\\Users\\FD1HVy\\AppData") returned="C:\\Users\\FD1HVy\\AppData" [0072.117] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53e65b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0 [0072.122] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0072.122] wcscmp (_String1="Application Data", _String2=".") returned 1 [0072.122] wcscmp (_String1="Application Data", _String2="..") returned 1 [0072.122] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x42) returned 0x546d840 [0072.122] wcscpy (in: _Dest=0x546d840, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0072.122] wcscat (in: _Dest=0x546d840, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0072.122] wcscat (in: _Dest=0x546d840, _Source="Application Data" | out: _Dest="C:\\Users\\FD1HVy\\Application Data") returned="C:\\Users\\FD1HVy\\Application Data" [0072.122] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x546d840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ac [0072.123] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0072.123] wcscmp (_String1="Contacts", _String2=".") returned 1 [0072.123] wcscmp (_String1="Contacts", _String2="..") returned 1 [0072.123] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x32) returned 0x5444c40 [0072.123] wcscpy (in: _Dest=0x5444c40, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0072.123] wcscat (in: _Dest=0x5444c40, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0072.123] wcscat (in: _Dest=0x5444c40, _Source="Contacts" | out: _Dest="C:\\Users\\FD1HVy\\Contacts") returned="C:\\Users\\FD1HVy\\Contacts" [0072.123] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5444c40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a8 [0072.124] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0072.124] wcscmp (_String1="Cookies", _String2=".") returned 1 [0072.124] wcscmp (_String1="Cookies", _String2="..") returned 1 [0072.124] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x30) returned 0x53e6238 [0072.124] wcscpy (in: _Dest=0x53e6238, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0072.124] wcscat (in: _Dest=0x53e6238, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0072.124] wcscat (in: _Dest=0x53e6238, _Source="Cookies" | out: _Dest="C:\\Users\\FD1HVy\\Cookies") returned="C:\\Users\\FD1HVy\\Cookies" [0072.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53e6238, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414 [0072.125] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa15a90db, ftLastAccessTime.dwHighDateTime=0x1d5e1e4, ftLastWriteTime.dwLowDateTime=0xa15a90db, ftLastWriteTime.dwHighDateTime=0x1d5e1e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0072.125] wcscmp (_String1="Desktop", _String2=".") returned 1 [0072.125] wcscmp (_String1="Desktop", _String2="..") returned 1 [0072.125] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x30) returned 0x53e63c0 [0072.125] wcscpy (in: _Dest=0x53e63c0, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0072.125] wcscat (in: _Dest=0x53e63c0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0072.125] wcscat (in: _Dest=0x53e63c0, _Source="Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0072.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53e63c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410 [0072.126] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x39b7fbfc, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39b7fbfc, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0072.126] wcscmp (_String1="Documents", _String2=".") returned 1 [0072.126] wcscmp (_String1="Documents", _String2="..") returned 1 [0072.126] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x34) returned 0x5445180 [0072.126] wcscpy (in: _Dest=0x5445180, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0072.126] wcscat (in: _Dest=0x5445180, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0072.126] wcscat (in: _Dest=0x5445180, _Source="Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0072.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5445180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x408 [0072.126] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0072.126] wcscmp (_String1="Downloads", _String2=".") returned 1 [0072.126] wcscmp (_String1="Downloads", _String2="..") returned 1 [0072.126] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x34) returned 0x5444f00 [0072.127] wcscpy (in: _Dest=0x5444f00, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0072.127] wcscat (in: _Dest=0x5444f00, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0072.127] wcscat (in: _Dest=0x5444f00, _Source="Downloads" | out: _Dest="C:\\Users\\FD1HVy\\Downloads") returned="C:\\Users\\FD1HVy\\Downloads" [0072.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5444f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3fc [0072.127] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0072.127] wcscmp (_String1="Favorites", _String2=".") returned 1 [0072.127] wcscmp (_String1="Favorites", _String2="..") returned 1 [0072.127] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x34) returned 0x5444b40 [0072.127] wcscpy (in: _Dest=0x5444b40, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0072.127] wcscat (in: _Dest=0x5444b40, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0072.127] wcscat (in: _Dest=0x5444b40, _Source="Favorites" | out: _Dest="C:\\Users\\FD1HVy\\Favorites") returned="C:\\Users\\FD1HVy\\Favorites" [0072.128] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5444b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f8 [0072.128] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0072.128] wcscmp (_String1="Links", _String2=".") returned 1 [0072.128] wcscmp (_String1="Links", _String2="..") returned 1 [0072.128] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2c) returned 0x53e63f8 [0072.128] wcscpy (in: _Dest=0x53e63f8, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0072.128] wcscat (in: _Dest=0x53e63f8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0072.128] wcscat (in: _Dest=0x53e63f8, _Source="Links" | out: _Dest="C:\\Users\\FD1HVy\\Links") returned="C:\\Users\\FD1HVy\\Links" [0072.128] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53e63f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b4 [0072.132] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0072.132] wcscmp (_String1="Local Settings", _String2=".") returned 1 [0072.132] wcscmp (_String1="Local Settings", _String2="..") returned 1 [0072.132] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3e) returned 0x537bf80 [0072.132] wcscpy (in: _Dest=0x537bf80, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0072.132] wcscat (in: _Dest=0x537bf80, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0072.132] wcscat (in: _Dest=0x537bf80, _Source="Local Settings" | out: _Dest="C:\\Users\\FD1HVy\\Local Settings") returned="C:\\Users\\FD1HVy\\Local Settings" [0072.132] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x537bf80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a8 [0072.132] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x39bf2515, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39bf2515, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0072.133] wcscmp (_String1="Music", _String2=".") returned 1 [0072.133] wcscmp (_String1="Music", _String2="..") returned 1 [0072.133] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2c) returned 0x53e6078 [0072.133] wcscpy (in: _Dest=0x53e6078, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0072.133] wcscat (in: _Dest=0x53e6078, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0072.133] wcscat (in: _Dest=0x53e6078, _Source="Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0072.133] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53e6078, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a0 [0072.133] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0072.133] wcscmp (_String1="My Documents", _String2=".") returned 1 [0072.133] wcscmp (_String1="My Documents", _String2="..") returned 1 [0072.133] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a5698 [0072.133] wcscpy (in: _Dest=0x38a5698, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0072.134] wcscat (in: _Dest=0x38a5698, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0072.134] wcscat (in: _Dest=0x38a5698, _Source="My Documents" | out: _Dest="C:\\Users\\FD1HVy\\My Documents") returned="C:\\Users\\FD1HVy\\My Documents" [0072.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a5698, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x388 [0072.134] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0072.134] wcscmp (_String1="NetHood", _String2=".") returned 1 [0072.134] wcscmp (_String1="NetHood", _String2="..") returned 1 [0072.134] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x30) returned 0x53e5f98 [0072.134] wcscpy (in: _Dest=0x53e5f98, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0072.134] wcscat (in: _Dest=0x53e5f98, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0072.134] wcscat (in: _Dest=0x53e5f98, _Source="NetHood" | out: _Dest="C:\\Users\\FD1HVy\\NetHood") returned="C:\\Users\\FD1HVy\\NetHood" [0072.135] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53e5f98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x488 [0072.135] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd21a84e3, ftLastAccessTime.dwHighDateTime=0x1d5d815, ftLastWriteTime.dwLowDateTime=0xd21a84e3, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0072.135] wcscmp (_String1="NTUSER.DAT", _String2=".") returned 1 [0072.135] wcscmp (_String1="NTUSER.DAT", _String2="..") returned 1 [0072.135] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0xbd400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0072.135] wcscmp (_String1="ntuser.dat.LOG1", _String2=".") returned 1 [0072.135] wcscmp (_String1="ntuser.dat.LOG1", _String2="..") returned 1 [0072.135] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0072.135] wcscmp (_String1="ntuser.dat.LOG2", _String2=".") returned 1 [0072.135] wcscmp (_String1="ntuser.dat.LOG2", _String2="..") returned 1 [0072.135] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0072.135] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", _String2=".") returned 1 [0072.135] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", _String2="..") returned 1 [0072.135] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0072.136] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", _String2=".") returned 1 [0072.136] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", _String2="..") returned 1 [0072.136] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0072.136] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", _String2=".") returned 1 [0072.136] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", _String2="..") returned 1 [0072.136] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xc1adea7d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc1adea7d, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc1adea7d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0072.136] wcscmp (_String1="ntuser.ini", _String2=".") returned 1 [0072.136] wcscmp (_String1="ntuser.ini", _String2="..") returned 1 [0072.136] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OneDrive", cAlternateFileName="")) returned 1 [0072.136] wcscmp (_String1="OneDrive", _String2=".") returned 1 [0072.136] wcscmp (_String1="OneDrive", _String2="..") returned 1 [0072.136] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x32) returned 0x5445240 [0072.136] wcscpy (in: _Dest=0x5445240, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0072.136] wcscat (in: _Dest=0x5445240, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0072.136] wcscat (in: _Dest=0x5445240, _Source="OneDrive" | out: _Dest="C:\\Users\\FD1HVy\\OneDrive") returned="C:\\Users\\FD1HVy\\OneDrive" [0072.136] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5445240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x48c [0072.137] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x39d95cc8, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39d95cc8, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0072.137] wcscmp (_String1="Pictures", _String2=".") returned 1 [0072.137] wcscmp (_String1="Pictures", _String2="..") returned 1 [0072.137] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x32) returned 0x5444e00 [0072.137] wcscpy (in: _Dest=0x5444e00, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0072.137] wcscat (in: _Dest=0x5444e00, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0072.137] wcscat (in: _Dest=0x5444e00, _Source="Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0072.137] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5444e00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x398 [0072.137] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0072.137] wcscmp (_String1="PrintHood", _String2=".") returned 1 [0072.138] wcscmp (_String1="PrintHood", _String2="..") returned 1 [0072.138] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x34) returned 0x5444bc0 [0072.138] wcscpy (in: _Dest=0x5444bc0, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0072.138] wcscat (in: _Dest=0x5444bc0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0072.138] wcscat (in: _Dest=0x5444bc0, _Source="PrintHood" | out: _Dest="C:\\Users\\FD1HVy\\PrintHood") returned="C:\\Users\\FD1HVy\\PrintHood" [0072.138] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5444bc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490 [0072.138] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0072.138] wcscmp (_String1="Recent", _String2=".") returned 1 [0072.138] wcscmp (_String1="Recent", _String2="..") returned 1 [0072.138] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2e) returned 0x53e6270 [0072.139] wcscpy (in: _Dest=0x53e6270, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0072.139] wcscat (in: _Dest=0x53e6270, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0072.139] wcscat (in: _Dest=0x53e6270, _Source="Recent" | out: _Dest="C:\\Users\\FD1HVy\\Recent") returned="C:\\Users\\FD1HVy\\Recent" [0072.139] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53e6270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0072.139] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0072.139] wcscmp (_String1="Saved Games", _String2=".") returned 1 [0072.139] wcscmp (_String1="Saved Games", _String2="..") returned 1 [0072.139] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x38) returned 0x5444c80 [0072.139] wcscpy (in: _Dest=0x5444c80, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0072.139] wcscat (in: _Dest=0x5444c80, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0072.139] wcscat (in: _Dest=0x5444c80, _Source="Saved Games" | out: _Dest="C:\\Users\\FD1HVy\\Saved Games") returned="C:\\Users\\FD1HVy\\Saved Games" [0072.139] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5444c80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x498 [0072.140] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0072.140] wcscmp (_String1="Searches", _String2=".") returned 1 [0072.140] wcscmp (_String1="Searches", _String2="..") returned 1 [0072.140] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x32) returned 0x5445000 [0072.140] wcscpy (in: _Dest=0x5445000, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0072.140] wcscat (in: _Dest=0x5445000, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0072.140] wcscat (in: _Dest=0x5445000, _Source="Searches" | out: _Dest="C:\\Users\\FD1HVy\\Searches") returned="C:\\Users\\FD1HVy\\Searches" [0072.140] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5445000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0072.141] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0072.141] wcscmp (_String1="SendTo", _String2=".") returned 1 [0072.141] wcscmp (_String1="SendTo", _String2="..") returned 1 [0072.141] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2e) returned 0x53e6430 [0072.141] wcscpy (in: _Dest=0x53e6430, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0072.141] wcscat (in: _Dest=0x53e6430, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0072.141] wcscat (in: _Dest=0x53e6430, _Source="SendTo" | out: _Dest="C:\\Users\\FD1HVy\\SendTo") returned="C:\\Users\\FD1HVy\\SendTo" [0072.141] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53e6430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x54c [0072.142] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0072.142] wcscmp (_String1="Start Menu", _String2=".") returned 1 [0072.142] wcscmp (_String1="Start Menu", _String2="..") returned 1 [0072.142] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x5445280 [0072.142] wcscpy (in: _Dest=0x5445280, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0072.142] wcscat (in: _Dest=0x5445280, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0072.142] wcscat (in: _Dest=0x5445280, _Source="Start Menu" | out: _Dest="C:\\Users\\FD1HVy\\Start Menu") returned="C:\\Users\\FD1HVy\\Start Menu" [0072.142] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5445280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x834 [0072.143] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0072.143] wcscmp (_String1="Templates", _String2=".") returned 1 [0072.143] wcscmp (_String1="Templates", _String2="..") returned 1 [0072.143] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x34) returned 0x5444d80 [0072.143] wcscpy (in: _Dest=0x5444d80, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0072.143] wcscat (in: _Dest=0x5444d80, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0072.143] wcscat (in: _Dest=0x5444d80, _Source="Templates" | out: _Dest="C:\\Users\\FD1HVy\\Templates") returned="C:\\Users\\FD1HVy\\Templates" [0072.143] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5444d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x910 [0072.144] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x39d49881, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39d49881, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0072.144] wcscmp (_String1="Videos", _String2=".") returned 1 [0072.144] wcscmp (_String1="Videos", _String2="..") returned 1 [0072.144] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2e) returned 0x53e64a0 [0072.144] wcscpy (in: _Dest=0x53e64a0, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0072.144] wcscat (in: _Dest=0x53e64a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0072.144] wcscat (in: _Dest=0x53e64a0, _Source="Videos" | out: _Dest="C:\\Users\\FD1HVy\\Videos") returned="C:\\Users\\FD1HVy\\Videos" [0072.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53e64a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x914 [0072.151] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x39d49881, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39d49881, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0072.151] FindClose (in: hFindFile=0x5445080 | out: hFindFile=0x5445080) returned 1 [0072.151] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542f8e0) returned 1 [0072.151] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a67f0) returned 1 [0072.151] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e00) returned 1 Thread: id = 119 os_tid = 0xa5c [0071.258] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x24) returned 0x38a6820 [0071.258] wcscpy (in: _Dest=0x38a6820, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0071.258] wcscat (in: _Dest=0x38a6820, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0071.258] wcscat (in: _Dest=0x38a6820, _Source="*" | out: _Dest="C:\\Users\\Public\\*") returned="C:\\Users\\Public\\*" [0071.258] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542fb48 [0071.258] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*", lpFindFileData=0x542fb48 | out: lpFindFileData=0x542fb48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f040 [0074.987] wcscmp (_String1=".", _String2=".") returned 0 [0074.987] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x542fb48 | out: lpFindFileData=0x542fb48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.987] wcscmp (_String1="..", _String2=".") returned 1 [0074.987] wcscmp (_String1="..", _String2="..") returned 0 [0074.987] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x542fb48 | out: lpFindFileData=0x542fb48*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccountPictures", cAlternateFileName="ACCOUN~1")) returned 1 [0074.987] wcscmp (_String1="AccountPictures", _String2=".") returned 1 [0074.987] wcscmp (_String1="AccountPictures", _String2="..") returned 1 [0074.987] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a57b8 [0074.987] wcscpy (in: _Dest=0x38a57b8, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0074.987] wcscat (in: _Dest=0x38a57b8, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0074.987] wcscat (in: _Dest=0x38a57b8, _Source="AccountPictures" | out: _Dest="C:\\Users\\Public\\AccountPictures") returned="C:\\Users\\Public\\AccountPictures" [0075.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a57b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x960 [0075.738] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x542fb48 | out: lpFindFileData=0x542fb48*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0075.739] wcscmp (_String1="Desktop", _String2=".") returned 1 [0075.739] wcscmp (_String1="Desktop", _String2="..") returned 1 [0075.739] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x30) returned 0x5531f88 [0075.739] wcscpy (in: _Dest=0x5531f88, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0075.739] wcscat (in: _Dest=0x5531f88, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0075.739] wcscat (in: _Dest=0x5531f88, _Source="Desktop" | out: _Dest="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0075.739] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5531f88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x840 [0075.739] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x542fb48 | out: lpFindFileData=0x542fb48*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0075.739] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0075.739] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0075.740] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x542fb48 | out: lpFindFileData=0x542fb48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0075.740] wcscmp (_String1="Documents", _String2=".") returned 1 [0075.740] wcscmp (_String1="Documents", _String2="..") returned 1 [0075.740] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x34) returned 0x389e700 [0075.740] wcscpy (in: _Dest=0x389e700, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0075.740] wcscat (in: _Dest=0x389e700, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0075.740] wcscat (in: _Dest=0x389e700, _Source="Documents" | out: _Dest="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0075.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389e700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x82c [0075.740] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x542fb48 | out: lpFindFileData=0x542fb48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0075.740] wcscmp (_String1="Downloads", _String2=".") returned 1 [0075.740] wcscmp (_String1="Downloads", _String2="..") returned 1 [0075.740] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x34) returned 0x389e740 [0075.740] wcscpy (in: _Dest=0x389e740, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0075.740] wcscat (in: _Dest=0x389e740, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0075.741] wcscat (in: _Dest=0x389e740, _Source="Downloads" | out: _Dest="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0075.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389e740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b8 [0075.741] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x542fb48 | out: lpFindFileData=0x542fb48*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb207547d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0075.741] wcscmp (_String1="Libraries", _String2=".") returned 1 [0075.741] wcscmp (_String1="Libraries", _String2="..") returned 1 [0075.741] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x34) returned 0x389e800 [0075.741] wcscpy (in: _Dest=0x389e800, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0075.741] wcscat (in: _Dest=0x389e800, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0075.741] wcscat (in: _Dest=0x389e800, _Source="Libraries" | out: _Dest="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0075.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389e800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x74c [0075.742] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x542fb48 | out: lpFindFileData=0x542fb48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0075.742] wcscmp (_String1="Music", _String2=".") returned 1 [0075.742] wcscmp (_String1="Music", _String2="..") returned 1 [0075.742] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2c) returned 0x5531f50 [0075.742] wcscpy (in: _Dest=0x5531f50, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0075.742] wcscat (in: _Dest=0x5531f50, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0075.742] wcscat (in: _Dest=0x5531f50, _Source="Music" | out: _Dest="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0075.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5531f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x748 [0075.743] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x542fb48 | out: lpFindFileData=0x542fb48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0075.743] wcscmp (_String1="Pictures", _String2=".") returned 1 [0075.743] wcscmp (_String1="Pictures", _String2="..") returned 1 [0075.743] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x32) returned 0x389e940 [0075.743] wcscpy (in: _Dest=0x389e940, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0075.743] wcscat (in: _Dest=0x389e940, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0075.743] wcscat (in: _Dest=0x389e940, _Source="Pictures" | out: _Dest="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0075.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x389e940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x744 [0075.744] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x542fb48 | out: lpFindFileData=0x542fb48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0075.744] wcscmp (_String1="Videos", _String2=".") returned 1 [0075.744] wcscmp (_String1="Videos", _String2="..") returned 1 [0075.744] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2e) returned 0x5531ea8 [0075.744] wcscpy (in: _Dest=0x5531ea8, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0075.744] wcscat (in: _Dest=0x5531ea8, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0075.744] wcscat (in: _Dest=0x5531ea8, _Source="Videos" | out: _Dest="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0075.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5531ea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x73c [0075.744] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x542fb48 | out: lpFindFileData=0x542fb48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0075.744] FindClose (in: hFindFile=0x389f040 | out: hFindFile=0x389f040) returned 1 [0075.745] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542fb48) returned 1 [0075.745] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6820) returned 1 [0075.745] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4f68) returned 1 Thread: id = 120 os_tid = 0xcc0 [0071.258] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 0x80 [0072.364] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml", dwFileAttributes=0x20) returned 1 [0075.547] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xc98 [0075.548] GetFileSizeEx (in: hFile=0xc98, lpFileSize=0x876fed4 | out: lpFileSize=0x876fed4*=272046) returned 1 [0075.548] SetFilePointerEx (in: hFile=0xc98, liDistanceToMove=0x426aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.548] ReadFile (in: hFile=0xc98, lpBuffer=0x876fe58, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x876fe54, lpOverlapped=0x0 | out: lpBuffer=0x876fe58*, lpNumberOfBytesRead=0x876fe54*=0x4, lpOverlapped=0x0) returned 1 [0075.591] SetFilePointerEx (in: hFile=0xc98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.591] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5260 [0075.591] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ec8 [0075.592] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4fe0 [0075.592] NtQuerySystemTime (in: CurrentTime=0x876fe34 | out: CurrentTime=0x876fe34*=132260136327460242) returned 0x0 [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0x268dc7af [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0x161b53e7 [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0x3eacc7dd [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0x70f98f5f [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0x327de081 [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0x4680c3e2 [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0x9d126453 [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0xeb7842f [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0x2c91d079 [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0x6606c0c [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0x41736a8a [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0x2dcb0120 [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0x6834f546 [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0xfffce441 [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0xebaa6cc4 [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0xb241a2c2 [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0x35e356c7 [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0x9b9205b9 [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0x99024d28 [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0xb8edd719 [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0x1ba022a [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0x14c83c58 [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0x7fe0cd95 [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0xbe640f4d [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0x78fa7c57 [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0x39a581ba [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0x38657589 [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0xa7188178 [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0x26a16a09 [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0xf2e85d56 [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0xc4e36423 [0075.592] RtlRandom (in: Seed=0x876fe40 | out: Seed=0x876fe40) returned 0xa37c5f9d [0075.602] SetFilePointerEx (in: hFile=0xc98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.602] ReadFile (in: hFile=0xc98, lpBuffer=0x554d060, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x876fdec, lpOverlapped=0x0 | out: lpBuffer=0x554d060*, lpNumberOfBytesRead=0x876fdec*=0xc800, lpOverlapped=0x0) returned 1 [0075.637] SetFilePointerEx (in: hFile=0xc98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.637] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a6388 [0075.637] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497340 [0075.637] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55599d8 [0075.637] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55599d8) returned 1 [0075.638] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5598898 [0075.643] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559bb8 [0075.643] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559be0 [0075.643] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559be0) returned 1 [0075.643] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497340) returned 1 [0075.643] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6388) returned 1 [0075.643] WriteFile (in: hFile=0xc98, lpBuffer=0x5598898*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x876fdec, lpOverlapped=0x0 | out: lpBuffer=0x5598898*, lpNumberOfBytesWritten=0x876fdec*=0xc800, lpOverlapped=0x0) returned 1 [0075.647] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5598898) returned 1 [0075.647] SetFilePointerEx (in: hFile=0xc98, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.648] ReadFile (in: hFile=0xc98, lpBuffer=0x554d060, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x876fdec, lpOverlapped=0x0 | out: lpBuffer=0x554d060*, lpNumberOfBytesRead=0x876fdec*=0xc800, lpOverlapped=0x0) returned 1 [0075.649] SetFilePointerEx (in: hFile=0xc98, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.649] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a6388 [0075.650] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5496e90 [0075.650] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559be0 [0075.650] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559be0) returned 1 [0075.650] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5598898 [0075.651] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559d20 [0075.651] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559d48 [0075.651] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559d48) returned 1 [0075.651] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496e90) returned 1 [0075.651] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6388) returned 1 [0075.651] WriteFile (in: hFile=0xc98, lpBuffer=0x5598898*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x876fdec, lpOverlapped=0x0 | out: lpBuffer=0x5598898*, lpNumberOfBytesWritten=0x876fdec*=0xc800, lpOverlapped=0x0) returned 1 [0075.653] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5598898) returned 1 [0075.655] SetFilePointerEx (in: hFile=0xc98, liDistanceToMove=0x35eae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.655] ReadFile (in: hFile=0xc98, lpBuffer=0x554d060, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x876fdec, lpOverlapped=0x0 | out: lpBuffer=0x554d060*, lpNumberOfBytesRead=0x876fdec*=0xc800, lpOverlapped=0x0) returned 1 [0075.655] SetFilePointerEx (in: hFile=0xc98, liDistanceToMove=0x35eae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.655] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a6388 [0075.656] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x54969e0 [0075.656] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a28 [0075.656] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a28) returned 1 [0075.656] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5598898 [0075.657] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55599d8 [0075.657] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559be0 [0075.657] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559be0) returned 1 [0075.657] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54969e0) returned 1 [0075.657] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6388) returned 1 [0075.657] WriteFile (in: hFile=0xc98, lpBuffer=0x5598898*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x876fdec, lpOverlapped=0x0 | out: lpBuffer=0x5598898*, lpNumberOfBytesWritten=0x876fdec*=0xc800, lpOverlapped=0x0) returned 1 [0075.690] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5598898) returned 1 [0075.690] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x38fcf30 [0075.690] SetFilePointerEx (in: hFile=0xc98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.691] WriteFile (in: hFile=0xc98, lpBuffer=0x3979a78*, nNumberOfBytesToWrite=0x153, lpNumberOfBytesWritten=0x876fe94, lpOverlapped=0x0 | out: lpBuffer=0x3979a78*, lpNumberOfBytesWritten=0x876fe94*=0x153, lpOverlapped=0x0) returned 1 [0075.692] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3979a78) returned 1 [0075.692] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5531dc8) returned 1 [0075.692] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559c08) returned 1 [0075.692] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5531ff8) returned 1 [0075.692] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38fcf30) returned 1 [0075.692] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4ec8) returned 1 [0075.692] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4ef0) returned 1 [0075.692] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389c0e0) returned 1 [0075.692] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x90) returned 0x38a7368 [0075.692] wcscpy (in: _Dest=0x38a7368, _Source="C:\\588bce7c90097ed212\\ParameterInfo.xml" | out: _Dest="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned="C:\\588bce7c90097ed212\\ParameterInfo.xml" [0075.692] wcscat (in: _Dest=0x38a7368, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\588bce7c90097ed212\\ParameterInfo.xml.mailto[knoocknoo@cock.li].a0a70") returned="C:\\588bce7c90097ed212\\ParameterInfo.xml.mailto[knoocknoo@cock.li].a0a70" [0075.692] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\588bce7c90097ed212\\ParameterInfo.xml.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x876fe4c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\588bce7c90097ed212\\ParameterInfo.xml.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0075.692] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa6) returned 0x54dec90 Thread: id = 121 os_tid = 0x480 [0071.258] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 0x80 [0072.363] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd", dwFileAttributes=0x20) returned 1 [0075.546] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xc94 [0075.546] GetFileSizeEx (in: hFile=0xc94, lpFileSize=0x87ef934 | out: lpFileSize=0x87ef934*=30120) returned 1 [0075.546] SetFilePointerEx (in: hFile=0xc94, liDistanceToMove=0x75a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.546] ReadFile (in: hFile=0xc94, lpBuffer=0x87ef8b8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x87ef8b4, lpOverlapped=0x0 | out: lpBuffer=0x87ef8b8*, lpNumberOfBytesRead=0x87ef8b4*=0x4, lpOverlapped=0x0) returned 1 [0075.579] SetFilePointerEx (in: hFile=0xc94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.579] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5260 [0075.579] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4e50 [0075.579] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4fe0 [0075.579] NtQuerySystemTime (in: CurrentTime=0x87ef894 | out: CurrentTime=0x87ef894*=132260136327304509) returned 0x0 [0075.579] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0xd823b68f [0075.579] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0xbc675bd1 [0075.579] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0x166c8f89 [0075.579] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0x60e9c26f [0075.580] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0xde4dbfab [0075.580] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0xcb09368c [0075.580] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0xb4167f2c [0075.580] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0x66df0842 [0075.580] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0xd012c3d8 [0075.580] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0x15413041 [0075.580] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0x833e5eac [0075.580] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0xfd0fd884 [0075.580] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0x44a41677 [0075.580] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0x77978640 [0075.580] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0x755f7219 [0075.580] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0xc0097fde [0075.580] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0x39fad5b8 [0075.580] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0x5876b10f [0075.580] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0x40ba372f [0075.580] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0x89ecf8d3 [0075.580] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0x5c4439ac [0075.580] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0x7c1ebcfb [0075.580] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0x933b15c3 [0075.580] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0x20282656 [0075.580] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0xc77be89f [0075.580] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0x18fa1de1 [0075.581] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0xb99a4097 [0075.581] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0x4b906602 [0075.581] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0x5a40c111 [0075.581] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0x1db0cf70 [0075.581] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0x9a0032f [0075.581] RtlRandom (in: Seed=0x87ef8a0 | out: Seed=0x87ef8a0) returned 0x87d0d77d [0075.591] ReadFile (in: hFile=0xc94, lpBuffer=0x5534050, nNumberOfBytesToRead=0x75a8, lpNumberOfBytesRead=0x87ef890, lpOverlapped=0x0 | out: lpBuffer=0x5534050*, lpNumberOfBytesRead=0x87ef890*=0x75a8, lpOverlapped=0x0) returned 1 [0075.635] SetFilePointerEx (in: hFile=0xc94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.635] WriteFile (in: hFile=0xc94, lpBuffer=0x5540858*, nNumberOfBytesToWrite=0x75a8, lpNumberOfBytesWritten=0x87ef88c, lpOverlapped=0x0 | out: lpBuffer=0x5540858*, lpNumberOfBytesWritten=0x87ef88c*=0x75a8, lpOverlapped=0x0) returned 1 [0076.152] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c08 [0076.152] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559d48 [0076.152] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559d48) returned 1 [0076.152] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5540858) returned 1 [0076.154] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5534050) returned 1 [0076.164] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496b48) returned 1 [0076.164] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6220) returned 1 [0076.164] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x23) returned 0x38a69d0 [0076.165] SetFilePointerEx (in: hFile=0xc94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.165] WriteFile (in: hFile=0xc94, lpBuffer=0x549be80*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x87ef8f4, lpOverlapped=0x0 | out: lpBuffer=0x549be80*, lpNumberOfBytesWritten=0x87ef8f4*=0x107, lpOverlapped=0x0) returned 1 [0076.171] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549be80) returned 1 [0076.171] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6880) returned 1 [0076.172] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559898) returned 1 [0076.172] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a69d0) returned 1 [0076.172] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559c08) returned 1 [0076.172] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e50) returned 1 [0076.172] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e78) returned 1 [0076.172] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4ea0) returned 1 [0076.172] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x84) returned 0x549db08 [0076.172] wcscpy (in: _Dest=0x549db08, _Source="C:\\588bce7c90097ed212\\SetupUi.xsd" | out: _Dest="C:\\588bce7c90097ed212\\SetupUi.xsd") returned="C:\\588bce7c90097ed212\\SetupUi.xsd" [0076.172] wcscat (in: _Dest=0x549db08, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\588bce7c90097ed212\\SetupUi.xsd.mailto[knoocknoo@cock.li].a0a70") returned="C:\\588bce7c90097ed212\\SetupUi.xsd.mailto[knoocknoo@cock.li].a0a70" [0076.172] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\588bce7c90097ed212\\SetupUi.xsd.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x87ef8ac, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\588bce7c90097ed212\\SetupUi.xsd.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.172] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9a) returned 0x54a1a70 Thread: id = 122 os_tid = 0x258 [0071.259] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 0x80 [0072.363] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp", dwFileAttributes=0x20) returned 1 [0074.771] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb84 [0074.771] GetFileSizeEx (in: hFile=0xb84, lpFileSize=0x886f88c | out: lpFileSize=0x886f88c*=41080) returned 1 [0074.771] SetFilePointerEx (in: hFile=0xb84, liDistanceToMove=0xa074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.771] ReadFile (in: hFile=0xb84, lpBuffer=0x886f810, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x886f80c, lpOverlapped=0x0 | out: lpBuffer=0x886f810*, lpNumberOfBytesRead=0x886f80c*=0x4, lpOverlapped=0x0) returned 1 [0074.787] SetFilePointerEx (in: hFile=0xb84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.787] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ea0 [0074.787] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4fe0 [0074.787] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5260 [0074.787] NtQuerySystemTime (in: CurrentTime=0x886f7ec | out: CurrentTime=0x886f7ec*=132260136319390393) returned 0x0 [0074.787] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0x94bad6a7 [0074.787] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0x858c7cb7 [0074.787] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0xc64b0620 [0074.787] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0x31b0f73a [0074.787] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0x4b551723 [0074.787] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0x5f737723 [0074.787] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0xe4b516e1 [0074.787] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0x9c5b800a [0074.788] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0xb745ba0a [0074.788] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0xf6e440fa [0074.788] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0x20705560 [0074.788] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0x1fd758ef [0074.788] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0xac847c19 [0074.788] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0xd3fa88a8 [0074.788] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0xbd65a3d3 [0074.788] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0x6796dda7 [0074.788] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0x21c5d30 [0074.788] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0xb38290e7 [0074.788] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0xaf405675 [0074.788] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0x22f31251 [0074.788] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0xeed0060b [0074.788] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0x333df2db [0074.788] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0x634a98bc [0074.788] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0x1fb730c9 [0074.788] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0x56f4b4b3 [0074.788] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0xc82b1ff5 [0074.788] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0x9b06f274 [0074.788] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0xcef82721 [0074.788] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0xe2943566 [0074.788] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0xf0d89d09 [0074.788] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0x6974a088 [0074.788] RtlRandom (in: Seed=0x886f7f8 | out: Seed=0x886f7f8) returned 0x2aeeafd8 [0074.798] ReadFile (in: hFile=0xb84, lpBuffer=0x5489fc8, nNumberOfBytesToRead=0xa078, lpNumberOfBytesRead=0x886f7e8, lpOverlapped=0x0 | out: lpBuffer=0x5489fc8*, lpNumberOfBytesRead=0x886f7e8*=0xa078, lpOverlapped=0x0) returned 1 [0074.802] SetFilePointerEx (in: hFile=0xb84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.802] WriteFile (in: hFile=0xb84, lpBuffer=0x54967d0*, nNumberOfBytesToWrite=0xa078, lpNumberOfBytesWritten=0x886f7e4, lpOverlapped=0x0 | out: lpBuffer=0x54967d0*, lpNumberOfBytesWritten=0x886f7e4*=0xa078, lpOverlapped=0x0) returned 1 [0075.447] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5260 [0075.447] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4e00 [0075.447] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e00) returned 1 [0075.447] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54967d0) returned 1 [0075.447] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5489fc8) returned 1 [0075.447] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5467ad0) returned 1 [0075.447] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5f50) returned 1 [0075.447] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2d) returned 0x5531f50 [0075.448] SetFilePointerEx (in: hFile=0xb84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.448] WriteFile (in: hFile=0xb84, lpBuffer=0x3979680*, nNumberOfBytesToWrite=0x111, lpNumberOfBytesWritten=0x886f84c, lpOverlapped=0x0 | out: lpBuffer=0x3979680*, lpNumberOfBytesWritten=0x886f84c*=0x111, lpOverlapped=0x0) returned 1 [0075.508] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3979680) returned 1 [0075.508] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5531ff8) returned 1 [0075.508] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e00) returned 1 [0075.508] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5531f50) returned 1 [0075.508] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5260) returned 1 [0075.508] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4fe0) returned 1 [0075.509] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e50) returned 1 [0075.509] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5170) returned 1 [0075.509] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8e) returned 0x38a72d0 [0075.509] wcscpy (in: _Dest=0x38a72d0, _Source="C:\\588bce7c90097ed212\\SplashScreen.bmp" | out: _Dest="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned="C:\\588bce7c90097ed212\\SplashScreen.bmp" [0075.509] wcscat (in: _Dest=0x38a72d0, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\588bce7c90097ed212\\SplashScreen.bmp.mailto[knoocknoo@cock.li].a0a70") returned="C:\\588bce7c90097ed212\\SplashScreen.bmp.mailto[knoocknoo@cock.li].a0a70" [0075.509] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\588bce7c90097ed212\\SplashScreen.bmp.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x886f804, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\588bce7c90097ed212\\SplashScreen.bmp.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0075.509] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa4) returned 0x54deea0 Thread: id = 123 os_tid = 0x11c4 [0071.259] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 0x80 [0072.363] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml", dwFileAttributes=0x20) returned 1 [0075.544] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xc90 [0075.544] GetFileSizeEx (in: hFile=0xc90, lpFileSize=0x88ef7e4 | out: lpFileSize=0x88ef7e4*=14084) returned 1 [0075.545] SetFilePointerEx (in: hFile=0xc90, liDistanceToMove=0x3700, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.545] ReadFile (in: hFile=0xc90, lpBuffer=0x88ef768, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x88ef764, lpOverlapped=0x0 | out: lpBuffer=0x88ef768*, lpNumberOfBytesRead=0x88ef764*=0x4, lpOverlapped=0x0) returned 1 [0075.568] SetFilePointerEx (in: hFile=0xc90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.568] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4fe0 [0075.568] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5198 [0075.568] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5260 [0075.568] NtQuerySystemTime (in: CurrentTime=0x88ef744 | out: CurrentTime=0x88ef744*=132260136327304509) returned 0x0 [0075.568] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0xa9cf0bba [0075.568] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0xbed383e [0075.568] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0xdeef63cb [0075.568] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0xec56c9cb [0075.568] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0x88268d53 [0075.568] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0xeecdd2d3 [0075.568] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0x7186a631 [0075.568] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0x1e857976 [0075.569] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0x6caea079 [0075.569] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0x5074d78e [0075.569] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0x62fb666f [0075.569] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0xd66cf7eb [0075.569] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0x6df97e3 [0075.569] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0x491e3f22 [0075.569] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0x83e7e0fe [0075.569] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0xc59e8906 [0075.569] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0xdf9e0acc [0075.569] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0xa9e97752 [0075.569] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0x23326faa [0075.569] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0x7f75b20f [0075.569] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0x3f141ad7 [0075.569] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0x65359eaf [0075.569] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0x5dd850f9 [0075.569] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0xfe357d06 [0075.569] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0x59c1f954 [0075.569] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0x8652ecb7 [0075.569] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0x81805d2b [0075.569] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0xa744cfef [0075.569] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0x68590adc [0075.569] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0xa01ca300 [0075.569] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0x3d573786 [0075.569] RtlRandom (in: Seed=0x88ef750 | out: Seed=0x88ef750) returned 0x15f50e03 [0075.579] ReadFile (in: hFile=0xc90, lpBuffer=0x54b17f0, nNumberOfBytesToRead=0x3704, lpNumberOfBytesRead=0x88ef740, lpOverlapped=0x0 | out: lpBuffer=0x54b17f0*, lpNumberOfBytesRead=0x88ef740*=0x3704, lpOverlapped=0x0) returned 1 [0075.634] SetFilePointerEx (in: hFile=0xc90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.634] WriteFile (in: hFile=0xc90, lpBuffer=0x5489fc8*, nNumberOfBytesToWrite=0x3704, lpNumberOfBytesWritten=0x88ef73c, lpOverlapped=0x0 | out: lpBuffer=0x5489fc8*, lpNumberOfBytesWritten=0x88ef73c*=0x3704, lpOverlapped=0x0) returned 1 [0076.132] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55599d8 [0076.132] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559ac8 [0076.132] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ac8) returned 1 [0076.132] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5489fc8) returned 1 [0076.141] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b17f0) returned 1 [0076.141] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5467ad0) returned 1 [0076.141] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6148) returned 1 [0076.141] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x23) returned 0x38a69a0 [0076.141] SetFilePointerEx (in: hFile=0xc90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.141] WriteFile (in: hFile=0xc90, lpBuffer=0x549be80*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x88ef7a4, lpOverlapped=0x0 | out: lpBuffer=0x549be80*, lpNumberOfBytesWritten=0x88ef7a4*=0x107, lpOverlapped=0x0) returned 1 [0076.143] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549be80) returned 1 [0076.143] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a66d0) returned 1 [0076.143] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a28) returned 1 [0076.143] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a69a0) returned 1 [0076.143] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55599d8) returned 1 [0076.143] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5198) returned 1 [0076.143] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a52b0) returned 1 [0076.143] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e00) returned 1 [0076.143] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x84) returned 0x549d5f8 [0076.146] wcscpy (in: _Dest=0x549d5f8, _Source="C:\\588bce7c90097ed212\\Strings.xml" | out: _Dest="C:\\588bce7c90097ed212\\Strings.xml") returned="C:\\588bce7c90097ed212\\Strings.xml" [0076.146] wcscat (in: _Dest=0x549d5f8, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\588bce7c90097ed212\\Strings.xml.mailto[knoocknoo@cock.li].a0a70") returned="C:\\588bce7c90097ed212\\Strings.xml.mailto[knoocknoo@cock.li].a0a70" [0076.146] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\588bce7c90097ed212\\Strings.xml.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x88ef75c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\588bce7c90097ed212\\Strings.xml.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.146] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9a) returned 0x38abf08 Thread: id = 124 os_tid = 0x2d8 [0071.260] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 0x80 [0072.362] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml", dwFileAttributes=0x20) returned 1 [0074.769] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x440 [0074.769] GetFileSizeEx (in: hFile=0x440, lpFileSize=0x896ff10 | out: lpFileSize=0x896ff10*=38898) returned 1 [0074.769] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x97ee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.770] ReadFile (in: hFile=0x440, lpBuffer=0x896fe94, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x896fe90, lpOverlapped=0x0 | out: lpBuffer=0x896fe94*, lpNumberOfBytesRead=0x896fe90*=0x4, lpOverlapped=0x0) returned 1 [0074.773] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.773] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ea0 [0074.773] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4fb8 [0074.773] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5260 [0074.773] NtQuerySystemTime (in: CurrentTime=0x896fe70 | out: CurrentTime=0x896fe70*=132260136319390393) returned 0x0 [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0xd6f8ef80 [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0x8963f433 [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0xf2df78f3 [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0xdc451615 [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0x3f857d37 [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0xf192a24b [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0x544cfd00 [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0x73e5581b [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0x1abf9de5 [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0x5fa4bf39 [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0xbbf382e2 [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0xf8379dd0 [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0xd027fe75 [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0x409ad90d [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0x68d6954b [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0x76185070 [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0xf5d609dd [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0xbdfaa11d [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0x40b01eed [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0x2f2c4e47 [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0xe50c68a6 [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0xf9c90e7 [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0x37112ea4 [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0x508d601 [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0x2c6014dd [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0x847e232d [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0x1e097e30 [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0xca7b497d [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0x40c1b187 [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0x94f336 [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0x1407f9b2 [0074.773] RtlRandom (in: Seed=0x896fe7c | out: Seed=0x896fe7c) returned 0x41155863 [0074.786] ReadFile (in: hFile=0x440, lpBuffer=0x5470fb8, nNumberOfBytesToRead=0x97f2, lpNumberOfBytesRead=0x896fe6c, lpOverlapped=0x0 | out: lpBuffer=0x5470fb8*, lpNumberOfBytesRead=0x896fe6c*=0x97f2, lpOverlapped=0x0) returned 1 [0074.800] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.800] WriteFile (in: hFile=0x440, lpBuffer=0x547d7c0*, nNumberOfBytesToWrite=0x97f2, lpNumberOfBytesWritten=0x896fe68, lpOverlapped=0x0 | out: lpBuffer=0x547d7c0*, lpNumberOfBytesWritten=0x896fe68*=0x97f2, lpOverlapped=0x0) returned 1 [0075.208] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5210 [0075.208] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5238 [0075.208] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5238) returned 1 [0075.208] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x547d7c0) returned 1 [0075.208] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5470fb8) returned 1 [0075.208] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54679e0) returned 1 [0075.208] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6580) returned 1 [0075.208] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x21) returned 0x38a6ac0 [0075.208] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.208] WriteFile (in: hFile=0x440, lpBuffer=0x39790e8*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x896fed0, lpOverlapped=0x0 | out: lpBuffer=0x39790e8*, lpNumberOfBytesWritten=0x896fed0*=0x105, lpOverlapped=0x0) returned 1 [0075.210] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39790e8) returned 1 [0075.210] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6bb0) returned 1 [0075.210] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5030) returned 1 [0075.210] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6ac0) returned 1 [0075.210] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5210) returned 1 [0075.210] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4fb8) returned 1 [0075.210] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e00) returned 1 [0075.210] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5148) returned 1 [0075.210] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x82) returned 0x38a9298 [0075.210] wcscpy (in: _Dest=0x38a9298, _Source="C:\\588bce7c90097ed212\\UiInfo.xml" | out: _Dest="C:\\588bce7c90097ed212\\UiInfo.xml") returned="C:\\588bce7c90097ed212\\UiInfo.xml" [0075.210] wcscat (in: _Dest=0x38a9298, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\588bce7c90097ed212\\UiInfo.xml.mailto[knoocknoo@cock.li].a0a70") returned="C:\\588bce7c90097ed212\\UiInfo.xml.mailto[knoocknoo@cock.li].a0a70" [0075.210] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\588bce7c90097ed212\\UiInfo.xml.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x896fe88, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\588bce7c90097ed212\\UiInfo.xml.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0075.210] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x98) returned 0x5426d68 Thread: id = 125 os_tid = 0x3c8 [0071.260] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 0x80 [0072.609] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp", dwFileAttributes=0x20) returned 1 [0075.556] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xccc [0075.556] GetFileSizeEx (in: hFile=0xccc, lpFileSize=0x89efef0 | out: lpFileSize=0x89efef0*=104072) returned 1 [0075.556] SetFilePointerEx (in: hFile=0xccc, liDistanceToMove=0x19684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.648] ReadFile (in: hFile=0xccc, lpBuffer=0x89efe74, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x89efe70, lpOverlapped=0x0 | out: lpBuffer=0x89efe74*, lpNumberOfBytesRead=0x89efe70*=0x4, lpOverlapped=0x0) returned 1 [0075.655] SetFilePointerEx (in: hFile=0xccc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.691] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c30 [0075.693] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559bb8 [0075.693] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559938 [0075.693] NtQuerySystemTime (in: CurrentTime=0x89efe50 | out: CurrentTime=0x89efe50*=132260136328554187) returned 0x0 [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0xa928dc8f [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0x7d540f07 [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0xe2f2f0fa [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0x16c68226 [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0x55a1374f [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0xfbfd4501 [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0x81c92bff [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0x9ddbb1a7 [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0x31aeff7 [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0x433ceb3c [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0xf0fac2e8 [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0x61d87761 [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0xc3a3b277 [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0x7294b8b2 [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0xf496a82e [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0x85a7fa88 [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0xaacbd5ce [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0xb5bde205 [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0xb8f3235a [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0x7041e6e [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0xf63d556b [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0x9f7c33ef [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0xcc66169c [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0x31082b27 [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0x9f02579a [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0x18f7f06c [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0xb545a47f [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0x7c42bc68 [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0x2990fb06 [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0xe16e379 [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0x3ecd05fc [0075.693] RtlRandom (in: Seed=0x89efe5c | out: Seed=0x89efe5c) returned 0xaf8fa52b [0075.702] SetFilePointerEx (in: hFile=0xccc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.702] ReadFile (in: hFile=0xccc, lpBuffer=0x554d060, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x89efe30, lpOverlapped=0x0 | out: lpBuffer=0x554d060*, lpNumberOfBytesRead=0x89efe30*=0xc800, lpOverlapped=0x0) returned 1 [0075.711] SetFilePointerEx (in: hFile=0xccc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.711] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a6388 [0075.711] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497340 [0075.711] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55599d8 [0075.711] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55599d8) returned 1 [0075.712] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5598898 [0075.713] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559be0 [0075.713] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c08 [0075.713] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559c08) returned 1 [0075.713] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497340) returned 1 [0075.713] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6388) returned 1 [0075.713] WriteFile (in: hFile=0xccc, lpBuffer=0x5598898*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x89efe30, lpOverlapped=0x0 | out: lpBuffer=0x5598898*, lpNumberOfBytesWritten=0x89efe30*=0xc800, lpOverlapped=0x0) returned 1 [0075.715] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5598898) returned 1 [0075.715] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x554d060) returned 1 [0075.715] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x27) returned 0x38a6790 [0075.715] SetFilePointerEx (in: hFile=0xccc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.715] WriteFile (in: hFile=0xccc, lpBuffer=0x388b210*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x89efeb0, lpOverlapped=0x0 | out: lpBuffer=0x388b210*, lpNumberOfBytesWritten=0x89efeb0*=0x10b, lpOverlapped=0x0) returned 1 [0081.189] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388b210) returned 1 [0091.755] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6bb0) returned 1 [0091.755] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559aa0) returned 1 [0091.755] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6790) returned 1 [0091.755] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559be0) returned 1 [0091.755] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559bb8) returned 1 [0091.755] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559cf8) returned 1 [0091.755] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559d20) returned 1 [0091.756] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x88) returned 0x549cd88 [0091.756] wcscpy (in: _Dest=0x549cd88, _Source="C:\\588bce7c90097ed212\\watermark.bmp" | out: _Dest="C:\\588bce7c90097ed212\\watermark.bmp") returned="C:\\588bce7c90097ed212\\watermark.bmp" [0091.756] wcscat (in: _Dest=0x549cd88, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\588bce7c90097ed212\\watermark.bmp.mailto[knoocknoo@cock.li].a0a70") returned="C:\\588bce7c90097ed212\\watermark.bmp.mailto[knoocknoo@cock.li].a0a70" [0091.756] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\588bce7c90097ed212\\watermark.bmp.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x89efe68, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\588bce7c90097ed212\\watermark.bmp.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0091.756] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9e) returned 0x38abb18 Thread: id = 126 os_tid = 0xdf8 [0071.261] GetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 0x20 [0075.315] SetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx", dwFileAttributes=0x20) returned 1 [0075.315] CreateFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xcd0 [0075.315] GetFileSizeEx (in: hFile=0xcd0, lpFileSize=0x8a6fcd4 | out: lpFileSize=0x8a6fcd4*=69632) returned 1 [0075.315] SetFilePointerEx (in: hFile=0xcd0, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.315] ReadFile (in: hFile=0xcd0, lpBuffer=0x8a6fc58, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8a6fc54, lpOverlapped=0x0 | out: lpBuffer=0x8a6fc58*, lpNumberOfBytesRead=0x8a6fc54*=0x4, lpOverlapped=0x0) returned 1 [0075.334] SetFilePointerEx (in: hFile=0xcd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.335] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4e00 [0075.335] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5030 [0075.335] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4e78 [0075.335] NtQuerySystemTime (in: CurrentTime=0x8a6fc34 | out: CurrentTime=0x8a6fc34*=132260136324960285) returned 0x0 [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0x6452d851 [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0x5b85191b [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0x46652eb1 [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0xedd1c683 [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0x1a89685b [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0x22fe64a7 [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0xed61e6a [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0xc070ec27 [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0x83dcfa18 [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0xb8ad9d90 [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0x2ec3b952 [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0x2afe2c3d [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0xd795877f [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0x26799183 [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0x2d3a4995 [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0xfce1f1f5 [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0xb82225de [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0x30ec07dd [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0x90a4f8e [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0x6636db6e [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0xe0ecfbac [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0x4c267d40 [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0xc979b335 [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0xf0c33d46 [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0x2c07da6d [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0xebe7ba13 [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0x76a487fa [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0xd30df899 [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0xa8937b11 [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0xe7b360d9 [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0x14e84f17 [0075.335] RtlRandom (in: Seed=0x8a6fc40 | out: Seed=0x8a6fc40) returned 0x6d35f521 [0075.344] SetFilePointerEx (in: hFile=0xcd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.344] ReadFile (in: hFile=0xcd0, lpBuffer=0x5470fb8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x8a6fc14, lpOverlapped=0x0 | out: lpBuffer=0x5470fb8*, lpNumberOfBytesRead=0x8a6fc14*=0xc800, lpOverlapped=0x0) returned 1 [0075.346] SetFilePointerEx (in: hFile=0xcd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.346] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5c80 [0075.346] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5467d28 [0075.346] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5260 [0075.346] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5260) returned 1 [0075.347] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x547d7c0 [0075.347] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5238 [0075.347] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5260 [0075.347] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5260) returned 1 [0075.347] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5467d28) returned 1 [0075.347] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5c80) returned 1 [0075.348] WriteFile (in: hFile=0xcd0, lpBuffer=0x547d7c0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x8a6fc14, lpOverlapped=0x0 | out: lpBuffer=0x547d7c0*, lpNumberOfBytesWritten=0x8a6fc14*=0xc800, lpOverlapped=0x0) returned 1 [0076.097] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x547d7c0) returned 1 [0076.119] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5470fb8) returned 1 [0076.122] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2d) returned 0x5531ff8 [0076.122] SetFilePointerEx (in: hFile=0xcd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.122] WriteFile (in: hFile=0xcd0, lpBuffer=0x549cb18*, nNumberOfBytesToWrite=0x111, lpNumberOfBytesWritten=0x8a6fc94, lpOverlapped=0x0 | out: lpBuffer=0x549cb18*, lpNumberOfBytesWritten=0x8a6fc94*=0x111, lpOverlapped=0x0) returned 1 [0076.125] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549cb18) returned 1 [0076.125] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5531d58) returned 1 [0076.125] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559c08) returned 1 [0076.125] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5531ff8) returned 1 [0076.125] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5238) returned 1 [0076.125] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5030) returned 1 [0076.125] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5148) returned 1 [0076.125] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5210) returned 1 [0076.125] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x72) returned 0x38d15a0 [0076.125] wcscpy (in: _Dest=0x38d15a0, _Source="C:\\Logs\\Application.evtx" | out: _Dest="C:\\Logs\\Application.evtx") returned="C:\\Logs\\Application.evtx" [0076.125] wcscat (in: _Dest=0x38d15a0, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Application.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Application.evtx.mailto[knoocknoo@cock.li].a0a70" [0076.125] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Application.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x8a6fc4c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Application.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.125] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x88) returned 0x38a9448 Thread: id = 127 os_tid = 0x724 [0071.264] GetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 0x20 [0075.714] SetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx", dwFileAttributes=0x20) returned 1 [0075.714] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xcf4 [0075.714] GetFileSizeEx (in: hFile=0xcf4, lpFileSize=0x8aef784 | out: lpFileSize=0x8aef784*=69632) returned 1 [0075.714] SetFilePointerEx (in: hFile=0xcf4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.714] ReadFile (in: hFile=0xcf4, lpBuffer=0x8aef708, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8aef704, lpOverlapped=0x0 | out: lpBuffer=0x8aef708*, lpNumberOfBytesRead=0x8aef704*=0x4, lpOverlapped=0x0) returned 1 [0075.717] SetFilePointerEx (in: hFile=0xcf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.717] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c30 [0075.717] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c08 [0075.717] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559938 [0075.717] NtQuerySystemTime (in: CurrentTime=0x8aef6e4 | out: CurrentTime=0x8aef6e4*=132260136328710135) returned 0x0 [0075.717] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0xd101c9bf [0075.717] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0x11c69113 [0075.717] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0x84b3c98a [0075.717] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0xb118fa1a [0075.717] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0x4599dae1 [0075.717] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0x336766af [0075.717] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0x1daa5f7b [0075.717] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0x6d75ecc7 [0075.717] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0xaa6a6ea7 [0075.717] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0x5265c342 [0075.718] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0x730e4252 [0075.718] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0x91cd72dd [0075.718] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0xb4036421 [0075.718] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0xae6b4205 [0075.718] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0xb8ca3f52 [0075.718] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0x26737b8f [0075.718] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0x1810e07e [0075.718] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0xb1b92067 [0075.718] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0x93ac709e [0075.718] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0x62d0f487 [0075.718] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0x4bb6152 [0075.718] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0xb4ea50b2 [0075.718] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0xe27609e1 [0075.718] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0x936e6190 [0075.718] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0x558a74ea [0075.718] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0x772b9425 [0075.718] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0xd73f2524 [0075.718] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0xa24da88a [0075.718] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0xc3fe636 [0075.718] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0xc04a7135 [0075.718] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0x3d6eca39 [0075.718] RtlRandom (in: Seed=0x8aef6f0 | out: Seed=0x8aef6f0) returned 0xff2afb5d [0075.727] SetFilePointerEx (in: hFile=0xcf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.727] ReadFile (in: hFile=0xcf4, lpBuffer=0x554d060, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x8aef6c4, lpOverlapped=0x0 | out: lpBuffer=0x554d060*, lpNumberOfBytesRead=0x8aef6c4*=0xc800, lpOverlapped=0x0) returned 1 [0075.728] SetFilePointerEx (in: hFile=0xcf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.728] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a6388 [0075.728] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497340 [0075.728] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55599d8 [0075.728] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55599d8) returned 1 [0075.729] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5598898 [0075.729] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c30 [0075.729] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559898 [0075.729] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559898) returned 1 [0075.729] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497340) returned 1 [0075.729] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6388) returned 1 [0075.729] WriteFile (in: hFile=0xcf4, lpBuffer=0x5598898*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x8aef6c4, lpOverlapped=0x0 | out: lpBuffer=0x5598898*, lpNumberOfBytesWritten=0x8aef6c4*=0xc800, lpOverlapped=0x0) returned 1 [0075.731] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5598898) returned 1 [0075.731] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x554d060) returned 1 [0075.731] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x33) returned 0x389e940 [0075.731] SetFilePointerEx (in: hFile=0xcf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.732] WriteFile (in: hFile=0xcf4, lpBuffer=0x3979a78*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0x8aef744, lpOverlapped=0x0 | out: lpBuffer=0x3979a78*, lpNumberOfBytesWritten=0x8aef744*=0x117, lpOverlapped=0x0) returned 1 [0075.734] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3979a78) returned 1 [0075.734] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389e700) returned 1 [0075.734] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ac8) returned 1 [0075.734] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389e940) returned 1 [0075.734] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559c30) returned 1 [0075.734] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559c08) returned 1 [0075.734] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559d48) returned 1 [0075.734] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559d70) returned 1 [0075.734] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x78) returned 0x38d0ca0 [0075.734] wcscpy (in: _Dest=0x38d0ca0, _Source="C:\\Logs\\HardwareEvents.evtx" | out: _Dest="C:\\Logs\\HardwareEvents.evtx") returned="C:\\Logs\\HardwareEvents.evtx" [0075.734] wcscat (in: _Dest=0x38d0ca0, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\HardwareEvents.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\HardwareEvents.evtx.mailto[knoocknoo@cock.li].a0a70" [0075.734] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\HardwareEvents.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x8aef6fc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\HardwareEvents.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0075.734] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8e) returned 0x38a7400 Thread: id = 128 os_tid = 0x7d8 [0071.268] GetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 0x20 [0071.937] SetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx", dwFileAttributes=0x20) returned 1 [0075.014] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xc34 [0075.014] GetFileSizeEx (in: hFile=0xc34, lpFileSize=0x8b6fe84 | out: lpFileSize=0x8b6fe84*=69632) returned 1 [0075.014] SetFilePointerEx (in: hFile=0xc34, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.014] ReadFile (in: hFile=0xc34, lpBuffer=0x8b6fe08, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8b6fe04, lpOverlapped=0x0 | out: lpBuffer=0x8b6fe08*, lpNumberOfBytesRead=0x8b6fe04*=0x4, lpOverlapped=0x0) returned 1 [0075.016] SetFilePointerEx (in: hFile=0xc34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.016] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5260 [0075.016] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a50f8 [0075.016] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5030 [0075.016] NtQuerySystemTime (in: CurrentTime=0x8b6fde4 | out: CurrentTime=0x8b6fde4*=132260136321772398) returned 0x0 [0075.016] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0x6540bb57 [0075.016] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0x9ddbb5db [0075.016] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0x4b42bcdd [0075.016] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0x51435aaa [0075.016] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0x210743e7 [0075.016] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0x577c3114 [0075.016] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0x7261c258 [0075.016] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0x9d78a5e1 [0075.016] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0xaaa74721 [0075.016] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0xa02944c7 [0075.017] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0x41ac19af [0075.017] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0xee0a494d [0075.017] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0xc667d386 [0075.017] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0x92a2be2f [0075.017] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0x4743b220 [0075.017] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0xfd64ad2e [0075.017] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0xfd039ed1 [0075.017] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0x14261996 [0075.017] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0x8cf1d731 [0075.017] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0xb98980d6 [0075.017] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0x43a777ae [0075.017] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0xcf044c45 [0075.017] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0xa5363899 [0075.017] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0xbdd4bc33 [0075.017] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0x1fc83f5e [0075.017] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0xb3f5a484 [0075.017] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0x3fd60cd8 [0075.017] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0x5ed803c7 [0075.017] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0x290700ac [0075.017] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0xb99402fb [0075.017] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0xcaad39c9 [0075.017] RtlRandom (in: Seed=0x8b6fdf0 | out: Seed=0x8b6fdf0) returned 0xe6204df [0075.031] SetFilePointerEx (in: hFile=0xc34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.031] ReadFile (in: hFile=0xc34, lpBuffer=0x54a4fe8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x8b6fdc4, lpOverlapped=0x0 | out: lpBuffer=0x54a4fe8*, lpNumberOfBytesRead=0x8b6fdc4*=0xc800, lpOverlapped=0x0) returned 1 [0075.032] SetFilePointerEx (in: hFile=0xc34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.032] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5968 [0075.032] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5467d28 [0075.032] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5030 [0075.032] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5030) returned 1 [0075.033] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x54b17f0 [0075.038] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5198 [0075.038] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a51c0 [0075.038] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a51c0) returned 1 [0075.038] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5467d28) returned 1 [0075.038] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5968) returned 1 [0075.038] WriteFile (in: hFile=0xc34, lpBuffer=0x54b17f0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x8b6fdc4, lpOverlapped=0x0 | out: lpBuffer=0x54b17f0*, lpNumberOfBytesWritten=0x8b6fdc4*=0xc800, lpOverlapped=0x0) returned 1 [0075.449] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b17f0) returned 1 [0075.449] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a4fe8) returned 1 [0075.453] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x39) returned 0x38a6460 [0075.453] SetFilePointerEx (in: hFile=0xc34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.453] WriteFile (in: hFile=0xc34, lpBuffer=0x39797a0*, nNumberOfBytesToWrite=0x11d, lpNumberOfBytesWritten=0x8b6fe44, lpOverlapped=0x0 | out: lpBuffer=0x39797a0*, lpNumberOfBytesWritten=0x8b6fe44*=0x11d, lpOverlapped=0x0) returned 1 [0075.507] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39797a0) returned 1 [0075.507] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5f50) returned 1 [0075.507] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e78) returned 1 [0075.507] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6460) returned 1 [0075.507] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5198) returned 1 [0075.507] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a50f8) returned 1 [0075.507] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5058) returned 1 [0075.507] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a52b0) returned 1 [0075.507] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7e) returned 0x3977ee0 [0075.507] wcscpy (in: _Dest=0x3977ee0, _Source="C:\\Logs\\Internet Explorer.evtx" | out: _Dest="C:\\Logs\\Internet Explorer.evtx") returned="C:\\Logs\\Internet Explorer.evtx" [0075.508] wcscat (in: _Dest=0x3977ee0, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Internet Explorer.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Internet Explorer.evtx.mailto[knoocknoo@cock.li].a0a70" [0075.508] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Internet Explorer.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x8b6fdfc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Internet Explorer.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0075.508] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x94) returned 0x5426e08 Thread: id = 129 os_tid = 0xf0 [0071.269] GetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 0x20 [0076.390] SetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx", dwFileAttributes=0x20) returned 1 [0076.390] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1130 [0076.394] GetFileSizeEx (in: hFile=0x1130, lpFileSize=0x8befcfc | out: lpFileSize=0x8befcfc*=69632) returned 1 [0076.394] SetFilePointerEx (in: hFile=0x1130, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.394] ReadFile (in: hFile=0x1130, lpBuffer=0x8befc80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8befc7c, lpOverlapped=0x0 | out: lpBuffer=0x8befc80*, lpNumberOfBytesRead=0x8befc7c*=0x4, lpOverlapped=0x0) returned 1 [0076.399] SetFilePointerEx (in: hFile=0x1130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.399] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c30 [0076.399] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c80 [0076.399] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559938 [0076.399] NtQuerySystemTime (in: CurrentTime=0x8befc5c | out: CurrentTime=0x8befc5c*=132260136335585246) returned 0x0 [0076.399] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0x7c5cad3c [0076.399] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0xec010bd9 [0076.399] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0xf00d5723 [0076.399] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0xb8584d31 [0076.399] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0x1524a6cb [0076.399] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0xd0741ac5 [0076.399] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0x77647f65 [0076.399] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0x3cb3f7b8 [0076.399] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0x844ab8e4 [0076.399] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0x622b7d75 [0076.399] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0xebbfbbf2 [0076.399] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0x46a21b5b [0076.399] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0xd1711303 [0076.399] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0xe77dcc4a [0076.399] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0x19dc906e [0076.399] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0x34d1de64 [0076.400] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0xa0ebc53b [0076.400] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0xa0b7fee2 [0076.400] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0xf582dc17 [0076.400] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0x443388aa [0076.400] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0x47c91b8d [0076.400] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0x5208c669 [0076.400] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0xacbde448 [0076.400] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0x67f35481 [0076.400] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0xb429d1be [0076.400] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0x928ed320 [0076.400] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0xe97ba6ef [0076.400] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0x3dc71726 [0076.400] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0xf2f956c4 [0076.400] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0x9ec8af10 [0076.400] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0x7f896261 [0076.400] RtlRandom (in: Seed=0x8befc68 | out: Seed=0x8befc68) returned 0x830a710c [0076.409] SetFilePointerEx (in: hFile=0x1130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.409] ReadFile (in: hFile=0x1130, lpBuffer=0x54fe820, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x8befc3c, lpOverlapped=0x0 | out: lpBuffer=0x54fe820*, lpNumberOfBytesRead=0x8befc3c*=0xc800, lpOverlapped=0x0) returned 1 [0076.410] SetFilePointerEx (in: hFile=0x1130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.410] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0076.410] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0076.410] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55599b0 [0076.410] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55599b0) returned 1 [0076.411] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5534050 [0076.411] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c30 [0076.411] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559d70 [0076.411] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559d70) returned 1 [0076.411] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.411] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0076.411] WriteFile (in: hFile=0x1130, lpBuffer=0x5534050*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x8befc3c, lpOverlapped=0x0 | out: lpBuffer=0x5534050*, lpNumberOfBytesWritten=0x8befc3c*=0xc800, lpOverlapped=0x0) returned 1 [0076.414] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5534050) returned 1 [0076.414] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54fe820) returned 1 [0076.414] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x43) returned 0x5532300 [0076.414] SetFilePointerEx (in: hFile=0x1130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.414] WriteFile (in: hFile=0x1130, lpBuffer=0x54a2b30*, nNumberOfBytesToWrite=0x127, lpNumberOfBytesWritten=0x8befcbc, lpOverlapped=0x0 | out: lpBuffer=0x54a2b30*, lpNumberOfBytesWritten=0x8befcbc*=0x127, lpOverlapped=0x0) returned 1 [0076.435] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a2b30) returned 1 [0076.435] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5532120) returned 1 [0076.435] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a50) returned 1 [0076.435] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5532300) returned 1 [0076.435] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559c30) returned 1 [0076.435] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559c80) returned 1 [0076.435] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559d48) returned 1 [0076.435] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ca8) returned 1 [0076.435] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x88) returned 0x549d328 [0076.435] wcscpy (in: _Dest=0x549d328, _Source="C:\\Logs\\Key Management Service.evtx" | out: _Dest="C:\\Logs\\Key Management Service.evtx") returned="C:\\Logs\\Key Management Service.evtx" [0076.435] wcscat (in: _Dest=0x549d328, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Key Management Service.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Key Management Service.evtx.mailto[knoocknoo@cock.li].a0a70" [0076.435] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Key Management Service.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x8befc74, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Key Management Service.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.435] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9e) returned 0x54a0b58 Thread: id = 130 os_tid = 0xdbc [0071.269] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 0x20 [0077.324] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0081.474] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ca4 [0081.484] GetFileSizeEx (in: hFile=0x1ca4, lpFileSize=0x8c6fc60 | out: lpFileSize=0x8c6fc60*=69632) returned 1 [0081.484] SetFilePointerEx (in: hFile=0x1ca4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.484] ReadFile (in: hFile=0x1ca4, lpBuffer=0x8c6fbe4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8c6fbe0, lpOverlapped=0x0 | out: lpBuffer=0x8c6fbe4*, lpNumberOfBytesRead=0x8c6fbe0*=0x4, lpOverlapped=0x0) returned 1 [0081.486] SetFilePointerEx (in: hFile=0x1ca4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.486] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1e10 [0081.486] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1cf8 [0081.486] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1e38 [0081.486] NtQuerySystemTime (in: CurrentTime=0x8c6fbc0 | out: CurrentTime=0x8c6fbc0*=132260136386397745) returned 0x0 [0081.486] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0xca1b98bf [0081.486] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0x89b730d6 [0081.486] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0xc52b760a [0081.486] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0x36a2bcd8 [0081.486] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0x47f878c1 [0081.486] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0x43fe5e8c [0081.486] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0x85a88773 [0081.486] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0xd1562155 [0081.486] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0x10c8499b [0081.486] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0xa566b21 [0081.486] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0xdd7baccd [0081.486] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0x2e822ec3 [0081.486] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0x40843387 [0081.486] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0xca2c9e35 [0081.486] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0xda6ea8f9 [0081.486] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0x7d1a3e7e [0081.486] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0xb4237ef4 [0081.486] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0x6f36fcdd [0081.486] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0xdebf01fb [0081.486] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0x791ac2bf [0081.486] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0x5cba02e6 [0081.486] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0x384d40c8 [0081.486] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0x4e0c315 [0081.486] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0x8e2ffcb2 [0081.486] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0x1db969ce [0081.486] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0xb646d4a4 [0081.486] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0x4f220d13 [0081.486] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0x8671e9b7 [0081.486] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0xb54b021b [0081.486] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0xa3d2d2e [0081.486] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0xdf4b6936 [0081.487] RtlRandom (in: Seed=0x8c6fbcc | out: Seed=0x8c6fbcc) returned 0x4cd1ac9e Thread: id = 131 os_tid = 0x1378 [0071.269] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 0x20 [0077.098] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", dwFileAttributes=0x20) returned 1 [0081.546] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cec [0081.546] GetFileSizeEx (in: hFile=0x1cec, lpFileSize=0x8cefd48 | out: lpFileSize=0x8cefd48*=69632) returned 1 [0081.546] SetFilePointerEx (in: hFile=0x1cec, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.547] ReadFile (in: hFile=0x1cec, lpBuffer=0x8cefccc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8cefcc8, lpOverlapped=0x0 | out: lpBuffer=0x8cefccc*, lpNumberOfBytesRead=0x8cefcc8*=0x4, lpOverlapped=0x0) returned 1 [0081.548] SetFilePointerEx (in: hFile=0x1cec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.548] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 132 os_tid = 0xecc [0071.270] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 0x20 [0077.181] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0081.523] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cbc [0081.523] GetFileSizeEx (in: hFile=0x1cbc, lpFileSize=0x8d6fd98 | out: lpFileSize=0x8d6fd98*=1052672) returned 1 [0081.523] SetFilePointerEx (in: hFile=0x1cbc, liDistanceToMove=0x100ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.523] ReadFile (in: hFile=0x1cbc, lpBuffer=0x8d6fd1c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8d6fd18, lpOverlapped=0x0 | out: lpBuffer=0x8d6fd1c*, lpNumberOfBytesRead=0x8d6fd18*=0x4, lpOverlapped=0x0) returned 1 [0081.524] SetFilePointerEx (in: hFile=0x1cbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.524] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 133 os_tid = 0xeec [0071.271] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 0x20 [0077.156] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx", dwFileAttributes=0x20) returned 1 [0081.526] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cc4 [0081.527] GetFileSizeEx (in: hFile=0x1cc4, lpFileSize=0x8deff34 | out: lpFileSize=0x8deff34*=69632) returned 1 [0081.527] SetFilePointerEx (in: hFile=0x1cc4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.527] ReadFile (in: hFile=0x1cc4, lpBuffer=0x8defeb8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8defeb4, lpOverlapped=0x0 | out: lpBuffer=0x8defeb8*, lpNumberOfBytesRead=0x8defeb4*=0x4, lpOverlapped=0x0) returned 1 [0081.528] SetFilePointerEx (in: hFile=0x1cc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.528] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 134 os_tid = 0xec8 [0071.271] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 0x20 [0076.257] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx", dwFileAttributes=0x20) returned 1 [0076.257] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1114 [0076.257] GetFileSizeEx (in: hFile=0x1114, lpFileSize=0x8e6fad0 | out: lpFileSize=0x8e6fad0*=69632) returned 1 [0076.258] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.258] ReadFile (in: hFile=0x1114, lpBuffer=0x8e6fa54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8e6fa50, lpOverlapped=0x0 | out: lpBuffer=0x8e6fa54*, lpNumberOfBytesRead=0x8e6fa50*=0x4, lpOverlapped=0x0) returned 1 [0076.259] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.259] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c30 [0076.259] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559b90 [0076.259] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559938 [0076.259] NtQuerySystemTime (in: CurrentTime=0x8e6fa30 | out: CurrentTime=0x8e6fa30*=132260136334179035) returned 0x0 [0076.259] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0xa4ddf1b1 [0076.259] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0x5e069c23 [0076.259] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0xa9d7aa03 [0076.259] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0x237ec56a [0076.260] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0x5f007e69 [0076.260] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0xaa8bb67a [0076.260] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0x227b4d64 [0076.260] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0x2f618ab4 [0076.260] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0x1b3d6538 [0076.260] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0x63a408da [0076.260] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0x774f7453 [0076.260] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0xc6603790 [0076.260] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0x6ea6c53a [0076.260] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0x261d16fb [0076.260] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0x403e19e9 [0076.260] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0xe980f809 [0076.260] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0x9dc780b [0076.260] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0xf614edc1 [0076.260] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0x44f00c74 [0076.260] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0x36685784 [0076.260] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0xde42de1 [0076.260] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0x91446e1c [0076.260] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0x1412cc40 [0076.260] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0x4abc3930 [0076.260] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0x57fb782a [0076.260] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0xda299d04 [0076.260] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0x5a84b86e [0076.260] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0x65d712e5 [0076.260] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0xd0d0678d [0076.260] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0x8d63e31a [0076.260] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0xb59ab34 [0076.260] RtlRandom (in: Seed=0x8e6fa3c | out: Seed=0x8e6fa3c) returned 0x2c6d7abf [0076.269] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.270] ReadFile (in: hFile=0x1114, lpBuffer=0x54a4fe8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x8e6fa10, lpOverlapped=0x0 | out: lpBuffer=0x54a4fe8*, lpNumberOfBytesRead=0x8e6fa10*=0xc800, lpOverlapped=0x0) returned 1 [0076.271] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.271] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a60b8 [0076.271] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0076.271] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55599b0 [0076.271] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55599b0) returned 1 [0076.272] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x54f2018 [0076.272] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c08 [0076.272] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c30 [0076.272] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559c30) returned 1 [0076.272] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.272] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a60b8) returned 1 [0076.273] WriteFile (in: hFile=0x1114, lpBuffer=0x54f2018*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x8e6fa10, lpOverlapped=0x0 | out: lpBuffer=0x54f2018*, lpNumberOfBytesWritten=0x8e6fa10*=0xc800, lpOverlapped=0x0) returned 1 [0081.198] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f2018) returned 1 [0091.756] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a4fe8) returned 1 [0091.756] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6d) returned 0x766d2f8 [0091.756] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.756] WriteFile (hFile=0x1114, lpBuffer=0x38af848, nNumberOfBytesToWrite=0x151, lpNumberOfBytesWritten=0x8e6fa90, lpOverlapped=0x0) Thread: id = 135 os_tid = 0xf0c [0071.272] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 0x20 [0077.153] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", dwFileAttributes=0x20) returned 1 [0081.528] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cc8 [0081.528] GetFileSizeEx (in: hFile=0x1cc8, lpFileSize=0x8eefd90 | out: lpFileSize=0x8eefd90*=69632) returned 1 [0081.528] SetFilePointerEx (in: hFile=0x1cc8, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.528] ReadFile (in: hFile=0x1cc8, lpBuffer=0x8eefd14, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8eefd10, lpOverlapped=0x0 | out: lpBuffer=0x8eefd14*, lpNumberOfBytesRead=0x8eefd10*=0x4, lpOverlapped=0x0) returned 1 [0081.529] SetFilePointerEx (in: hFile=0x1cc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.530] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 136 os_tid = 0xf4c [0071.273] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 0x20 [0077.158] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", dwFileAttributes=0x20) returned 1 [0081.525] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cc0 [0081.525] GetFileSizeEx (in: hFile=0x1cc0, lpFileSize=0x8f6fa7c | out: lpFileSize=0x8f6fa7c*=69632) returned 1 [0081.525] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.525] ReadFile (in: hFile=0x1cc0, lpBuffer=0x8f6fa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8f6f9fc, lpOverlapped=0x0 | out: lpBuffer=0x8f6fa00*, lpNumberOfBytesRead=0x8f6f9fc*=0x4, lpOverlapped=0x0) returned 1 [0081.526] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.526] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 137 os_tid = 0x13a0 [0071.274] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 0x20 [0077.184] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0081.521] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cb8 [0081.521] GetFileSizeEx (in: hFile=0x1cb8, lpFileSize=0x8fef9e8 | out: lpFileSize=0x8fef9e8*=69632) returned 1 [0081.521] SetFilePointerEx (in: hFile=0x1cb8, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.521] ReadFile (in: hFile=0x1cb8, lpBuffer=0x8fef96c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8fef968, lpOverlapped=0x0 | out: lpBuffer=0x8fef96c*, lpNumberOfBytesRead=0x8fef968*=0x4, lpOverlapped=0x0) returned 1 [0081.523] SetFilePointerEx (in: hFile=0x1cb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.523] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 138 os_tid = 0xf7c [0071.274] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 0x20 [0076.259] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0076.259] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x111c [0076.259] GetFileSizeEx (in: hFile=0x111c, lpFileSize=0x906f9d8 | out: lpFileSize=0x906f9d8*=69632) returned 1 [0076.270] SetFilePointerEx (in: hFile=0x111c, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.270] ReadFile (in: hFile=0x111c, lpBuffer=0x906f95c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x906f958, lpOverlapped=0x0 | out: lpBuffer=0x906f95c*, lpNumberOfBytesRead=0x906f958*=0x4, lpOverlapped=0x0) returned 1 [0076.276] SetFilePointerEx (in: hFile=0x111c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.276] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c30 [0076.276] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c80 [0076.276] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559938 [0076.276] NtQuerySystemTime (in: CurrentTime=0x906f938 | out: CurrentTime=0x906f938*=132260136334335289) returned 0x0 [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0xde4215ac [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0xfe912a1 [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0xd3088358 [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0x3a431720 [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0xf7385e8e [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0xc35d2476 [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0x6686703f [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0x84d59b68 [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0xda121b9 [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0xa97b1d9a [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0xd9001941 [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0x5a5d8c0c [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0xe08e8a29 [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0x838abe78 [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0x94acc2b [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0xa6c90fb [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0x9dbd171b [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0x6ac8b36e [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0xc507abb0 [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0x20e7684d [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0xd202bb25 [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0x875fcabb [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0xa138783e [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0xc015ce65 [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0x1a1b50a7 [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0x5e3df69 [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0x58c57d96 [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0xfed7a969 [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0xc9e23ed3 [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0x5131025 [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0x915a7877 [0076.276] RtlRandom (in: Seed=0x906f944 | out: Seed=0x906f944) returned 0x51a7ec5b [0076.297] SetFilePointerEx (in: hFile=0x111c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.297] ReadFile (in: hFile=0x111c, lpBuffer=0x54fe820, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x906f918, lpOverlapped=0x0 | out: lpBuffer=0x54fe820*, lpNumberOfBytesRead=0x906f918*=0xc800, lpOverlapped=0x0) returned 1 [0076.299] SetFilePointerEx (in: hFile=0x111c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.299] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a60b8 [0076.299] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0076.299] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55599b0 [0076.299] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55599b0) returned 1 [0076.300] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5534050 [0076.304] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c30 [0076.304] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559d70 [0076.304] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559d70) returned 1 [0076.304] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.305] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a60b8) returned 1 [0076.305] WriteFile (in: hFile=0x111c, lpBuffer=0x5534050*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x906f918, lpOverlapped=0x0 | out: lpBuffer=0x5534050*, lpNumberOfBytesWritten=0x906f918*=0xc800, lpOverlapped=0x0) returned 1 [0076.307] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5534050) returned 1 [0076.307] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54fe820) returned 1 [0076.307] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x61) returned 0x396d6c0 [0076.307] SetFilePointerEx (in: hFile=0x111c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.307] WriteFile (in: hFile=0x111c, lpBuffer=0x54a2b30*, nNumberOfBytesToWrite=0x145, lpNumberOfBytesWritten=0x906f998, lpOverlapped=0x0 | out: lpBuffer=0x54a2b30*, lpNumberOfBytesWritten=0x906f998*=0x145, lpOverlapped=0x0) returned 1 [0076.309] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a2b30) returned 1 [0076.309] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396d810) returned 1 [0076.309] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a50) returned 1 [0076.310] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396d6c0) returned 1 [0076.310] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559c30) returned 1 [0076.310] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559c80) returned 1 [0076.310] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559d48) returned 1 [0076.310] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ca8) returned 1 [0076.310] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa6) returned 0x54de9d0 [0076.310] wcscpy (in: _Dest=0x54de9d0, _Source="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" [0076.310] wcscat (in: _Dest=0x54de9d0, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.mailto[knoocknoo@cock.li].a0a70" [0076.310] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x906f950, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.310] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x3974910 Thread: id = 139 os_tid = 0xb30 [0071.275] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 0x20 [0079.926] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0079.926] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14d4 [0079.926] GetFileSizeEx (in: hFile=0x14d4, lpFileSize=0x90ef950 | out: lpFileSize=0x90ef950*=1118208) returned 1 [0079.926] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0x110ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.926] ReadFile (in: hFile=0x14d4, lpBuffer=0x90ef8d4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x90ef8d0, lpOverlapped=0x0 | out: lpBuffer=0x90ef8d4*, lpNumberOfBytesRead=0x90ef8d0*=0x4, lpOverlapped=0x0) returned 1 [0079.931] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.931] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e360 [0079.931] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e180 [0079.931] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e720 [0079.931] NtQuerySystemTime (in: CurrentTime=0x90ef8b0 | out: CurrentTime=0x90ef8b0*=132260136370910375) returned 0x0 [0079.931] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0x81db286e [0079.931] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0x5b110099 [0079.931] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0xb77a57ed [0079.931] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0xcc56dfe4 [0079.931] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0x5d1b7873 [0079.931] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0xa1c97a13 [0079.931] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0x41c57b24 [0079.931] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0x7610c1ad [0079.931] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0x1cbae5c4 [0079.931] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0x2433d6fc [0079.931] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0xcf184955 [0079.931] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0x1df34804 [0079.931] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0x120950e7 [0079.931] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0x3b122283 [0079.931] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0x96387fe4 [0079.931] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0xef61b7d7 [0079.931] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0xa771250e [0079.931] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0x845a9cba [0079.931] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0x2c7c8a0d [0079.931] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0x6544ada5 [0079.931] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0xff9424 [0079.931] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0x3f0cdc2a [0079.931] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0x9ab604ad [0079.931] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0x6027108e [0079.931] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0x2da46c95 [0079.932] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0x3473bd53 [0079.932] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0x932607c0 [0079.932] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0x7d13e921 [0079.932] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0x25c23389 [0079.932] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0x5bf81d9e [0079.932] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0x4ff36432 [0079.932] RtlRandom (in: Seed=0x90ef8bc | out: Seed=0x90ef8bc) returned 0xe3ce65af [0079.941] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.941] ReadFile (in: hFile=0x14d4, lpBuffer=0x7388008, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x90ef868, lpOverlapped=0x0 | out: lpBuffer=0x7388008*, lpNumberOfBytesRead=0x90ef868*=0xc800, lpOverlapped=0x0) returned 1 [0079.953] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.953] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x73a10d8 [0079.953] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5eee0b0 [0079.953] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e360 [0079.953] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e360) returned 1 [0079.954] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x73a2020 [0079.958] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e360 [0079.958] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e680 [0079.958] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e680) returned 1 [0079.958] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee0b0) returned 1 [0079.959] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a10d8) returned 1 [0079.959] WriteFile (in: hFile=0x14d4, lpBuffer=0x73a2020*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x90ef868, lpOverlapped=0x0 | out: lpBuffer=0x73a2020*, lpNumberOfBytesWritten=0x90ef868*=0xc800, lpOverlapped=0x0) returned 1 [0082.954] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a2020) returned 1 [0085.893] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0x89800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.893] ReadFile (in: hFile=0x14d4, lpBuffer=0x7388008, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x90ef868, lpOverlapped=0x0 | out: lpBuffer=0x7388008*, lpNumberOfBytesRead=0x90ef868*=0xc800, lpOverlapped=0x0) returned 1 [0085.894] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0x89800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.894] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8de0 [0085.894] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0xe51d0a8 [0085.894] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe51e270 [0085.894] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe51e270) returned 1 [0085.895] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x73a2020 [0085.896] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe51e5b8 [0085.896] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe51e680 [0085.896] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe51e680) returned 1 [0085.896] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe51d0a8) returned 1 [0085.896] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8de0) returned 1 [0085.896] WriteFile (in: hFile=0x14d4, lpBuffer=0x73a2020*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x90ef868, lpOverlapped=0x0 | out: lpBuffer=0x73a2020*, lpNumberOfBytesWritten=0x90ef868*=0xc800, lpOverlapped=0x0) returned 1 [0085.897] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a2020) returned 1 [0085.897] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0x104800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.897] ReadFile (in: hFile=0x14d4, lpBuffer=0x7388008, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x90ef868, lpOverlapped=0x0 | out: lpBuffer=0x7388008*, lpNumberOfBytesRead=0x90ef868*=0xc800, lpOverlapped=0x0) returned 1 [0085.905] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0x104800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.905] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8960 [0085.905] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0xe51cf40 [0085.905] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe51e540 [0085.905] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe51e540) returned 1 [0085.906] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x73a2020 [0085.907] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe51e270 [0085.907] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe51e5e0 [0085.907] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe51e5e0) returned 1 [0085.907] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe51cf40) returned 1 [0085.907] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8960) returned 1 [0085.907] WriteFile (in: hFile=0x14d4, lpBuffer=0x73a2020*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x90ef868, lpOverlapped=0x0 | out: lpBuffer=0x73a2020*, lpNumberOfBytesWritten=0x90ef868*=0xc800, lpOverlapped=0x0) returned 1 [0085.914] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a2020) returned 1 [0085.914] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x6e958f8 [0085.915] SetFilePointerEx (in: hFile=0x14d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.915] WriteFile (in: hFile=0x14d4, lpBuffer=0x54bdc20*, nNumberOfBytesToWrite=0x191, lpNumberOfBytesWritten=0x90ef910, lpOverlapped=0x0 | out: lpBuffer=0x54bdc20*, lpNumberOfBytesWritten=0x90ef910*=0x191, lpOverlapped=0x0) returned 1 [0089.296] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bdc20) returned 1 [0091.621] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe51d468) returned 1 [0091.621] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe51e568) returned 1 [0091.621] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe51d990) returned 1 [0091.621] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x6e958f8) returned 1 [0091.621] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e180) returned 1 [0091.621] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e658) returned 1 [0091.621] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e540) returned 1 [0091.622] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb2) returned 0x5b166d0 [0091.622] wcscpy (in: _Dest=0x5b166d0, _Source="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" [0091.622] wcscat (in: _Dest=0x5b166d0, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70" [0091.622] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x90ef8c8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0091.622] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x53f7a20 Thread: id = 140 os_tid = 0xda4 [0071.276] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 0x20 [0077.206] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0081.519] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cb4 [0081.520] GetFileSizeEx (in: hFile=0x1cb4, lpFileSize=0x916fd50 | out: lpFileSize=0x916fd50*=69632) returned 1 [0081.520] SetFilePointerEx (in: hFile=0x1cb4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.520] ReadFile (in: hFile=0x1cb4, lpBuffer=0x916fcd4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x916fcd0, lpOverlapped=0x0 | out: lpBuffer=0x916fcd4*, lpNumberOfBytesRead=0x916fcd0*=0x4, lpOverlapped=0x0) returned 1 [0081.521] SetFilePointerEx (in: hFile=0x1cb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.521] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 141 os_tid = 0x3fc [0071.277] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx")) returned 0x20 [0076.275] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0076.306] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1120 [0076.306] GetFileSizeEx (in: hFile=0x1120, lpFileSize=0x91ef7c4 | out: lpFileSize=0x91ef7c4*=2166784) returned 1 [0076.306] SetFilePointerEx (in: hFile=0x1120, liDistanceToMove=0x210ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.306] ReadFile (in: hFile=0x1120, lpBuffer=0x91ef748, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x91ef744, lpOverlapped=0x0 | out: lpBuffer=0x91ef748*, lpNumberOfBytesRead=0x91ef744*=0x4, lpOverlapped=0x0) returned 1 [0076.312] SetFilePointerEx (in: hFile=0x1120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.312] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c30 [0076.312] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c80 [0076.313] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559938 [0076.313] NtQuerySystemTime (in: CurrentTime=0x91ef724 | out: CurrentTime=0x91ef724*=132260136334647619) returned 0x0 [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0xe7fa821f [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0xb3ae98 [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0x9e6ef888 [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0x6febf467 [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0xc12f82d3 [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0x54cd9527 [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0x7c86b81b [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0xcaf6e049 [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0xb5cd029b [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0x586c2589 [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0x54c31344 [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0xc6ee7b3a [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0x1bc6a574 [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0x80baab6c [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0x39ae5ab1 [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0x42cb24df [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0x8516aff0 [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0xe40652be [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0x720801eb [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0x602572e9 [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0x8a0df2fa [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0x51483e24 [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0xa742a025 [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0xd80cc589 [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0x2ec325eb [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0x85a621b7 [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0xf7f4ebff [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0xe022a08d [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0xdfe9f64c [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0xda0f1dfd [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0x11e00c2a [0076.313] RtlRandom (in: Seed=0x91ef730 | out: Seed=0x91ef730) returned 0xda469bdd [0076.322] SetFilePointerEx (in: hFile=0x1120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.322] ReadFile (in: hFile=0x1120, lpBuffer=0x54fe820, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x91ef6dc, lpOverlapped=0x0 | out: lpBuffer=0x54fe820*, lpNumberOfBytesRead=0x91ef6dc*=0xc800, lpOverlapped=0x0) returned 1 [0076.324] SetFilePointerEx (in: hFile=0x1120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.324] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a60b8 [0076.324] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0076.324] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55599b0 [0076.324] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55599b0) returned 1 [0076.325] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5534050 [0076.326] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c30 [0076.326] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559d70 [0076.326] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559d70) returned 1 [0076.326] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.326] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a60b8) returned 1 [0076.326] WriteFile (in: hFile=0x1120, lpBuffer=0x5534050*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x91ef6dc, lpOverlapped=0x0 | out: lpBuffer=0x5534050*, lpNumberOfBytesWritten=0x91ef6dc*=0xc800, lpOverlapped=0x0) returned 1 [0076.328] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5534050) returned 1 [0076.328] SetFilePointerEx (in: hFile=0x1120, liDistanceToMove=0x113000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.328] ReadFile (in: hFile=0x1120, lpBuffer=0x54fe820, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x91ef6dc, lpOverlapped=0x0 | out: lpBuffer=0x54fe820*, lpNumberOfBytesRead=0x91ef6dc*=0xc800, lpOverlapped=0x0) returned 1 [0076.331] SetFilePointerEx (in: hFile=0x1120, liDistanceToMove=0x113000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.331] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5890 [0076.331] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5496e90 [0076.331] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559d70 [0076.331] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559d70) returned 1 [0076.332] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5534050 [0076.333] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559d70 [0076.333] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559898 [0076.333] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559898) returned 1 [0076.333] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496e90) returned 1 [0076.333] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5890) returned 1 [0076.333] WriteFile (in: hFile=0x1120, lpBuffer=0x5534050*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x91ef6dc, lpOverlapped=0x0 | out: lpBuffer=0x5534050*, lpNumberOfBytesWritten=0x91ef6dc*=0xc800, lpOverlapped=0x0) returned 1 [0076.334] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5534050) returned 1 [0076.334] SetFilePointerEx (in: hFile=0x1120, liDistanceToMove=0x204800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.335] ReadFile (in: hFile=0x1120, lpBuffer=0x54fe820, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x91ef6dc, lpOverlapped=0x0 | out: lpBuffer=0x54fe820*, lpNumberOfBytesRead=0x91ef6dc*=0xc800, lpOverlapped=0x0) returned 1 [0076.336] SetFilePointerEx (in: hFile=0x1120, liDistanceToMove=0x204800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.336] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5a40 [0076.336] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0076.336] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559ac8 [0076.336] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ac8) returned 1 [0076.337] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5534050 [0076.338] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559ac8 [0076.338] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559898 [0076.338] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559898) returned 1 [0076.338] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.338] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5a40) returned 1 [0076.338] WriteFile (in: hFile=0x1120, lpBuffer=0x5534050*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x91ef6dc, lpOverlapped=0x0 | out: lpBuffer=0x5534050*, lpNumberOfBytesWritten=0x91ef6dc*=0xc800, lpOverlapped=0x0) returned 1 [0076.339] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5534050) returned 1 [0076.339] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x542ba70 [0076.339] SetFilePointerEx (in: hFile=0x1120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.339] WriteFile (in: hFile=0x1120, lpBuffer=0x54a2b30*, nNumberOfBytesToWrite=0x1a1, lpNumberOfBytesWritten=0x91ef784, lpOverlapped=0x0 | out: lpBuffer=0x54a2b30*, lpNumberOfBytesWritten=0x91ef784*=0x1a1, lpOverlapped=0x0) returned 1 [0076.341] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a2b30) returned 1 [0076.341] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3978100) returned 1 [0076.341] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55598e8) returned 1 [0076.341] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3977f68) returned 1 [0076.341] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542ba70) returned 1 [0076.341] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559c80) returned 1 [0076.341] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559d48) returned 1 [0076.341] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ca8) returned 1 [0076.341] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x3971bf0 [0076.342] wcscpy (in: _Dest=0x3971bf0, _Source="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" [0076.342] wcscat (in: _Dest=0x3971bf0, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70" [0076.342] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x91ef73c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.342] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x39341e8 Thread: id = 142 os_tid = 0xf58 [0071.279] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 0x20 [0077.148] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", dwFileAttributes=0x20) returned 1 [0081.531] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cd0 [0081.532] GetFileSizeEx (in: hFile=0x1cd0, lpFileSize=0x926fc84 | out: lpFileSize=0x926fc84*=69632) returned 1 [0081.532] SetFilePointerEx (in: hFile=0x1cd0, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.532] ReadFile (in: hFile=0x1cd0, lpBuffer=0x926fc08, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x926fc04, lpOverlapped=0x0 | out: lpBuffer=0x926fc08*, lpNumberOfBytesRead=0x926fc04*=0x4, lpOverlapped=0x0) returned 1 [0081.533] SetFilePointerEx (in: hFile=0x1cd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.533] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 143 os_tid = 0x1328 [0071.281] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 0x20 [0077.208] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0081.508] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cb0 [0081.518] GetFileSizeEx (in: hFile=0x1cb0, lpFileSize=0x92efa20 | out: lpFileSize=0x92efa20*=69632) returned 1 [0081.518] SetFilePointerEx (in: hFile=0x1cb0, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.518] ReadFile (in: hFile=0x1cb0, lpBuffer=0x92ef9a4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x92ef9a0, lpOverlapped=0x0 | out: lpBuffer=0x92ef9a4*, lpNumberOfBytesRead=0x92ef9a0*=0x4, lpOverlapped=0x0) returned 1 [0081.519] SetFilePointerEx (in: hFile=0x1cb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.519] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 144 os_tid = 0xfb4 [0071.283] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 0x20 [0076.341] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0076.342] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1124 [0076.342] GetFileSizeEx (in: hFile=0x1124, lpFileSize=0x936f9f8 | out: lpFileSize=0x936f9f8*=69632) returned 1 [0076.342] SetFilePointerEx (in: hFile=0x1124, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.342] ReadFile (in: hFile=0x1124, lpBuffer=0x936f97c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x936f978, lpOverlapped=0x0 | out: lpBuffer=0x936f97c*, lpNumberOfBytesRead=0x936f978*=0x4, lpOverlapped=0x0) returned 1 [0076.343] SetFilePointerEx (in: hFile=0x1124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.344] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c30 [0076.344] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c80 [0076.344] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559938 [0076.344] NtQuerySystemTime (in: CurrentTime=0x936f958 | out: CurrentTime=0x936f958*=132260136334960226) returned 0x0 [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0xd78d15ac [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0xdaba7812 [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0xd4e25224 [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0x24f0e6ce [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0x2553a7c7 [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0x65af45de [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0xc6ebb81b [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0xc6e6bb2b [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0x483c9af2 [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0x8fb833c9 [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0x499681c4 [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0x2152a86e [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0xd0c6e79f [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0x950592f4 [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0xaf9f66b5 [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0xe39dec8d [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0x3a4462d3 [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0xfe9fb13c [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0x52d78cce [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0xd5322f25 [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0x539dce0f [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0x69fb3bd8 [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0x5447b9a7 [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0x85c455c2 [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0xe7f3bcb [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0x81d94d3a [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0xc934cf69 [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0x9b6343ad [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0xd68bc3d2 [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0xfb8ad1ad [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0x59e636da [0076.344] RtlRandom (in: Seed=0x936f964 | out: Seed=0x936f964) returned 0x97f5e332 [0076.354] SetFilePointerEx (in: hFile=0x1124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.354] ReadFile (in: hFile=0x1124, lpBuffer=0x54fe820, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x936f938, lpOverlapped=0x0 | out: lpBuffer=0x54fe820*, lpNumberOfBytesRead=0x936f938*=0xc800, lpOverlapped=0x0) returned 1 [0076.355] SetFilePointerEx (in: hFile=0x1124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.355] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0076.355] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0076.355] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55599b0 [0076.355] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55599b0) returned 1 [0076.356] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5534050 [0076.357] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c30 [0076.357] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559d70 [0076.357] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559d70) returned 1 [0076.357] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.357] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0076.357] WriteFile (in: hFile=0x1124, lpBuffer=0x5534050*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x936f938, lpOverlapped=0x0 | out: lpBuffer=0x5534050*, lpNumberOfBytesWritten=0x936f938*=0xc800, lpOverlapped=0x0) returned 1 [0076.359] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5534050) returned 1 [0076.359] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54fe820) returned 1 [0076.359] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8d) returned 0x549ef78 [0076.359] SetFilePointerEx (in: hFile=0x1124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.359] WriteFile (in: hFile=0x1124, lpBuffer=0x54a2b30*, nNumberOfBytesToWrite=0x171, lpNumberOfBytesWritten=0x936f9b8, lpOverlapped=0x0 | out: lpBuffer=0x54a2b30*, lpNumberOfBytesWritten=0x936f9b8*=0x171, lpOverlapped=0x0) returned 1 [0076.361] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a2b30) returned 1 [0076.361] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549f730) returned 1 [0076.361] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a50) returned 1 [0076.361] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549ef78) returned 1 [0076.361] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559c30) returned 1 [0076.361] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559c80) returned 1 [0076.361] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559d48) returned 1 [0076.361] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ca8) returned 1 [0076.361] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x3933848 [0076.361] wcscpy (in: _Dest=0x3933848, _Source="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" [0076.361] wcscat (in: _Dest=0x3933848, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70" [0076.361] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x936f970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.361] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x396e7b8 Thread: id = 145 os_tid = 0xf90 [0071.285] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 0x20 [0077.212] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0081.497] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cac [0081.506] GetFileSizeEx (in: hFile=0x1cac, lpFileSize=0x93efe64 | out: lpFileSize=0x93efe64*=69632) returned 1 [0081.506] SetFilePointerEx (in: hFile=0x1cac, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.507] ReadFile (in: hFile=0x1cac, lpBuffer=0x93efde8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x93efde4, lpOverlapped=0x0 | out: lpBuffer=0x93efde8*, lpNumberOfBytesRead=0x93efde4*=0x4, lpOverlapped=0x0) returned 1 [0081.508] SetFilePointerEx (in: hFile=0x1cac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.508] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1ff0 [0081.508] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1fa0 [0081.508] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1fc8 [0081.508] NtQuerySystemTime (in: CurrentTime=0x93efdc4 | out: CurrentTime=0x93efdc4*=132260136386691780) returned 0x0 [0081.508] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0xb4098920 [0081.508] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0x8f8225c0 [0081.508] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0x7302a33d [0081.508] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0x27503e9e [0081.508] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0x8442bda7 [0081.508] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0xdfa2b3d0 [0081.508] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0x4bc4deec [0081.508] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0x5a9f23ea [0081.508] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0x3342dda5 [0081.508] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0x2b1ca979 [0081.508] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0x3b7a784f [0081.509] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0x936ead08 [0081.509] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0x8cdec933 [0081.509] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0x59eff64 [0081.509] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0x29bb45fe [0081.509] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0xe8e659da [0081.509] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0xc7887085 [0081.509] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0x60e15490 [0081.509] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0xaa0bfafa [0081.509] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0xacc5b47b [0081.509] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0xe4517f6a [0081.509] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0x8c563e6 [0081.509] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0x2a32e040 [0081.509] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0x73238690 [0081.509] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0x7107d975 [0081.509] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0xdf0520d4 [0081.509] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0xac6e0091 [0081.509] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0x2a88b488 [0081.509] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0x5756e4d8 [0081.509] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0x9ef950b1 [0081.509] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0x9509c4ed [0081.509] RtlRandom (in: Seed=0x93efdd0 | out: Seed=0x93efdd0) returned 0xefa8bd1e Thread: id = 146 os_tid = 0xea4 [0071.286] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 0x20 [0076.343] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0076.358] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1128 [0076.358] GetFileSizeEx (in: hFile=0x1128, lpFileSize=0x946f894 | out: lpFileSize=0x946f894*=69632) returned 1 [0076.358] SetFilePointerEx (in: hFile=0x1128, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.358] ReadFile (in: hFile=0x1128, lpBuffer=0x946f818, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x946f814, lpOverlapped=0x0 | out: lpBuffer=0x946f818*, lpNumberOfBytesRead=0x946f814*=0x4, lpOverlapped=0x0) returned 1 [0076.363] SetFilePointerEx (in: hFile=0x1128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.363] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c30 [0076.363] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c80 [0076.363] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559938 [0076.363] NtQuerySystemTime (in: CurrentTime=0x946f7f4 | out: CurrentTime=0x946f7f4*=132260136335272588) returned 0x0 [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0x463c24e9 [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0x1af9f033 [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0x4ba40217 [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0x60d64fa1 [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0x17c0cc1d [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0x5dd62da9 [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0x53b44002 [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0x1dc4466b [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0xd29509bc [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0xd0c4b79d [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0xa189df3b [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0x327bd366 [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0x7b1e41ba [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0xaa3e9c36 [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0x29e75130 [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0x5a98223e [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0x730075a [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0x65e290ac [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0xffc1b75c [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0x7517d5dd [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0xa91e1671 [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0xfed293c8 [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0xd6213e3a [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0x13dea195 [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0x356feb4a [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0xf940618d [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0x9c5fc5f3 [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0x46bc3ecd [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0x218c86f2 [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0x6157b8fe [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0x9aaffd01 [0076.363] RtlRandom (in: Seed=0x946f800 | out: Seed=0x946f800) returned 0x7c9c6816 [0076.372] SetFilePointerEx (in: hFile=0x1128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.372] ReadFile (in: hFile=0x1128, lpBuffer=0x54fe820, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x946f7d4, lpOverlapped=0x0 | out: lpBuffer=0x54fe820*, lpNumberOfBytesRead=0x946f7d4*=0xc800, lpOverlapped=0x0) returned 1 [0076.373] SetFilePointerEx (in: hFile=0x1128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.373] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0076.373] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0076.373] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55599b0 [0076.373] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55599b0) returned 1 [0076.374] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5534050 [0076.375] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c30 [0076.375] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559d70 [0076.375] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559d70) returned 1 [0076.375] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.375] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0076.375] WriteFile (in: hFile=0x1128, lpBuffer=0x5534050*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x946f7d4, lpOverlapped=0x0 | out: lpBuffer=0x5534050*, lpNumberOfBytesWritten=0x946f7d4*=0xc800, lpOverlapped=0x0) returned 1 [0076.377] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5534050) returned 1 [0076.377] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54fe820) returned 1 [0076.377] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6f) returned 0x5496b48 [0076.377] SetFilePointerEx (in: hFile=0x1128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.377] WriteFile (in: hFile=0x1128, lpBuffer=0x54a2b30*, nNumberOfBytesToWrite=0x153, lpNumberOfBytesWritten=0x946f854, lpOverlapped=0x0 | out: lpBuffer=0x54a2b30*, lpNumberOfBytesWritten=0x946f854*=0x153, lpOverlapped=0x0) returned 1 [0076.379] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a2b30) returned 1 [0076.379] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497250) returned 1 [0076.379] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a50) returned 1 [0076.379] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496b48) returned 1 [0076.379] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559c30) returned 1 [0076.379] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559c80) returned 1 [0076.379] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559d48) returned 1 [0076.379] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ca8) returned 1 [0076.379] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb4) returned 0x39051a0 [0076.379] wcscpy (in: _Dest=0x39051a0, _Source="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" [0076.380] wcscat (in: _Dest=0x39051a0, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70" [0076.380] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x946f80c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.380] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xca) returned 0x3973d48 Thread: id = 147 os_tid = 0x6bc [0071.287] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 0x20 [0077.223] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0081.485] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ca8 [0081.495] GetFileSizeEx (in: hFile=0x1ca8, lpFileSize=0x94ef788 | out: lpFileSize=0x94ef788*=69632) returned 1 [0081.495] SetFilePointerEx (in: hFile=0x1ca8, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.495] ReadFile (in: hFile=0x1ca8, lpBuffer=0x94ef70c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x94ef708, lpOverlapped=0x0 | out: lpBuffer=0x94ef70c*, lpNumberOfBytesRead=0x94ef708*=0x4, lpOverlapped=0x0) returned 1 [0081.497] SetFilePointerEx (in: hFile=0x1ca8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.497] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1e88 [0081.497] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1eb0 [0081.497] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1f50 [0081.497] NtQuerySystemTime (in: CurrentTime=0x94ef6e8 | out: CurrentTime=0x94ef6e8*=132260136386535947) returned 0x0 [0081.497] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0xb64ccc91 [0081.497] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0x3d43cf24 [0081.497] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0x9650c489 [0081.497] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0x759761a8 [0081.497] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0x7b4cb300 [0081.497] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0x61515de8 [0081.497] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0xca44f3ae [0081.497] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0x575b4818 [0081.497] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0xbd8f775a [0081.497] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0x7abd0f7d [0081.497] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0xfd7a3bcf [0081.497] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0xaa33f1f9 [0081.497] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0xa53c7b33 [0081.497] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0x727bcaeb [0081.497] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0x11039 [0081.497] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0xa6987362 [0081.497] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0x6fe000fc [0081.497] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0xd7eda59c [0081.497] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0xe7d4e51c [0081.498] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0xf26642d [0081.498] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0xdf167bf0 [0081.498] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0x47adb3d2 [0081.498] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0x81e9fb24 [0081.498] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0xa1195d5f [0081.498] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0xddb801e [0081.498] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0x5ac77c4b [0081.498] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0x684f997 [0081.498] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0xcfe50dda [0081.498] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0x60eaa9cd [0081.498] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0x35ffff61 [0081.498] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0xe89d3580 [0081.498] RtlRandom (in: Seed=0x94ef6f4 | out: Seed=0x94ef6f4) returned 0xdda330b0 Thread: id = 148 os_tid = 0x470 [0071.289] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 0x20 [0077.149] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", dwFileAttributes=0x20) returned 1 [0081.530] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ccc [0081.530] GetFileSizeEx (in: hFile=0x1ccc, lpFileSize=0x956f810 | out: lpFileSize=0x956f810*=69632) returned 1 [0081.530] SetFilePointerEx (in: hFile=0x1ccc, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.530] ReadFile (in: hFile=0x1ccc, lpBuffer=0x956f794, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x956f790, lpOverlapped=0x0 | out: lpBuffer=0x956f794*, lpNumberOfBytesRead=0x956f790*=0x4, lpOverlapped=0x0) returned 1 [0081.531] SetFilePointerEx (in: hFile=0x1ccc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.531] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 149 os_tid = 0xff0 [0071.290] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 0x20 [0076.362] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0076.373] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x112c [0076.376] GetFileSizeEx (in: hFile=0x112c, lpFileSize=0x95ef760 | out: lpFileSize=0x95ef760*=69632) returned 1 [0076.376] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.376] ReadFile (in: hFile=0x112c, lpBuffer=0x95ef6e4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x95ef6e0, lpOverlapped=0x0 | out: lpBuffer=0x95ef6e4*, lpNumberOfBytesRead=0x95ef6e0*=0x4, lpOverlapped=0x0) returned 1 [0076.380] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.380] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c30 [0076.380] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c80 [0076.380] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559938 [0076.380] NtQuerySystemTime (in: CurrentTime=0x95ef6c0 | out: CurrentTime=0x95ef6c0*=132260136335428783) returned 0x0 [0076.380] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0x7230a471 [0076.380] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0xde7eb0b7 [0076.380] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0x69ff20b4 [0076.380] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0x1d2d1907 [0076.380] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0x344c25b5 [0076.380] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0xb27800e3 [0076.380] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0x98984e80 [0076.380] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0xccd8609c [0076.380] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0xad2c233a [0076.380] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0x8f820e94 [0076.380] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0x464b9355 [0076.380] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0x8a41eded [0076.380] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0x174ebc6a [0076.380] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0xdc22c91f [0076.380] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0xc7c54feb [0076.380] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0x6ba08db5 [0076.380] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0x460c987f [0076.380] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0x66f48991 [0076.380] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0x9fd339d5 [0076.380] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0x88a7cc6d [0076.380] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0xa2399dff [0076.380] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0x6172bf5a [0076.381] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0xe8bc87dd [0076.381] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0xe52509c1 [0076.381] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0x491e049b [0076.381] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0xc7c9d127 [0076.381] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0xfb6a35a9 [0076.381] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0xc393caa8 [0076.381] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0xe48115c1 [0076.381] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0xef51686a [0076.381] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0xab659934 [0076.381] RtlRandom (in: Seed=0x95ef6cc | out: Seed=0x95ef6cc) returned 0x9c6d801e [0076.390] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.390] ReadFile (in: hFile=0x112c, lpBuffer=0x54fe820, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x95ef6a0, lpOverlapped=0x0 | out: lpBuffer=0x54fe820*, lpNumberOfBytesRead=0x95ef6a0*=0xc800, lpOverlapped=0x0) returned 1 [0076.391] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.391] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0076.391] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0076.391] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55599b0 [0076.391] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55599b0) returned 1 [0076.392] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5534050 [0076.393] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c30 [0076.393] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559d70 [0076.393] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559d70) returned 1 [0076.393] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.393] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0076.393] WriteFile (in: hFile=0x112c, lpBuffer=0x5534050*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x95ef6a0, lpOverlapped=0x0 | out: lpBuffer=0x5534050*, lpNumberOfBytesWritten=0x95ef6a0*=0xc800, lpOverlapped=0x0) returned 1 [0076.395] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5534050) returned 1 [0076.395] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54fe820) returned 1 [0076.395] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6d) returned 0x5496b48 [0076.395] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.395] WriteFile (in: hFile=0x112c, lpBuffer=0x54a2b30*, nNumberOfBytesToWrite=0x151, lpNumberOfBytesWritten=0x95ef720, lpOverlapped=0x0 | out: lpBuffer=0x54a2b30*, lpNumberOfBytesWritten=0x95ef720*=0x151, lpOverlapped=0x0) returned 1 [0076.397] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a2b30) returned 1 [0076.397] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497250) returned 1 [0076.397] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a50) returned 1 [0076.397] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496b48) returned 1 [0076.397] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559c30) returned 1 [0076.397] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559c80) returned 1 [0076.397] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559d48) returned 1 [0076.397] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ca8) returned 1 [0076.397] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb2) returned 0x3905260 [0076.397] wcscpy (in: _Dest=0x3905260, _Source="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" [0076.397] wcscat (in: _Dest=0x3905260, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70" [0076.397] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x95ef6d8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.397] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x3970ae0 Thread: id = 150 os_tid = 0x500 [0071.618] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 0x20 [0077.112] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0081.533] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cd4 [0081.533] GetFileSizeEx (in: hFile=0x1cd4, lpFileSize=0x966f834 | out: lpFileSize=0x966f834*=1052672) returned 1 [0081.533] SetFilePointerEx (in: hFile=0x1cd4, liDistanceToMove=0x100ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.533] ReadFile (in: hFile=0x1cd4, lpBuffer=0x966f7b8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x966f7b4, lpOverlapped=0x0 | out: lpBuffer=0x966f7b8*, lpNumberOfBytesRead=0x966f7b4*=0x4, lpOverlapped=0x0) returned 1 [0081.535] SetFilePointerEx (in: hFile=0x1cd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.535] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 151 os_tid = 0xf24 [0071.618] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x84) returned 0x38a9298 [0071.619] wcscpy (in: _Dest=0x38a9298, _Source="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies") returned="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies" [0071.619] wcscat (in: _Dest=0x38a9298, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\") returned="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\" [0071.619] wcscat (in: _Dest=0x38a9298, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\*") returned="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\*" [0071.619] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542d260 [0071.619] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\*", lpFindFileData=0x542d260 | out: lpFindFileData=0x542d260*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xbc17eb24, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4adfea18, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f380 [0073.957] wcscmp (_String1=".", _String2=".") returned 0 [0073.957] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x542d260 | out: lpFindFileData=0x542d260*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xbc17eb24, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4adfea18, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.957] wcscmp (_String1="..", _String2=".") returned 1 [0073.957] wcscmp (_String1="..", _String2="..") returned 0 [0073.957] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x542d260 | out: lpFindFileData=0x542d260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a0e1ac1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x1d040, dwReserved0=0x0, dwReserved1=0x0, cFileName="adodb.dll", cAlternateFileName="")) returned 1 [0073.957] wcscmp (_String1="adodb.dll", _String2=".") returned 1 [0073.957] wcscmp (_String1="adodb.dll", _String2="..") returned 1 [0073.957] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x542d260 | out: lpFindFileData=0x542d260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a238f8c, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x7a4aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.mshtml.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0073.957] wcscmp (_String1="Microsoft.mshtml.dll", _String2=".") returned 1 [0073.957] wcscmp (_String1="Microsoft.mshtml.dll", _String2="..") returned 1 [0073.957] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x542d260 | out: lpFindFileData=0x542d260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a2ab773, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x5440, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.stdformat.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0073.957] wcscmp (_String1="Microsoft.stdformat.dll", _String2=".") returned 1 [0073.957] wcscmp (_String1="Microsoft.stdformat.dll", _String2="..") returned 1 [0073.957] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x542d260 | out: lpFindFileData=0x542d260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a402c44, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3040, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdatasrc.dll", cAlternateFileName="MSDATA~1.DLL")) returned 1 [0073.957] wcscmp (_String1="msdatasrc.dll", _String2=".") returned 1 [0073.957] wcscmp (_String1="msdatasrc.dll", _String2="..") returned 1 [0073.957] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x542d260 | out: lpFindFileData=0x542d260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae24be2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x6040, dwReserved0=0x0, dwReserved1=0x0, cFileName="stdole.dll", cAlternateFileName="")) returned 1 [0073.957] wcscmp (_String1="stdole.dll", _String2=".") returned 1 [0073.957] wcscmp (_String1="stdole.dll", _String2="..") returned 1 [0073.957] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x542d260 | out: lpFindFileData=0x542d260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae24be2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x6040, dwReserved0=0x0, dwReserved1=0x0, cFileName="stdole.dll", cAlternateFileName="")) returned 0 [0073.957] FindClose (in: hFindFile=0x389f380 | out: hFindFile=0x389f380) returned 1 [0073.958] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542d260) returned 1 [0073.958] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a9298) returned 1 [0073.958] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5409258) returned 1 Thread: id = 152 os_tid = 0x67c [0071.619] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x38b24f8 [0071.619] wcscpy (in: _Dest=0x38b24f8, _Source="C:\\Program Files (x86)\\Microsoft.NET\\RedistList" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList" [0071.619] wcscat (in: _Dest=0x38b24f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\" [0071.619] wcscat (in: _Dest=0x38b24f8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\*") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\*" [0071.619] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542dc00 [0071.619] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\*", lpFindFileData=0x542dc00 | out: lpFindFileData=0x542dc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc17f062, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7340c2, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445a40 [0077.206] wcscmp (_String1=".", _String2=".") returned 0 [0077.207] FindNextFileW (in: hFindFile=0x5445a40, lpFindFileData=0x542dc00 | out: lpFindFileData=0x542dc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc17f062, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7340c2, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.207] wcscmp (_String1="..", _String2=".") returned 1 [0077.207] wcscmp (_String1="..", _String2="..") returned 0 [0077.207] FindNextFileW (in: hFindFile=0x5445a40, lpFindFileData=0x542dc00 | out: lpFindFileData=0x542dc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9beb855b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9beb855b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9beb855b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3d63, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssemblyList_4_client.xml", cAlternateFileName="")) returned 1 [0077.207] wcscmp (_String1="AssemblyList_4_client.xml", _String2=".") returned 1 [0077.207] wcscmp (_String1="AssemblyList_4_client.xml", _String2="..") returned 1 [0077.207] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x94) returned 0x5426548 [0077.207] wcscpy (in: _Dest=0x5426548, _Source="C:\\Program Files (x86)\\Microsoft.NET\\RedistList" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList" [0077.207] wcscat (in: _Dest=0x5426548, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\" [0077.207] wcscat (in: _Dest=0x5426548, _Source="AssemblyList_4_client.xml" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml" [0080.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5426548, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x121c [0080.957] FindNextFileW (in: hFindFile=0x5445a40, lpFindFileData=0x542dc00 | out: lpFindFileData=0x542dc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ce8441a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9ce8441a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9ce8441a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x201c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssemblyList_4_extended.xml", cAlternateFileName="")) returned 1 [0080.957] wcscmp (_String1="AssemblyList_4_extended.xml", _String2=".") returned 1 [0080.957] wcscmp (_String1="AssemblyList_4_extended.xml", _String2="..") returned 1 [0080.957] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x98) returned 0x55c6938 [0080.957] wcscpy (in: _Dest=0x55c6938, _Source="C:\\Program Files (x86)\\Microsoft.NET\\RedistList" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList" [0080.957] wcscat (in: _Dest=0x55c6938, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\" [0080.957] wcscat (in: _Dest=0x55c6938, _Source="AssemblyList_4_extended.xml" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml" [0080.957] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55c6938, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18fc [0080.958] FindNextFileW (in: hFindFile=0x5445a40, lpFindFileData=0x542dc00 | out: lpFindFileData=0x542dc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ce8441a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9ce8441a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9ce8441a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x201c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssemblyList_4_extended.xml", cAlternateFileName="")) returned 0 [0080.958] FindClose (in: hFindFile=0x5445a40 | out: hFindFile=0x5445a40) returned 1 [0080.958] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542dc00) returned 1 [0080.958] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b24f8) returned 1 [0080.958] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541afa8) returned 1 Thread: id = 153 os_tid = 0xd80 [0071.620] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x5445940 [0071.620] wcscpy (in: _Dest=0x5445940, _Source="C:\\Users\\All Users\\Adobe" | out: _Dest="C:\\Users\\All Users\\Adobe") returned="C:\\Users\\All Users\\Adobe" [0071.620] wcscat (in: _Dest=0x5445940, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\") returned="C:\\Users\\All Users\\Adobe\\" [0071.620] wcscat (in: _Dest=0x5445940, _Source="*" | out: _Dest="C:\\Users\\All Users\\Adobe\\*") returned="C:\\Users\\All Users\\Adobe\\*" [0071.620] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542e0d0 [0071.620] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\*", lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4511a9a6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f0c0 [0075.055] wcscmp (_String1=".", _String2=".") returned 0 [0075.055] FindNextFileW (in: hFindFile=0x389f0c0, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4511a9a6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.055] wcscmp (_String1="..", _String2=".") returned 1 [0075.055] wcscmp (_String1="..", _String2="..") returned 0 [0075.055] FindNextFileW (in: hFindFile=0x389f0c0, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 1 [0075.055] wcscmp (_String1="ARM", _String2=".") returned 1 [0075.055] wcscmp (_String1="ARM", _String2="..") returned 1 [0075.055] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a59f8 [0075.055] wcscpy (in: _Dest=0x38a59f8, _Source="C:\\Users\\All Users\\Adobe" | out: _Dest="C:\\Users\\All Users\\Adobe") returned="C:\\Users\\All Users\\Adobe" [0075.055] wcscat (in: _Dest=0x38a59f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\") returned="C:\\Users\\All Users\\Adobe\\" [0075.055] wcscat (in: _Dest=0x38a59f8, _Source="ARM" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM") returned="C:\\Users\\All Users\\Adobe\\ARM" [0081.167] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a59f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc54 [0081.167] FindNextFileW (in: hFindFile=0x389f0c0, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 0 [0081.168] FindClose (in: hFindFile=0x389f0c0 | out: hFindFile=0x389f0c0) returned 1 [0081.168] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542e0d0) returned 1 [0081.168] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445940) returned 1 [0081.168] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54454c0) returned 1 Thread: id = 154 os_tid = 0xde8 [0071.620] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x5428818 [0071.620] wcscpy (in: _Dest=0x5428818, _Source="C:\\Users\\All Users\\Application Data" | out: _Dest="C:\\Users\\All Users\\Application Data") returned="C:\\Users\\All Users\\Application Data" [0071.620] wcscat (in: _Dest=0x5428818, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Application Data\\") returned="C:\\Users\\All Users\\Application Data\\" [0071.620] wcscat (in: _Dest=0x5428818, _Source="*" | out: _Dest="C:\\Users\\All Users\\Application Data\\*") returned="C:\\Users\\All Users\\Application Data\\*" [0071.620] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542e338 [0071.620] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Application Data\\*", lpFindFileData=0x542e338 | out: lpFindFileData=0x542e338*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.903] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542e338) returned 1 [0074.903] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5428818) returned 1 [0074.903] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x543dc18) returned 1 Thread: id = 155 os_tid = 0xc30 [0071.621] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x5445480 [0071.621] wcscpy (in: _Dest=0x5445480, _Source="C:\\Users\\All Users\\Comms" | out: _Dest="C:\\Users\\All Users\\Comms") returned="C:\\Users\\All Users\\Comms" [0071.621] wcscat (in: _Dest=0x5445480, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Comms\\") returned="C:\\Users\\All Users\\Comms\\" [0071.621] wcscat (in: _Dest=0x5445480, _Source="*" | out: _Dest="C:\\Users\\All Users\\Comms\\*") returned="C:\\Users\\All Users\\Comms\\*" [0071.621] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542e5a0 [0071.621] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Comms\\*", lpFindFileData=0x542e5a0 | out: lpFindFileData=0x542e5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f0c0 [0075.054] wcscmp (_String1=".", _String2=".") returned 0 [0075.054] FindNextFileW (in: hFindFile=0x389f0c0, lpFindFileData=0x542e5a0 | out: lpFindFileData=0x542e5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.054] wcscmp (_String1="..", _String2=".") returned 1 [0075.054] wcscmp (_String1="..", _String2="..") returned 0 [0075.054] FindNextFileW (in: hFindFile=0x389f0c0, lpFindFileData=0x542e5a0 | out: lpFindFileData=0x542e5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.054] FindClose (in: hFindFile=0x389f0c0 | out: hFindFile=0x389f0c0) returned 1 [0075.054] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542e5a0) returned 1 [0075.054] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445480) returned 1 [0075.054] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445880) returned 1 Thread: id = 156 os_tid = 0x1374 [0071.621] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x537b560 [0071.621] wcscpy (in: _Dest=0x537b560, _Source="C:\\Users\\All Users\\Desktop" | out: _Dest="C:\\Users\\All Users\\Desktop") returned="C:\\Users\\All Users\\Desktop" [0071.621] wcscat (in: _Dest=0x537b560, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Desktop\\") returned="C:\\Users\\All Users\\Desktop\\" [0071.621] wcscat (in: _Dest=0x537b560, _Source="*" | out: _Dest="C:\\Users\\All Users\\Desktop\\*") returned="C:\\Users\\All Users\\Desktop\\*" [0071.621] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542e808 [0071.621] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Desktop\\*", lpFindFileData=0x542e808 | out: lpFindFileData=0x542e808*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.623] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542e808) returned 1 [0074.623] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b560) returned 1 [0074.623] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54457c0) returned 1 Thread: id = 157 os_tid = 0xe84 [0071.622] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3e) returned 0x537b5a8 [0071.622] wcscpy (in: _Dest=0x537b5a8, _Source="C:\\Users\\All Users\\Documents" | out: _Dest="C:\\Users\\All Users\\Documents") returned="C:\\Users\\All Users\\Documents" [0071.622] wcscat (in: _Dest=0x537b5a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Documents\\") returned="C:\\Users\\All Users\\Documents\\" [0071.622] wcscat (in: _Dest=0x537b5a8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Documents\\*") returned="C:\\Users\\All Users\\Documents\\*" [0071.622] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542ea70 [0071.622] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Documents\\*", lpFindFileData=0x542ea70 | out: lpFindFileData=0x542ea70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.622] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542ea70) returned 1 [0074.622] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b5a8) returned 1 [0074.622] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b1b8) returned 1 Thread: id = 158 os_tid = 0x139c [0071.622] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3e) returned 0x537b638 [0071.622] wcscpy (in: _Dest=0x537b638, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0071.622] wcscat (in: _Dest=0x537b638, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0071.622] wcscat (in: _Dest=0x537b638, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\*") returned="C:\\Users\\All Users\\Microsoft\\*" [0071.622] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542ecd8 [0071.622] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\*", lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0082.401] wcscmp (_String1=".", _String2=".") returned 0 [0082.401] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.401] wcscmp (_String1="..", _String2=".") returned 1 [0082.401] wcscmp (_String1="..", _String2="..") returned 0 [0082.401] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppV", cAlternateFileName="")) returned 1 [0082.401] wcscmp (_String1="AppV", _String2=".") returned 1 [0082.401] wcscmp (_String1="AppV", _String2="..") returned 1 [0082.401] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x397a0c8 [0082.401] wcscpy (in: _Dest=0x397a0c8, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.401] wcscat (in: _Dest=0x397a0c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.401] wcscat (in: _Dest=0x397a0c8, _Source="AppV" | out: _Dest="C:\\Users\\All Users\\Microsoft\\AppV") returned="C:\\Users\\All Users\\Microsoft\\AppV" [0082.401] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x397a0c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c80 [0082.402] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfa011b19, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfa011b19, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1 [0082.402] wcscmp (_String1="ClickToRun", _String2=".") returned 1 [0082.402] wcscmp (_String1="ClickToRun", _String2="..") returned 1 [0082.402] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x757e3f0 [0082.402] wcscpy (in: _Dest=0x757e3f0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.402] wcscat (in: _Dest=0x757e3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.402] wcscat (in: _Dest=0x757e3f0, _Source="ClickToRun" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun" [0082.402] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x757e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e18 [0082.403] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1 [0082.403] wcscmp (_String1="Crypto", _String2=".") returned 1 [0082.403] wcscmp (_String1="Crypto", _String2="..") returned 1 [0082.403] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x397a938 [0082.403] wcscpy (in: _Dest=0x397a938, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.403] wcscat (in: _Dest=0x397a938, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.403] wcscat (in: _Dest=0x397a938, _Source="Crypto" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto") returned="C:\\Users\\All Users\\Microsoft\\Crypto" [0082.403] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x397a938, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e1c [0082.404] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataMart", cAlternateFileName="")) returned 1 [0082.404] wcscmp (_String1="DataMart", _String2=".") returned 1 [0082.404] wcscmp (_String1="DataMart", _String2="..") returned 1 [0082.404] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x757e810 [0082.404] wcscpy (in: _Dest=0x757e810, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.404] wcscat (in: _Dest=0x757e810, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.404] wcscat (in: _Dest=0x757e810, _Source="DataMart" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DataMart") returned="C:\\Users\\All Users\\Microsoft\\DataMart" [0082.404] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x757e810, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e20 [0082.404] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1 [0082.404] wcscmp (_String1="Device Stage", _String2=".") returned 1 [0082.404] wcscmp (_String1="Device Stage", _String2="..") returned 1 [0082.404] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x75836e0 [0082.404] wcscpy (in: _Dest=0x75836e0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.404] wcscat (in: _Dest=0x75836e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.404] wcscat (in: _Dest=0x75836e0, _Source="Device Stage" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage") returned="C:\\Users\\All Users\\Microsoft\\Device Stage" [0082.405] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x75836e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e24 [0082.405] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1 [0082.405] wcscmp (_String1="DeviceSync", _String2=".") returned 1 [0082.405] wcscmp (_String1="DeviceSync", _String2="..") returned 1 [0082.405] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x757ea78 [0082.405] wcscpy (in: _Dest=0x757ea78, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.405] wcscat (in: _Dest=0x757ea78, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.405] wcscat (in: _Dest=0x757ea78, _Source="DeviceSync" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DeviceSync") returned="C:\\Users\\All Users\\Microsoft\\DeviceSync" [0082.405] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x757ea78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e28 [0082.406] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnosis", cAlternateFileName="DIAGNO~1")) returned 1 [0082.406] wcscmp (_String1="Diagnosis", _String2=".") returned 1 [0082.406] wcscmp (_String1="Diagnosis", _String2="..") returned 1 [0082.406] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x757e4f8 [0082.406] wcscpy (in: _Dest=0x757e4f8, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.406] wcscat (in: _Dest=0x757e4f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.406] wcscat (in: _Dest=0x757e4f8, _Source="Diagnosis" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis" [0082.406] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x757e4f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e2c [0082.407] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1 [0082.407] wcscmp (_String1="DRM", _String2=".") returned 1 [0082.407] wcscmp (_String1="DRM", _String2="..") returned 1 [0082.407] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x42) returned 0x397a208 [0082.407] wcscpy (in: _Dest=0x397a208, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.407] wcscat (in: _Dest=0x397a208, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.407] wcscat (in: _Dest=0x397a208, _Source="DRM" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM") returned="C:\\Users\\All Users\\Microsoft\\DRM" [0082.407] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x397a208, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e30 [0082.407] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x40368daa, ftLastAccessTime.dwHighDateTime=0x1d39f5f, ftLastWriteTime.dwLowDateTime=0x40368daa, ftLastWriteTime.dwHighDateTime=0x1d39f5f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0082.407] wcscmp (_String1="Event Viewer", _String2=".") returned 1 [0082.408] wcscmp (_String1="Event Viewer", _String2="..") returned 1 [0082.408] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x75837a0 [0082.408] wcscpy (in: _Dest=0x75837a0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.408] wcscat (in: _Dest=0x75837a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.408] wcscat (in: _Dest=0x75837a0, _Source="Event Viewer" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer" [0082.408] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x75837a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e34 [0082.408] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1 [0082.408] wcscmp (_String1="IdentityCRL", _String2=".") returned 1 [0082.408] wcscmp (_String1="IdentityCRL", _String2="..") returned 1 [0082.408] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x7583800 [0082.408] wcscpy (in: _Dest=0x7583800, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.408] wcscat (in: _Dest=0x7583800, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.409] wcscat (in: _Dest=0x7583800, _Source="IdentityCRL" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL" [0082.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7583800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e38 [0082.409] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MapData", cAlternateFileName="")) returned 1 [0082.409] wcscmp (_String1="MapData", _String2=".") returned 1 [0082.409] wcscmp (_String1="MapData", _String2="..") returned 1 [0082.409] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x757e550 [0082.410] wcscpy (in: _Dest=0x757e550, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.410] wcscat (in: _Dest=0x757e550, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.410] wcscat (in: _Dest=0x757e550, _Source="MapData" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MapData") returned="C:\\Users\\All Users\\Microsoft\\MapData" [0082.410] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x757e550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e3c [0082.410] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80d7aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MF", cAlternateFileName="")) returned 1 [0082.410] wcscmp (_String1="MF", _String2=".") returned 1 [0082.410] wcscmp (_String1="MF", _String2="..") returned 1 [0082.410] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8450 [0082.410] wcscpy (in: _Dest=0x5ba8450, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.410] wcscat (in: _Dest=0x5ba8450, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.410] wcscat (in: _Dest=0x5ba8450, _Source="MF" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF") returned="C:\\Users\\All Users\\Microsoft\\MF" [0082.410] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba8450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e40 [0082.411] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1 [0082.411] wcscmp (_String1="NetFramework", _String2=".") returned 1 [0082.411] wcscmp (_String1="NetFramework", _String2="..") returned 1 [0082.411] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x75838c0 [0082.411] wcscpy (in: _Dest=0x75838c0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.411] wcscat (in: _Dest=0x75838c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.411] wcscat (in: _Dest=0x75838c0, _Source="NetFramework" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework") returned="C:\\Users\\All Users\\Microsoft\\NetFramework" [0082.411] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x75838c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e44 [0082.412] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0082.412] wcscmp (_String1="Network", _String2=".") returned 1 [0082.412] wcscmp (_String1="Network", _String2="..") returned 1 [0082.412] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x757ead0 [0082.412] wcscpy (in: _Dest=0x757ead0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.412] wcscat (in: _Dest=0x757ead0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.412] wcscat (in: _Dest=0x757ead0, _Source="Network" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network") returned="C:\\Users\\All Users\\Microsoft\\Network" [0082.412] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x757ead0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e48 [0082.413] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0082.413] wcscmp (_String1="Office", _String2=".") returned 1 [0082.413] wcscmp (_String1="Office", _String2="..") returned 1 [0082.413] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x397a258 [0082.413] wcscpy (in: _Dest=0x397a258, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.413] wcscat (in: _Dest=0x397a258, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.413] wcscat (in: _Dest=0x397a258, _Source="Office" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Office") returned="C:\\Users\\All Users\\Microsoft\\Office" [0082.413] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x397a258, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e4c [0082.414] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfee8021d, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfee8021d, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Provisioning", cAlternateFileName="PROVIS~1")) returned 1 [0082.414] wcscmp (_String1="Provisioning", _String2=".") returned 1 [0082.414] wcscmp (_String1="Provisioning", _String2="..") returned 1 [0082.414] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x7583920 [0082.414] wcscpy (in: _Dest=0x7583920, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.414] wcscat (in: _Dest=0x7583920, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.414] wcscat (in: _Dest=0x7583920, _Source="Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0082.414] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7583920) returned 1 [0082.414] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb79dd84e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb7a500e7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb7a500e7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1 [0082.414] wcscmp (_String1="Search", _String2=".") returned 1 [0082.414] wcscmp (_String1="Search", _String2="..") returned 1 [0082.414] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x397a438 [0082.414] wcscpy (in: _Dest=0x397a438, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.414] wcscat (in: _Dest=0x397a438, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.414] wcscat (in: _Dest=0x397a438, _Source="Search" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search") returned="C:\\Users\\All Users\\Microsoft\\Search" [0082.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x397a438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e50 [0082.415] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30e3b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0082.415] wcscmp (_String1="Settings", _String2=".") returned 1 [0082.415] wcscmp (_String1="Settings", _String2="..") returned 1 [0082.415] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x757eb28 [0082.415] wcscpy (in: _Dest=0x757eb28, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.415] wcscat (in: _Dest=0x757eb28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.415] wcscat (in: _Dest=0x757eb28, _Source="Settings" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Settings") returned="C:\\Users\\All Users\\Microsoft\\Settings" [0082.415] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x757eb28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e54 [0082.416] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dcfea0a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1dcfea0a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmsRouter", cAlternateFileName="SMSROU~1")) returned 1 [0082.416] wcscmp (_String1="SmsRouter", _String2=".") returned 1 [0082.416] wcscmp (_String1="SmsRouter", _String2="..") returned 1 [0082.416] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x757e5a8 [0082.416] wcscpy (in: _Dest=0x757e5a8, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.416] wcscat (in: _Dest=0x757e5a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.416] wcscat (in: _Dest=0x757e5a8, _Source="SmsRouter" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter" [0082.416] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x757e5a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e58 [0082.417] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spectrum", cAlternateFileName="")) returned 1 [0082.417] wcscmp (_String1="Spectrum", _String2=".") returned 1 [0082.417] wcscmp (_String1="Spectrum", _String2="..") returned 1 [0082.417] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x757e760 [0082.417] wcscpy (in: _Dest=0x757e760, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.417] wcscat (in: _Dest=0x757e760, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.417] wcscat (in: _Dest=0x757e760, _Source="Spectrum" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Spectrum") returned="C:\\Users\\All Users\\Microsoft\\Spectrum" [0082.417] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x757e760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e5c [0082.418] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech_OneCore", cAlternateFileName="SPEECH~1")) returned 1 [0082.418] wcscmp (_String1="Speech_OneCore", _String2=".") returned 1 [0082.418] wcscmp (_String1="Speech_OneCore", _String2="..") returned 1 [0082.418] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x7583920 [0082.418] wcscpy (in: _Dest=0x7583920, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.418] wcscat (in: _Dest=0x7583920, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.418] wcscat (in: _Dest=0x7583920, _Source="Speech_OneCore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Speech_OneCore") returned="C:\\Users\\All Users\\Microsoft\\Speech_OneCore" [0082.418] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7583920, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e60 [0082.419] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xcb4dcad0, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Storage Health", cAlternateFileName="STORAG~1")) returned 1 [0082.419] wcscmp (_String1="Storage Health", _String2=".") returned 1 [0082.419] wcscmp (_String1="Storage Health", _String2="..") returned 1 [0082.419] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x7583980 [0082.419] wcscpy (in: _Dest=0x7583980, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.419] wcscat (in: _Dest=0x7583980, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.419] wcscat (in: _Dest=0x7583980, _Source="Storage Health" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Storage Health") returned="C:\\Users\\All Users\\Microsoft\\Storage Health" [0082.419] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7583980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e64 [0082.419] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe3615f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UEV", cAlternateFileName="")) returned 1 [0082.420] wcscmp (_String1="UEV", _String2=".") returned 1 [0082.420] wcscmp (_String1="UEV", _String2="..") returned 1 [0082.420] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x42) returned 0x397a398 [0082.420] wcscpy (in: _Dest=0x397a398, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.420] wcscat (in: _Dest=0x397a398, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.420] wcscat (in: _Dest=0x397a398, _Source="UEV" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV") returned="C:\\Users\\All Users\\Microsoft\\UEV" [0082.420] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x397a398, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e68 [0082.420] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbaae4059, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xbaae4059, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1 [0082.420] wcscmp (_String1="User Account Pictures", _String2=".") returned 1 [0082.420] wcscmp (_String1="User Account Pictures", _String2="..") returned 1 [0082.420] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x5ba7c08 [0082.420] wcscpy (in: _Dest=0x5ba7c08, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.420] wcscat (in: _Dest=0x5ba7c08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.420] wcscat (in: _Dest=0x5ba7c08, _Source="User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0082.421] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba7c08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e6c [0082.421] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4bcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x448126f7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0082.421] wcscmp (_String1="Vault", _String2=".") returned 1 [0082.421] wcscmp (_String1="Vault", _String2="..") returned 1 [0082.421] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x46) returned 0x397a118 [0082.421] wcscpy (in: _Dest=0x397a118, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.421] wcscat (in: _Dest=0x397a118, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.421] wcscat (in: _Dest=0x397a118, _Source="Vault" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault") returned="C:\\Users\\All Users\\Microsoft\\Vault" [0082.421] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x397a118, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e70 [0082.422] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDF", cAlternateFileName="")) returned 1 [0082.422] wcscmp (_String1="WDF", _String2=".") returned 1 [0082.422] wcscmp (_String1="WDF", _String2="..") returned 1 [0082.422] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x42) returned 0x397a758 [0082.422] wcscpy (in: _Dest=0x397a758, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.422] wcscat (in: _Dest=0x397a758, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.422] wcscat (in: _Dest=0x397a758, _Source="WDF" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WDF") returned="C:\\Users\\All Users\\Microsoft\\WDF" [0082.422] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x397a758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e74 [0082.423] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xedcf5f61, ftLastAccessTime.dwHighDateTime=0x1d336d9, ftLastWriteTime.dwLowDateTime=0xedcf5f61, ftLastWriteTime.dwHighDateTime=0x1d336d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0082.423] wcscmp (_String1="Windows", _String2=".") returned 1 [0082.423] wcscmp (_String1="Windows", _String2="..") returned 1 [0082.423] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x757e600 [0082.423] wcscpy (in: _Dest=0x757e600, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.423] wcscat (in: _Dest=0x757e600, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.423] wcscat (in: _Dest=0x757e600, _Source="Windows" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows") returned="C:\\Users\\All Users\\Microsoft\\Windows" [0082.423] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x757e600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e78 [0082.424] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d4e74, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb320aac5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0082.424] wcscmp (_String1="Windows Defender", _String2=".") returned 1 [0082.424] wcscmp (_String1="Windows Defender", _String2="..") returned 1 [0082.424] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x542b4c0 [0082.424] wcscpy (in: _Dest=0x542b4c0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.424] wcscat (in: _Dest=0x542b4c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.424] wcscat (in: _Dest=0x542b4c0, _Source="Windows Defender" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender" [0082.424] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542b4c0) returned 1 [0082.424] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a90a48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender Advanced Threat Protection", cAlternateFileName="WIF4A9~1")) returned 1 [0082.424] wcscmp (_String1="Windows Defender Advanced Threat Protection", _String2=".") returned 1 [0082.424] wcscmp (_String1="Windows Defender Advanced Threat Protection", _String2="..") returned 1 [0082.424] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x92) returned 0x55c6cf8 [0082.424] wcscpy (in: _Dest=0x55c6cf8, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.424] wcscat (in: _Dest=0x55c6cf8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.424] wcscat (in: _Dest=0x55c6cf8, _Source="Windows Defender Advanced Threat Protection" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection" [0082.424] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55c6cf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e7c [0082.444] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a928fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~2")) returned 1 [0082.444] wcscmp (_String1="Windows Live", _String2=".") returned 1 [0082.444] wcscmp (_String1="Windows Live", _String2="..") returned 1 [0082.444] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x75839e0 [0082.444] wcscpy (in: _Dest=0x75839e0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.444] wcscat (in: _Dest=0x75839e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.444] wcscat (in: _Dest=0x75839e0, _Source="Windows Live" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Live") returned="C:\\Users\\All Users\\Microsoft\\Windows Live" [0082.444] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x75839e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e80 [0082.445] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a93496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~3")) returned 1 [0082.445] wcscmp (_String1="Windows NT", _String2=".") returned 1 [0082.445] wcscmp (_String1="Windows NT", _String2="..") returned 1 [0082.445] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x757e658 [0082.445] wcscpy (in: _Dest=0x757e658, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.445] wcscat (in: _Dest=0x757e658, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.445] wcscat (in: _Dest=0x757e658, _Source="Windows NT" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT") returned="C:\\Users\\All Users\\Microsoft\\Windows NT" [0082.445] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x757e658, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e84 [0082.446] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0ef6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Security Health", cAlternateFileName="WINDOW~4")) returned 1 [0082.446] wcscmp (_String1="Windows Security Health", _String2=".") returned 1 [0082.446] wcscmp (_String1="Windows Security Health", _String2="..") returned 1 [0082.446] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6a) returned 0x54972c8 [0082.446] wcscpy (in: _Dest=0x54972c8, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.446] wcscat (in: _Dest=0x54972c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.446] wcscat (in: _Dest=0x54972c8, _Source="Windows Security Health" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Security Health") returned="C:\\Users\\All Users\\Microsoft\\Windows Security Health" [0082.446] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54972c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e88 [0082.447] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMSIPC", cAlternateFileName="")) returned 1 [0082.447] wcscmp (_String1="WinMSIPC", _String2=".") returned 1 [0082.447] wcscmp (_String1="WinMSIPC", _String2="..") returned 1 [0082.447] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x757e868 [0082.447] wcscpy (in: _Dest=0x757e868, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.447] wcscat (in: _Dest=0x757e868, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.447] wcscat (in: _Dest=0x757e868, _Source="WinMSIPC" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WinMSIPC") returned="C:\\Users\\All Users\\Microsoft\\WinMSIPC" [0082.447] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x757e868, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e8c [0082.448] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 1 [0082.450] wcscmp (_String1="WwanSvc", _String2=".") returned 1 [0082.450] wcscmp (_String1="WwanSvc", _String2="..") returned 1 [0082.450] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x757e708 [0082.450] wcscpy (in: _Dest=0x757e708, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0082.450] wcscat (in: _Dest=0x757e708, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0082.451] wcscat (in: _Dest=0x757e708, _Source="WwanSvc" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc" [0082.451] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x757e708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e90 [0082.451] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 0 [0082.452] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0082.462] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542ecd8) returned 1 [0082.462] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b638) returned 1 [0082.462] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b6c8) returned 1 Thread: id = 159 os_tid = 0x138c [0071.623] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x5428870 [0071.623] wcscpy (in: _Dest=0x5428870, _Source="C:\\Users\\All Users\\Microsoft OneDrive" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive") returned="C:\\Users\\All Users\\Microsoft OneDrive" [0071.623] wcscat (in: _Dest=0x5428870, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive\\") returned="C:\\Users\\All Users\\Microsoft OneDrive\\" [0071.623] wcscat (in: _Dest=0x5428870, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive\\*") returned="C:\\Users\\All Users\\Microsoft OneDrive\\*" [0071.623] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542ef40 [0071.623] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\*", lpFindFileData=0x542ef40 | out: lpFindFileData=0x542ef40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f180 [0075.064] wcscmp (_String1=".", _String2=".") returned 0 [0075.064] FindNextFileW (in: hFindFile=0x389f180, lpFindFileData=0x542ef40 | out: lpFindFileData=0x542ef40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.064] wcscmp (_String1="..", _String2=".") returned 1 [0075.064] wcscmp (_String1="..", _String2="..") returned 0 [0075.064] FindNextFileW (in: hFindFile=0x389f180, lpFindFileData=0x542ef40 | out: lpFindFileData=0x542ef40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup", cAlternateFileName="")) returned 1 [0075.064] wcscmp (_String1="setup", _String2=".") returned 1 [0075.064] wcscmp (_String1="setup", _String2="..") returned 1 [0075.064] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x38b60c8 [0075.064] wcscpy (in: _Dest=0x38b60c8, _Source="C:\\Users\\All Users\\Microsoft OneDrive" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive") returned="C:\\Users\\All Users\\Microsoft OneDrive" [0075.064] wcscat (in: _Dest=0x38b60c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive\\") returned="C:\\Users\\All Users\\Microsoft OneDrive\\" [0075.064] wcscat (in: _Dest=0x38b60c8, _Source="setup" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive\\setup") returned="C:\\Users\\All Users\\Microsoft OneDrive\\setup" [0081.169] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b60c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b68 [0081.170] FindNextFileW (in: hFindFile=0x389f180, lpFindFileData=0x542ef40 | out: lpFindFileData=0x542ef40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup", cAlternateFileName="")) returned 0 [0081.170] FindClose (in: hFindFile=0x389f180 | out: hFindFile=0x389f180) returned 1 [0081.170] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542ef40) returned 1 [0081.170] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5428870) returned 1 [0081.170] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541b830) returned 1 Thread: id = 160 os_tid = 0x1394 [0071.623] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x38) returned 0x5445500 [0071.623] wcscpy (in: _Dest=0x5445500, _Source="C:\\Users\\All Users\\Oracle" | out: _Dest="C:\\Users\\All Users\\Oracle") returned="C:\\Users\\All Users\\Oracle" [0071.623] wcscat (in: _Dest=0x5445500, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\") returned="C:\\Users\\All Users\\Oracle\\" [0071.623] wcscat (in: _Dest=0x5445500, _Source="*" | out: _Dest="C:\\Users\\All Users\\Oracle\\*") returned="C:\\Users\\All Users\\Oracle\\*" [0071.623] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542fdb0 [0071.623] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\*", lpFindFileData=0x542fdb0 | out: lpFindFileData=0x542fdb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f080 [0075.053] wcscmp (_String1=".", _String2=".") returned 0 [0075.053] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x542fdb0 | out: lpFindFileData=0x542fdb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.053] wcscmp (_String1="..", _String2=".") returned 1 [0075.053] wcscmp (_String1="..", _String2="..") returned 0 [0075.053] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x542fdb0 | out: lpFindFileData=0x542fdb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0075.053] wcscmp (_String1="Java", _String2=".") returned 1 [0075.053] wcscmp (_String1="Java", _String2="..") returned 1 [0075.053] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3e) returned 0x38a5968 [0075.053] wcscpy (in: _Dest=0x38a5968, _Source="C:\\Users\\All Users\\Oracle" | out: _Dest="C:\\Users\\All Users\\Oracle") returned="C:\\Users\\All Users\\Oracle" [0075.053] wcscat (in: _Dest=0x38a5968, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\") returned="C:\\Users\\All Users\\Oracle\\" [0075.053] wcscat (in: _Dest=0x38a5968, _Source="Java" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java") returned="C:\\Users\\All Users\\Oracle\\Java" [0081.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a5968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b64 [0081.166] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x542fdb0 | out: lpFindFileData=0x542fdb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0 [0081.166] FindClose (in: hFindFile=0x389f080 | out: hFindFile=0x389f080) returned 1 [0081.166] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542fdb0) returned 1 [0081.166] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445500) returned 1 [0081.166] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445300) returned 1 Thread: id = 161 os_tid = 0x1398 [0071.623] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x46) returned 0x5443370 [0071.624] wcscpy (in: _Dest=0x5443370, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0071.624] wcscat (in: _Dest=0x5443370, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0071.624] wcscat (in: _Dest=0x5443370, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\*") returned="C:\\Users\\All Users\\Package Cache\\*" [0071.624] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5430018 [0071.624] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\*", lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0082.357] wcscmp (_String1=".", _String2=".") returned 0 [0082.357] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.357] wcscmp (_String1="..", _String2=".") returned 1 [0082.358] wcscmp (_String1="..", _String2="..") returned 0 [0082.358] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", cAlternateFileName="{13A4E~1.210")) returned 1 [0082.358] wcscmp (_String1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", _String2=".") returned 1 [0082.358] wcscmp (_String1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", _String2="..") returned 1 [0082.358] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa6) returned 0x54df6e0 [0082.358] wcscpy (in: _Dest=0x54df6e0, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0082.358] wcscat (in: _Dest=0x54df6e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0082.358] wcscat (in: _Dest=0x54df6e0, _Source="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" [0082.358] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54df6e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d9c [0082.358] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf03b3d5, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1 [0082.358] wcscmp (_String1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", _String2=".") returned 1 [0082.358] wcscmp (_String1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", _String2="..") returned 1 [0082.358] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x90) returned 0x549fd20 [0082.359] wcscpy (in: _Dest=0x549fd20, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0082.359] wcscat (in: _Dest=0x549fd20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0082.359] wcscat (in: _Dest=0x549fd20, _Source="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0082.359] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x549fd20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1db4 [0082.359] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1 [0082.359] wcscmp (_String1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", _String2=".") returned 1 [0082.359] wcscmp (_String1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", _String2="..") returned 1 [0082.359] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa6) returned 0x54dff20 [0082.359] wcscpy (in: _Dest=0x54dff20, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0082.359] wcscat (in: _Dest=0x54dff20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0082.359] wcscat (in: _Dest=0x54dff20, _Source="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" [0082.359] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54dff20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1db8 [0082.360] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd40b2b5b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1 [0082.360] wcscmp (_String1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", _String2=".") returned 1 [0082.360] wcscmp (_String1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", _String2="..") returned 1 [0082.360] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x90) returned 0x549f600 [0082.360] wcscpy (in: _Dest=0x549f600, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0082.360] wcscat (in: _Dest=0x549f600, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0082.360] wcscat (in: _Dest=0x549f600, _Source="{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0082.360] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x549f600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dbc [0082.361] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", cAlternateFileName="{582EA~1.250")) returned 1 [0082.361] wcscmp (_String1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", _String2=".") returned 1 [0082.361] wcscmp (_String1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", _String2="..") returned 1 [0082.361] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa8) returned 0x54df790 [0082.361] wcscpy (in: _Dest=0x54df790, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0082.361] wcscat (in: _Dest=0x54df790, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0082.361] wcscat (in: _Dest=0x54df790, _Source="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" [0082.361] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54df790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dc0 [0082.362] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", cAlternateFileName="{68306~1.250")) returned 1 [0082.362] wcscmp (_String1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", _String2=".") returned 1 [0082.362] wcscmp (_String1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", _String2="..") returned 1 [0082.362] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa8) returned 0x54dfdc0 [0082.362] wcscpy (in: _Dest=0x54dfdc0, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0082.362] wcscat (in: _Dest=0x54dfdc0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0082.362] wcscat (in: _Dest=0x54dfdc0, _Source="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" [0082.362] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54dfdc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dc4 [0082.363] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", cAlternateFileName="{8D4F7~1.250")) returned 1 [0082.363] wcscmp (_String1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", _String2=".") returned 1 [0082.363] wcscmp (_String1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", _String2="..") returned 1 [0082.363] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa8) returned 0x54df630 [0082.363] wcscpy (in: _Dest=0x54df630, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0082.363] wcscat (in: _Dest=0x54df630, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0082.363] wcscat (in: _Dest=0x54df630, _Source="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" [0082.363] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54df630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dc8 [0082.363] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1 [0082.363] wcscmp (_String1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", _String2=".") returned 1 [0082.364] wcscmp (_String1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", _String2="..") returned 1 [0082.364] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa6) returned 0x54df9a0 [0082.364] wcscpy (in: _Dest=0x54df9a0, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0082.364] wcscat (in: _Dest=0x54df9a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0082.364] wcscat (in: _Dest=0x54df9a0, _Source="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" [0082.364] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54df9a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dcc [0082.364] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1 [0082.364] wcscmp (_String1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", _String2=".") returned 1 [0082.364] wcscmp (_String1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", _String2="..") returned 1 [0082.364] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa6) returned 0x54df840 [0082.364] wcscpy (in: _Dest=0x54df840, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0082.364] wcscat (in: _Dest=0x54df840, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0082.364] wcscat (in: _Dest=0x54df840, _Source="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" [0082.365] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54df840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dd0 [0082.365] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1 [0082.365] wcscmp (_String1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", _String2=".") returned 1 [0082.365] wcscmp (_String1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", _String2="..") returned 1 [0082.365] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa6) returned 0x54dfa50 [0082.365] wcscpy (in: _Dest=0x54dfa50, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0082.365] wcscat (in: _Dest=0x54dfa50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0082.365] wcscat (in: _Dest=0x54dfa50, _Source="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" [0082.365] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54dfa50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dd4 [0082.366] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1 [0082.366] wcscmp (_String1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", _String2=".") returned 1 [0082.366] wcscmp (_String1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", _String2="..") returned 1 [0082.366] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa6) returned 0x54dfb00 [0082.366] wcscpy (in: _Dest=0x54dfb00, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0082.366] wcscat (in: _Dest=0x54dfb00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0082.366] wcscat (in: _Dest=0x54dfb00, _Source="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" [0082.366] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54dfb00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dd8 [0082.367] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0a28d82, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1 [0082.367] wcscmp (_String1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", _String2=".") returned 1 [0082.367] wcscmp (_String1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", _String2="..") returned 1 [0082.367] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x90) returned 0x549f4d0 [0082.367] wcscpy (in: _Dest=0x549f4d0, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0082.367] wcscat (in: _Dest=0x549f4d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0082.367] wcscat (in: _Dest=0x549f4d0, _Source="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0082.367] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x549f4d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ddc [0082.368] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", cAlternateFileName="{CF2BE~1.610")) returned 1 [0082.368] wcscmp (_String1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", _String2=".") returned 1 [0082.368] wcscmp (_String1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", _String2="..") returned 1 [0082.368] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa6) returned 0x54dfe70 [0082.368] wcscpy (in: _Dest=0x54dfe70, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0082.368] wcscat (in: _Dest=0x54dfe70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0082.368] wcscat (in: _Dest=0x54dfe70, _Source="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" [0082.368] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54dfe70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1de0 [0082.369] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", cAlternateFileName="{E5127~1.250")) returned 1 [0082.369] wcscmp (_String1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", _String2=".") returned 1 [0082.369] wcscmp (_String1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", _String2="..") returned 1 [0082.369] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa8) returned 0x54df8f0 [0082.369] wcscpy (in: _Dest=0x54df8f0, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0082.369] wcscat (in: _Dest=0x54df8f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0082.369] wcscat (in: _Dest=0x54df8f0, _Source="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" [0082.369] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54df8f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1de4 [0082.370] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc767be9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e52a6842-b0ac-476e-b48f-378a97a67346}", cAlternateFileName="{E52A6~1")) returned 1 [0082.370] wcscmp (_String1="{e52a6842-b0ac-476e-b48f-378a97a67346}", _String2=".") returned 1 [0082.370] wcscmp (_String1="{e52a6842-b0ac-476e-b48f-378a97a67346}", _String2="..") returned 1 [0082.370] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x90) returned 0x549ef78 [0082.370] wcscpy (in: _Dest=0x549ef78, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0082.370] wcscat (in: _Dest=0x549ef78, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0082.370] wcscat (in: _Dest=0x549ef78, _Source="{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" [0082.370] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x549ef78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1de8 [0082.371] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2593ec2, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", cAlternateFileName="{E6E75~1")) returned 1 [0082.371] wcscmp (_String1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", _String2=".") returned 1 [0082.371] wcscmp (_String1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", _String2="..") returned 1 [0082.371] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x90) returned 0x549ebe8 [0082.371] wcscpy (in: _Dest=0x549ebe8, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0082.371] wcscat (in: _Dest=0x549ebe8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0082.371] wcscat (in: _Dest=0x549ebe8, _Source="{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0082.371] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x549ebe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dec [0082.371] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9a674c8, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", cAlternateFileName="{F325F~1")) returned 1 [0082.371] wcscmp (_String1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", _String2=".") returned 1 [0082.371] wcscmp (_String1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", _String2="..") returned 1 [0082.371] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x90) returned 0x549f438 [0082.372] wcscpy (in: _Dest=0x549f438, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0082.372] wcscat (in: _Dest=0x549f438, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0082.372] wcscat (in: _Dest=0x549f438, _Source="{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0082.372] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x549f438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1df0 [0082.372] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 1 [0082.372] wcscmp (_String1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", _String2=".") returned 1 [0082.372] wcscmp (_String1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", _String2="..") returned 1 [0082.372] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa6) returned 0x54dfbb0 [0082.372] wcscpy (in: _Dest=0x54dfbb0, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0082.372] wcscat (in: _Dest=0x54dfbb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0082.372] wcscat (in: _Dest=0x54dfbb0, _Source="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" [0082.372] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54dfbb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1df4 [0082.373] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 0 [0082.376] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0082.389] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5430018) returned 1 [0082.389] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5443370) returned 1 [0082.389] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b3408) returned 1 Thread: id = 162 os_tid = 0x13a8 [0071.624] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x38b2568 [0071.624] wcscpy (in: _Dest=0x38b2568, _Source="C:\\Users\\All Users\\regid.1991-06.com.microsoft" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft" [0071.624] wcscat (in: _Dest=0x38b2568, _Source="\\" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\" [0071.624] wcscat (in: _Dest=0x38b2568, _Source="*" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\*") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\*" [0071.624] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54304e8 [0071.624] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\*", lpFindFileData=0x54304e8 | out: lpFindFileData=0x54304e8*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53fba98c, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ee80 [0076.242] wcscmp (_String1=".", _String2=".") returned 0 [0076.242] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54304e8 | out: lpFindFileData=0x54304e8*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53fba98c, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.280] wcscmp (_String1="..", _String2=".") returned 1 [0081.280] wcscmp (_String1="..", _String2="..") returned 0 [0081.280] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54304e8 | out: lpFindFileData=0x54304e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1446700, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0x4af5600b, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf1446700, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x430, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", cAlternateFileName="REGID1~3.SWI")) returned 1 [0081.280] wcscmp (_String1="regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", _String2=".") returned 1 [0081.280] wcscmp (_String1="regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", _String2="..") returned 1 [0081.280] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x104) Thread: id = 163 os_tid = 0x1390 [0071.625] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x543d638 [0071.625] wcscpy (in: _Dest=0x543d638, _Source="C:\\Users\\All Users\\SoftwareDistribution" | out: _Dest="C:\\Users\\All Users\\SoftwareDistribution") returned="C:\\Users\\All Users\\SoftwareDistribution" [0071.625] wcscat (in: _Dest=0x543d638, _Source="\\" | out: _Dest="C:\\Users\\All Users\\SoftwareDistribution\\") returned="C:\\Users\\All Users\\SoftwareDistribution\\" [0071.625] wcscat (in: _Dest=0x543d638, _Source="*" | out: _Dest="C:\\Users\\All Users\\SoftwareDistribution\\*") returned="C:\\Users\\All Users\\SoftwareDistribution\\*" [0071.625] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5430750 [0071.625] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\SoftwareDistribution\\*", lpFindFileData=0x5430750 | out: lpFindFileData=0x5430750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f080 [0075.051] wcscmp (_String1=".", _String2=".") returned 0 [0075.051] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5430750 | out: lpFindFileData=0x5430750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.052] wcscmp (_String1="..", _String2=".") returned 1 [0075.052] wcscmp (_String1="..", _String2="..") returned 0 [0075.052] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x5430750 | out: lpFindFileData=0x5430750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.052] FindClose (in: hFindFile=0x389f080 | out: hFindFile=0x389f080) returned 1 [0075.052] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5430750) returned 1 [0075.052] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x543d638) returned 1 [0075.052] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541b410) returned 1 Thread: id = 164 os_tid = 0x1388 [0071.625] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x537b7a0 [0071.625] wcscpy (in: _Dest=0x537b7a0, _Source="C:\\Users\\All Users\\Start Menu" | out: _Dest="C:\\Users\\All Users\\Start Menu") returned="C:\\Users\\All Users\\Start Menu" [0071.625] wcscat (in: _Dest=0x537b7a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Start Menu\\") returned="C:\\Users\\All Users\\Start Menu\\" [0071.625] wcscat (in: _Dest=0x537b7a0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Start Menu\\*") returned="C:\\Users\\All Users\\Start Menu\\*" [0071.625] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5430c20 [0071.625] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Start Menu\\*", lpFindFileData=0x5430c20 | out: lpFindFileData=0x5430c20*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.621] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5430c20) returned 1 [0074.621] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b7a0) returned 1 [0074.621] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b128) returned 1 Thread: id = 165 os_tid = 0x758 [0071.625] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3e) returned 0x537b7e8 [0071.626] wcscpy (in: _Dest=0x537b7e8, _Source="C:\\Users\\All Users\\Templates" | out: _Dest="C:\\Users\\All Users\\Templates") returned="C:\\Users\\All Users\\Templates" [0071.626] wcscat (in: _Dest=0x537b7e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Templates\\") returned="C:\\Users\\All Users\\Templates\\" [0071.626] wcscat (in: _Dest=0x537b7e8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Templates\\*") returned="C:\\Users\\All Users\\Templates\\*" [0071.626] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5430e88 [0071.626] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Templates\\*", lpFindFileData=0x5430e88 | out: lpFindFileData=0x5430e88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.621] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5430e88) returned 1 [0074.621] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b7e8) returned 1 [0074.621] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b0e0) returned 1 Thread: id = 166 os_tid = 0x7dc [0071.626] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x537b830 [0071.626] wcscpy (in: _Dest=0x537b830, _Source="C:\\Users\\All Users\\USOPrivate" | out: _Dest="C:\\Users\\All Users\\USOPrivate") returned="C:\\Users\\All Users\\USOPrivate" [0071.626] wcscat (in: _Dest=0x537b830, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOPrivate\\") returned="C:\\Users\\All Users\\USOPrivate\\" [0071.626] wcscat (in: _Dest=0x537b830, _Source="*" | out: _Dest="C:\\Users\\All Users\\USOPrivate\\*") returned="C:\\Users\\All Users\\USOPrivate\\*" [0071.626] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54065c0 [0071.626] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\USOPrivate\\*", lpFindFileData=0x54065c0 | out: lpFindFileData=0x54065c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1931975, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f000 [0075.050] wcscmp (_String1=".", _String2=".") returned 0 [0075.051] FindNextFileW (in: hFindFile=0x389f000, lpFindFileData=0x54065c0 | out: lpFindFileData=0x54065c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1931975, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.051] wcscmp (_String1="..", _String2=".") returned 1 [0075.051] wcscmp (_String1="..", _String2="..") returned 0 [0075.051] FindNextFileW (in: hFindFile=0x389f000, lpFindFileData=0x54065c0 | out: lpFindFileData=0x54065c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x91f4ffc6, ftLastAccessTime.dwHighDateTime=0x1d5d815, ftLastWriteTime.dwLowDateTime=0x91f4ffc6, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateStore", cAlternateFileName="UPDATE~1")) returned 1 [0075.051] wcscmp (_String1="UpdateStore", _String2=".") returned 1 [0075.051] wcscmp (_String1="UpdateStore", _String2="..") returned 1 [0075.051] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x38b6008 [0075.051] wcscpy (in: _Dest=0x38b6008, _Source="C:\\Users\\All Users\\USOPrivate" | out: _Dest="C:\\Users\\All Users\\USOPrivate") returned="C:\\Users\\All Users\\USOPrivate" [0075.051] wcscat (in: _Dest=0x38b6008, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOPrivate\\") returned="C:\\Users\\All Users\\USOPrivate\\" [0075.051] wcscat (in: _Dest=0x38b6008, _Source="UpdateStore" | out: _Dest="C:\\Users\\All Users\\USOPrivate\\UpdateStore") returned="C:\\Users\\All Users\\USOPrivate\\UpdateStore" [0081.150] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b6008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc4c [0081.150] FindNextFileW (in: hFindFile=0x389f000, lpFindFileData=0x54065c0 | out: lpFindFileData=0x54065c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x91f4ffc6, ftLastAccessTime.dwHighDateTime=0x1d5d815, ftLastWriteTime.dwLowDateTime=0x91f4ffc6, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateStore", cAlternateFileName="UPDATE~1")) returned 0 [0081.151] FindClose (in: hFindFile=0x389f000 | out: hFindFile=0x389f000) returned 1 [0081.556] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54065c0) returned 1 [0081.556] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b830) returned 1 [0081.557] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b098) returned 1 Thread: id = 167 os_tid = 0x1364 [0071.627] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3e) returned 0x537b878 [0071.627] wcscpy (in: _Dest=0x537b878, _Source="C:\\Users\\All Users\\USOShared" | out: _Dest="C:\\Users\\All Users\\USOShared") returned="C:\\Users\\All Users\\USOShared" [0071.627] wcscat (in: _Dest=0x537b878, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\") returned="C:\\Users\\All Users\\USOShared\\" [0071.627] wcscat (in: _Dest=0x537b878, _Source="*" | out: _Dest="C:\\Users\\All Users\\USOShared\\*") returned="C:\\Users\\All Users\\USOShared\\*" [0071.627] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5406828 [0071.627] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\USOShared\\*", lpFindFileData=0x5406828 | out: lpFindFileData=0x5406828*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389efc0 [0075.050] wcscmp (_String1=".", _String2=".") returned 0 [0075.050] FindNextFileW (in: hFindFile=0x389efc0, lpFindFileData=0x5406828 | out: lpFindFileData=0x5406828*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.050] wcscmp (_String1="..", _String2=".") returned 1 [0075.050] wcscmp (_String1="..", _String2="..") returned 0 [0075.050] FindNextFileW (in: hFindFile=0x389efc0, lpFindFileData=0x5406828 | out: lpFindFileData=0x5406828*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa872976f, ftLastAccessTime.dwHighDateTime=0x1d5e1e4, ftLastWriteTime.dwLowDateTime=0xa872976f, ftLastWriteTime.dwHighDateTime=0x1d5e1e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0075.050] wcscmp (_String1="Logs", _String2=".") returned 1 [0075.050] wcscmp (_String1="Logs", _String2="..") returned 1 [0075.050] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x3940418 [0075.050] wcscpy (in: _Dest=0x3940418, _Source="C:\\Users\\All Users\\USOShared" | out: _Dest="C:\\Users\\All Users\\USOShared") returned="C:\\Users\\All Users\\USOShared" [0075.050] wcscat (in: _Dest=0x3940418, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\") returned="C:\\Users\\All Users\\USOShared\\" [0075.050] wcscat (in: _Dest=0x3940418, _Source="Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0081.148] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3940418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc48 [0081.149] FindNextFileW (in: hFindFile=0x389efc0, lpFindFileData=0x5406828 | out: lpFindFileData=0x5406828*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa872976f, ftLastAccessTime.dwHighDateTime=0x1d5e1e4, ftLastWriteTime.dwLowDateTime=0xa872976f, ftLastWriteTime.dwHighDateTime=0x1d5e1e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 0 [0081.149] FindClose (in: hFindFile=0x389efc0 | out: hFindFile=0x389efc0) returned 1 [0081.149] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5406828) returned 1 [0081.149] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b878) returned 1 [0081.149] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b440) returned 1 Thread: id = 168 os_tid = 0x136c [0071.627] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x541ae70 [0071.627] wcscpy (in: _Dest=0x541ae70, _Source="C:\\Users\\All Users\\WindowsHolographicDevices" | out: _Dest="C:\\Users\\All Users\\WindowsHolographicDevices") returned="C:\\Users\\All Users\\WindowsHolographicDevices" [0071.627] wcscat (in: _Dest=0x541ae70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\WindowsHolographicDevices\\") returned="C:\\Users\\All Users\\WindowsHolographicDevices\\" [0071.627] wcscat (in: _Dest=0x541ae70, _Source="*" | out: _Dest="C:\\Users\\All Users\\WindowsHolographicDevices\\*") returned="C:\\Users\\All Users\\WindowsHolographicDevices\\*" [0071.627] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5406a90 [0071.627] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\WindowsHolographicDevices\\*", lpFindFileData=0x5406a90 | out: lpFindFileData=0x5406a90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7567248 [0086.998] wcscmp (_String1=".", _String2=".") returned 0 [0086.998] FindNextFileW (hFindFile=0x7567248, lpFindFileData=0x5406a90) Thread: id = 169 os_tid = 0x1370 [0071.628] GetFileAttributesW (lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag")) returned 0x20 [0075.510] SetFileAttributesW (lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", dwFileAttributes=0x20) returned 1 [0075.511] CreateFileW (lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xcf0 [0075.511] GetFileSizeEx (in: hFile=0xcf0, lpFileSize=0x9fefd00 | out: lpFileSize=0x9fefd00*=1072) returned 1 [0075.511] SetFilePointerEx (in: hFile=0xcf0, liDistanceToMove=0x42c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.511] ReadFile (in: hFile=0xcf0, lpBuffer=0x9fefc84, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9fefc80, lpOverlapped=0x0 | out: lpBuffer=0x9fefc84*, lpNumberOfBytesRead=0x9fefc80*=0x4, lpOverlapped=0x0) returned 1 [0075.512] SetFilePointerEx (in: hFile=0xcf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.512] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5260 [0075.512] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5170 [0075.512] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4e50 [0075.513] NtQuerySystemTime (in: CurrentTime=0x9fefc60 | out: CurrentTime=0x9fefc60*=132260136326679088) returned 0x0 [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0x1875605f [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0xd6f6fc06 [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0x5f093f23 [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0xbf914cbe [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0x7eb87c0b [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0xd6328250 [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0xfb63a036 [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0xfd4eaf9d [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0x665b43a9 [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0x5047a8c [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0xb5082dc3 [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0x6071a483 [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0xe2e0c1ea [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0xf6ec4aa3 [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0xe3cc06ae [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0xc162b258 [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0xd79ed69c [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0x11b16fb7 [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0xf66b8ef2 [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0x75c4813 [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0x7dc3cca1 [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0xcc91751a [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0x8fa1adf3 [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0x6d1f0a34 [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0x6d4361dc [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0x40f3dd8e [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0xa5a115d2 [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0xbb6f2f30 [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0x6c3d5b9c [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0x52d8161e [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0x3797a7e0 [0075.513] RtlRandom (in: Seed=0x9fefc6c | out: Seed=0x9fefc6c) returned 0xc48dc549 [0075.528] ReadFile (in: hFile=0xcf0, lpBuffer=0x54a4fe8, nNumberOfBytesToRead=0x430, lpNumberOfBytesRead=0x9fefc5c, lpOverlapped=0x0 | out: lpBuffer=0x54a4fe8*, lpNumberOfBytesRead=0x9fefc5c*=0x430, lpOverlapped=0x0) returned 1 [0075.528] SetFilePointerEx (in: hFile=0xcf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.528] WriteFile (in: hFile=0xcf0, lpBuffer=0x54b17f0*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x9fefc58, lpOverlapped=0x0 | out: lpBuffer=0x54b17f0*, lpNumberOfBytesWritten=0x9fefc58*=0x430, lpOverlapped=0x0) returned 1 [0075.529] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5198 [0075.529] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5058 [0075.530] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5058) returned 1 [0075.530] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b17f0) returned 1 [0075.530] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a4fe8) returned 1 [0075.530] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5467ad0) returned 1 [0075.530] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a60b8) returned 1 [0075.530] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb1) returned 0x3904ea0 [0075.530] SetFilePointerEx (in: hFile=0xcf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.530] WriteFile (in: hFile=0xcf0, lpBuffer=0x3979680*, nNumberOfBytesToWrite=0x195, lpNumberOfBytesWritten=0x9fefcc0, lpOverlapped=0x0 | out: lpBuffer=0x3979680*, lpNumberOfBytesWritten=0x9fefcc0*=0x195, lpOverlapped=0x0) returned 1 [0075.531] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3979680) returned 1 [0075.531] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3905b60) returned 1 [0075.531] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5058) returned 1 [0075.531] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3904ea0) returned 1 [0075.531] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5198) returned 1 [0075.531] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5170) returned 1 [0075.531] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a50f8) returned 1 [0075.531] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4fe0) returned 1 [0075.531] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x13c) returned 0x3979680 [0075.531] wcscpy (in: _Dest=0x3979680, _Source="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag" | out: _Dest="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag") returned="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag" [0075.532] wcscat (in: _Dest=0x3979680, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.mailto[knoocknoo@cock.li].a0a70") returned="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.mailto[knoocknoo@cock.li].a0a70" [0075.532] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x9fefc78, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0075.532] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x152) returned 0x3979918 [0088.155] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3979918) Thread: id = 170 os_tid = 0x1380 [0071.632] GetFileAttributesW (lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag")) returned 0x20 [0077.110] SetFileAttributesW (lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", dwFileAttributes=0x20) returned 1 [0088.143] CreateFileW (lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2218 [0088.144] GetFileSizeEx (in: hFile=0x2218, lpFileSize=0xa06feb0 | out: lpFileSize=0xa06feb0*=1068) returned 1 [0088.144] SetFilePointerEx (in: hFile=0x2218, liDistanceToMove=0x428, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.144] ReadFile (in: hFile=0x2218, lpBuffer=0xa06fe34, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa06fe30, lpOverlapped=0x0 | out: lpBuffer=0xa06fe34*, lpNumberOfBytesRead=0xa06fe30*=0x4, lpOverlapped=0x0) returned 1 [0088.145] SetFilePointerEx (in: hFile=0x2218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.145] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032f40 [0088.145] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032310 [0088.145] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032928 [0088.145] NtQuerySystemTime (in: CurrentTime=0xa06fe10 | out: CurrentTime=0xa06fe10*=132260136453056208) returned 0x0 [0088.145] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0x82613345 [0088.145] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0xd041f61e [0088.145] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0xea1b27e7 [0088.145] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0x390574ee [0088.145] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0xe3d8e07 [0088.145] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0x482e4fd3 [0088.145] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0xffa7d7b8 [0088.145] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0xa5ed82ad [0088.145] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0x7d8b6ebc [0088.145] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0x9d844768 [0088.145] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0x217b41b1 [0088.145] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0xa69d8b73 [0088.145] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0x34e8bd3e [0088.146] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0x7ea5ac38 [0088.146] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0x9b1e85be [0088.146] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0x9850903 [0088.146] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0xc68f20cb [0088.146] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0xd6387152 [0088.146] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0x46d20d24 [0088.146] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0x977723cb [0088.146] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0xb9f358e8 [0088.146] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0x3b6a7d12 [0088.146] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0x544e071f [0088.146] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0x62e6a09f [0088.146] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0xc224b7b5 [0088.146] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0x139f5116 [0088.146] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0x30c5b216 [0088.146] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0x20c70f5b [0088.146] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0x173393a1 [0088.146] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0xfbbd1b65 [0088.146] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0x732f332f [0088.146] RtlRandom (in: Seed=0xa06fe1c | out: Seed=0xa06fe1c) returned 0x74132862 Thread: id = 171 os_tid = 0x1368 [0071.634] GetFileAttributesW (lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag")) returned 0x20 [0077.324] SetFileAttributesW (lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", dwFileAttributes=0x20) returned 1 [0088.116] CreateFileW (lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2210 [0088.116] GetFileSizeEx (in: hFile=0x2210, lpFileSize=0xa0ef8b8 | out: lpFileSize=0xa0ef8b8*=1071) returned 1 [0088.116] SetFilePointerEx (in: hFile=0x2210, liDistanceToMove=0x42b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.116] ReadFile (in: hFile=0x2210, lpBuffer=0xa0ef83c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa0ef838, lpOverlapped=0x0 | out: lpBuffer=0xa0ef83c*, lpNumberOfBytesRead=0xa0ef838*=0x4, lpOverlapped=0x0) returned 1 [0088.118] SetFilePointerEx (in: hFile=0x2210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.118] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032f40 [0088.118] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032220 [0088.118] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032298 [0088.118] NtQuerySystemTime (in: CurrentTime=0xa0ef818 | out: CurrentTime=0xa0ef818*=132260136452844359) returned 0x0 [0088.118] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0xb74f3693 [0088.118] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0x905fbb98 [0088.118] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0xd99ca764 [0088.118] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0xe99f09ee [0088.118] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0x2678a79e [0088.118] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0xd2de5154 [0088.118] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0x1092eef5 [0088.118] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0xc3553c4 [0088.118] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0xdad6f411 [0088.118] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0x769b4128 [0088.118] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0x33c06b37 [0088.119] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0xba3dbe4 [0088.119] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0x71c6bb3 [0088.119] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0x13716a1b [0088.119] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0xd4e2722 [0088.119] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0x3018e1c4 [0088.119] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0x9dce9370 [0088.119] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0xac0146be [0088.119] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0x995a6255 [0088.119] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0x1acdc81f [0088.119] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0xbcef8474 [0088.119] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0x1e49b86d [0088.119] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0x9ecb14dc [0088.119] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0x470f5f9f [0088.119] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0x1c7f1ab5 [0088.119] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0x90f9e1a5 [0088.119] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0xf4663be7 [0088.119] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0x79457a27 [0088.119] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0x58f3ae8c [0088.119] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0x8633a83b [0088.119] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0x3ce3a3ff [0088.119] RtlRandom (in: Seed=0xa0ef824 | out: Seed=0xa0ef824) returned 0x26dd8323 Thread: id = 172 os_tid = 0x1360 [0071.634] GetFileAttributesW (lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_windows-10-pro.swidtag")) returned 0x20 [0077.159] SetFileAttributesW (lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", dwFileAttributes=0x20) returned 1 [0088.129] CreateFileW (lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_windows-10-pro.swidtag"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2214 [0088.129] GetFileSizeEx (in: hFile=0x2214, lpFileSize=0xa16f884 | out: lpFileSize=0xa16f884*=997) returned 1 [0088.129] SetFilePointerEx (in: hFile=0x2214, liDistanceToMove=0x3e1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.130] ReadFile (in: hFile=0x2214, lpBuffer=0xa16f808, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa16f804, lpOverlapped=0x0 | out: lpBuffer=0xa16f808*, lpNumberOfBytesRead=0xa16f804*=0x4, lpOverlapped=0x0) returned 1 [0088.131] SetFilePointerEx (in: hFile=0x2214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.131] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032f40 [0088.131] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032298 [0088.131] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032310 [0088.131] NtQuerySystemTime (in: CurrentTime=0xa16f7e4 | out: CurrentTime=0xa16f7e4*=132260136452899307) returned 0x0 [0088.131] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0xd9ed4d85 [0088.131] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0xd1c4b69f [0088.131] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0x8e62f92 [0088.131] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0x8cfda3b6 [0088.131] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0xe74ce1ca [0088.131] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0xae55b70c [0088.131] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0x6b31e131 [0088.131] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0xb27d98b4 [0088.131] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0xf1ead295 [0088.131] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0x3727c323 [0088.131] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0x1156ce5 [0088.131] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0x84e24692 [0088.131] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0x8ade9b9b [0088.131] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0xfff77c7d [0088.131] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0xe129b348 [0088.131] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0xffcb7e4c [0088.131] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0x82848414 [0088.131] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0xd3d9d0b4 [0088.131] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0xc8e98e20 [0088.132] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0xa49aaea8 [0088.132] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0x64872fa1 [0088.132] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0xd3d1f258 [0088.132] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0xa46cee98 [0088.132] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0x76f8866f [0088.132] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0x4dfbd2b6 [0088.132] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0xe2f40784 [0088.132] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0x87c293eb [0088.132] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0x952866b8 [0088.132] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0xcaea4ae3 [0088.132] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0xed1cc9b2 [0088.132] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0x947b0569 [0088.132] RtlRandom (in: Seed=0xa16f7f0 | out: Seed=0xa16f7f0) returned 0x462dbc2c Thread: id = 173 os_tid = 0x908 [0071.635] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x537b488 [0071.635] wcscpy (in: _Dest=0x537b488, _Source="C:\\ProgramData\\USOShared\\Logs" | out: _Dest="C:\\ProgramData\\USOShared\\Logs") returned="C:\\ProgramData\\USOShared\\Logs" [0071.635] wcscat (in: _Dest=0x537b488, _Source="\\" | out: _Dest="C:\\ProgramData\\USOShared\\Logs\\") returned="C:\\ProgramData\\USOShared\\Logs\\" [0071.635] wcscat (in: _Dest=0x537b488, _Source="*" | out: _Dest="C:\\ProgramData\\USOShared\\Logs\\*") returned="C:\\ProgramData\\USOShared\\Logs\\*" [0071.635] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5406cf8 [0071.635] FindFirstFileW (in: lpFileName="C:\\ProgramData\\USOShared\\Logs\\*", lpFindFileData=0x5406cf8 | out: lpFindFileData=0x5406cf8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa872976f, ftLastAccessTime.dwHighDateTime=0x1d5e1e4, ftLastWriteTime.dwLowDateTime=0xa872976f, ftLastWriteTime.dwHighDateTime=0x1d5e1e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f100 [0075.058] wcscmp (_String1=".", _String2=".") returned 0 [0075.058] FindNextFileW (in: hFindFile=0x389f100, lpFindFileData=0x5406cf8 | out: lpFindFileData=0x5406cf8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa872976f, ftLastAccessTime.dwHighDateTime=0x1d5e1e4, ftLastWriteTime.dwLowDateTime=0xa872976f, ftLastWriteTime.dwHighDateTime=0x1d5e1e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.059] wcscmp (_String1="..", _String2=".") returned 1 [0075.059] wcscmp (_String1="..", _String2="..") returned 0 [0075.059] FindNextFileW (in: hFindFile=0x389f100, lpFindFileData=0x5406cf8 | out: lpFindFileData=0x5406cf8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cf76e0, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x58d51fd9, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x597705f5, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUx.001.etl", cAlternateFileName="NOBE5B~1.ETL")) returned 1 [0075.059] wcscmp (_String1="NotificationUx.001.etl", _String2=".") returned 1 [0075.059] wcscmp (_String1="NotificationUx.001.etl", _String2="..") returned 1 [0075.059] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6a) returned 0x5467968 [0075.059] wcscpy (in: _Dest=0x5467968, _Source="C:\\ProgramData\\USOShared\\Logs" | out: _Dest="C:\\ProgramData\\USOShared\\Logs") returned="C:\\ProgramData\\USOShared\\Logs" [0075.059] wcscat (in: _Dest=0x5467968, _Source="\\" | out: _Dest="C:\\ProgramData\\USOShared\\Logs\\") returned="C:\\ProgramData\\USOShared\\Logs\\" [0075.059] wcscat (in: _Dest=0x5467968, _Source="NotificationUx.001.etl" | out: _Dest="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.001.etl") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.001.etl" [0081.169] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5467968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc58 [0081.169] FindNextFileW (in: hFindFile=0x389f100, lpFindFileData=0x5406cf8 | out: lpFindFileData=0x5406cf8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cf76e0, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x7cf76e0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x852e502, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUx.002.etl", cAlternateFileName="NOTIFI~2.ETL")) returned 1 [0081.169] wcscmp (_String1="NotificationUx.002.etl", _String2=".") returned 1 [0081.169] wcscmp (_String1="NotificationUx.002.etl", _String2="..") returned 1 [0081.169] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6a) returned 0x766d910 [0091.755] wcscpy (in: _Dest=0x766d910, _Source="C:\\ProgramData\\USOShared\\Logs" | out: _Dest="C:\\ProgramData\\USOShared\\Logs") returned="C:\\ProgramData\\USOShared\\Logs" [0091.755] wcscat (in: _Dest=0x766d910, _Source="\\" | out: _Dest="C:\\ProgramData\\USOShared\\Logs\\") returned="C:\\ProgramData\\USOShared\\Logs\\" [0091.755] wcscat (in: _Dest=0x766d910, _Source="NotificationUx.002.etl" | out: _Dest="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.002.etl") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.002.etl" Thread: id = 174 os_tid = 0x98c [0071.635] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x5428920 [0071.636] wcscpy (in: _Dest=0x5428920, _Source="C:\\ProgramData\\USOPrivate\\UpdateStore" | out: _Dest="C:\\ProgramData\\USOPrivate\\UpdateStore") returned="C:\\ProgramData\\USOPrivate\\UpdateStore" [0071.636] wcscat (in: _Dest=0x5428920, _Source="\\" | out: _Dest="C:\\ProgramData\\USOPrivate\\UpdateStore\\") returned="C:\\ProgramData\\USOPrivate\\UpdateStore\\" [0071.636] wcscat (in: _Dest=0x5428920, _Source="*" | out: _Dest="C:\\ProgramData\\USOPrivate\\UpdateStore\\*") returned="C:\\ProgramData\\USOPrivate\\UpdateStore\\*" [0071.636] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5407430 [0071.636] FindFirstFileW (in: lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\*", lpFindFileData=0x5407430 | out: lpFindFileData=0x5407430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x91f4ffc6, ftLastAccessTime.dwHighDateTime=0x1d5d815, ftLastWriteTime.dwLowDateTime=0x91f4ffc6, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445780 [0071.767] wcscmp (_String1=".", _String2=".") returned 0 [0071.767] FindNextFileW (in: hFindFile=0x5445780, lpFindFileData=0x5407430 | out: lpFindFileData=0x5407430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x91f4ffc6, ftLastAccessTime.dwHighDateTime=0x1d5d815, ftLastWriteTime.dwLowDateTime=0x91f4ffc6, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.767] wcscmp (_String1="..", _String2=".") returned 1 [0071.767] wcscmp (_String1="..", _String2="..") returned 0 [0071.767] FindNextFileW (in: hFindFile=0x5445780, lpFindFileData=0x5407430 | out: lpFindFileData=0x5407430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc9086d4, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xdc9086d4, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xdc9086d4, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateCspStore.xml", cAlternateFileName="UPDATE~2.XML")) returned 1 [0071.767] wcscmp (_String1="UpdateCspStore.xml", _String2=".") returned 1 [0071.767] wcscmp (_String1="UpdateCspStore.xml", _String2="..") returned 1 [0071.767] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x72) returned 0x3890820 [0071.767] wcscpy (in: _Dest=0x3890820, _Source="C:\\ProgramData\\USOPrivate\\UpdateStore" | out: _Dest="C:\\ProgramData\\USOPrivate\\UpdateStore") returned="C:\\ProgramData\\USOPrivate\\UpdateStore" [0071.767] wcscat (in: _Dest=0x3890820, _Source="\\" | out: _Dest="C:\\ProgramData\\USOPrivate\\UpdateStore\\") returned="C:\\ProgramData\\USOPrivate\\UpdateStore\\" [0071.768] wcscat (in: _Dest=0x3890820, _Source="UpdateCspStore.xml" | out: _Dest="C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml") returned="C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml" [0071.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3890820, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x390 [0071.768] FindNextFileW (in: hFindFile=0x5445780, lpFindFileData=0x5407430 | out: lpFindFileData=0x5407430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1957bdd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x91edd636, ftLastAccessTime.dwHighDateTime=0x1d5d815, ftLastWriteTime.dwLowDateTime=0x91f4ffc6, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", cAlternateFileName="UPDATE~1.XML")) returned 1 [0071.768] wcscmp (_String1="updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", _String2=".") returned 1 [0071.768] wcscmp (_String1="updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", _String2="..") returned 1 [0071.768] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb4) returned 0x53fe008 [0071.768] wcscpy (in: _Dest=0x53fe008, _Source="C:\\ProgramData\\USOPrivate\\UpdateStore" | out: _Dest="C:\\ProgramData\\USOPrivate\\UpdateStore") returned="C:\\ProgramData\\USOPrivate\\UpdateStore" [0071.768] wcscat (in: _Dest=0x53fe008, _Source="\\" | out: _Dest="C:\\ProgramData\\USOPrivate\\UpdateStore\\") returned="C:\\ProgramData\\USOPrivate\\UpdateStore\\" [0071.768] wcscat (in: _Dest=0x53fe008, _Source="updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" | out: _Dest="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml") returned="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" [0071.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53fe008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x348 [0071.769] FindNextFileW (in: hFindFile=0x5445780, lpFindFileData=0x5407430 | out: lpFindFileData=0x5407430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1957bdd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x91edd636, ftLastAccessTime.dwHighDateTime=0x1d5d815, ftLastWriteTime.dwLowDateTime=0x91f4ffc6, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", cAlternateFileName="UPDATE~1.XML")) returned 0 [0071.769] FindClose (in: hFindFile=0x5445780 | out: hFindFile=0x5445780) returned 1 [0071.770] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5407430) returned 1 [0071.771] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5428920) returned 1 [0071.771] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541b780) returned 1 Thread: id = 175 os_tid = 0x9b4 [0071.636] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa2) returned 0x388e8b0 [0071.636] wcscpy (in: _Dest=0x388e8b0, _Source="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" [0071.636] wcscat (in: _Dest=0x388e8b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\" [0071.636] wcscat (in: _Dest=0x388e8b0, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*" [0071.636] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5407b68 [0071.636] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*", lpFindFileData=0x5407b68 | out: lpFindFileData=0x5407b68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445780 [0077.156] wcscmp (_String1=".", _String2=".") returned 0 [0077.156] FindNextFileW (in: hFindFile=0x5445780, lpFindFileData=0x5407b68 | out: lpFindFileData=0x5407b68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.156] wcscmp (_String1="..", _String2=".") returned 1 [0077.156] wcscmp (_String1="..", _String2="..") returned 0 [0077.156] FindNextFileW (in: hFindFile=0x5445780, lpFindFileData=0x5407b68 | out: lpFindFileData=0x5407b68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0077.156] wcscmp (_String1="packages", _String2=".") returned 1 [0077.156] wcscmp (_String1="packages", _String2="..") returned 1 [0077.156] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x38a2050 [0077.156] wcscpy (in: _Dest=0x38a2050, _Source="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" [0077.156] wcscat (in: _Dest=0x38a2050, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\" [0077.156] wcscat (in: _Dest=0x38a2050, _Source="packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages" [0080.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a2050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120c [0080.971] FindNextFileW (in: hFindFile=0x5445780, lpFindFileData=0x5407b68 | out: lpFindFileData=0x5407b68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0080.971] FindClose (in: hFindFile=0x5445780 | out: hFindFile=0x5445780) returned 1 [0080.971] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5407b68) returned 1 [0080.971] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388e8b0) returned 1 [0080.971] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ac2f8) returned 1 Thread: id = 176 os_tid = 0x1108 [0071.639] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8c) returned 0x38a7790 [0071.639] wcscpy (in: _Dest=0x38a7790, _Source="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: _Dest="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0071.639] wcscat (in: _Dest=0x38a7790, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\") returned="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\" [0071.639] wcscat (in: _Dest=0x38a7790, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*") returned="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*" [0071.639] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5407dd0 [0071.639] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*", lpFindFileData=0x5407dd0 | out: lpFindFileData=0x5407dd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf03b3d5, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0082.390] wcscmp (_String1=".", _String2=".") returned 0 [0082.390] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5407dd0 | out: lpFindFileData=0x5407dd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf03b3d5, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.390] wcscmp (_String1="..", _String2=".") returned 1 [0082.390] wcscmp (_String1="..", _String2="..") returned 0 [0082.390] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5407dd0 | out: lpFindFileData=0x5407dd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x354d9570, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0082.390] wcscmp (_String1="state.rsm", _String2=".") returned 1 [0082.390] wcscmp (_String1="state.rsm", _String2="..") returned 1 [0082.390] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9c) returned 0x54a2250 [0082.390] wcscpy (in: _Dest=0x54a2250, _Source="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: _Dest="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0082.390] wcscat (in: _Dest=0x54a2250, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\") returned="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\" [0082.390] wcscat (in: _Dest=0x54a2250, _Source="state.rsm" | out: _Dest="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm") returned="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" [0082.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54a2250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e0c [0082.391] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5407dd0 | out: lpFindFileData=0x5407dd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xcef30371, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0082.391] wcscmp (_String1="vcredist_x86.exe", _String2=".") returned 1 [0082.391] wcscmp (_String1="vcredist_x86.exe", _String2="..") returned 1 [0082.391] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5407dd0 | out: lpFindFileData=0x5407dd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xcef30371, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0082.391] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0082.391] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5407dd0) returned 1 [0082.391] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a7790) returned 1 [0082.391] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a9718) returned 1 Thread: id = 177 os_tid = 0x72c [0071.640] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa2) returned 0x388e960 [0071.640] wcscpy (in: _Dest=0x388e960, _Source="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" [0071.640] wcscat (in: _Dest=0x388e960, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\" [0071.640] wcscat (in: _Dest=0x388e960, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*" [0071.640] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5408038 [0071.640] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*", lpFindFileData=0x5408038 | out: lpFindFileData=0x5408038*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445540 [0077.223] wcscmp (_String1=".", _String2=".") returned 0 [0077.223] FindNextFileW (in: hFindFile=0x5445540, lpFindFileData=0x5408038 | out: lpFindFileData=0x5408038*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.223] wcscmp (_String1="..", _String2=".") returned 1 [0077.223] wcscmp (_String1="..", _String2="..") returned 0 [0077.223] FindNextFileW (in: hFindFile=0x5445540, lpFindFileData=0x5408038 | out: lpFindFileData=0x5408038*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0077.223] wcscmp (_String1="packages", _String2=".") returned 1 [0077.223] wcscmp (_String1="packages", _String2="..") returned 1 [0077.223] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x38a2108 [0077.223] wcscpy (in: _Dest=0x38a2108, _Source="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" [0077.223] wcscat (in: _Dest=0x38a2108, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\" [0077.223] wcscat (in: _Dest=0x38a2108, _Source="packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages" [0080.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a2108, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1234 [0080.938] FindNextFileW (in: hFindFile=0x5445540, lpFindFileData=0x5408038 | out: lpFindFileData=0x5408038*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0080.938] FindClose (in: hFindFile=0x5445540 | out: hFindFile=0x5445540) returned 1 [0080.938] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5408038) returned 1 [0080.938] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388e960) returned 1 [0080.938] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ac3a0) returned 1 Thread: id = 178 os_tid = 0xe90 [0071.712] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8c) returned 0x38a7958 [0071.712] wcscpy (in: _Dest=0x38a7958, _Source="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: _Dest="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0071.712] wcscat (in: _Dest=0x38a7958, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\") returned="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\" [0071.712] wcscat (in: _Dest=0x38a7958, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*") returned="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*" [0071.712] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54082a0 [0071.712] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*", lpFindFileData=0x54082a0 | out: lpFindFileData=0x54082a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd40b2b5b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0082.355] wcscmp (_String1=".", _String2=".") returned 0 [0082.355] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x54082a0 | out: lpFindFileData=0x54082a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd40b2b5b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.355] wcscmp (_String1="..", _String2=".") returned 1 [0082.355] wcscmp (_String1="..", _String2="..") returned 0 [0082.355] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x54082a0 | out: lpFindFileData=0x54082a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd40b2b5b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd40b2b5b, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x3639a1f2, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0082.355] wcscmp (_String1="state.rsm", _String2=".") returned 1 [0082.355] wcscmp (_String1="state.rsm", _String2="..") returned 1 [0082.355] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9c) returned 0x54a21a8 [0082.355] wcscpy (in: _Dest=0x54a21a8, _Source="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: _Dest="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0082.355] wcscat (in: _Dest=0x54a21a8, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\") returned="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\" [0082.355] wcscat (in: _Dest=0x54a21a8, _Source="state.rsm" | out: _Dest="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm") returned="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" [0082.355] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54a21a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1db0 [0082.356] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x54082a0 | out: lpFindFileData=0x54082a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd408c921, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd4040448, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0082.356] wcscmp (_String1="vcredist_x64.exe", _String2=".") returned 1 [0082.356] wcscmp (_String1="vcredist_x64.exe", _String2="..") returned 1 [0082.356] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x54082a0 | out: lpFindFileData=0x54082a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd408c921, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd4040448, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0082.356] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0082.356] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54082a0) returned 1 [0082.356] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a7958) returned 1 [0082.356] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a8bd8) returned 1 Thread: id = 179 os_tid = 0x1100 [0071.713] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa4) returned 0x388dd00 [0071.713] wcscpy (in: _Dest=0x388dd00, _Source="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" [0071.713] wcscat (in: _Dest=0x388dd00, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\") returned="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\" [0071.713] wcscat (in: _Dest=0x388dd00, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*") returned="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*" [0071.713] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5416ec0 [0071.713] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*", lpFindFileData=0x5416ec0 | out: lpFindFileData=0x5416ec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445740 [0082.374] wcscmp (_String1=".", _String2=".") returned 0 [0082.374] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x5416ec0 | out: lpFindFileData=0x5416ec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.374] wcscmp (_String1="..", _String2=".") returned 1 [0082.374] wcscmp (_String1="..", _String2="..") returned 0 [0082.374] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x5416ec0 | out: lpFindFileData=0x5416ec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0082.374] wcscmp (_String1="packages", _String2=".") returned 1 [0082.374] wcscmp (_String1="packages", _String2="..") returned 1 [0082.374] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb2) returned 0x5b15ad0 [0082.374] wcscpy (in: _Dest=0x5b15ad0, _Source="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" [0082.374] wcscat (in: _Dest=0x5b15ad0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\") returned="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\" [0082.374] wcscat (in: _Dest=0x5b15ad0, _Source="packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages") returned="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages" [0082.374] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5b15ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dfc [0082.375] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x5416ec0 | out: lpFindFileData=0x5416ec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0082.375] FindClose (in: hFindFile=0x5445740 | out: hFindFile=0x5445740) returned 1 [0082.375] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5416ec0) returned 1 [0082.375] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388dd00) returned 1 [0082.375] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ac448) returned 1 Thread: id = 180 os_tid = 0x10c4 [0071.714] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa4) returned 0x388e070 [0071.715] wcscpy (in: _Dest=0x388e070, _Source="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" [0071.715] wcscat (in: _Dest=0x388e070, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\" [0071.715] wcscat (in: _Dest=0x388e070, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*" [0071.715] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5419540 [0071.715] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*", lpFindFileData=0x5419540 | out: lpFindFileData=0x5419540*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ebc0 [0077.107] wcscmp (_String1=".", _String2=".") returned 0 [0077.107] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5419540 | out: lpFindFileData=0x5419540*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.107] wcscmp (_String1="..", _String2=".") returned 1 [0077.107] wcscmp (_String1="..", _String2="..") returned 0 [0077.107] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5419540 | out: lpFindFileData=0x5419540*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0077.107] wcscmp (_String1="packages", _String2=".") returned 1 [0077.107] wcscmp (_String1="packages", _String2="..") returned 1 [0077.107] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb2) returned 0x3905fe0 [0077.108] wcscpy (in: _Dest=0x3905fe0, _Source="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" [0077.108] wcscat (in: _Dest=0x3905fe0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\" [0077.108] wcscat (in: _Dest=0x3905fe0, _Source="packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" [0081.014] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3905fe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11ec [0081.015] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5419540 | out: lpFindFileData=0x5419540*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0081.015] FindClose (in: hFindFile=0x389ebc0 | out: hFindFile=0x389ebc0) returned 1 [0081.015] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5419540) returned 1 [0081.015] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388e070) returned 1 [0081.015] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ac250) returned 1 Thread: id = 181 os_tid = 0x10f0 [0071.716] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa4) returned 0x388e120 [0071.716] wcscpy (in: _Dest=0x388e120, _Source="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" [0071.716] wcscat (in: _Dest=0x388e120, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\" [0071.716] wcscat (in: _Dest=0x388e120, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*" [0071.716] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54197a8 [0071.716] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*", lpFindFileData=0x54197a8 | out: lpFindFileData=0x54197a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445740 [0082.376] wcscmp (_String1=".", _String2=".") returned 0 [0082.376] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x54197a8 | out: lpFindFileData=0x54197a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.376] wcscmp (_String1="..", _String2=".") returned 1 [0082.376] wcscmp (_String1="..", _String2="..") returned 0 [0082.376] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x54197a8 | out: lpFindFileData=0x54197a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0082.376] wcscmp (_String1="packages", _String2=".") returned 1 [0082.377] wcscmp (_String1="packages", _String2="..") returned 1 [0082.377] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb2) returned 0x5b15c50 [0082.377] wcscpy (in: _Dest=0x5b15c50, _Source="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" [0082.377] wcscat (in: _Dest=0x5b15c50, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\" [0082.377] wcscat (in: _Dest=0x5b15c50, _Source="packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages" [0082.377] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5b15c50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1df8 [0082.377] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x54197a8 | out: lpFindFileData=0x54197a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0082.377] FindClose (in: hFindFile=0x5445740 | out: hFindFile=0x5445740) returned 1 [0082.378] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54197a8) returned 1 [0082.378] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388e120) returned 1 [0082.378] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ab9c8) returned 1 Thread: id = 182 os_tid = 0x10f4 [0071.717] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa2) returned 0x388e1d0 [0071.717] wcscpy (in: _Dest=0x388e1d0, _Source="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" [0071.717] wcscat (in: _Dest=0x388e1d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\" [0071.717] wcscat (in: _Dest=0x388e1d0, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*" [0071.717] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5417128 [0071.717] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*", lpFindFileData=0x5417128 | out: lpFindFileData=0x5417128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e7c0 [0076.752] wcscmp (_String1=".", _String2=".") returned 0 [0076.752] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x5417128 | out: lpFindFileData=0x5417128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.753] wcscmp (_String1="..", _String2=".") returned 1 [0076.753] wcscmp (_String1="..", _String2="..") returned 0 [0076.753] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x5417128 | out: lpFindFileData=0x5417128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0076.753] wcscmp (_String1="packages", _String2=".") returned 1 [0076.753] wcscmp (_String1="packages", _String2="..") returned 1 [0076.753] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x5445cf0 [0076.753] wcscpy (in: _Dest=0x5445cf0, _Source="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" [0076.753] wcscat (in: _Dest=0x5445cf0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\" [0076.753] wcscat (in: _Dest=0x5445cf0, _Source="packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages" [0081.072] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5445cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a54 [0081.073] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x5417128 | out: lpFindFileData=0x5417128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0081.073] FindClose (in: hFindFile=0x389e7c0 | out: hFindFile=0x389e7c0) returned 1 [0081.073] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5417128) returned 1 [0081.073] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388e1d0) returned 1 [0081.073] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ac4f0) returned 1 Thread: id = 183 os_tid = 0x10e0 [0071.718] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa2) returned 0x388fa90 [0071.719] wcscpy (in: _Dest=0x388fa90, _Source="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" [0071.719] wcscat (in: _Dest=0x388fa90, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\" [0071.719] wcscat (in: _Dest=0x388fa90, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*" [0071.719] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5419ee0 [0071.719] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*", lpFindFileData=0x5419ee0 | out: lpFindFileData=0x5419ee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445740 [0082.382] wcscmp (_String1=".", _String2=".") returned 0 [0082.382] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x5419ee0 | out: lpFindFileData=0x5419ee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.382] wcscmp (_String1="..", _String2=".") returned 1 [0082.382] wcscmp (_String1="..", _String2="..") returned 0 [0082.382] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x5419ee0 | out: lpFindFileData=0x5419ee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0082.382] wcscmp (_String1="packages", _String2=".") returned 1 [0082.382] wcscmp (_String1="packages", _String2="..") returned 1 [0082.382] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x55c7ba8 [0082.382] wcscpy (in: _Dest=0x55c7ba8, _Source="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" [0082.382] wcscat (in: _Dest=0x55c7ba8, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\" [0082.382] wcscat (in: _Dest=0x55c7ba8, _Source="packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages" [0082.382] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55c7ba8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e00 [0082.383] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x5419ee0 | out: lpFindFileData=0x5419ee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0082.383] FindClose (in: hFindFile=0x5445740 | out: hFindFile=0x5445740) returned 1 [0082.383] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5419ee0) returned 1 [0082.383] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388fa90) returned 1 [0082.383] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38abe60) returned 1 Thread: id = 184 os_tid = 0x10d0 [0071.720] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa2) returned 0x388f3b0 [0071.720] wcscpy (in: _Dest=0x388f3b0, _Source="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" [0071.720] wcscat (in: _Dest=0x388f3b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\" [0071.720] wcscat (in: _Dest=0x388f3b0, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*" [0071.720] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x541a148 [0071.720] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*", lpFindFileData=0x541a148 | out: lpFindFileData=0x541a148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e840 [0076.800] wcscmp (_String1=".", _String2=".") returned 0 [0076.800] FindNextFileW (in: hFindFile=0x389e840, lpFindFileData=0x541a148 | out: lpFindFileData=0x541a148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.800] wcscmp (_String1="..", _String2=".") returned 1 [0076.800] wcscmp (_String1="..", _String2="..") returned 0 [0076.800] FindNextFileW (in: hFindFile=0x389e840, lpFindFileData=0x541a148 | out: lpFindFileData=0x541a148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0076.800] wcscmp (_String1="packages", _String2=".") returned 1 [0076.800] wcscmp (_String1="packages", _String2="..") returned 1 [0076.800] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x54474a8 [0076.800] wcscpy (in: _Dest=0x54474a8, _Source="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" [0076.800] wcscat (in: _Dest=0x54474a8, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\" [0076.800] wcscat (in: _Dest=0x54474a8, _Source="packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" [0081.069] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54474a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a4c [0081.069] FindNextFileW (in: hFindFile=0x389e840, lpFindFileData=0x541a148 | out: lpFindFileData=0x541a148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0081.069] FindClose (in: hFindFile=0x389e840 | out: hFindFile=0x389e840) returned 1 [0081.070] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541a148) returned 1 [0081.070] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388f3b0) returned 1 [0081.070] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38abc68) returned 1 Thread: id = 185 os_tid = 0x111c [0071.721] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa2) returned 0x388f1a0 [0071.721] wcscpy (in: _Dest=0x388f1a0, _Source="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" [0071.721] wcscat (in: _Dest=0x388f1a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\" [0071.721] wcscat (in: _Dest=0x388f1a0, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*" [0071.721] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x541a3b0 [0071.721] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*", lpFindFileData=0x541a3b0 | out: lpFindFileData=0x541a3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445740 [0082.384] wcscmp (_String1=".", _String2=".") returned 0 [0082.384] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x541a3b0 | out: lpFindFileData=0x541a3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.384] wcscmp (_String1="..", _String2=".") returned 1 [0082.384] wcscmp (_String1="..", _String2="..") returned 0 [0082.384] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x541a3b0 | out: lpFindFileData=0x541a3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0082.384] wcscmp (_String1="packages", _String2=".") returned 1 [0082.384] wcscmp (_String1="packages", _String2="..") returned 1 [0082.384] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x55c7c60 [0082.384] wcscpy (in: _Dest=0x55c7c60, _Source="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" [0082.385] wcscat (in: _Dest=0x55c7c60, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\" [0082.385] wcscat (in: _Dest=0x55c7c60, _Source="packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages" [0082.385] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55c7c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e04 [0082.385] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x541a3b0 | out: lpFindFileData=0x541a3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0082.385] FindClose (in: hFindFile=0x5445740 | out: hFindFile=0x5445740) returned 1 [0082.385] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541a3b0) returned 1 [0082.385] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388f1a0) returned 1 [0082.386] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38abb18) returned 1 Thread: id = 186 os_tid = 0x1120 [0071.722] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8c) returned 0x38a6e10 [0071.722] wcscpy (in: _Dest=0x38a6e10, _Source="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: _Dest="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0071.722] wcscat (in: _Dest=0x38a6e10, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\") returned="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\" [0071.722] wcscat (in: _Dest=0x38a6e10, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*") returned="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*" [0071.722] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a4418 [0071.722] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*", lpFindFileData=0x53a4418 | out: lpFindFileData=0x53a4418*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0a28d82, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445340 [0081.163] wcscmp (_String1=".", _String2=".") returned 0 [0081.163] FindNextFileW (in: hFindFile=0x5445340, lpFindFileData=0x53a4418 | out: lpFindFileData=0x53a4418*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0a28d82, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.163] wcscmp (_String1="..", _String2=".") returned 1 [0081.163] wcscmp (_String1="..", _String2="..") returned 0 [0081.163] FindNextFileW (in: hFindFile=0x5445340, lpFindFileData=0x53a4418 | out: lpFindFileData=0x53a4418*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x359ea6b6, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0081.163] wcscmp (_String1="state.rsm", _String2=".") returned 1 [0081.163] wcscmp (_String1="state.rsm", _String2="..") returned 1 [0081.163] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9c) returned 0x54a2988 [0081.163] wcscpy (in: _Dest=0x54a2988, _Source="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: _Dest="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0081.163] wcscat (in: _Dest=0x54a2988, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\") returned="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\" [0081.163] wcscat (in: _Dest=0x54a2988, _Source="state.rsm" | out: _Dest="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm") returned="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" [0081.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54a2988, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b60 [0081.164] FindNextFileW (in: hFindFile=0x5445340, lpFindFileData=0x53a4418 | out: lpFindFileData=0x53a4418*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd0a02b30, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0081.164] wcscmp (_String1="vcredist_x64.exe", _String2=".") returned 1 [0081.164] wcscmp (_String1="vcredist_x64.exe", _String2="..") returned 1 [0081.164] FindNextFileW (in: hFindFile=0x5445340, lpFindFileData=0x53a4418 | out: lpFindFileData=0x53a4418*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd0a02b30, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0081.164] FindClose (in: hFindFile=0x5445340 | out: hFindFile=0x5445340) returned 1 [0081.164] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a4418) returned 1 [0081.164] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6e10) returned 1 [0081.164] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a8c68) returned 1 Thread: id = 187 os_tid = 0xbe8 [0071.724] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa2) returned 0x388f250 [0071.724] wcscpy (in: _Dest=0x388f250, _Source="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" [0071.724] wcscat (in: _Dest=0x388f250, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\" [0071.724] wcscat (in: _Dest=0x388f250, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*" [0071.724] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a48e8 [0071.724] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*", lpFindFileData=0x53a48e8 | out: lpFindFileData=0x53a48e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445740 [0082.386] wcscmp (_String1=".", _String2=".") returned 0 [0082.386] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x53a48e8 | out: lpFindFileData=0x53a48e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.386] wcscmp (_String1="..", _String2=".") returned 1 [0082.386] wcscmp (_String1="..", _String2="..") returned 0 [0082.387] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x53a48e8 | out: lpFindFileData=0x53a48e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0082.387] wcscmp (_String1="packages", _String2=".") returned 1 [0082.387] wcscmp (_String1="packages", _String2="..") returned 1 [0082.387] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x55c7ff8 [0082.387] wcscpy (in: _Dest=0x55c7ff8, _Source="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" [0082.387] wcscat (in: _Dest=0x55c7ff8, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\" [0082.387] wcscat (in: _Dest=0x55c7ff8, _Source="packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages" [0082.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55c7ff8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e08 [0082.387] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x53a48e8 | out: lpFindFileData=0x53a48e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0082.387] FindClose (in: hFindFile=0x5445740 | out: hFindFile=0x5445740) returned 1 [0082.388] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a48e8) returned 1 [0082.388] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388f250) returned 1 [0082.388] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38aba70) returned 1 Thread: id = 188 os_tid = 0x13b0 [0071.725] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa4) returned 0x388f300 [0071.725] wcscpy (in: _Dest=0x388f300, _Source="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" [0071.725] wcscat (in: _Dest=0x388f300, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\" [0071.725] wcscat (in: _Dest=0x388f300, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*" [0071.725] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a4b50 [0071.725] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*", lpFindFileData=0x53a4b50 | out: lpFindFileData=0x53a4b50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445880 [0081.161] wcscmp (_String1=".", _String2=".") returned 0 [0081.161] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53a4b50 | out: lpFindFileData=0x53a4b50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.161] wcscmp (_String1="..", _String2=".") returned 1 [0081.161] wcscmp (_String1="..", _String2="..") returned 0 [0081.161] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53a4b50 | out: lpFindFileData=0x53a4b50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0081.161] wcscmp (_String1="packages", _String2=".") returned 1 [0081.161] wcscmp (_String1="packages", _String2="..") returned 1 [0081.161] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb2) returned 0x5b15a10 [0081.161] wcscpy (in: _Dest=0x5b15a10, _Source="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" [0081.161] wcscat (in: _Dest=0x5b15a10, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\" [0081.161] wcscat (in: _Dest=0x5b15a10, _Source="packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages" [0081.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5b15a10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b5c [0081.162] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53a4b50 | out: lpFindFileData=0x53a4b50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0081.162] FindClose (in: hFindFile=0x5445880 | out: hFindFile=0x5445880) returned 1 [0081.162] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a4b50) returned 1 [0081.162] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388f300) returned 1 [0081.162] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ac598) returned 1 Thread: id = 189 os_tid = 0x13c8 [0071.726] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8c) returned 0x38a6ea8 [0071.726] wcscpy (in: _Dest=0x38a6ea8, _Source="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: _Dest="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" [0071.726] wcscat (in: _Dest=0x38a6ea8, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\") returned="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\" [0071.726] wcscat (in: _Dest=0x38a6ea8, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*") returned="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*" [0071.726] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a4db8 [0071.726] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*", lpFindFileData=0x53a4db8 | out: lpFindFileData=0x53a4db8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc767be9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445880 [0081.159] wcscmp (_String1=".", _String2=".") returned 0 [0081.159] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53a4db8 | out: lpFindFileData=0x53a4db8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc767be9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.159] wcscmp (_String1="..", _String2=".") returned 1 [0081.159] wcscmp (_String1="..", _String2="..") returned 0 [0081.159] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53a4db8 | out: lpFindFileData=0x53a4db8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x37687158, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x2ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0081.159] wcscmp (_String1="state.rsm", _String2=".") returned 1 [0081.159] wcscmp (_String1="state.rsm", _String2="..") returned 1 [0081.159] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9c) returned 0x54a1b18 [0081.159] wcscpy (in: _Dest=0x54a1b18, _Source="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: _Dest="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" [0081.159] wcscat (in: _Dest=0x54a1b18, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\") returned="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\" [0081.159] wcscat (in: _Dest=0x54a1b18, _Source="state.rsm" | out: _Dest="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm") returned="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" [0081.159] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54a1b18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b58 [0081.160] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53a4db8 | out: lpFindFileData=0x53a4db8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc6f54ba, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1 [0081.160] wcscmp (_String1="VC_redist.x64.exe", _String2=".") returned 1 [0081.160] wcscmp (_String1="VC_redist.x64.exe", _String2="..") returned 1 [0081.160] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53a4db8 | out: lpFindFileData=0x53a4db8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc6f54ba, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0 [0081.160] FindClose (in: hFindFile=0x5445880 | out: hFindFile=0x5445880) returned 1 [0081.160] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a4db8) returned 1 [0081.160] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6ea8) returned 1 [0081.160] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a8cf8) returned 1 Thread: id = 190 os_tid = 0x13ac [0071.726] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8c) returned 0x38a6f40 [0071.726] wcscpy (in: _Dest=0x38a6f40, _Source="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: _Dest="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0071.726] wcscat (in: _Dest=0x38a6f40, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\") returned="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\" [0071.726] wcscat (in: _Dest=0x38a6f40, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*") returned="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*" [0071.726] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a5020 [0071.726] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x53a5020 | out: lpFindFileData=0x53a5020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2593ec2, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445880 [0081.157] wcscmp (_String1=".", _String2=".") returned 0 [0081.157] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53a5020 | out: lpFindFileData=0x53a5020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2593ec2, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.157] wcscmp (_String1="..", _String2=".") returned 1 [0081.157] wcscmp (_String1="..", _String2="..") returned 0 [0081.157] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53a5020 | out: lpFindFileData=0x53a5020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x35efb7db, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0081.157] wcscmp (_String1="state.rsm", _String2=".") returned 1 [0081.157] wcscmp (_String1="state.rsm", _String2="..") returned 1 [0081.157] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9c) returned 0x54a15d8 [0081.157] wcscpy (in: _Dest=0x54a15d8, _Source="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: _Dest="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0081.157] wcscat (in: _Dest=0x54a15d8, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\") returned="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\" [0081.157] wcscat (in: _Dest=0x54a15d8, _Source="state.rsm" | out: _Dest="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm") returned="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" [0081.157] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54a15d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b54 [0081.158] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53a5020 | out: lpFindFileData=0x53a5020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd2547a05, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0081.158] wcscmp (_String1="vcredist_x86.exe", _String2=".") returned 1 [0081.158] wcscmp (_String1="vcredist_x86.exe", _String2="..") returned 1 [0081.158] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53a5020 | out: lpFindFileData=0x53a5020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd2547a05, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0081.158] FindClose (in: hFindFile=0x5445880 | out: hFindFile=0x5445880) returned 1 [0081.158] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a5020) returned 1 [0081.158] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6f40) returned 1 [0081.158] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a8f38) returned 1 Thread: id = 191 os_tid = 0xf8c [0071.727] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8c) returned 0x38a6fd8 [0071.727] wcscpy (in: _Dest=0x38a6fd8, _Source="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: _Dest="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0071.727] wcscat (in: _Dest=0x38a6fd8, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\") returned="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\" [0071.727] wcscat (in: _Dest=0x38a6fd8, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*") returned="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*" [0071.727] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a5288 [0071.727] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*", lpFindFileData=0x53a5288 | out: lpFindFileData=0x53a5288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9a674c8, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445880 [0081.155] wcscmp (_String1=".", _String2=".") returned 0 [0081.155] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53a5288 | out: lpFindFileData=0x53a5288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9a674c8, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.155] wcscmp (_String1="..", _String2=".") returned 1 [0081.155] wcscmp (_String1="..", _String2="..") returned 0 [0081.155] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53a5288 | out: lpFindFileData=0x53a5288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x3714fdce, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x2ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0081.155] wcscmp (_String1="state.rsm", _String2=".") returned 1 [0081.155] wcscmp (_String1="state.rsm", _String2="..") returned 1 [0081.155] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9c) returned 0x54a1488 [0081.155] wcscpy (in: _Dest=0x54a1488, _Source="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: _Dest="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0081.155] wcscat (in: _Dest=0x54a1488, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\") returned="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\" [0081.155] wcscat (in: _Dest=0x54a1488, _Source="state.rsm" | out: _Dest="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm") returned="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" [0081.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54a1488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b50 [0081.156] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53a5288 | out: lpFindFileData=0x53a5288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd99f4dad, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1 [0081.156] wcscmp (_String1="VC_redist.x86.exe", _String2=".") returned 1 [0081.156] wcscmp (_String1="VC_redist.x86.exe", _String2="..") returned 1 [0081.156] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53a5288 | out: lpFindFileData=0x53a5288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd99f4dad, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0 [0081.156] FindClose (in: hFindFile=0x5445880 | out: hFindFile=0x5445880) returned 1 [0081.156] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a5288) returned 1 [0081.156] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6fd8) returned 1 [0081.156] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a8d88) returned 1 Thread: id = 192 os_tid = 0xed4 [0071.728] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa2) returned 0x388f460 [0071.728] wcscpy (in: _Dest=0x388f460, _Source="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" [0071.728] wcscat (in: _Dest=0x388f460, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\" [0071.728] wcscat (in: _Dest=0x388f460, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*" [0071.728] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a54f0 [0071.728] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*", lpFindFileData=0x53a54f0 | out: lpFindFileData=0x53a54f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54453c0 [0082.392] wcscmp (_String1=".", _String2=".") returned 0 [0082.392] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x53a54f0 | out: lpFindFileData=0x53a54f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.392] wcscmp (_String1="..", _String2=".") returned 1 [0082.392] wcscmp (_String1="..", _String2="..") returned 0 [0082.392] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x53a54f0 | out: lpFindFileData=0x53a54f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0082.392] wcscmp (_String1="packages", _String2=".") returned 1 [0082.392] wcscmp (_String1="packages", _String2="..") returned 1 [0082.392] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x55c85b8 [0082.392] wcscpy (in: _Dest=0x55c85b8, _Source="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" [0082.392] wcscat (in: _Dest=0x55c85b8, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\" [0082.392] wcscat (in: _Dest=0x55c85b8, _Source="packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages" [0082.392] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55c85b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e10 [0082.393] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x53a54f0 | out: lpFindFileData=0x53a54f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0082.393] FindClose (in: hFindFile=0x54453c0 | out: hFindFile=0x54453c0) returned 1 [0082.393] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a54f0) returned 1 [0082.393] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388f460) returned 1 [0082.393] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ac6e8) returned 1 Thread: id = 193 os_tid = 0xd94 [0071.729] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x537b4d0 [0071.729] wcscpy (in: _Dest=0x537b4d0, _Source="C:\\ProgramData\\Oracle\\Java" | out: _Dest="C:\\ProgramData\\Oracle\\Java") returned="C:\\ProgramData\\Oracle\\Java" [0071.729] wcscat (in: _Dest=0x537b4d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Oracle\\Java\\") returned="C:\\ProgramData\\Oracle\\Java\\" [0071.729] wcscat (in: _Dest=0x537b4d0, _Source="*" | out: _Dest="C:\\ProgramData\\Oracle\\Java\\*") returned="C:\\ProgramData\\Oracle\\Java\\*" [0071.729] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a18c8 [0071.729] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\*", lpFindFileData=0x53a18c8 | out: lpFindFileData=0x53a18c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445780 [0071.774] wcscmp (_String1=".", _String2=".") returned 0 [0071.774] FindNextFileW (in: hFindFile=0x5445780, lpFindFileData=0x53a18c8 | out: lpFindFileData=0x53a18c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.774] wcscmp (_String1="..", _String2=".") returned 1 [0071.774] wcscmp (_String1="..", _String2="..") returned 0 [0071.774] FindNextFileW (in: hFindFile=0x5445780, lpFindFileData=0x53a18c8 | out: lpFindFileData=0x53a18c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc2d63c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xad19b2ee, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".oracle_jre_usage", cAlternateFileName="ORACLE~1")) returned 1 [0071.774] wcscmp (_String1=".oracle_jre_usage", _String2=".") returned 1 [0071.774] wcscmp (_String1=".oracle_jre_usage", _String2="..") returned 1 [0071.774] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x541ada0 [0071.774] wcscpy (in: _Dest=0x541ada0, _Source="C:\\ProgramData\\Oracle\\Java" | out: _Dest="C:\\ProgramData\\Oracle\\Java") returned="C:\\ProgramData\\Oracle\\Java" [0071.774] wcscat (in: _Dest=0x541ada0, _Source="\\" | out: _Dest="C:\\ProgramData\\Oracle\\Java\\") returned="C:\\ProgramData\\Oracle\\Java\\" [0071.774] wcscat (in: _Dest=0x541ada0, _Source=".oracle_jre_usage" | out: _Dest="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage") returned="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage" [0071.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x541ada0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6fc [0071.775] FindNextFileW (in: hFindFile=0x5445780, lpFindFileData=0x53a18c8 | out: lpFindFileData=0x53a18c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d35a5d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8d35a5d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="installcache_x64", cAlternateFileName="INSTAL~1")) returned 1 [0071.775] wcscmp (_String1="installcache_x64", _String2=".") returned 1 [0071.775] wcscmp (_String1="installcache_x64", _String2="..") returned 1 [0071.775] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x38b5768 [0071.775] wcscpy (in: _Dest=0x38b5768, _Source="C:\\ProgramData\\Oracle\\Java" | out: _Dest="C:\\ProgramData\\Oracle\\Java") returned="C:\\ProgramData\\Oracle\\Java" [0071.775] wcscat (in: _Dest=0x38b5768, _Source="\\" | out: _Dest="C:\\ProgramData\\Oracle\\Java\\") returned="C:\\ProgramData\\Oracle\\Java\\" [0071.775] wcscat (in: _Dest=0x38b5768, _Source="installcache_x64" | out: _Dest="C:\\ProgramData\\Oracle\\Java\\installcache_x64") returned="C:\\ProgramData\\Oracle\\Java\\installcache_x64" [0071.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b5768, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc [0071.776] FindNextFileW (in: hFindFile=0x5445780, lpFindFileData=0x53a18c8 | out: lpFindFileData=0x53a18c8*(dwFileAttributes=0x2410, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="javapath", cAlternateFileName="")) returned 1 [0071.776] wcscmp (_String1="javapath", _String2=".") returned 1 [0071.776] wcscmp (_String1="javapath", _String2="..") returned 1 [0071.776] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x38b8338 [0071.776] wcscpy (in: _Dest=0x38b8338, _Source="C:\\ProgramData\\Oracle\\Java" | out: _Dest="C:\\ProgramData\\Oracle\\Java") returned="C:\\ProgramData\\Oracle\\Java" [0071.776] wcscat (in: _Dest=0x38b8338, _Source="\\" | out: _Dest="C:\\ProgramData\\Oracle\\Java\\") returned="C:\\ProgramData\\Oracle\\Java\\" [0071.776] wcscat (in: _Dest=0x38b8338, _Source="javapath" | out: _Dest="C:\\ProgramData\\Oracle\\Java\\javapath") returned="C:\\ProgramData\\Oracle\\Java\\javapath" [0071.776] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b8338, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d8 [0071.777] FindNextFileW (in: hFindFile=0x5445780, lpFindFileData=0x53a18c8 | out: lpFindFileData=0x53a18c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="javapath_target_474984", cAlternateFileName="JAVAPA~1")) returned 1 [0071.777] wcscmp (_String1="javapath_target_474984", _String2=".") returned 1 [0071.777] wcscmp (_String1="javapath_target_474984", _String2="..") returned 1 [0071.777] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x38b2728 [0071.777] wcscpy (in: _Dest=0x38b2728, _Source="C:\\ProgramData\\Oracle\\Java" | out: _Dest="C:\\ProgramData\\Oracle\\Java") returned="C:\\ProgramData\\Oracle\\Java" [0071.777] wcscat (in: _Dest=0x38b2728, _Source="\\" | out: _Dest="C:\\ProgramData\\Oracle\\Java\\") returned="C:\\ProgramData\\Oracle\\Java\\" [0071.777] wcscat (in: _Dest=0x38b2728, _Source="javapath_target_474984" | out: _Dest="C:\\ProgramData\\Oracle\\Java\\javapath_target_474984") returned="C:\\ProgramData\\Oracle\\Java\\javapath_target_474984" [0071.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b2728, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d4 [0071.777] FindNextFileW (in: hFindFile=0x5445780, lpFindFileData=0x53a18c8 | out: lpFindFileData=0x53a18c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="javapath_target_474984", cAlternateFileName="JAVAPA~1")) returned 0 [0071.778] FindClose (in: hFindFile=0x5445780 | out: hFindFile=0x5445780) returned 1 [0071.778] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a18c8) returned 1 [0071.778] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b4d0) returned 1 [0071.778] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389ee40) returned 1 Thread: id = 194 os_tid = 0x58 [0071.729] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x543d278 [0071.729] wcscpy (in: _Dest=0x543d278, _Source="C:\\ProgramData\\Microsoft OneDrive\\setup" | out: _Dest="C:\\ProgramData\\Microsoft OneDrive\\setup") returned="C:\\ProgramData\\Microsoft OneDrive\\setup" [0071.729] wcscat (in: _Dest=0x543d278, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft OneDrive\\setup\\") returned="C:\\ProgramData\\Microsoft OneDrive\\setup\\" [0071.729] wcscat (in: _Dest=0x543d278, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft OneDrive\\setup\\*") returned="C:\\ProgramData\\Microsoft OneDrive\\setup\\*" [0071.730] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a1b30 [0071.730] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft OneDrive\\setup\\*", lpFindFileData=0x53a1b30 | out: lpFindFileData=0x53a1b30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54457c0 [0077.195] wcscmp (_String1=".", _String2=".") returned 0 [0077.195] FindNextFileW (in: hFindFile=0x54457c0, lpFindFileData=0x53a1b30 | out: lpFindFileData=0x53a1b30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.200] wcscmp (_String1="..", _String2=".") returned 1 [0077.204] wcscmp (_String1="..", _String2="..") returned 0 [0077.204] FindNextFileW (in: hFindFile=0x54457c0, lpFindFileData=0x53a1b30 | out: lpFindFileData=0x53a1b30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe877edbb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="refcount.ini", cAlternateFileName="")) returned 1 [0077.204] wcscmp (_String1="refcount.ini", _String2=".") returned 1 [0077.204] wcscmp (_String1="refcount.ini", _String2="..") returned 1 [0077.204] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6a) returned 0x54970e8 [0077.204] wcscpy (in: _Dest=0x54970e8, _Source="C:\\ProgramData\\Microsoft OneDrive\\setup" | out: _Dest="C:\\ProgramData\\Microsoft OneDrive\\setup") returned="C:\\ProgramData\\Microsoft OneDrive\\setup" [0077.204] wcscat (in: _Dest=0x54970e8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft OneDrive\\setup\\") returned="C:\\ProgramData\\Microsoft OneDrive\\setup\\" [0077.204] wcscat (in: _Dest=0x54970e8, _Source="refcount.ini" | out: _Dest="C:\\ProgramData\\Microsoft OneDrive\\setup\\refcount.ini") returned="C:\\ProgramData\\Microsoft OneDrive\\setup\\refcount.ini" [0080.969] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54970e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1208 [0080.969] FindNextFileW (in: hFindFile=0x54457c0, lpFindFileData=0x53a1b30 | out: lpFindFileData=0x53a1b30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe877edbb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="refcount.ini", cAlternateFileName="")) returned 0 [0080.970] FindClose (in: hFindFile=0x54457c0 | out: hFindFile=0x54457c0) returned 1 [0080.970] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a1b30) returned 1 [0080.970] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x543d278) returned 1 [0080.970] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541b620) returned 1 Thread: id = 195 os_tid = 0xcec [0071.730] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x537c010 [0071.730] wcscpy (in: _Dest=0x537c010, _Source="C:\\ProgramData\\Microsoft\\AppV" | out: _Dest="C:\\ProgramData\\Microsoft\\AppV") returned="C:\\ProgramData\\Microsoft\\AppV" [0071.730] wcscat (in: _Dest=0x537c010, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\AppV\\") returned="C:\\ProgramData\\Microsoft\\AppV\\" [0071.730] wcscat (in: _Dest=0x537c010, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\AppV\\*") returned="C:\\ProgramData\\Microsoft\\AppV\\*" [0071.730] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a1d98 [0071.730] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\AppV\\*", lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445440 [0077.212] wcscmp (_String1=".", _String2=".") returned 0 [0077.212] FindNextFileW (in: hFindFile=0x5445440, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.212] wcscmp (_String1="..", _String2=".") returned 1 [0077.212] wcscmp (_String1="..", _String2="..") returned 0 [0077.212] FindNextFileW (in: hFindFile=0x5445440, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup", cAlternateFileName="")) returned 1 [0077.212] wcscmp (_String1="Setup", _String2=".") returned 1 [0077.212] wcscmp (_String1="Setup", _String2="..") returned 1 [0077.212] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x5532260 [0077.212] wcscpy (in: _Dest=0x5532260, _Source="C:\\ProgramData\\Microsoft\\AppV" | out: _Dest="C:\\ProgramData\\Microsoft\\AppV") returned="C:\\ProgramData\\Microsoft\\AppV" [0077.212] wcscat (in: _Dest=0x5532260, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\AppV\\") returned="C:\\ProgramData\\Microsoft\\AppV\\" [0077.212] wcscat (in: _Dest=0x5532260, _Source="Setup" | out: _Dest="C:\\ProgramData\\Microsoft\\AppV\\Setup") returned="C:\\ProgramData\\Microsoft\\AppV\\Setup" [0080.941] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5532260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1228 [0080.942] FindNextFileW (in: hFindFile=0x5445440, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup", cAlternateFileName="")) returned 0 [0080.942] FindClose (in: hFindFile=0x5445440 | out: hFindFile=0x5445440) returned 1 [0080.942] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a1d98) returned 1 [0080.942] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537c010) returned 1 [0080.942] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5920) returned 1 Thread: id = 196 os_tid = 0x448 [0071.731] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x5428ce8 [0071.731] wcscpy (in: _Dest=0x5428ce8, _Source="C:\\ProgramData\\Microsoft\\ClickToRun" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun") returned="C:\\ProgramData\\Microsoft\\ClickToRun" [0071.731] wcscat (in: _Dest=0x5428ce8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\" [0071.731] wcscat (in: _Dest=0x5428ce8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun\\*") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\*" [0071.731] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a2000 [0071.731] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\*", lpFindFileData=0x53a2000 | out: lpFindFileData=0x53a2000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c4413a9, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f380 [0075.065] wcscmp (_String1=".", _String2=".") returned 0 [0075.065] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x53a2000 | out: lpFindFileData=0x53a2000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c4413a9, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.065] wcscmp (_String1="..", _String2=".") returned 1 [0075.065] wcscmp (_String1="..", _String2="..") returned 0 [0075.065] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x53a2000 | out: lpFindFileData=0x53a2000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", cAlternateFileName="0D0D4E~1")) returned 1 [0075.065] wcscmp (_String1="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", _String2=".") returned 1 [0075.065] wcscmp (_String1="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", _String2="..") returned 1 [0075.065] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x92) returned 0x5426ae8 [0075.065] wcscpy (in: _Dest=0x5426ae8, _Source="C:\\ProgramData\\Microsoft\\ClickToRun" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun") returned="C:\\ProgramData\\Microsoft\\ClickToRun" [0075.065] wcscat (in: _Dest=0x5426ae8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\" [0075.065] wcscat (in: _Dest=0x5426ae8, _Source="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4" [0081.171] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5426ae8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc60 [0081.172] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x53a2000 | out: lpFindFileData=0x53a2000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", cAlternateFileName="19B111~1")) returned 1 [0081.172] wcscmp (_String1="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", _String2=".") returned 1 [0081.172] wcscmp (_String1="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", _String2="..") returned 1 [0081.172] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x92) returned 0x55c69d8 [0081.172] wcscpy (in: _Dest=0x55c69d8, _Source="C:\\ProgramData\\Microsoft\\ClickToRun" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun") returned="C:\\ProgramData\\Microsoft\\ClickToRun" [0081.172] wcscat (in: _Dest=0x55c69d8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\" [0081.172] wcscat (in: _Dest=0x55c69d8, _Source="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0" [0081.172] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55c69d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b6c [0081.172] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x53a2000 | out: lpFindFileData=0x53a2000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", cAlternateFileName="201EB7~1")) returned 1 [0081.172] wcscmp (_String1="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", _String2=".") returned 1 [0081.172] wcscmp (_String1="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", _String2="..") returned 1 [0081.172] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x92) returned 0x55c6a78 [0081.172] wcscpy (in: _Dest=0x55c6a78, _Source="C:\\ProgramData\\Microsoft\\ClickToRun" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun") returned="C:\\ProgramData\\Microsoft\\ClickToRun" [0081.173] wcscat (in: _Dest=0x55c6a78, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\" [0081.173] wcscat (in: _Dest=0x55c6a78, _Source="201EB7DF-C721-4B8B-9C81-A09DE7F931E6" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6" [0081.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55c6a78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b70 [0081.173] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x53a2000 | out: lpFindFileData=0x53a2000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3dbb3c9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8512127a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8512127a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.0.xml", cAlternateFileName="DEPLOY~1.XML")) returned 1 [0081.173] wcscmp (_String1="DeploymentConfig.0.xml", _String2=".") returned 1 [0081.173] wcscmp (_String1="DeploymentConfig.0.xml", _String2="..") returned 1 [0081.173] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x76) returned 0x38d0da0 [0081.173] wcscpy (in: _Dest=0x38d0da0, _Source="C:\\ProgramData\\Microsoft\\ClickToRun" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun") returned="C:\\ProgramData\\Microsoft\\ClickToRun" [0081.173] wcscat (in: _Dest=0x38d0da0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\" [0081.173] wcscat (in: _Dest=0x38d0da0, _Source="DeploymentConfig.0.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" [0081.174] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d0da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b74 [0081.174] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x53a2000 | out: lpFindFileData=0x53a2000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b22dc95, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa011b19, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfa011b19, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x7b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.1.xml", cAlternateFileName="DEPLOY~3.XML")) returned 1 [0081.174] wcscmp (_String1="DeploymentConfig.1.xml", _String2=".") returned 1 [0081.174] wcscmp (_String1="DeploymentConfig.1.xml", _String2="..") returned 1 [0081.174] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x76) returned 0x38d17a0 [0081.174] wcscpy (in: _Dest=0x38d17a0, _Source="C:\\ProgramData\\Microsoft\\ClickToRun" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun") returned="C:\\ProgramData\\Microsoft\\ClickToRun" [0081.174] wcscat (in: _Dest=0x38d17a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\" [0081.174] wcscat (in: _Dest=0x38d17a0, _Source="DeploymentConfig.1.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml" [0081.174] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d17a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b78 [0081.175] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x53a2000 | out: lpFindFileData=0x53a2000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534ee362, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c4413a9, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.2.xml", cAlternateFileName="DEPLOY~2.XML")) returned 1 [0081.175] wcscmp (_String1="DeploymentConfig.2.xml", _String2=".") returned 1 [0081.175] wcscmp (_String1="DeploymentConfig.2.xml", _String2="..") returned 1 [0081.175] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x76) returned 0x38d21a0 [0081.175] wcscpy (in: _Dest=0x38d21a0, _Source="C:\\ProgramData\\Microsoft\\ClickToRun" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun") returned="C:\\ProgramData\\Microsoft\\ClickToRun" [0081.175] wcscat (in: _Dest=0x38d21a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\" [0081.175] wcscat (in: _Dest=0x38d21a0, _Source="DeploymentConfig.2.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" [0081.175] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d21a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b7c [0081.176] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x53a2000 | out: lpFindFileData=0x53a2000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineData", cAlternateFileName="MACHIN~1")) returned 1 [0081.176] wcscmp (_String1="MachineData", _String2=".") returned 1 [0081.176] wcscmp (_String1="MachineData", _String2="..") returned 1 [0081.176] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x6e96730 [0081.176] wcscpy (in: _Dest=0x6e96730, _Source="C:\\ProgramData\\Microsoft\\ClickToRun" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun") returned="C:\\ProgramData\\Microsoft\\ClickToRun" [0081.176] wcscat (in: _Dest=0x6e96730, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\" [0081.176] wcscat (in: _Dest=0x6e96730, _Source="MachineData" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData" [0081.176] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x6e96730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b80 [0081.177] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x53a2000 | out: lpFindFileData=0x53a2000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProductReleases", cAlternateFileName="PRODUC~1")) returned 1 [0081.177] wcscmp (_String1="ProductReleases", _String2=".") returned 1 [0081.177] wcscmp (_String1="ProductReleases", _String2="..") returned 1 [0081.177] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x68) returned 0x5ba7348 [0081.177] wcscpy (in: _Dest=0x5ba7348, _Source="C:\\ProgramData\\Microsoft\\ClickToRun" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun") returned="C:\\ProgramData\\Microsoft\\ClickToRun" [0081.177] wcscat (in: _Dest=0x5ba7348, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\" [0081.177] wcscat (in: _Dest=0x5ba7348, _Source="ProductReleases" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases" [0081.177] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba7348, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b84 [0081.177] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x53a2000 | out: lpFindFileData=0x53a2000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserData", cAlternateFileName="")) returned 1 [0081.177] wcscmp (_String1="UserData", _String2=".") returned 1 [0081.177] wcscmp (_String1="UserData", _String2="..") returned 1 [0081.177] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x6e96798 [0081.177] wcscpy (in: _Dest=0x6e96798, _Source="C:\\ProgramData\\Microsoft\\ClickToRun" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun") returned="C:\\ProgramData\\Microsoft\\ClickToRun" [0081.178] wcscat (in: _Dest=0x6e96798, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\" [0081.178] wcscat (in: _Dest=0x6e96798, _Source="UserData" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData" [0081.178] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x6e96798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b88 [0081.178] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x53a2000 | out: lpFindFileData=0x53a2000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 1 [0081.178] wcscmp (_String1="{9AC08E99-230B-47e8-9721-4577B7F124EA}", _String2=".") returned 1 [0081.178] wcscmp (_String1="{9AC08E99-230B-47e8-9721-4577B7F124EA}", _String2="..") returned 1 [0081.178] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x96) returned 0x55c6bb8 [0081.178] wcscpy (in: _Dest=0x55c6bb8, _Source="C:\\ProgramData\\Microsoft\\ClickToRun" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun") returned="C:\\ProgramData\\Microsoft\\ClickToRun" [0081.178] wcscat (in: _Dest=0x55c6bb8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\" [0081.178] wcscat (in: _Dest=0x55c6bb8, _Source="{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0081.178] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55c6bb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b8c [0081.179] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x53a2000 | out: lpFindFileData=0x53a2000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0 [0081.179] FindClose (in: hFindFile=0x389f380 | out: hFindFile=0x389f380) returned 1 [0081.179] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a2000) returned 1 [0081.179] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5428ce8) returned 1 [0081.179] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b36d8) returned 1 Thread: id = 197 os_tid = 0x1024 [0071.731] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x38b2968 [0071.731] wcscpy (in: _Dest=0x38b2968, _Source="C:\\ProgramData\\Microsoft\\Crypto" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto" [0071.731] wcscat (in: _Dest=0x38b2968, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\" [0071.731] wcscat (in: _Dest=0x38b2968, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\*" [0071.731] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a2738 [0071.732] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\*", lpFindFileData=0x53a2738 | out: lpFindFileData=0x53a2738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54455c0 [0077.154] wcscmp (_String1=".", _String2=".") returned 0 [0077.154] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x53a2738 | out: lpFindFileData=0x53a2738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.155] wcscmp (_String1="..", _String2=".") returned 1 [0077.155] wcscmp (_String1="..", _String2="..") returned 0 [0077.155] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x53a2738 | out: lpFindFileData=0x53a2738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DSS", cAlternateFileName="")) returned 1 [0077.155] wcscmp (_String1="DSS", _String2=".") returned 1 [0077.155] wcscmp (_String1="DSS", _String2="..") returned 1 [0077.155] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x5532170 [0077.155] wcscpy (in: _Dest=0x5532170, _Source="C:\\ProgramData\\Microsoft\\Crypto" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto" [0077.155] wcscat (in: _Dest=0x5532170, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\" [0077.155] wcscat (in: _Dest=0x5532170, _Source="DSS" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS" [0080.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5532170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1204 [0080.973] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x53a2738 | out: lpFindFileData=0x53a2738*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys", cAlternateFileName="")) returned 1 [0080.973] wcscmp (_String1="Keys", _String2=".") returned 1 [0080.973] wcscmp (_String1="Keys", _String2="..") returned 1 [0080.973] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x757ea20 [0080.973] wcscpy (in: _Dest=0x757ea20, _Source="C:\\ProgramData\\Microsoft\\Crypto" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto" [0080.973] wcscat (in: _Dest=0x757ea20, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\" [0080.973] wcscat (in: _Dest=0x757ea20, _Source="Keys" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\Keys") returned="C:\\ProgramData\\Microsoft\\Crypto\\Keys" [0080.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x757ea20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1900 [0080.973] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x53a2738 | out: lpFindFileData=0x53a2738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PCPKSP", cAlternateFileName="")) returned 1 [0080.974] wcscmp (_String1="PCPKSP", _String2=".") returned 1 [0080.974] wcscmp (_String1="PCPKSP", _String2="..") returned 1 [0080.974] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x757e1e0 [0080.974] wcscpy (in: _Dest=0x757e1e0, _Source="C:\\ProgramData\\Microsoft\\Crypto" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto" [0080.974] wcscat (in: _Dest=0x757e1e0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\" [0080.974] wcscat (in: _Dest=0x757e1e0, _Source="PCPKSP" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP") returned="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP" [0080.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x757e1e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1904 [0080.974] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x53a2738 | out: lpFindFileData=0x53a2738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x17c6f037, ftLastAccessTime.dwHighDateTime=0x1d2a02b, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1 [0080.974] wcscmp (_String1="RSA", _String2=".") returned 1 [0080.974] wcscmp (_String1="RSA", _String2="..") returned 1 [0080.974] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x397dcc8 [0080.974] wcscpy (in: _Dest=0x397dcc8, _Source="C:\\ProgramData\\Microsoft\\Crypto" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto" [0080.974] wcscat (in: _Dest=0x397dcc8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\" [0080.974] wcscat (in: _Dest=0x397dcc8, _Source="RSA" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA" [0080.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x397dcc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1908 [0080.975] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x53a2738 | out: lpFindFileData=0x53a2738*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xfe648d52, ftLastWriteTime.dwHighDateTime=0x1d32770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 1 [0080.975] wcscmp (_String1="SystemKeys", _String2=".") returned 1 [0080.975] wcscmp (_String1="SystemKeys", _String2="..") returned 1 [0080.975] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x75831a0 [0080.975] wcscpy (in: _Dest=0x75831a0, _Source="C:\\ProgramData\\Microsoft\\Crypto" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto" [0080.975] wcscat (in: _Dest=0x75831a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\" [0080.975] wcscat (in: _Dest=0x75831a0, _Source="SystemKeys" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys") returned="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys" [0080.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x75831a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x190c [0080.976] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x53a2738 | out: lpFindFileData=0x53a2738*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xfe648d52, ftLastWriteTime.dwHighDateTime=0x1d32770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 0 [0080.976] FindClose (in: hFindFile=0x54455c0 | out: hFindFile=0x54455c0) returned 1 [0080.976] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a2738) returned 1 [0080.976] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b2968) returned 1 [0080.976] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b5f0) returned 1 Thread: id = 198 os_tid = 0x105c [0071.733] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x38b2a08 [0071.733] wcscpy (in: _Dest=0x38b2a08, _Source="C:\\ProgramData\\Microsoft\\DataMart" | out: _Dest="C:\\ProgramData\\Microsoft\\DataMart") returned="C:\\ProgramData\\Microsoft\\DataMart" [0071.733] wcscat (in: _Dest=0x38b2a08, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\DataMart\\") returned="C:\\ProgramData\\Microsoft\\DataMart\\" [0071.733] wcscat (in: _Dest=0x38b2a08, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\DataMart\\*") returned="C:\\ProgramData\\Microsoft\\DataMart\\*" [0071.733] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a29a0 [0071.733] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DataMart\\*", lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54453c0 [0082.448] wcscmp (_String1=".", _String2=".") returned 0 [0082.448] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.448] wcscmp (_String1="..", _String2=".") returned 1 [0082.448] wcscmp (_String1="..", _String2="..") returned 0 [0082.448] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PaidWiFi", cAlternateFileName="")) returned 1 [0082.448] wcscmp (_String1="PaidWiFi", _String2=".") returned 1 [0082.448] wcscmp (_String1="PaidWiFi", _String2="..") returned 1 [0082.448] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x7583a40 [0082.448] wcscpy (in: _Dest=0x7583a40, _Source="C:\\ProgramData\\Microsoft\\DataMart" | out: _Dest="C:\\ProgramData\\Microsoft\\DataMart") returned="C:\\ProgramData\\Microsoft\\DataMart" [0082.448] wcscat (in: _Dest=0x7583a40, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\DataMart\\") returned="C:\\ProgramData\\Microsoft\\DataMart\\" [0082.448] wcscat (in: _Dest=0x7583a40, _Source="PaidWiFi" | out: _Dest="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi") returned="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi" [0082.448] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7583a40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e94 [0082.449] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PaidWiFi", cAlternateFileName="")) returned 0 [0082.449] FindClose (in: hFindFile=0x54453c0 | out: hFindFile=0x54453c0) returned 1 [0082.449] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a29a0) returned 1 [0082.449] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b2a08) returned 1 [0082.449] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b3728) returned 1 Thread: id = 199 os_tid = 0x1010 [0071.734] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x5428450 [0071.734] wcscpy (in: _Dest=0x5428450, _Source="C:\\ProgramData\\Microsoft\\Device Stage" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage") returned="C:\\ProgramData\\Microsoft\\Device Stage" [0071.734] wcscat (in: _Dest=0x5428450, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\" [0071.734] wcscat (in: _Dest=0x5428450, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\*") returned="C:\\ProgramData\\Microsoft\\Device Stage\\*" [0071.734] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a3a78 [0071.734] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\*", lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389eb80 [0077.106] wcscmp (_String1=".", _String2=".") returned 0 [0077.106] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.106] wcscmp (_String1="..", _String2=".") returned 1 [0077.106] wcscmp (_String1="..", _String2="..") returned 0 [0077.106] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device", cAlternateFileName="")) returned 1 [0077.106] wcscmp (_String1="Device", _String2=".") returned 1 [0077.106] wcscmp (_String1="Device", _String2="..") returned 1 [0077.106] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x542ba70 [0077.106] wcscpy (in: _Dest=0x542ba70, _Source="C:\\ProgramData\\Microsoft\\Device Stage" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage") returned="C:\\ProgramData\\Microsoft\\Device Stage" [0077.107] wcscat (in: _Dest=0x542ba70, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\" [0077.107] wcscat (in: _Dest=0x542ba70, _Source="Device" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device" [0081.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x542ba70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11e8 [0081.019] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 1 [0081.019] wcscmp (_String1="Task", _String2=".") returned 1 [0081.019] wcscmp (_String1="Task", _String2="..") returned 1 [0081.019] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x7583d40 [0081.019] wcscpy (in: _Dest=0x7583d40, _Source="C:\\ProgramData\\Microsoft\\Device Stage" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage") returned="C:\\ProgramData\\Microsoft\\Device Stage" [0081.019] wcscat (in: _Dest=0x7583d40, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\" [0081.019] wcscat (in: _Dest=0x7583d40, _Source="Task" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task" [0081.019] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7583d40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19a0 [0081.020] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 0 [0081.020] FindClose (in: hFindFile=0x389eb80 | out: hFindFile=0x389eb80) returned 1 [0081.020] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a3a78) returned 1 [0081.020] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5428450) returned 1 [0081.020] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541b888) returned 1 Thread: id = 200 os_tid = 0xde0 [0071.735] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x5428558 [0071.735] wcscpy (in: _Dest=0x5428558, _Source="C:\\ProgramData\\Microsoft\\DeviceSync" | out: _Dest="C:\\ProgramData\\Microsoft\\DeviceSync") returned="C:\\ProgramData\\Microsoft\\DeviceSync" [0071.735] wcscat (in: _Dest=0x5428558, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\DeviceSync\\") returned="C:\\ProgramData\\Microsoft\\DeviceSync\\" [0071.735] wcscat (in: _Dest=0x5428558, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\DeviceSync\\*") returned="C:\\ProgramData\\Microsoft\\DeviceSync\\*" [0071.735] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a3ce0 [0071.735] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\*", lpFindFileData=0x53a3ce0 | out: lpFindFileData=0x53a3ce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445900 [0081.282] wcscmp (_String1=".", _String2=".") returned 0 [0081.282] FindNextFileW (in: hFindFile=0x5445900, lpFindFileData=0x53a3ce0 | out: lpFindFileData=0x53a3ce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.282] wcscmp (_String1="..", _String2=".") returned 1 [0081.282] wcscmp (_String1="..", _String2="..") returned 0 [0081.282] FindNextFileW (in: hFindFile=0x5445900, lpFindFileData=0x53a3ce0 | out: lpFindFileData=0x53a3ce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0081.282] FindClose (in: hFindFile=0x5445900 | out: hFindFile=0x5445900) returned 1 [0081.282] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a3ce0) returned 1 [0081.282] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5428558) returned 1 [0081.282] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x543e708) returned 1 Thread: id = 201 os_tid = 0x8cc [0071.736] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x54285b0 [0071.736] wcscpy (in: _Dest=0x54285b0, _Source="C:\\ProgramData\\Microsoft\\Diagnosis" | out: _Dest="C:\\ProgramData\\Microsoft\\Diagnosis") returned="C:\\ProgramData\\Microsoft\\Diagnosis" [0071.736] wcscat (in: _Dest=0x54285b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Diagnosis\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\" [0071.736] wcscat (in: _Dest=0x54285b0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Diagnosis\\*") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\*" [0071.736] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a3f48 [0071.736] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\*", lpFindFileData=0x53a3f48 | out: lpFindFileData=0x53a3f48*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389eec0 [0076.780] wcscmp (_String1=".", _String2=".") returned 0 [0076.780] FindNextFileW (in: hFindFile=0x389eec0, lpFindFileData=0x53a3f48 | out: lpFindFileData=0x53a3f48*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.781] wcscmp (_String1="..", _String2=".") returned 1 [0076.781] wcscmp (_String1="..", _String2="..") returned 0 [0076.781] FindNextFileW (in: hFindFile=0x389eec0, lpFindFileData=0x53a3f48 | out: lpFindFileData=0x53a3f48*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AsimovUploader", cAlternateFileName="ASIMOV~1")) returned 1 [0076.781] wcscmp (_String1="AsimovUploader", _String2=".") returned 1 [0076.781] wcscmp (_String1="AsimovUploader", _String2="..") returned 1 [0076.781] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x396d6c0 [0076.781] wcscpy (in: _Dest=0x396d6c0, _Source="C:\\ProgramData\\Microsoft\\Diagnosis" | out: _Dest="C:\\ProgramData\\Microsoft\\Diagnosis") returned="C:\\ProgramData\\Microsoft\\Diagnosis" [0076.781] wcscat (in: _Dest=0x396d6c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Diagnosis\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\" [0076.781] wcscat (in: _Dest=0x396d6c0, _Source="AsimovUploader" | out: _Dest="C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader" [0081.071] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x396d6c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x117c [0081.071] FindNextFileW (in: hFindFile=0x389eec0, lpFindFileData=0x53a3f48 | out: lpFindFileData=0x53a3f48*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d9a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a88b65e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DownloadedScenarios", cAlternateFileName="DOWNLO~1")) returned 1 [0081.071] wcscmp (_String1="DownloadedScenarios", _String2=".") returned 1 [0081.071] wcscmp (_String1="DownloadedScenarios", _String2="..") returned 1 [0081.071] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6e) returned 0x5497430 [0081.071] wcscpy (in: _Dest=0x5497430, _Source="C:\\ProgramData\\Microsoft\\Diagnosis" | out: _Dest="C:\\ProgramData\\Microsoft\\Diagnosis") returned="C:\\ProgramData\\Microsoft\\Diagnosis" [0081.071] wcscat (in: _Dest=0x5497430, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Diagnosis\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\" [0081.071] wcscat (in: _Dest=0x5497430, _Source="DownloadedScenarios" | out: _Dest="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios" [0081.071] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5497430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a50 [0081.072] FindNextFileW (in: hFindFile=0x389eec0, lpFindFileData=0x53a3f48 | out: lpFindFileData=0x53a3f48*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4d8e7d9f, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4d8e7d9f, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DownloadedSettings", cAlternateFileName="DOWNLO~2")) returned 1 [0081.072] wcscmp (_String1="DownloadedSettings", _String2=".") returned 1 [0081.072] wcscmp (_String1="DownloadedSettings", _String2="..") returned 1 [0081.072] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6c) returned 0x7305840 [0091.750] wcscpy (in: _Dest=0x7305840, _Source="C:\\ProgramData\\Microsoft\\Diagnosis" | out: _Dest="C:\\ProgramData\\Microsoft\\Diagnosis") returned="C:\\ProgramData\\Microsoft\\Diagnosis" [0091.750] wcscat (in: _Dest=0x7305840, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Diagnosis\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\" [0091.750] wcscat (in: _Dest=0x7305840, _Source="DownloadedSettings" | out: _Dest="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings" Thread: id = 202 os_tid = 0x69c [0071.737] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3e) returned 0x537bfc8 [0071.737] wcscpy (in: _Dest=0x537bfc8, _Source="C:\\ProgramData\\Microsoft\\DRM" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM") returned="C:\\ProgramData\\Microsoft\\DRM" [0071.737] wcscat (in: _Dest=0x537bfc8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM\\") returned="C:\\ProgramData\\Microsoft\\DRM\\" [0071.737] wcscat (in: _Dest=0x537bfc8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM\\*") returned="C:\\ProgramData\\Microsoft\\DRM\\*" [0071.737] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a2c08 [0071.737] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\*", lpFindFileData=0x53a2c08 | out: lpFindFileData=0x53a2c08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54453c0 [0082.452] wcscmp (_String1=".", _String2=".") returned 0 [0082.452] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x53a2c08 | out: lpFindFileData=0x53a2c08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.452] wcscmp (_String1="..", _String2=".") returned 1 [0082.452] wcscmp (_String1="..", _String2="..") returned 0 [0082.452] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x53a2c08 | out: lpFindFileData=0x53a2c08*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 1 [0082.452] wcscmp (_String1="Server", _String2=".") returned 1 [0082.452] wcscmp (_String1="Server", _String2="..") returned 1 [0082.452] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x397a988 [0082.452] wcscpy (in: _Dest=0x397a988, _Source="C:\\ProgramData\\Microsoft\\DRM" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM") returned="C:\\ProgramData\\Microsoft\\DRM" [0082.452] wcscat (in: _Dest=0x397a988, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM\\") returned="C:\\ProgramData\\Microsoft\\DRM\\" [0082.452] wcscat (in: _Dest=0x397a988, _Source="Server" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM\\Server") returned="C:\\ProgramData\\Microsoft\\DRM\\Server" [0082.453] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x397a988, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e98 [0082.453] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x53a2c08 | out: lpFindFileData=0x53a2c08*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 0 [0082.453] FindClose (in: hFindFile=0x54453c0 | out: hFindFile=0x54453c0) returned 1 [0082.454] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a2c08) returned 1 [0082.454] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537bfc8) returned 1 [0082.454] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b518) returned 1 Thread: id = 203 os_tid = 0xdfc [0071.738] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x5428298 [0071.738] wcscpy (in: _Dest=0x5428298, _Source="C:\\ProgramData\\Microsoft\\Event Viewer" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer") returned="C:\\ProgramData\\Microsoft\\Event Viewer" [0071.738] wcscat (in: _Dest=0x5428298, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\" [0071.738] wcscat (in: _Dest=0x5428298, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\*") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\*" [0071.739] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a2268 [0071.739] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\*", lpFindFileData=0x53a2268 | out: lpFindFileData=0x53a2268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x40368daa, ftLastAccessTime.dwHighDateTime=0x1d39f5f, ftLastWriteTime.dwLowDateTime=0xfbfe5ab1, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0082.467] wcscmp (_String1=".", _String2=".") returned 0 [0082.467] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53a2268 | out: lpFindFileData=0x53a2268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x40368daa, ftLastAccessTime.dwHighDateTime=0x1d39f5f, ftLastWriteTime.dwLowDateTime=0xfbfe5ab1, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.467] wcscmp (_String1="..", _String2=".") returned 1 [0082.467] wcscmp (_String1="..", _String2="..") returned 0 [0082.467] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53a2268 | out: lpFindFileData=0x53a2268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 1 [0082.467] wcscmp (_String1="Views", _String2=".") returned 1 [0082.467] wcscmp (_String1="Views", _String2="..") returned 1 [0082.467] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x7583da0 [0082.467] wcscpy (in: _Dest=0x7583da0, _Source="C:\\ProgramData\\Microsoft\\Event Viewer" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer") returned="C:\\ProgramData\\Microsoft\\Event Viewer" [0082.467] wcscat (in: _Dest=0x7583da0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\" [0082.467] wcscat (in: _Dest=0x7583da0, _Source="Views" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\Views") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views" [0082.467] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7583da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ea4 [0082.468] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53a2268 | out: lpFindFileData=0x53a2268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 0 [0082.468] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0082.468] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a2268) returned 1 [0082.468] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5428298) returned 1 [0082.468] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541b2b0) returned 1 Thread: id = 204 os_tid = 0x3d0 [0071.739] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x54282f0 [0071.739] wcscpy (in: _Dest=0x54282f0, _Source="C:\\ProgramData\\Microsoft\\IdentityCRL" | out: _Dest="C:\\ProgramData\\Microsoft\\IdentityCRL") returned="C:\\ProgramData\\Microsoft\\IdentityCRL" [0071.739] wcscat (in: _Dest=0x54282f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\IdentityCRL\\") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\" [0071.739] wcscat (in: _Dest=0x54282f0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\IdentityCRL\\*") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\*" [0071.739] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a24d0 [0071.739] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x53a24d0 | out: lpFindFileData=0x53a24d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54453c0 [0082.469] wcscmp (_String1=".", _String2=".") returned 0 [0082.469] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x53a24d0 | out: lpFindFileData=0x53a24d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.469] wcscmp (_String1="..", _String2=".") returned 1 [0082.469] wcscmp (_String1="..", _String2="..") returned 0 [0082.469] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x53a24d0 | out: lpFindFileData=0x53a24d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7b0839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INT", cAlternateFileName="")) returned 1 [0082.469] wcscmp (_String1="INT", _String2=".") returned 1 [0082.469] wcscmp (_String1="INT", _String2="..") returned 1 [0082.469] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x7583e00 [0082.469] wcscpy (in: _Dest=0x7583e00, _Source="C:\\ProgramData\\Microsoft\\IdentityCRL" | out: _Dest="C:\\ProgramData\\Microsoft\\IdentityCRL") returned="C:\\ProgramData\\Microsoft\\IdentityCRL" [0082.469] wcscat (in: _Dest=0x7583e00, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\IdentityCRL\\") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\" [0082.469] wcscat (in: _Dest=0x7583e00, _Source="INT" | out: _Dest="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT" [0082.470] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7583e00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ea8 [0082.470] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x53a24d0 | out: lpFindFileData=0x53a24d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46b00d5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="production", cAlternateFileName="PRODUC~1")) returned 1 [0082.470] wcscmp (_String1="production", _String2=".") returned 1 [0082.470] wcscmp (_String1="production", _String2="..") returned 1 [0082.470] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x542b9a0 [0082.470] wcscpy (in: _Dest=0x542b9a0, _Source="C:\\ProgramData\\Microsoft\\IdentityCRL" | out: _Dest="C:\\ProgramData\\Microsoft\\IdentityCRL") returned="C:\\ProgramData\\Microsoft\\IdentityCRL" [0082.470] wcscat (in: _Dest=0x542b9a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\IdentityCRL\\") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\" [0082.470] wcscat (in: _Dest=0x542b9a0, _Source="production" | out: _Dest="C:\\ProgramData\\Microsoft\\IdentityCRL\\production") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\production" [0082.470] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x542b9a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1eac [0082.471] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x53a24d0 | out: lpFindFileData=0x53a24d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46b00d5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="production", cAlternateFileName="PRODUC~1")) returned 0 [0082.471] FindClose (in: hFindFile=0x54453c0 | out: hFindFile=0x54453c0) returned 1 [0082.471] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a24d0) returned 1 [0082.471] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54282f0) returned 1 [0082.471] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541b468) returned 1 Thread: id = 205 os_tid = 0xa64 [0071.740] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x46) returned 0x38b3368 [0071.740] wcscpy (in: _Dest=0x38b3368, _Source="C:\\ProgramData\\Microsoft\\MapData" | out: _Dest="C:\\ProgramData\\Microsoft\\MapData") returned="C:\\ProgramData\\Microsoft\\MapData" [0071.740] wcscat (in: _Dest=0x38b3368, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\MapData\\") returned="C:\\ProgramData\\Microsoft\\MapData\\" [0071.740] wcscat (in: _Dest=0x38b3368, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\MapData\\*") returned="C:\\ProgramData\\Microsoft\\MapData\\*" [0071.740] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a2e70 [0071.740] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MapData\\*", lpFindFileData=0x53a2e70 | out: lpFindFileData=0x53a2e70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445780 [0081.151] wcscmp (_String1=".", _String2=".") returned 0 [0081.151] FindNextFileW (in: hFindFile=0x5445780, lpFindFileData=0x53a2e70 | out: lpFindFileData=0x53a2e70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.151] wcscmp (_String1="..", _String2=".") returned 1 [0081.151] wcscmp (_String1="..", _String2="..") returned 0 [0081.151] FindNextFileW (in: hFindFile=0x5445780, lpFindFileData=0x53a2e70 | out: lpFindFileData=0x53a2e70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0081.152] FindClose (in: hFindFile=0x5445780 | out: hFindFile=0x5445780) returned 1 [0081.152] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a2e70) returned 1 [0081.152] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b3368) returned 1 [0081.152] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x543e7f8) returned 1 Thread: id = 206 os_tid = 0xc38 [0071.741] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3c) returned 0x537b998 [0071.741] wcscpy (in: _Dest=0x537b998, _Source="C:\\ProgramData\\Microsoft\\MF" | out: _Dest="C:\\ProgramData\\Microsoft\\MF") returned="C:\\ProgramData\\Microsoft\\MF" [0071.741] wcscat (in: _Dest=0x537b998, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\") returned="C:\\ProgramData\\Microsoft\\MF\\" [0071.741] wcscat (in: _Dest=0x537b998, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\*") returned="C:\\ProgramData\\Microsoft\\MF\\*" [0071.741] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a30d8 [0071.741] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\*", lpFindFileData=0x53a30d8 | out: lpFindFileData=0x53a30d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80d7aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0082.194] wcscmp (_String1=".", _String2=".") returned 0 [0082.194] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53a30d8 | out: lpFindFileData=0x53a30d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80d7aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.194] wcscmp (_String1="..", _String2=".") returned 1 [0082.194] wcscmp (_String1="..", _String2="..") returned 0 [0082.194] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53a30d8 | out: lpFindFileData=0x53a30d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Active.GRL", cAlternateFileName="")) returned 1 [0082.194] wcscmp (_String1="Active.GRL", _String2=".") returned 1 [0082.194] wcscmp (_String1="Active.GRL", _String2="..") returned 1 [0082.194] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x757e2e8 [0082.194] wcscpy (in: _Dest=0x757e2e8, _Source="C:\\ProgramData\\Microsoft\\MF" | out: _Dest="C:\\ProgramData\\Microsoft\\MF") returned="C:\\ProgramData\\Microsoft\\MF" [0082.194] wcscat (in: _Dest=0x757e2e8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\") returned="C:\\ProgramData\\Microsoft\\MF\\" [0082.194] wcscat (in: _Dest=0x757e2e8, _Source="Active.GRL" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\Active.GRL") returned="C:\\ProgramData\\Microsoft\\MF\\Active.GRL" [0082.194] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x757e2e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d28 [0082.195] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53a30d8 | out: lpFindFileData=0x53a30d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pending.GRL", cAlternateFileName="")) returned 1 [0082.195] wcscmp (_String1="Pending.GRL", _String2=".") returned 1 [0082.195] wcscmp (_String1="Pending.GRL", _String2="..") returned 1 [0082.195] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x757ebd8 [0082.195] wcscpy (in: _Dest=0x757ebd8, _Source="C:\\ProgramData\\Microsoft\\MF" | out: _Dest="C:\\ProgramData\\Microsoft\\MF") returned="C:\\ProgramData\\Microsoft\\MF" [0082.195] wcscat (in: _Dest=0x757ebd8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\") returned="C:\\ProgramData\\Microsoft\\MF\\" [0082.195] wcscat (in: _Dest=0x757ebd8, _Source="Pending.GRL" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL") returned="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL" [0082.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x757ebd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d2c [0082.196] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53a30d8 | out: lpFindFileData=0x53a30d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pending.GRL", cAlternateFileName="")) returned 0 [0082.196] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0082.196] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a30d8) returned 1 [0082.196] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b998) returned 1 [0082.196] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445400) returned 1 Thread: id = 207 os_tid = 0x110c [0071.742] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x5428348 [0071.742] wcscpy (in: _Dest=0x5428348, _Source="C:\\ProgramData\\Microsoft\\NetFramework" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework") returned="C:\\ProgramData\\Microsoft\\NetFramework" [0071.742] wcscat (in: _Dest=0x5428348, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework\\") returned="C:\\ProgramData\\Microsoft\\NetFramework\\" [0071.742] wcscat (in: _Dest=0x5428348, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework\\*") returned="C:\\ProgramData\\Microsoft\\NetFramework\\*" [0071.742] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a3340 [0071.742] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\*", lpFindFileData=0x53a3340 | out: lpFindFileData=0x53a3340*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445780 [0081.153] wcscmp (_String1=".", _String2=".") returned 0 [0081.153] FindNextFileW (in: hFindFile=0x5445780, lpFindFileData=0x53a3340 | out: lpFindFileData=0x53a3340*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.153] wcscmp (_String1="..", _String2=".") returned 1 [0081.153] wcscmp (_String1="..", _String2="..") returned 0 [0081.153] FindNextFileW (in: hFindFile=0x5445780, lpFindFileData=0x53a3340 | out: lpFindFileData=0x53a3340*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80f277, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 1 [0081.153] wcscmp (_String1="BreadcrumbStore", _String2=".") returned 1 [0081.153] wcscmp (_String1="BreadcrumbStore", _String2="..") returned 1 [0081.153] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6c) returned 0x550bb20 [0091.754] wcscpy (in: _Dest=0x550bb20, _Source="C:\\ProgramData\\Microsoft\\NetFramework" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework") returned="C:\\ProgramData\\Microsoft\\NetFramework" [0091.754] wcscat (in: _Dest=0x550bb20, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework\\") returned="C:\\ProgramData\\Microsoft\\NetFramework\\" [0091.754] wcscat (in: _Dest=0x550bb20, _Source="BreadcrumbStore" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore") returned="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore" Thread: id = 208 os_tid = 0x10fc [0071.742] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x46) returned 0x543e618 [0071.742] wcscpy (in: _Dest=0x543e618, _Source="C:\\ProgramData\\Microsoft\\Network" | out: _Dest="C:\\ProgramData\\Microsoft\\Network") returned="C:\\ProgramData\\Microsoft\\Network" [0071.742] wcscat (in: _Dest=0x543e618, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\") returned="C:\\ProgramData\\Microsoft\\Network\\" [0071.742] wcscat (in: _Dest=0x543e618, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\*") returned="C:\\ProgramData\\Microsoft\\Network\\*" [0071.742] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a35a8 [0071.742] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\*", lpFindFileData=0x53a35a8 | out: lpFindFileData=0x53a35a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f3c0 [0075.068] wcscmp (_String1=".", _String2=".") returned 0 [0075.068] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x53a35a8 | out: lpFindFileData=0x53a35a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.073] wcscmp (_String1="..", _String2=".") returned 1 [0075.073] wcscmp (_String1="..", _String2="..") returned 0 [0075.073] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x53a35a8 | out: lpFindFileData=0x53a35a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0075.073] wcscmp (_String1="Connections", _String2=".") returned 1 [0075.073] wcscmp (_String1="Connections", _String2="..") returned 1 [0075.073] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x38fc778 [0075.073] wcscpy (in: _Dest=0x38fc778, _Source="C:\\ProgramData\\Microsoft\\Network" | out: _Dest="C:\\ProgramData\\Microsoft\\Network") returned="C:\\ProgramData\\Microsoft\\Network" [0075.073] wcscat (in: _Dest=0x38fc778, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\") returned="C:\\ProgramData\\Microsoft\\Network\\" [0075.073] wcscat (in: _Dest=0x38fc778, _Source="Connections" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Connections") returned="C:\\ProgramData\\Microsoft\\Network\\Connections" [0081.180] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38fc778, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc64 [0081.181] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x53a35a8 | out: lpFindFileData=0x53a35a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc6206d3e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc6206d3e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 1 [0081.181] wcscmp (_String1="Downloader", _String2=".") returned 1 [0081.181] wcscmp (_String1="Downloader", _String2="..") returned 1 [0081.181] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x7583860 [0081.181] wcscpy (in: _Dest=0x7583860, _Source="C:\\ProgramData\\Microsoft\\Network" | out: _Dest="C:\\ProgramData\\Microsoft\\Network") returned="C:\\ProgramData\\Microsoft\\Network" [0081.181] wcscat (in: _Dest=0x7583860, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\") returned="C:\\ProgramData\\Microsoft\\Network\\" [0081.181] wcscat (in: _Dest=0x7583860, _Source="Downloader" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader" [0081.181] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7583860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b90 [0081.182] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x53a35a8 | out: lpFindFileData=0x53a35a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc6206d3e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc6206d3e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 0 [0081.182] FindClose (in: hFindFile=0x389f3c0 | out: hFindFile=0x389f3c0) returned 1 [0081.182] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a35a8) returned 1 [0081.182] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x543e618) returned 1 [0081.182] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x543e6b8) returned 1 Thread: id = 209 os_tid = 0x116c [0071.743] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x3892b60 [0071.743] wcscpy (in: _Dest=0x3892b60, _Source="C:\\ProgramData\\Microsoft\\Office" | out: _Dest="C:\\ProgramData\\Microsoft\\Office") returned="C:\\ProgramData\\Microsoft\\Office" [0071.743] wcscat (in: _Dest=0x3892b60, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Office\\") returned="C:\\ProgramData\\Microsoft\\Office\\" [0071.743] wcscat (in: _Dest=0x3892b60, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Office\\*") returned="C:\\ProgramData\\Microsoft\\Office\\*" [0071.743] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a3810 [0071.743] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Office\\*", lpFindFileData=0x53a3810 | out: lpFindFileData=0x53a3810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54457c0 [0081.154] wcscmp (_String1=".", _String2=".") returned 0 [0081.154] FindNextFileW (in: hFindFile=0x54457c0, lpFindFileData=0x53a3810 | out: lpFindFileData=0x53a3810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.154] wcscmp (_String1="..", _String2=".") returned 1 [0081.154] wcscmp (_String1="..", _String2="..") returned 0 [0081.154] FindNextFileW (in: hFindFile=0x54457c0, lpFindFileData=0x53a3810 | out: lpFindFileData=0x53a3810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRunPackageLocker", cAlternateFileName="CLICKT~1")) returned 1 [0081.154] wcscmp (_String1="ClickToRunPackageLocker", _String2=".") returned 1 [0081.154] wcscmp (_String1="ClickToRunPackageLocker", _String2="..") returned 1 [0081.154] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x727fe08 [0091.754] wcscpy (in: _Dest=0x727fe08, _Source="C:\\ProgramData\\Microsoft\\Office" | out: _Dest="C:\\ProgramData\\Microsoft\\Office") returned="C:\\ProgramData\\Microsoft\\Office" [0091.754] wcscat (in: _Dest=0x727fe08, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Office\\") returned="C:\\ProgramData\\Microsoft\\Office\\" [0091.754] wcscat (in: _Dest=0x727fe08, _Source="ClickToRunPackageLocker" | out: _Dest="C:\\ProgramData\\Microsoft\\Office\\ClickToRunPackageLocker") returned="C:\\ProgramData\\Microsoft\\Office\\ClickToRunPackageLocker" Thread: id = 210 os_tid = 0x13cc [0071.744] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x541ccb8 [0071.744] wcscpy (in: _Dest=0x541ccb8, _Source="C:\\ProgramData\\Microsoft\\Search" | out: _Dest="C:\\ProgramData\\Microsoft\\Search") returned="C:\\ProgramData\\Microsoft\\Search" [0071.744] wcscat (in: _Dest=0x541ccb8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\") returned="C:\\ProgramData\\Microsoft\\Search\\" [0071.744] wcscat (in: _Dest=0x541ccb8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\*") returned="C:\\ProgramData\\Microsoft\\Search\\*" [0071.744] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a41b0 [0071.744] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\*", lpFindFileData=0x53a41b0 | out: lpFindFileData=0x53a41b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb79dd84e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb7a500e7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb7a500e7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0082.399] wcscmp (_String1=".", _String2=".") returned 0 [0082.399] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53a41b0 | out: lpFindFileData=0x53a41b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb79dd84e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb7a500e7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb7a500e7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.399] wcscmp (_String1="..", _String2=".") returned 1 [0082.399] wcscmp (_String1="..", _String2="..") returned 0 [0082.399] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53a41b0 | out: lpFindFileData=0x53a41b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f068b0c, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x768c9439, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x768c9439, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1 [0082.399] wcscmp (_String1="Data", _String2=".") returned 1 [0082.399] wcscmp (_String1="Data", _String2="..") returned 1 [0082.399] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x757e398 [0082.399] wcscpy (in: _Dest=0x757e398, _Source="C:\\ProgramData\\Microsoft\\Search" | out: _Dest="C:\\ProgramData\\Microsoft\\Search") returned="C:\\ProgramData\\Microsoft\\Search" [0082.399] wcscat (in: _Dest=0x757e398, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\") returned="C:\\ProgramData\\Microsoft\\Search\\" [0082.399] wcscat (in: _Dest=0x757e398, _Source="Data" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data") returned="C:\\ProgramData\\Microsoft\\Search\\Data" [0082.399] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x757e398, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e14 [0082.400] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53a41b0 | out: lpFindFileData=0x53a41b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f068b0c, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x768c9439, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x768c9439, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 0 [0082.400] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0082.400] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a41b0) returned 1 [0082.400] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541ccb8) returned 1 [0082.400] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b200) returned 1 Thread: id = 211 os_tid = 0x135c [0071.745] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x38b84c8 [0071.745] wcscpy (in: _Dest=0x38b84c8, _Source="C:\\ProgramData\\Microsoft\\Settings" | out: _Dest="C:\\ProgramData\\Microsoft\\Settings") returned="C:\\ProgramData\\Microsoft\\Settings" [0071.745] wcscat (in: _Dest=0x38b84c8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Settings\\") returned="C:\\ProgramData\\Microsoft\\Settings\\" [0071.746] wcscat (in: _Dest=0x38b84c8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Settings\\*") returned="C:\\ProgramData\\Microsoft\\Settings\\*" [0071.746] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a4680 [0071.746] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Settings\\*", lpFindFileData=0x53a4680 | out: lpFindFileData=0x53a4680*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30e3b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445340 [0081.230] wcscmp (_String1=".", _String2=".") returned 0 [0081.230] FindNextFileW (in: hFindFile=0x5445340, lpFindFileData=0x53a4680 | out: lpFindFileData=0x53a4680*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30e3b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.230] wcscmp (_String1="..", _String2=".") returned 1 [0081.230] wcscmp (_String1="..", _String2="..") returned 0 [0081.230] FindNextFileW (in: hFindFile=0x5445340, lpFindFileData=0x53a4680 | out: lpFindFileData=0x53a4680*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30ecb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accounts", cAlternateFileName="")) returned 1 [0081.230] wcscmp (_String1="Accounts", _String2=".") returned 1 [0081.230] wcscmp (_String1="Accounts", _String2="..") returned 1 [0081.230] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x7583320 [0081.230] wcscpy (in: _Dest=0x7583320, _Source="C:\\ProgramData\\Microsoft\\Settings" | out: _Dest="C:\\ProgramData\\Microsoft\\Settings") returned="C:\\ProgramData\\Microsoft\\Settings" [0081.230] wcscat (in: _Dest=0x7583320, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Settings\\") returned="C:\\ProgramData\\Microsoft\\Settings\\" [0081.230] wcscat (in: _Dest=0x7583320, _Source="Accounts" | out: _Dest="C:\\ProgramData\\Microsoft\\Settings\\Accounts") returned="C:\\ProgramData\\Microsoft\\Settings\\Accounts" [0081.230] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7583320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bc4 [0081.231] FindNextFileW (in: hFindFile=0x5445340, lpFindFileData=0x53a4680 | out: lpFindFileData=0x53a4680*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30ecb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accounts", cAlternateFileName="")) returned 0 [0081.231] FindClose (in: hFindFile=0x5445340 | out: hFindFile=0x5445340) returned 1 [0081.231] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a4680) returned 1 [0081.231] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b84c8) returned 1 [0081.231] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x543e9d8) returned 1 Thread: id = 212 os_tid = 0x10d4 [0071.747] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x54283f8 [0071.747] wcscpy (in: _Dest=0x54283f8, _Source="C:\\ProgramData\\Microsoft\\SmsRouter" | out: _Dest="C:\\ProgramData\\Microsoft\\SmsRouter") returned="C:\\ProgramData\\Microsoft\\SmsRouter" [0071.747] wcscat (in: _Dest=0x54283f8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\SmsRouter\\") returned="C:\\ProgramData\\Microsoft\\SmsRouter\\" [0071.747] wcscat (in: _Dest=0x54283f8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\SmsRouter\\*") returned="C:\\ProgramData\\Microsoft\\SmsRouter\\*" [0071.747] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b29b8 [0071.747] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\*", lpFindFileData=0x53b29b8 | out: lpFindFileData=0x53b29b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dcfea0a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1dcfea0a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445340 [0081.228] wcscmp (_String1=".", _String2=".") returned 0 [0081.228] FindNextFileW (in: hFindFile=0x5445340, lpFindFileData=0x53b29b8 | out: lpFindFileData=0x53b29b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dcfea0a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1dcfea0a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.228] wcscmp (_String1="..", _String2=".") returned 1 [0081.228] wcscmp (_String1="..", _String2="..") returned 0 [0081.228] FindNextFileW (in: hFindFile=0x5445340, lpFindFileData=0x53b29b8 | out: lpFindFileData=0x53b29b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1dcfea0a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1b408c4a, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x1b408c4a, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessageStore", cAlternateFileName="MESSAG~1")) returned 1 [0081.228] wcscmp (_String1="MessageStore", _String2=".") returned 1 [0081.228] wcscmp (_String1="MessageStore", _String2="..") returned 1 [0081.228] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x541aac8 [0081.228] wcscpy (in: _Dest=0x541aac8, _Source="C:\\ProgramData\\Microsoft\\SmsRouter" | out: _Dest="C:\\ProgramData\\Microsoft\\SmsRouter") returned="C:\\ProgramData\\Microsoft\\SmsRouter" [0081.228] wcscat (in: _Dest=0x541aac8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\SmsRouter\\") returned="C:\\ProgramData\\Microsoft\\SmsRouter\\" [0081.228] wcscat (in: _Dest=0x541aac8, _Source="MessageStore" | out: _Dest="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore") returned="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore" [0081.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x541aac8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bc0 [0081.229] FindNextFileW (in: hFindFile=0x5445340, lpFindFileData=0x53b29b8 | out: lpFindFileData=0x53b29b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1dcfea0a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1b408c4a, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x1b408c4a, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessageStore", cAlternateFileName="MESSAG~1")) returned 0 [0081.229] FindClose (in: hFindFile=0x5445340 | out: hFindFile=0x5445340) returned 1 [0081.229] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b29b8) returned 1 [0081.229] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54283f8) returned 1 [0081.229] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x543e898) returned 1 Thread: id = 213 os_tid = 0x1244 [0071.747] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x38b83d8 [0071.747] wcscpy (in: _Dest=0x38b83d8, _Source="C:\\ProgramData\\Microsoft\\Spectrum" | out: _Dest="C:\\ProgramData\\Microsoft\\Spectrum") returned="C:\\ProgramData\\Microsoft\\Spectrum" [0071.747] wcscat (in: _Dest=0x38b83d8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Spectrum\\") returned="C:\\ProgramData\\Microsoft\\Spectrum\\" [0071.748] wcscat (in: _Dest=0x38b83d8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Spectrum\\*") returned="C:\\ProgramData\\Microsoft\\Spectrum\\*" [0071.748] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b4b68 [0071.748] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Spectrum\\*", lpFindFileData=0x53b4b68 | out: lpFindFileData=0x53b4b68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445880 [0081.227] wcscmp (_String1=".", _String2=".") returned 0 [0081.227] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53b4b68 | out: lpFindFileData=0x53b4b68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.227] wcscmp (_String1="..", _String2=".") returned 1 [0081.227] wcscmp (_String1="..", _String2="..") returned 0 [0081.227] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53b4b68 | out: lpFindFileData=0x53b4b68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0081.227] FindClose (in: hFindFile=0x5445880 | out: hFindFile=0x5445880) returned 1 [0081.227] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b4b68) returned 1 [0081.227] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b83d8) returned 1 [0081.227] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x543e758) returned 1 Thread: id = 214 os_tid = 0x11c0 [0071.748] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x38b57c8 [0071.748] wcscpy (in: _Dest=0x38b57c8, _Source="C:\\ProgramData\\Microsoft\\Speech_OneCore" | out: _Dest="C:\\ProgramData\\Microsoft\\Speech_OneCore") returned="C:\\ProgramData\\Microsoft\\Speech_OneCore" [0071.748] wcscat (in: _Dest=0x38b57c8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Speech_OneCore\\") returned="C:\\ProgramData\\Microsoft\\Speech_OneCore\\" [0071.748] wcscat (in: _Dest=0x38b57c8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Speech_OneCore\\*") returned="C:\\ProgramData\\Microsoft\\Speech_OneCore\\*" [0071.748] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b4dd0 [0071.748] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Speech_OneCore\\*", lpFindFileData=0x53b4dd0 | out: lpFindFileData=0x53b4dd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0082.397] wcscmp (_String1=".", _String2=".") returned 0 [0082.397] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53b4dd0 | out: lpFindFileData=0x53b4dd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.397] wcscmp (_String1="..", _String2=".") returned 1 [0082.397] wcscmp (_String1="..", _String2="..") returned 0 [0082.397] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53b4dd0 | out: lpFindFileData=0x53b4dd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0082.397] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0082.398] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b4dd0) returned 1 [0082.398] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b57c8) returned 1 [0082.398] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541b518) returned 1 Thread: id = 215 os_tid = 0x1138 [0071.749] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x38b5828 [0071.749] wcscpy (in: _Dest=0x38b5828, _Source="C:\\ProgramData\\Microsoft\\Storage Health" | out: _Dest="C:\\ProgramData\\Microsoft\\Storage Health") returned="C:\\ProgramData\\Microsoft\\Storage Health" [0071.750] wcscat (in: _Dest=0x38b5828, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Storage Health\\") returned="C:\\ProgramData\\Microsoft\\Storage Health\\" [0071.750] wcscat (in: _Dest=0x38b5828, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Storage Health\\*") returned="C:\\ProgramData\\Microsoft\\Storage Health\\*" [0071.750] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b5038 [0071.750] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Storage Health\\*", lpFindFileData=0x53b5038 | out: lpFindFileData=0x53b5038*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xcb4dcad0, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445880 [0081.224] wcscmp (_String1=".", _String2=".") returned 0 [0081.224] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53b5038 | out: lpFindFileData=0x53b5038*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xcb4dcad0, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.224] wcscmp (_String1="..", _String2=".") returned 1 [0081.224] wcscmp (_String1="..", _String2="..") returned 0 [0081.224] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53b5038 | out: lpFindFileData=0x53b5038*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4dcad0, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x165f3a8f, ftLastWriteTime.dwHighDateTime=0x1d5d811, nFileSizeHigh=0x0, nFileSizeLow=0x19a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="StorageEventsArchive.dat", cAlternateFileName="STORAG~1.DAT")) returned 1 [0081.224] wcscmp (_String1="StorageEventsArchive.dat", _String2=".") returned 1 [0081.224] wcscmp (_String1="StorageEventsArchive.dat", _String2="..") returned 1 [0081.224] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x82) returned 0x549cc68 [0081.224] wcscpy (in: _Dest=0x549cc68, _Source="C:\\ProgramData\\Microsoft\\Storage Health" | out: _Dest="C:\\ProgramData\\Microsoft\\Storage Health") returned="C:\\ProgramData\\Microsoft\\Storage Health" [0081.224] wcscat (in: _Dest=0x549cc68, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Storage Health\\") returned="C:\\ProgramData\\Microsoft\\Storage Health\\" [0081.224] wcscat (in: _Dest=0x549cc68, _Source="StorageEventsArchive.dat" | out: _Dest="C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat") returned="C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat" [0081.225] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549cc68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bb8 [0081.225] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53b5038 | out: lpFindFileData=0x53b5038*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x529e643a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x529e643a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x529e643a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1375f, dwReserved0=0x0, dwReserved1=0x0, cFileName="StorageHealthModel.dat", cAlternateFileName="")) returned 1 [0081.225] wcscmp (_String1="StorageHealthModel.dat", _String2=".") returned 1 [0081.225] wcscmp (_String1="StorageHealthModel.dat", _String2="..") returned 1 [0081.225] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7e) returned 0x3977880 [0081.225] wcscpy (in: _Dest=0x3977880, _Source="C:\\ProgramData\\Microsoft\\Storage Health" | out: _Dest="C:\\ProgramData\\Microsoft\\Storage Health") returned="C:\\ProgramData\\Microsoft\\Storage Health" [0081.225] wcscat (in: _Dest=0x3977880, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Storage Health\\") returned="C:\\ProgramData\\Microsoft\\Storage Health\\" [0081.225] wcscat (in: _Dest=0x3977880, _Source="StorageHealthModel.dat" | out: _Dest="C:\\ProgramData\\Microsoft\\Storage Health\\StorageHealthModel.dat") returned="C:\\ProgramData\\Microsoft\\Storage Health\\StorageHealthModel.dat" [0081.225] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3977880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bbc [0081.226] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53b5038 | out: lpFindFileData=0x53b5038*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x529e643a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x529e643a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x529e643a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1375f, dwReserved0=0x0, dwReserved1=0x0, cFileName="StorageHealthModel.dat", cAlternateFileName="")) returned 0 [0081.226] FindClose (in: hFindFile=0x5445880 | out: hFindFile=0x5445880) returned 1 [0081.226] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b5038) returned 1 [0081.226] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b5828) returned 1 [0081.226] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541b5c8) returned 1 Thread: id = 216 os_tid = 0x1144 [0071.751] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3e) returned 0x537b9e0 [0071.751] wcscpy (in: _Dest=0x537b9e0, _Source="C:\\ProgramData\\Microsoft\\UEV" | out: _Dest="C:\\ProgramData\\Microsoft\\UEV") returned="C:\\ProgramData\\Microsoft\\UEV" [0071.751] wcscat (in: _Dest=0x537b9e0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\UEV\\") returned="C:\\ProgramData\\Microsoft\\UEV\\" [0071.751] wcscat (in: _Dest=0x537b9e0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\UEV\\*") returned="C:\\ProgramData\\Microsoft\\UEV\\*" [0071.751] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b2c20 [0071.751] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\UEV\\*", lpFindFileData=0x53b2c20 | out: lpFindFileData=0x53b2c20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe3615f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445340 [0081.220] wcscmp (_String1=".", _String2=".") returned 0 [0081.220] FindNextFileW (in: hFindFile=0x5445340, lpFindFileData=0x53b2c20 | out: lpFindFileData=0x53b2c20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe3615f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.220] wcscmp (_String1="..", _String2=".") returned 1 [0081.220] wcscmp (_String1="..", _String2="..") returned 0 [0081.220] FindNextFileW (in: hFindFile=0x5445340, lpFindFileData=0x53b2c20 | out: lpFindFileData=0x53b2c20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46867b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InboxTemplates", cAlternateFileName="INBOXT~1")) returned 1 [0081.220] wcscmp (_String1="InboxTemplates", _String2=".") returned 1 [0081.221] wcscmp (_String1="InboxTemplates", _String2="..") returned 1 [0081.221] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x7583200 [0081.221] wcscpy (in: _Dest=0x7583200, _Source="C:\\ProgramData\\Microsoft\\UEV" | out: _Dest="C:\\ProgramData\\Microsoft\\UEV") returned="C:\\ProgramData\\Microsoft\\UEV" [0081.221] wcscat (in: _Dest=0x7583200, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\UEV\\") returned="C:\\ProgramData\\Microsoft\\UEV\\" [0081.221] wcscat (in: _Dest=0x7583200, _Source="InboxTemplates" | out: _Dest="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates") returned="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates" [0081.221] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7583200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bac [0081.221] FindNextFileW (in: hFindFile=0x5445340, lpFindFileData=0x53b2c20 | out: lpFindFileData=0x53b2c20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe469068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scripts", cAlternateFileName="")) returned 1 [0081.221] wcscmp (_String1="Scripts", _String2=".") returned 1 [0081.221] wcscmp (_String1="Scripts", _String2="..") returned 1 [0081.221] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x757e7b8 [0081.221] wcscpy (in: _Dest=0x757e7b8, _Source="C:\\ProgramData\\Microsoft\\UEV" | out: _Dest="C:\\ProgramData\\Microsoft\\UEV") returned="C:\\ProgramData\\Microsoft\\UEV" [0081.221] wcscat (in: _Dest=0x757e7b8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\UEV\\") returned="C:\\ProgramData\\Microsoft\\UEV\\" [0081.221] wcscat (in: _Dest=0x757e7b8, _Source="Scripts" | out: _Dest="C:\\ProgramData\\Microsoft\\UEV\\Scripts") returned="C:\\ProgramData\\Microsoft\\UEV\\Scripts" [0081.221] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x757e7b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bb0 [0081.222] FindNextFileW (in: hFindFile=0x5445340, lpFindFileData=0x53b2c20 | out: lpFindFileData=0x53b2c20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0081.222] wcscmp (_String1="Templates", _String2=".") returned 1 [0081.222] wcscmp (_String1="Templates", _String2="..") returned 1 [0081.222] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x757e290 [0081.222] wcscpy (in: _Dest=0x757e290, _Source="C:\\ProgramData\\Microsoft\\UEV" | out: _Dest="C:\\ProgramData\\Microsoft\\UEV") returned="C:\\ProgramData\\Microsoft\\UEV" [0081.222] wcscat (in: _Dest=0x757e290, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\UEV\\") returned="C:\\ProgramData\\Microsoft\\UEV\\" [0081.222] wcscat (in: _Dest=0x757e290, _Source="Templates" | out: _Dest="C:\\ProgramData\\Microsoft\\UEV\\Templates") returned="C:\\ProgramData\\Microsoft\\UEV\\Templates" [0081.223] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x757e290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bb4 [0081.223] FindNextFileW (in: hFindFile=0x5445340, lpFindFileData=0x53b2c20 | out: lpFindFileData=0x53b2c20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0081.223] FindClose (in: hFindFile=0x5445340 | out: hFindFile=0x5445340) returned 1 [0081.223] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b2c20) returned 1 [0081.223] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b9e0) returned 1 [0081.223] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b3b0) returned 1 Thread: id = 217 os_tid = 0x1168 [0071.751] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x38b2648 [0071.751] wcscpy (in: _Dest=0x38b2648, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures" [0071.751] wcscat (in: _Dest=0x38b2648, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\" [0071.752] wcscat (in: _Dest=0x38b2648, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\*") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\*" [0071.752] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b35c0 [0071.752] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x53b35c0 | out: lpFindFileData=0x53b35c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbaae4059, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xbaae4059, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f040 [0074.716] wcscmp (_String1=".", _String2=".") returned 0 [0074.716] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x53b35c0 | out: lpFindFileData=0x53b35c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbaae4059, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xbaae4059, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.716] wcscmp (_String1="..", _String2=".") returned 1 [0074.716] wcscmp (_String1="..", _String2="..") returned 0 [0074.716] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x53b35c0 | out: lpFindFileData=0x53b35c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ecc15f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa4ecc15f, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa4ecc15f, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x930d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default User.dat", cAlternateFileName="DEFAUL~1.DAT")) returned 1 [0074.717] wcscmp (_String1="Default User.dat", _String2=".") returned 1 [0074.717] wcscmp (_String1="Default User.dat", _String2="..") returned 1 [0074.717] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x80) returned 0x5409fa0 [0074.717] wcscpy (in: _Dest=0x5409fa0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures" [0074.717] wcscat (in: _Dest=0x5409fa0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\" [0074.717] wcscat (in: _Dest=0x5409fa0, _Source="Default User.dat" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat" [0074.717] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5409fa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x43c [0074.718] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x53b35c0 | out: lpFindFileData=0x53b35c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37896d36, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x37896d36, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x37896d36, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy.dat", cAlternateFileName="")) returned 1 [0074.718] wcscmp (_String1="FD1HVy.dat", _String2=".") returned 1 [0074.718] wcscmp (_String1="FD1HVy.dat", _String2="..") returned 1 [0074.718] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x74) returned 0x38d0620 [0074.718] wcscpy (in: _Dest=0x38d0620, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures" [0074.718] wcscat (in: _Dest=0x38d0620, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\" [0074.718] wcscat (in: _Dest=0x38d0620, _Source="FD1HVy.dat" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\FD1HVy.dat") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\FD1HVy.dat" [0074.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d0620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x438 [0074.718] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x53b35c0 | out: lpFindFileData=0x53b35c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x93038, dwReserved0=0x0, dwReserved1=0x0, cFileName="guest.bmp", cAlternateFileName="")) returned 1 [0074.718] wcscmp (_String1="guest.bmp", _String2=".") returned 1 [0074.718] wcscmp (_String1="guest.bmp", _String2="..") returned 1 [0074.718] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x72) returned 0x38d0720 [0074.718] wcscpy (in: _Dest=0x38d0720, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures" [0074.718] wcscat (in: _Dest=0x38d0720, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\" [0074.719] wcscat (in: _Dest=0x38d0720, _Source="guest.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" [0074.719] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d0720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x434 [0074.719] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x53b35c0 | out: lpFindFileData=0x53b35c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1518, dwReserved0=0x0, dwReserved1=0x0, cFileName="guest.png", cAlternateFileName="")) returned 1 [0074.719] wcscmp (_String1="guest.png", _String2=".") returned 1 [0074.719] wcscmp (_String1="guest.png", _String2="..") returned 1 [0074.719] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x72) returned 0x38d10a0 [0074.719] wcscpy (in: _Dest=0x38d10a0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures" [0074.719] wcscat (in: _Dest=0x38d10a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\" [0074.719] wcscat (in: _Dest=0x38d10a0, _Source="guest.png" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png" [0074.719] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d10a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x430 [0074.720] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x53b35c0 | out: lpFindFileData=0x53b35c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x967, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-192.png", cAlternateFileName="")) returned 1 [0074.720] wcscmp (_String1="user-192.png", _String2=".") returned 1 [0074.720] wcscmp (_String1="user-192.png", _String2="..") returned 1 [0074.720] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x78) returned 0x38d1420 [0074.720] wcscpy (in: _Dest=0x38d1420, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures" [0074.720] wcscat (in: _Dest=0x38d1420, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\" [0074.720] wcscat (in: _Dest=0x38d1420, _Source="user-192.png" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png" [0074.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d1420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x42c [0074.721] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x53b35c0 | out: lpFindFileData=0x53b35c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-32.png", cAlternateFileName="")) returned 1 [0074.721] wcscmp (_String1="user-32.png", _String2=".") returned 1 [0074.721] wcscmp (_String1="user-32.png", _String2="..") returned 1 [0074.721] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x76) returned 0x38d07a0 [0074.721] wcscpy (in: _Dest=0x38d07a0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures" [0074.721] wcscat (in: _Dest=0x38d07a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\" [0074.721] wcscat (in: _Dest=0x38d07a0, _Source="user-32.png" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png" [0074.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d07a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x428 [0074.721] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x53b35c0 | out: lpFindFileData=0x53b35c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-40.png", cAlternateFileName="")) returned 1 [0074.722] wcscmp (_String1="user-40.png", _String2=".") returned 1 [0074.722] wcscmp (_String1="user-40.png", _String2="..") returned 1 [0074.722] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x76) returned 0x38d0820 [0074.722] wcscpy (in: _Dest=0x38d0820, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures" [0074.722] wcscat (in: _Dest=0x38d0820, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\" [0074.722] wcscat (in: _Dest=0x38d0820, _Source="user-40.png" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png" [0074.722] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d0820, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x424 [0074.722] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x53b35c0 | out: lpFindFileData=0x53b35c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-48.png", cAlternateFileName="")) returned 1 [0074.722] wcscmp (_String1="user-48.png", _String2=".") returned 1 [0074.722] wcscmp (_String1="user-48.png", _String2="..") returned 1 [0074.722] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x76) returned 0x38d0a20 [0074.722] wcscpy (in: _Dest=0x38d0a20, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures" [0074.722] wcscat (in: _Dest=0x38d0a20, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\" [0074.722] wcscat (in: _Dest=0x38d0a20, _Source="user-48.png" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png" [0074.722] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d0a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x420 [0074.723] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x53b35c0 | out: lpFindFileData=0x53b35c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x93038, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.bmp", cAlternateFileName="")) returned 1 [0074.723] wcscmp (_String1="user.bmp", _String2=".") returned 1 [0074.723] wcscmp (_String1="user.bmp", _String2="..") returned 1 [0074.723] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5467440 [0074.723] wcscpy (in: _Dest=0x5467440, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures" [0074.723] wcscat (in: _Dest=0x5467440, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\" [0074.723] wcscat (in: _Dest=0x5467440, _Source="user.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" [0074.723] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5467440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x41c [0074.724] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x53b35c0 | out: lpFindFileData=0x53b35c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1518, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.png", cAlternateFileName="")) returned 1 [0074.724] wcscmp (_String1="user.png", _String2=".") returned 1 [0074.724] wcscmp (_String1="user.png", _String2="..") returned 1 [0074.724] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5467800 [0074.724] wcscpy (in: _Dest=0x5467800, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures" [0074.724] wcscat (in: _Dest=0x5467800, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\" [0074.724] wcscat (in: _Dest=0x5467800, _Source="user.png" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png" [0074.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5467800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x404 [0074.725] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x53b35c0 | out: lpFindFileData=0x53b35c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1518, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.png", cAlternateFileName="")) returned 0 [0074.725] FindClose (in: hFindFile=0x389f040 | out: hFindFile=0x389f040) returned 1 [0074.725] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b35c0) returned 1 [0074.725] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b2648) returned 1 [0074.725] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541b010) returned 1 Thread: id = 218 os_tid = 0x574 [0071.752] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x42) returned 0x38b87e8 [0071.752] wcscpy (in: _Dest=0x38b87e8, _Source="C:\\ProgramData\\Microsoft\\Vault" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault") returned="C:\\ProgramData\\Microsoft\\Vault" [0071.752] wcscat (in: _Dest=0x38b87e8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault\\") returned="C:\\ProgramData\\Microsoft\\Vault\\" [0071.752] wcscat (in: _Dest=0x38b87e8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault\\*") returned="C:\\ProgramData\\Microsoft\\Vault\\*" [0071.752] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b3828 [0071.752] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\*", lpFindFileData=0x53b3828 | out: lpFindFileData=0x53b3828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4bcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x448126f7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445800 [0071.792] wcscmp (_String1=".", _String2=".") returned 0 [0071.792] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b3828 | out: lpFindFileData=0x53b3828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4bcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x448126f7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.792] wcscmp (_String1="..", _String2=".") returned 1 [0071.792] wcscmp (_String1="..", _String2="..") returned 0 [0071.792] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b3828 | out: lpFindFileData=0x53b3828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC658CB4-9126-49BD-B877-31EEDAB3F204", cAlternateFileName="AC658C~1")) returned 1 [0071.792] wcscmp (_String1="AC658CB4-9126-49BD-B877-31EEDAB3F204", _String2=".") returned 1 [0071.792] wcscmp (_String1="AC658CB4-9126-49BD-B877-31EEDAB3F204", _String2="..") returned 1 [0071.793] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x88) returned 0x38a9568 [0071.793] wcscpy (in: _Dest=0x38a9568, _Source="C:\\ProgramData\\Microsoft\\Vault" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault") returned="C:\\ProgramData\\Microsoft\\Vault" [0071.793] wcscat (in: _Dest=0x38a9568, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault\\") returned="C:\\ProgramData\\Microsoft\\Vault\\" [0071.793] wcscat (in: _Dest=0x38a9568, _Source="AC658CB4-9126-49BD-B877-31EEDAB3F204" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204") returned="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" [0071.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a9568, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c8 [0071.793] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b3828 | out: lpFindFileData=0x53b3828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC658CB4-9126-49BD-B877-31EEDAB3F204", cAlternateFileName="AC658C~1")) returned 0 [0071.793] FindClose (in: hFindFile=0x5445800 | out: hFindFile=0x5445800) returned 1 [0071.793] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b3828) returned 1 [0071.794] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b87e8) returned 1 [0071.794] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b368) returned 1 Thread: id = 219 os_tid = 0xa48 [0071.753] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3e) returned 0x537bf38 [0071.753] wcscpy (in: _Dest=0x537bf38, _Source="C:\\ProgramData\\Microsoft\\WDF" | out: _Dest="C:\\ProgramData\\Microsoft\\WDF") returned="C:\\ProgramData\\Microsoft\\WDF" [0071.753] wcscat (in: _Dest=0x537bf38, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\WDF\\") returned="C:\\ProgramData\\Microsoft\\WDF\\" [0071.753] wcscat (in: _Dest=0x537bf38, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\WDF\\*") returned="C:\\ProgramData\\Microsoft\\WDF\\*" [0071.753] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b3a90 [0071.753] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WDF\\*", lpFindFileData=0x53b3a90 | out: lpFindFileData=0x53b3a90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445880 [0081.219] wcscmp (_String1=".", _String2=".") returned 0 [0081.219] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53b3a90 | out: lpFindFileData=0x53b3a90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.219] wcscmp (_String1="..", _String2=".") returned 1 [0081.219] wcscmp (_String1="..", _String2="..") returned 0 [0081.219] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53b3a90 | out: lpFindFileData=0x53b3a90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0081.219] FindClose (in: hFindFile=0x5445880 | out: hFindFile=0x5445880) returned 1 [0081.219] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b3a90) returned 1 [0081.220] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537bf38) returned 1 [0081.220] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b248) returned 1 Thread: id = 220 os_tid = 0x124c [0071.753] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x46) returned 0x38b8888 [0071.753] wcscpy (in: _Dest=0x38b8888, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0071.754] wcscat (in: _Dest=0x38b8888, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0071.754] wcscat (in: _Dest=0x38b8888, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\*" [0071.754] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b3cf8 [0071.754] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\*", lpFindFileData=0x53b3cf8 | out: lpFindFileData=0x53b3cf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xedcf5f61, ftLastAccessTime.dwHighDateTime=0x1d336d9, ftLastWriteTime.dwLowDateTime=0xedcf5f61, ftLastWriteTime.dwHighDateTime=0x1d336d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f440 [0075.139] wcscmp (_String1=".", _String2=".") returned 0 [0075.139] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x53b3cf8 | out: lpFindFileData=0x53b3cf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xedcf5f61, ftLastAccessTime.dwHighDateTime=0x1d336d9, ftLastWriteTime.dwLowDateTime=0xedcf5f61, ftLastWriteTime.dwHighDateTime=0x1d336d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.139] wcscmp (_String1="..", _String2=".") returned 1 [0075.139] wcscmp (_String1="..", _String2="..") returned 0 [0075.139] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x53b3cf8 | out: lpFindFileData=0x53b3cf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc9faaa23, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xc9faaa23, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppRepository", cAlternateFileName="APPREP~1")) returned 1 [0075.139] wcscmp (_String1="AppRepository", _String2=".") returned 1 [0075.139] wcscmp (_String1="AppRepository", _String2="..") returned 1 [0075.139] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x38fc8b0 [0075.139] wcscpy (in: _Dest=0x38fc8b0, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0075.139] wcscat (in: _Dest=0x38fc8b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0075.139] wcscat (in: _Dest=0x38fc8b0, _Source="AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0080.446] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38fc8b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1530 [0080.447] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x53b3cf8 | out: lpFindFileData=0x53b3cf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e4e338, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadc9b08d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xadc74e2f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4317, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxProvisioning.xml", cAlternateFileName="APPXPR~1.XML")) returned 1 [0080.447] wcscmp (_String1="AppxProvisioning.xml", _String2=".") returned 1 [0080.447] wcscmp (_String1="AppxProvisioning.xml", _String2="..") returned 1 [0080.447] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6c) returned 0x5eee038 [0080.447] wcscpy (in: _Dest=0x5eee038, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0080.447] wcscat (in: _Dest=0x5eee038, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0080.447] wcscat (in: _Dest=0x5eee038, _Source="AppxProvisioning.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppxProvisioning.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppxProvisioning.xml" [0080.447] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5eee038, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1534 [0080.448] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x53b3cf8 | out: lpFindFileData=0x53b3cf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e238740, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xf60bd162, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf60bd162, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Caches", cAlternateFileName="")) returned 1 [0080.448] wcscmp (_String1="Caches", _String2=".") returned 1 [0080.448] wcscmp (_String1="Caches", _String2="..") returned 1 [0080.448] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x5428f50 [0080.448] wcscpy (in: _Dest=0x5428f50, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0080.448] wcscat (in: _Dest=0x5428f50, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0080.448] wcscat (in: _Dest=0x5428f50, _Source="Caches" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Caches") returned="C:\\ProgramData\\Microsoft\\Windows\\Caches" [0080.448] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5428f50) returned 1 [0080.448] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x53b3cf8 | out: lpFindFileData=0x53b3cf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x7dc6c35, ftLastAccessTime.dwHighDateTime=0x1d5d806, ftLastWriteTime.dwLowDateTime=0x7dc6c35, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClipSVC", cAlternateFileName="")) returned 1 [0080.448] wcscmp (_String1="ClipSVC", _String2=".") returned 1 [0080.448] wcscmp (_String1="ClipSVC", _String2="..") returned 1 [0080.448] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x38b5a08 [0080.448] wcscpy (in: _Dest=0x38b5a08, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0080.448] wcscat (in: _Dest=0x38b5a08, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0080.448] wcscat (in: _Dest=0x38b5a08, _Source="ClipSVC" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC") returned="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC" [0080.448] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b5a08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1538 [0080.449] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x53b3cf8 | out: lpFindFileData=0x53b3cf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f00595d, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xccc6a2b9, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xccc6a2b9, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceMetadataCache", cAlternateFileName="DEVICE~2")) returned 1 [0080.449] wcscmp (_String1="DeviceMetadataCache", _String2=".") returned 1 [0080.449] wcscmp (_String1="DeviceMetadataCache", _String2="..") returned 1 [0080.449] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6a) returned 0x5eedcf0 [0080.449] wcscpy (in: _Dest=0x5eedcf0, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0080.449] wcscat (in: _Dest=0x5eedcf0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0080.449] wcscat (in: _Dest=0x5eedcf0, _Source="DeviceMetadataCache" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataCache") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataCache" [0080.449] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5eedcf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x153c [0080.450] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x53b3cf8 | out: lpFindFileData=0x53b3cf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2129d74, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceMetadataStore", cAlternateFileName="DEVICE~1")) returned 1 [0080.450] wcscmp (_String1="DeviceMetadataStore", _String2=".") returned 1 [0080.450] wcscmp (_String1="DeviceMetadataStore", _String2="..") returned 1 [0080.450] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6a) returned 0x5eedd68 [0080.450] wcscpy (in: _Dest=0x5eedd68, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0080.450] wcscat (in: _Dest=0x5eedd68, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0080.450] wcscat (in: _Dest=0x5eedd68, _Source="DeviceMetadataStore" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore" [0080.450] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5eedd68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1540 [0080.451] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x53b3cf8 | out: lpFindFileData=0x53b3cf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212a839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1 [0080.451] wcscmp (_String1="GameExplorer", _String2=".") returned 1 [0080.451] wcscmp (_String1="GameExplorer", _String2="..") returned 1 [0080.451] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x6e95a30 [0080.451] wcscpy (in: _Dest=0x6e95a30, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0080.451] wcscat (in: _Dest=0x6e95a30, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0080.451] wcscat (in: _Dest=0x6e95a30, _Source="GameExplorer" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer") returned="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer" [0080.451] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x6e95a30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1544 [0080.452] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x53b3cf8 | out: lpFindFileData=0x53b3cf8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xf4120249, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf4120249, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LfSvc", cAlternateFileName="")) returned 1 [0080.452] wcscmp (_String1="LfSvc", _String2=".") returned 1 [0080.452] wcscmp (_String1="LfSvc", _String2="..") returned 1 [0080.452] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x5428f50 [0080.452] wcscpy (in: _Dest=0x5428f50, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0080.452] wcscat (in: _Dest=0x5428f50, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0080.452] wcscat (in: _Dest=0x5428f50, _Source="LfSvc" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\LfSvc") returned="C:\\ProgramData\\Microsoft\\Windows\\LfSvc" [0080.452] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5428f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1548 [0080.453] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x53b3cf8 | out: lpFindFileData=0x53b3cf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212c481, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackagedEventProviders", cAlternateFileName="PACKAG~1")) returned 1 [0080.453] wcscmp (_String1="PackagedEventProviders", _String2=".") returned 1 [0080.453] wcscmp (_String1="PackagedEventProviders", _String2="..") returned 1 [0080.453] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5eedde0 [0080.453] wcscpy (in: _Dest=0x5eedde0, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0080.453] wcscat (in: _Dest=0x5eedde0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0080.453] wcscat (in: _Dest=0x5eedde0, _Source="PackagedEventProviders" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\PackagedEventProviders") returned="C:\\ProgramData\\Microsoft\\Windows\\PackagedEventProviders" [0080.453] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5eedde0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x154c [0080.454] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x53b3cf8 | out: lpFindFileData=0x53b3cf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212c80e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parental Controls", cAlternateFileName="PARENT~1")) returned 1 [0080.454] wcscmp (_String1="Parental Controls", _String2=".") returned 1 [0080.454] wcscmp (_String1="Parental Controls", _String2="..") returned 1 [0080.454] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x38b1fb8 [0080.454] wcscpy (in: _Dest=0x38b1fb8, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0080.454] wcscat (in: _Dest=0x38b1fb8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0080.454] wcscat (in: _Dest=0x38b1fb8, _Source="Parental Controls" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Parental Controls") returned="C:\\ProgramData\\Microsoft\\Windows\\Parental Controls" [0080.454] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b1fb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1550 [0080.454] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x53b3cf8 | out: lpFindFileData=0x53b3cf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1516f86b, ftLastAccessTime.dwHighDateTime=0x1d336da, ftLastWriteTime.dwLowDateTime=0x1516f86b, ftLastWriteTime.dwHighDateTime=0x1d336da, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Power Efficiency Diagnostics", cAlternateFileName="POWERE~1")) returned 1 [0080.454] wcscmp (_String1="Power Efficiency Diagnostics", _String2=".") returned 1 [0080.455] wcscmp (_String1="Power Efficiency Diagnostics", _String2="..") returned 1 [0080.455] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7c) returned 0x3978210 [0080.455] wcscpy (in: _Dest=0x3978210, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0080.455] wcscat (in: _Dest=0x3978210, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0080.455] wcscat (in: _Dest=0x3978210, _Source="Power Efficiency Diagnostics" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" [0080.455] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3978210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1554 [0080.455] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x53b3cf8 | out: lpFindFileData=0x53b3cf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc21e5ea3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1 [0080.455] wcscmp (_String1="Ringtones", _String2=".") returned 1 [0080.455] wcscmp (_String1="Ringtones", _String2="..") returned 1 [0080.455] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x38b5a68 [0080.455] wcscpy (in: _Dest=0x38b5a68, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0080.455] wcscat (in: _Dest=0x38b5a68, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0080.455] wcscat (in: _Dest=0x38b5a68, _Source="Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0080.456] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b5a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1558 [0080.456] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x53b3cf8 | out: lpFindFileData=0x53b3cf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedcf5f61, ftCreationTime.dwHighDateTime=0x1d336d9, ftLastAccessTime.dwLowDateTime=0xeeb42f5b, ftLastAccessTime.dwHighDateTime=0x1d336d9, ftLastWriteTime.dwLowDateTime=0xeeb42f5b, ftLastWriteTime.dwHighDateTime=0x1d336d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SleepStudy", cAlternateFileName="SLEEPS~1")) returned 1 [0080.456] wcscmp (_String1="SleepStudy", _String2=".") returned 1 [0080.456] wcscmp (_String1="SleepStudy", _String2="..") returned 1 [0080.456] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x38b5b28 [0080.456] wcscpy (in: _Dest=0x38b5b28, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0080.456] wcscat (in: _Dest=0x38b5b28, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0080.457] wcscat (in: _Dest=0x38b5b28, _Source="SleepStudy" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\SleepStudy") returned="C:\\ProgramData\\Microsoft\\Windows\\SleepStudy" [0080.457] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b5b28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x155c [0080.457] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x53b3cf8 | out: lpFindFileData=0x53b3cf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sqm", cAlternateFileName="")) returned 1 [0080.457] wcscmp (_String1="Sqm", _String2=".") returned 1 [0080.457] wcscmp (_String1="Sqm", _String2="..") returned 1 [0080.457] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x757e4a0 [0080.457] wcscpy (in: _Dest=0x757e4a0, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0080.457] wcscat (in: _Dest=0x757e4a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0080.457] wcscat (in: _Dest=0x757e4a0, _Source="Sqm" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm" [0080.457] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x757e4a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1560 [0080.458] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x53b3cf8 | out: lpFindFileData=0x53b3cf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc229ee00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a923ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0080.458] wcscmp (_String1="Start Menu", _String2=".") returned 1 [0080.458] wcscmp (_String1="Start Menu", _String2="..") returned 1 [0080.458] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x38b5948 [0080.458] wcscpy (in: _Dest=0x38b5948, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0080.458] wcscat (in: _Dest=0x38b5948, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0080.458] wcscat (in: _Dest=0x38b5948, _Source="Start Menu" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu" [0080.458] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b5948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1564 [0080.459] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x53b3cf8 | out: lpFindFileData=0x53b3cf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc252d1d0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Start Menu Places", cAlternateFileName="STARTM~2")) returned 1 [0080.459] wcscmp (_String1="Start Menu Places", _String2=".") returned 1 [0080.459] wcscmp (_String1="Start Menu Places", _String2="..") returned 1 [0080.459] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x38b23a8 [0080.459] wcscpy (in: _Dest=0x38b23a8, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0080.459] wcscat (in: _Dest=0x38b23a8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0080.459] wcscat (in: _Dest=0x38b23a8, _Source="Start Menu Places" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places" [0080.459] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b23a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1568 [0080.460] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x53b3cf8 | out: lpFindFileData=0x53b3cf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe349c49, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xbe349c49, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbe349c49, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemData", cAlternateFileName="SYSTEM~1")) returned 1 [0080.460] wcscmp (_String1="SystemData", _String2=".") returned 1 [0080.460] wcscmp (_String1="SystemData", _String2="..") returned 1 [0080.460] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x38b5e28 [0080.460] wcscpy (in: _Dest=0x38b5e28, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0080.460] wcscat (in: _Dest=0x38b5e28, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0080.460] wcscat (in: _Dest=0x38b5e28, _Source="SystemData" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\SystemData") returned="C:\\ProgramData\\Microsoft\\Windows\\SystemData" [0080.460] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b5e28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x156c [0080.461] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x53b3cf8 | out: lpFindFileData=0x53b3cf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc25d1ac7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0080.461] wcscmp (_String1="Templates", _String2=".") returned 1 [0080.461] wcscmp (_String1="Templates", _String2="..") returned 1 [0080.461] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x38b5ee8 [0080.461] wcscpy (in: _Dest=0x38b5ee8, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0080.461] wcscat (in: _Dest=0x38b5ee8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0080.461] wcscat (in: _Dest=0x38b5ee8, _Source="Templates" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Templates") returned="C:\\ProgramData\\Microsoft\\Windows\\Templates" [0080.461] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b5ee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1570 [0080.462] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x53b3cf8 | out: lpFindFileData=0x53b3cf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d22c5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WER", cAlternateFileName="")) returned 1 [0080.462] wcscmp (_String1="WER", _String2=".") returned 1 [0080.462] wcscmp (_String1="WER", _String2="..") returned 1 [0080.462] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x757e448 [0080.462] wcscpy (in: _Dest=0x757e448, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0080.462] wcscat (in: _Dest=0x757e448, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0080.462] wcscat (in: _Dest=0x757e448, _Source="WER" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER") returned="C:\\ProgramData\\Microsoft\\Windows\\WER" [0080.462] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x757e448, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1574 [0080.462] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x53b3cf8 | out: lpFindFileData=0x53b3cf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8846c94f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8846c94f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wfp", cAlternateFileName="")) returned 1 [0080.462] wcscmp (_String1="wfp", _String2=".") returned 1 [0080.462] wcscmp (_String1="wfp", _String2="..") returned 1 [0080.463] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x757e9c8 [0080.463] wcscpy (in: _Dest=0x757e9c8, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0080.463] wcscat (in: _Dest=0x757e9c8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0080.463] wcscat (in: _Dest=0x757e9c8, _Source="wfp" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\wfp") returned="C:\\ProgramData\\Microsoft\\Windows\\wfp" [0080.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x757e9c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1578 [0080.463] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x53b3cf8 | out: lpFindFileData=0x53b3cf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8846c94f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8846c94f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wfp", cAlternateFileName="")) returned 0 [0080.463] FindClose (in: hFindFile=0x389f440 | out: hFindFile=0x389f440) returned 1 [0080.464] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b3cf8) returned 1 [0080.464] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b8888) returned 1 [0080.464] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x543e7a8) returned 1 Thread: id = 221 os_tid = 0x774 [0071.754] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8e) returned 0x38a7c50 [0071.754] wcscpy (in: _Dest=0x38a7c50, _Source="C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection") returned="C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection" [0071.754] wcscat (in: _Dest=0x38a7c50, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\") returned="C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\" [0071.754] wcscat (in: _Dest=0x38a7c50, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*") returned="C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*" [0071.755] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b3f60 [0071.755] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*", lpFindFileData=0x53b3f60 | out: lpFindFileData=0x53b3f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a90a48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445880 [0081.235] wcscmp (_String1=".", _String2=".") returned 0 [0081.235] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53b3f60 | out: lpFindFileData=0x53b3f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a90a48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.235] wcscmp (_String1="..", _String2=".") returned 1 [0081.235] wcscmp (_String1="..", _String2="..") returned 0 [0081.235] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53b3f60 | out: lpFindFileData=0x53b3f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a9166d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0081.235] wcscmp (_String1="Cache", _String2=".") returned 1 [0081.235] wcscmp (_String1="Cache", _String2="..") returned 1 [0081.235] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x96) returned 0x55c6c58 [0081.235] wcscpy (in: _Dest=0x55c6c58, _Source="C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection") returned="C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection" [0081.235] wcscat (in: _Dest=0x55c6c58, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\") returned="C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\" [0081.235] wcscat (in: _Dest=0x55c6c58, _Source="Cache" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Cache") returned="C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Cache" [0081.235] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55c6c58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bd0 [0081.236] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53b3f60 | out: lpFindFileData=0x53b3f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a91ebd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0081.236] wcscmp (_String1="Temp", _String2=".") returned 1 [0081.236] wcscmp (_String1="Temp", _String2="..") returned 1 [0081.236] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x94) returned 0x55c6b18 [0081.236] wcscpy (in: _Dest=0x55c6b18, _Source="C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection") returned="C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection" [0081.236] wcscat (in: _Dest=0x55c6b18, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\") returned="C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\" [0081.236] wcscat (in: _Dest=0x55c6b18, _Source="Temp" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Temp") returned="C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Temp" [0081.236] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55c6b18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bd4 [0081.237] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53b3f60 | out: lpFindFileData=0x53b3f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a91ebd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0081.237] FindClose (in: hFindFile=0x5445880 | out: hFindFile=0x5445880) returned 1 [0081.237] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b3f60) returned 1 [0081.237] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a7c50) returned 1 [0081.237] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a76f8) returned 1 Thread: id = 222 os_tid = 0xd00 [0071.756] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x5428b30 [0071.756] wcscpy (in: _Dest=0x5428b30, _Source="C:\\ProgramData\\Microsoft\\Windows Live" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows Live") returned="C:\\ProgramData\\Microsoft\\Windows Live" [0071.756] wcscat (in: _Dest=0x5428b30, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows Live\\") returned="C:\\ProgramData\\Microsoft\\Windows Live\\" [0071.756] wcscat (in: _Dest=0x5428b30, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows Live\\*") returned="C:\\ProgramData\\Microsoft\\Windows Live\\*" [0071.756] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b41c8 [0071.756] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Live\\*", lpFindFileData=0x53b41c8 | out: lpFindFileData=0x53b41c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a928fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0082.476] wcscmp (_String1=".", _String2=".") returned 0 [0082.476] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53b41c8 | out: lpFindFileData=0x53b41c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a928fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.477] wcscmp (_String1="..", _String2=".") returned 1 [0082.477] wcscmp (_String1="..", _String2="..") returned 0 [0082.477] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53b41c8 | out: lpFindFileData=0x53b41c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a996721, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1231, dwReserved0=0x0, dwReserved1=0x0, cFileName="WLive48x48.png", cAlternateFileName="WLIVE4~1.PNG")) returned 1 [0082.477] wcscmp (_String1="WLive48x48.png", _String2=".") returned 1 [0082.477] wcscmp (_String1="WLive48x48.png", _String2="..") returned 1 [0082.477] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6a) returned 0x766e310 [0086.010] wcscpy (in: _Dest=0x766e310, _Source="C:\\ProgramData\\Microsoft\\Windows Live" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows Live") returned="C:\\ProgramData\\Microsoft\\Windows Live" [0086.010] wcscat (in: _Dest=0x766e310, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows Live\\") returned="C:\\ProgramData\\Microsoft\\Windows Live\\" [0086.010] wcscat (in: _Dest=0x766e310, _Source="WLive48x48.png" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows Live\\WLive48x48.png") returned="C:\\ProgramData\\Microsoft\\Windows Live\\WLive48x48.png" [0088.673] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x766e310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b4 [0088.673] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53b41c8 | out: lpFindFileData=0x53b41c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a996721, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1231, dwReserved0=0x0, dwReserved1=0x0, cFileName="WLive48x48.png", cAlternateFileName="WLIVE4~1.PNG")) returned 0 [0088.673] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0088.673] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b41c8) returned 1 [0088.673] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5428b30) returned 1 [0088.673] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5428768) returned 1 Thread: id = 223 os_tid = 0x113c [0071.757] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x5428c90 [0071.757] wcscpy (in: _Dest=0x5428c90, _Source="C:\\ProgramData\\Microsoft\\Windows NT" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT") returned="C:\\ProgramData\\Microsoft\\Windows NT" [0071.757] wcscat (in: _Dest=0x5428c90, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\" [0071.757] wcscat (in: _Dest=0x5428c90, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\*") returned="C:\\ProgramData\\Microsoft\\Windows NT\\*" [0071.757] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b4430 [0071.757] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\*", lpFindFileData=0x53b4430 | out: lpFindFileData=0x53b4430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a93496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445880 [0081.232] wcscmp (_String1=".", _String2=".") returned 0 [0081.232] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53b4430 | out: lpFindFileData=0x53b4430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a93496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.232] wcscmp (_String1="..", _String2=".") returned 1 [0081.232] wcscmp (_String1="..", _String2="..") returned 0 [0081.232] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53b4430 | out: lpFindFileData=0x53b4430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb2396478, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb2396478, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSFax", cAlternateFileName="")) returned 1 [0081.232] wcscmp (_String1="MSFax", _String2=".") returned 1 [0081.232] wcscmp (_String1="MSFax", _String2="..") returned 1 [0081.232] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x7583380 [0081.232] wcscpy (in: _Dest=0x7583380, _Source="C:\\ProgramData\\Microsoft\\Windows NT" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT") returned="C:\\ProgramData\\Microsoft\\Windows NT" [0081.233] wcscat (in: _Dest=0x7583380, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\" [0081.233] wcscat (in: _Dest=0x7583380, _Source="MSFax" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax" [0081.233] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7583380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bc8 [0081.233] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53b4430 | out: lpFindFileData=0x53b4430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0e356, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 1 [0081.233] wcscmp (_String1="MSScan", _String2=".") returned 1 [0081.233] wcscmp (_String1="MSScan", _String2="..") returned 1 [0081.233] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x7583440 [0081.233] wcscpy (in: _Dest=0x7583440, _Source="C:\\ProgramData\\Microsoft\\Windows NT" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT") returned="C:\\ProgramData\\Microsoft\\Windows NT" [0081.233] wcscat (in: _Dest=0x7583440, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\" [0081.233] wcscat (in: _Dest=0x7583440, _Source="MSScan" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan" [0081.233] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7583440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bcc [0081.234] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53b4430 | out: lpFindFileData=0x53b4430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0e356, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 0 [0081.234] FindClose (in: hFindFile=0x5445880 | out: hFindFile=0x5445880) returned 1 [0081.234] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b4430) returned 1 [0081.234] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5428c90) returned 1 [0081.234] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5442ec0) returned 1 Thread: id = 224 os_tid = 0xd70 [0071.757] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x38b26b8 [0071.757] wcscpy (in: _Dest=0x38b26b8, _Source="C:\\ProgramData\\Microsoft\\Windows Security Health" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows Security Health") returned="C:\\ProgramData\\Microsoft\\Windows Security Health" [0071.757] wcscat (in: _Dest=0x38b26b8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows Security Health\\") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\" [0071.757] wcscat (in: _Dest=0x38b26b8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows Security Health\\*") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\*" [0071.758] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b4698 [0071.758] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\*", lpFindFileData=0x53b4698 | out: lpFindFileData=0x53b4698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0ef6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0082.473] wcscmp (_String1=".", _String2=".") returned 0 [0082.473] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53b4698 | out: lpFindFileData=0x53b4698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0ef6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.474] wcscmp (_String1="..", _String2=".") returned 1 [0082.474] wcscmp (_String1="..", _String2="..") returned 0 [0082.474] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53b4698 | out: lpFindFileData=0x53b4698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0fb9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Health Advisor", cAlternateFileName="HEALTH~1")) returned 1 [0082.474] wcscmp (_String1="Health Advisor", _String2=".") returned 1 [0082.474] wcscmp (_String1="Health Advisor", _String2="..") returned 1 [0082.474] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x80) returned 0x3978430 [0082.474] wcscpy (in: _Dest=0x3978430, _Source="C:\\ProgramData\\Microsoft\\Windows Security Health" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows Security Health") returned="C:\\ProgramData\\Microsoft\\Windows Security Health" [0082.474] wcscat (in: _Dest=0x3978430, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows Security Health\\") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\" [0082.474] wcscat (in: _Dest=0x3978430, _Source="Health Advisor" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows Security Health\\Health Advisor") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Health Advisor" [0082.474] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3978430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1eb0 [0082.474] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53b4698 | out: lpFindFileData=0x53b4698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa1b0a55, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0xa1b0a55, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0082.474] wcscmp (_String1="Logs", _String2=".") returned 1 [0082.474] wcscmp (_String1="Logs", _String2="..") returned 1 [0082.474] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6c) returned 0x38aaae0 [0082.475] wcscpy (in: _Dest=0x38aaae0, _Source="C:\\ProgramData\\Microsoft\\Windows Security Health" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows Security Health") returned="C:\\ProgramData\\Microsoft\\Windows Security Health" [0082.475] wcscat (in: _Dest=0x38aaae0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows Security Health\\") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\" [0082.475] wcscat (in: _Dest=0x38aaae0, _Source="Logs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs" [0082.475] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38aaae0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1eb4 [0082.475] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53b4698 | out: lpFindFileData=0x53b4698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa1b0a55, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0xa1b0a55, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 0 [0082.475] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0082.475] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b4698) returned 1 [0082.476] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b26b8) returned 1 [0082.476] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b2258) returned 1 Thread: id = 225 os_tid = 0x1118 [0071.758] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x38b8158 [0071.758] wcscpy (in: _Dest=0x38b8158, _Source="C:\\ProgramData\\Microsoft\\WinMSIPC" | out: _Dest="C:\\ProgramData\\Microsoft\\WinMSIPC") returned="C:\\ProgramData\\Microsoft\\WinMSIPC" [0071.758] wcscat (in: _Dest=0x38b8158, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\WinMSIPC\\") returned="C:\\ProgramData\\Microsoft\\WinMSIPC\\" [0071.758] wcscat (in: _Dest=0x38b8158, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\WinMSIPC\\*") returned="C:\\ProgramData\\Microsoft\\WinMSIPC\\*" [0071.758] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b4900 [0071.758] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WinMSIPC\\*", lpFindFileData=0x53b4900 | out: lpFindFileData=0x53b4900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445880 [0081.238] wcscmp (_String1=".", _String2=".") returned 0 [0081.238] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53b4900 | out: lpFindFileData=0x53b4900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.238] wcscmp (_String1="..", _String2=".") returned 1 [0081.238] wcscmp (_String1="..", _String2="..") returned 0 [0081.238] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53b4900 | out: lpFindFileData=0x53b4900*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 1 [0081.238] wcscmp (_String1="Server", _String2=".") returned 1 [0081.238] wcscmp (_String1="Server", _String2="..") returned 1 [0081.238] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x75834a0 [0081.238] wcscpy (in: _Dest=0x75834a0, _Source="C:\\ProgramData\\Microsoft\\WinMSIPC" | out: _Dest="C:\\ProgramData\\Microsoft\\WinMSIPC") returned="C:\\ProgramData\\Microsoft\\WinMSIPC" [0081.238] wcscat (in: _Dest=0x75834a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\WinMSIPC\\") returned="C:\\ProgramData\\Microsoft\\WinMSIPC\\" [0081.239] wcscat (in: _Dest=0x75834a0, _Source="Server" | out: _Dest="C:\\ProgramData\\Microsoft\\WinMSIPC\\Server") returned="C:\\ProgramData\\Microsoft\\WinMSIPC\\Server" [0081.239] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x75834a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bd8 [0081.239] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53b4900 | out: lpFindFileData=0x53b4900*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 0 [0081.239] FindClose (in: hFindFile=0x5445880 | out: hFindFile=0x5445880) returned 1 [0081.239] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b4900) returned 1 [0081.239] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b8158) returned 1 [0081.239] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5442dd0) returned 1 Thread: id = 226 os_tid = 0x1128 [0071.783] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x46) returned 0x38b81a8 [0071.783] wcscpy (in: _Dest=0x38b81a8, _Source="C:\\ProgramData\\Microsoft\\WwanSvc" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc") returned="C:\\ProgramData\\Microsoft\\WwanSvc" [0071.783] wcscat (in: _Dest=0x38b81a8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc\\") returned="C:\\ProgramData\\Microsoft\\WwanSvc\\" [0071.783] wcscat (in: _Dest=0x38b81a8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc\\*") returned="C:\\ProgramData\\Microsoft\\WwanSvc\\*" [0071.783] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b52a0 [0071.783] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\*", lpFindFileData=0x53b52a0 | out: lpFindFileData=0x53b52a0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0082.464] wcscmp (_String1=".", _String2=".") returned 0 [0082.464] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53b52a0 | out: lpFindFileData=0x53b52a0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.464] wcscmp (_String1="..", _String2=".") returned 1 [0082.464] wcscmp (_String1="..", _String2="..") returned 0 [0082.464] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53b52a0 | out: lpFindFileData=0x53b52a0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DMProfiles", cAlternateFileName="DMPROF~1")) returned 1 [0082.464] wcscmp (_String1="DMProfiles", _String2=".") returned 1 [0082.464] wcscmp (_String1="DMProfiles", _String2="..") returned 1 [0082.464] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x7583b00 [0082.464] wcscpy (in: _Dest=0x7583b00, _Source="C:\\ProgramData\\Microsoft\\WwanSvc" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc") returned="C:\\ProgramData\\Microsoft\\WwanSvc" [0082.464] wcscat (in: _Dest=0x7583b00, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc\\") returned="C:\\ProgramData\\Microsoft\\WwanSvc\\" [0082.464] wcscat (in: _Dest=0x7583b00, _Source="DMProfiles" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc\\DMProfiles") returned="C:\\ProgramData\\Microsoft\\WwanSvc\\DMProfiles" [0082.464] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7583b00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e9c [0082.465] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53b52a0 | out: lpFindFileData=0x53b52a0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0082.465] wcscmp (_String1="Profiles", _String2=".") returned 1 [0082.465] wcscmp (_String1="Profiles", _String2="..") returned 1 [0082.465] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x7583b60 [0082.465] wcscpy (in: _Dest=0x7583b60, _Source="C:\\ProgramData\\Microsoft\\WwanSvc" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc") returned="C:\\ProgramData\\Microsoft\\WwanSvc" [0082.465] wcscat (in: _Dest=0x7583b60, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc\\") returned="C:\\ProgramData\\Microsoft\\WwanSvc\\" [0082.465] wcscat (in: _Dest=0x7583b60, _Source="Profiles" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles") returned="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles" [0082.465] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7583b60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ea0 [0082.466] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53b52a0 | out: lpFindFileData=0x53b52a0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 0 [0082.466] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0082.466] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b52a0) returned 1 [0082.466] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b81a8) returned 1 [0082.466] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5442f10) returned 1 Thread: id = 227 os_tid = 0x8d0 [0071.784] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x5445580 [0071.784] wcscpy (in: _Dest=0x5445580, _Source="C:\\ProgramData\\Adobe\\ARM" | out: _Dest="C:\\ProgramData\\Adobe\\ARM") returned="C:\\ProgramData\\Adobe\\ARM" [0071.784] wcscat (in: _Dest=0x5445580, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\ARM\\") returned="C:\\ProgramData\\Adobe\\ARM\\" [0071.784] wcscat (in: _Dest=0x5445580, _Source="*" | out: _Dest="C:\\ProgramData\\Adobe\\ARM\\*") returned="C:\\ProgramData\\Adobe\\ARM\\*" [0071.784] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b5508 [0071.784] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\*", lpFindFileData=0x53b5508 | out: lpFindFileData=0x53b5508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445800 [0071.860] wcscmp (_String1=".", _String2=".") returned 0 [0071.860] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b5508 | out: lpFindFileData=0x53b5508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.860] wcscmp (_String1="..", _String2=".") returned 1 [0071.860] wcscmp (_String1="..", _String2="..") returned 0 [0071.860] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b5508 | out: lpFindFileData=0x53b5508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_15.007.20033", cAlternateFileName="READER~1.200")) returned 1 [0071.860] wcscmp (_String1="Reader_15.007.20033", _String2=".") returned 1 [0071.861] wcscmp (_String1="Reader_15.007.20033", _String2="..") returned 1 [0071.861] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x541ae08 [0071.861] wcscpy (in: _Dest=0x541ae08, _Source="C:\\ProgramData\\Adobe\\ARM" | out: _Dest="C:\\ProgramData\\Adobe\\ARM") returned="C:\\ProgramData\\Adobe\\ARM" [0071.861] wcscat (in: _Dest=0x541ae08, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\ARM\\") returned="C:\\ProgramData\\Adobe\\ARM\\" [0071.861] wcscat (in: _Dest=0x541ae08, _Source="Reader_15.007.20033" | out: _Dest="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033") returned="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033" [0071.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x541ae08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7cc [0071.861] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b5508 | out: lpFindFileData=0x53b5508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xa7140105, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_15.023.20070", cAlternateFileName="READER~2.200")) returned 1 [0071.861] wcscmp (_String1="Reader_15.023.20070", _String2=".") returned 1 [0071.861] wcscmp (_String1="Reader_15.023.20070", _String2="..") returned 1 [0071.861] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x542b590 [0071.862] wcscpy (in: _Dest=0x542b590, _Source="C:\\ProgramData\\Adobe\\ARM" | out: _Dest="C:\\ProgramData\\Adobe\\ARM") returned="C:\\ProgramData\\Adobe\\ARM" [0071.862] wcscat (in: _Dest=0x542b590, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\ARM\\") returned="C:\\ProgramData\\Adobe\\ARM\\" [0071.862] wcscat (in: _Dest=0x542b590, _Source="Reader_15.023.20070" | out: _Dest="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070") returned="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070" [0071.862] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x542b590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f4 [0071.863] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b5508 | out: lpFindFileData=0x53b5508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S", cAlternateFileName="")) returned 1 [0071.863] wcscmp (_String1="S", _String2=".") returned 1 [0071.863] wcscmp (_String1="S", _String2="..") returned 1 [0071.863] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x5445900 [0071.863] wcscpy (in: _Dest=0x5445900, _Source="C:\\ProgramData\\Adobe\\ARM" | out: _Dest="C:\\ProgramData\\Adobe\\ARM") returned="C:\\ProgramData\\Adobe\\ARM" [0071.863] wcscat (in: _Dest=0x5445900, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\ARM\\") returned="C:\\ProgramData\\Adobe\\ARM\\" [0071.863] wcscat (in: _Dest=0x5445900, _Source="S" | out: _Dest="C:\\ProgramData\\Adobe\\ARM\\S") returned="C:\\ProgramData\\Adobe\\ARM\\S" [0071.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5445900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f8 [0071.863] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b5508 | out: lpFindFileData=0x53b5508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S", cAlternateFileName="")) returned 0 [0071.864] FindClose (in: hFindFile=0x5445800 | out: hFindFile=0x5445800) returned 1 [0071.864] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b5508) returned 1 [0071.864] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445580) returned 1 [0071.864] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389eb40) returned 1 Thread: id = 228 os_tid = 0x8d8 [0071.785] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 0x20 [0076.058] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", dwFileAttributes=0x20) returned 1 [0076.059] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x110c [0076.059] GetFileSizeEx (in: hFile=0x110c, lpFileSize=0xbf7f934 | out: lpFileSize=0xbf7f934*=156) returned 1 [0076.059] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c30 [0076.059] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c08 [0076.060] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559938 [0076.060] NtQuerySystemTime (in: CurrentTime=0xbf7f894 | out: CurrentTime=0xbf7f894*=132260136332147853) returned 0x0 [0076.060] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0x916a0aea [0076.060] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0xdbd08229 [0076.060] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0xf1799b09 [0076.060] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0x25491ee3 [0076.060] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0xd4d164f8 [0076.060] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0x994e6e55 [0076.060] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0x8c8cbae6 [0076.060] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0x57cdcf0e [0076.061] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0xd5ce0bd [0076.061] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0x6c9c4f85 [0076.061] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0xa5a8c538 [0076.061] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0x65ead365 [0076.061] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0x578c1e73 [0076.061] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0x2c01fc85 [0076.061] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0x6a785d1f [0076.061] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0x69e85c71 [0076.061] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0xd1bcef2f [0076.061] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0xc4eb5cd [0076.061] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0xbf2574d [0076.061] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0x374556ba [0076.061] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0x9802d116 [0076.061] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0x21bf1c09 [0076.061] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0xddf98d7c [0076.061] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0xa4c5d760 [0076.061] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0x97591a8e [0076.061] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0xde9805c8 [0076.061] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0xefcbb7d5 [0076.061] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0x6130400c [0076.061] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0x967a4e63 [0076.061] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0xf2853e72 [0076.062] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0x89b05363 [0076.062] RtlRandom (in: Seed=0xbf7f8a0 | out: Seed=0xbf7f8a0) returned 0x4a3621e6 [0076.081] ReadFile (in: hFile=0x110c, lpBuffer=0x554d060, nNumberOfBytesToRead=0x9c, lpNumberOfBytesRead=0xbf7f890, lpOverlapped=0x0 | out: lpBuffer=0x554d060*, lpNumberOfBytesRead=0xbf7f890*=0x9c, lpOverlapped=0x0) returned 1 [0076.082] SetFilePointerEx (in: hFile=0x110c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.082] WriteFile (in: hFile=0x110c, lpBuffer=0x5598898*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0xbf7f88c, lpOverlapped=0x0 | out: lpBuffer=0x5598898*, lpNumberOfBytesWritten=0xbf7f88c*=0x9c, lpOverlapped=0x0) returned 1 [0076.084] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c30 [0076.084] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559898 [0076.084] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559898) returned 1 [0076.084] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5598898) returned 1 [0076.084] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x554d060) returned 1 [0076.084] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.084] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5890) returned 1 [0076.084] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x39) returned 0x38a5890 [0076.084] SetFilePointerEx (in: hFile=0x110c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.084] WriteFile (in: hFile=0x110c, lpBuffer=0x549cb18*, nNumberOfBytesToWrite=0x11d, lpNumberOfBytesWritten=0xbf7f8f4, lpOverlapped=0x0 | out: lpBuffer=0x549cb18*, lpNumberOfBytesWritten=0xbf7f8f4*=0x11d, lpOverlapped=0x0) returned 1 [0076.086] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549cb18) returned 1 [0076.086] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5608) returned 1 [0076.086] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ac8) returned 1 [0076.086] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5890) returned 1 [0076.086] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559c30) returned 1 [0076.086] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559c08) returned 1 [0076.087] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559d48) returned 1 [0076.087] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559d70) returned 1 [0076.087] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9a) returned 0x38ac838 [0076.087] wcscpy (in: _Dest=0x38ac838, _Source="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" | out: _Dest="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" [0076.087] wcscat (in: _Dest=0x38ac838, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.mailto[knoocknoo@cock.li].a0a70") returned="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.mailto[knoocknoo@cock.li].a0a70" [0076.087] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.mailto[knoocknoo@cock.li].a0a70", NtPathName=0xbf7f8ac, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.087] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x54476d0 [0076.209] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54476d0) returned 1 [0076.209] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54de500) returned 1 [0076.209] NtQueryInformationFile (in: FileHandle=0x110c, IoStatusBlock=0xbf7f8b8, FileInformation=0xbf7f890, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xbf7f8b8, FileInformation=0xbf7f890) returned 0x0 [0076.209] NtSetInformationFile (FileHandle=0x110c, IoStatusBlock=0xbf7f8b8, FileInformation=0xbf7f890, Length=0x28, FileInformationClass=0x4) returned 0x0 [0076.210] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ac838) returned 1 [0076.210] FlushFileBuffers (hFile=0x110c) returned 1 [0076.213] CloseHandle (hObject=0x110c) returned 1 [0076.213] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x5428d40 [0076.213] wcscpy (in: _Dest=0x5428d40, _Source="C:\\$GetCurrent\\SafeOS\\" | out: _Dest="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\" [0076.213] wcscat (in: _Dest=0x5428d40, _Source="A0A70-Readme.txt" | out: _Dest="C:\\$GetCurrent\\SafeOS\\A0A70-Readme.txt") returned="C:\\$GetCurrent\\SafeOS\\A0A70-Readme.txt" [0076.214] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\A0A70-Readme.txt" (normalized: "c:\\$getcurrent\\safeos\\a0a70-readme.txt")) returned 0xffffffff [0076.214] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\A0A70-Readme.txt" (normalized: "c:\\$getcurrent\\safeos\\a0a70-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x110c [0076.215] WriteFile (in: hFile=0x110c, lpBuffer=0x38ab1f8*, nNumberOfBytesToWrite=0x6f4, lpNumberOfBytesWritten=0xbf7f8b4, lpOverlapped=0x0 | out: lpBuffer=0x38ab1f8*, lpNumberOfBytesWritten=0xbf7f8b4*=0x6f4, lpOverlapped=0x0) returned 1 [0076.216] CloseHandle (hObject=0x110c) returned 1 [0076.217] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5428d40) returned 1 [0076.217] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541a9f8) returned 1 Thread: id = 229 os_tid = 0xdec [0071.787] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x96) returned 0x5426e08 [0071.787] wcscpy (in: _Dest=0x5426e08, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm" [0071.787] wcscat (in: _Dest=0x5426e08, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\" [0071.787] wcscat (in: _Dest=0x5426e08, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\*") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\*" [0071.787] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b18e0 [0071.787] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\*", lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x223c89ad, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa93a9ec0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3002ee68, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445800 [0071.797] wcscmp (_String1=".", _String2=".") returned 0 [0071.797] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x223c89ad, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa93a9ec0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3002ee68, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.797] wcscmp (_String1="..", _String2=".") returned 1 [0071.797] wcscmp (_String1="..", _String2="..") returned 0 [0071.797] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x229e4b3b, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x229e4b3b, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x229e4b3b, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="05DBE9EA-EF75-43DB-8A03-27898B59D1E9", cAlternateFileName="05DBE9~1")) returned 1 [0071.797] wcscmp (_String1="05DBE9EA-EF75-43DB-8A03-27898B59D1E9", _String2=".") returned 1 [0071.797] wcscmp (_String1="05DBE9EA-EF75-43DB-8A03-27898B59D1E9", _String2="..") returned 1 [0071.797] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x53fe0c8 [0071.797] wcscpy (in: _Dest=0x53fe0c8, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm" [0071.797] wcscat (in: _Dest=0x53fe0c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\" [0071.797] wcscat (in: _Dest=0x53fe0c8, _Source="05DBE9EA-EF75-43DB-8A03-27898B59D1E9" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\05DBE9EA-EF75-43DB-8A03-27898B59D1E9") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\05DBE9EA-EF75-43DB-8A03-27898B59D1E9" [0071.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53fe0c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x774 [0071.798] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x227f4c7c, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x227f4c7c, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0xce12, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="APPXBL~1.XML")) returned 1 [0071.798] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0071.798] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0071.798] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb4) returned 0x38af788 [0071.798] wcscpy (in: _Dest=0x38af788, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm" [0071.798] wcscat (in: _Dest=0x38af788, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\" [0071.798] wcscat (in: _Dest=0x38af788, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxBlockMap.xml" [0071.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38af788, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x778 [0071.799] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2275c34d, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x2275c34d, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x1f13, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="APPXMA~1.XML")) returned 1 [0071.799] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0071.799] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0071.799] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb4) returned 0x38af848 [0071.799] wcscpy (in: _Dest=0x38af848, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm" [0071.799] wcscat (in: _Dest=0x38af848, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\" [0071.799] wcscat (in: _Dest=0x38af848, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxManifest.xml" [0071.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38af848, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x77c [0071.800] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x228b384c, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa93abe68, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x228b384c, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0071.800] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0071.800] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0071.800] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xac) returned 0x5446a98 [0071.800] wcscpy (in: _Dest=0x5446a98, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm" [0071.800] wcscat (in: _Dest=0x5446a98, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\" [0071.800] wcscat (in: _Dest=0x5446a98, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxMetadata" [0071.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5446a98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x780 [0071.800] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2294c1cd, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x2294c1cd, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x293a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="APPXSI~1.P7X")) returned 1 [0071.801] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0071.801] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0071.801] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb6) returned 0x38af908 [0071.801] wcscpy (in: _Dest=0x38af908, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm" [0071.801] wcscat (in: _Dest=0x38af908, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\" [0071.801] wcscat (in: _Dest=0x38af908, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxSignature.p7x" [0071.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38af908, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x784 [0071.801] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x229e4b3b, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa94b581e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2310be20, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0071.801] wcscmp (_String1="Assets", _String2=".") returned 1 [0071.801] wcscmp (_String1="Assets", _String2="..") returned 1 [0071.801] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa0) returned 0x38abfb0 [0071.801] wcscpy (in: _Dest=0x38abfb0, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm" [0071.802] wcscat (in: _Dest=0x38abfb0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\" [0071.802] wcscat (in: _Dest=0x38abfb0, _Source="Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0071.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38abfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x788 [0071.802] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2310be20, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x2310be20, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0xeb58, dwReserved0=0x0, dwReserved1=0x0, cFileName="clrcompression.dll", cAlternateFileName="CLRCOM~1.DLL")) returned 1 [0071.802] wcscmp (_String1="clrcompression.dll", _String2=".") returned 1 [0071.802] wcscmp (_String1="clrcompression.dll", _String2="..") returned 1 [0071.802] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2310be20, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa967b88f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2313207f, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0071.802] wcscmp (_String1="js", _String2=".") returned 1 [0071.802] wcscmp (_String1="js", _String2="..") returned 1 [0071.802] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x98) returned 0x5426228 [0071.802] wcscpy (in: _Dest=0x5426228, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm" [0071.802] wcscat (in: _Dest=0x5426228, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\" [0071.803] wcscat (in: _Dest=0x5426228, _Source="js" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js" [0071.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5426228, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x78c [0071.803] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3002ee68, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa967c915, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3002ee68, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0071.803] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0071.803] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0071.803] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd6) returned 0x38b4948 [0071.803] wcscpy (in: _Dest=0x38b4948, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm" [0071.803] wcscat (in: _Dest=0x38b4948, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\" [0071.803] wcscat (in: _Dest=0x38b4948, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\microsoft.system.package.metadata" [0071.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b4948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x790 [0071.804] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2313207f, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x2313207f, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x136470, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="RESOUR~1.PRI")) returned 1 [0071.804] wcscmp (_String1="resources.pri", _String2=".") returned 1 [0071.804] wcscmp (_String1="resources.pri", _String2="..") returned 1 [0071.804] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xae) returned 0x5446fa0 [0071.804] wcscpy (in: _Dest=0x5446fa0, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm" [0071.804] wcscat (in: _Dest=0x5446fa0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\" [0071.804] wcscat (in: _Dest=0x5446fa0, _Source="resources.pri" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\resources.pri") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\resources.pri" [0071.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5446fa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x794 [0071.805] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2313207f, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x2313207f, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Twitter.Background.winmd", cAlternateFileName="TWITTE~1.WIN")) returned 1 [0071.805] wcscmp (_String1="Twitter.Background.winmd", _String2=".") returned 1 [0071.805] wcscmp (_String1="Twitter.Background.winmd", _String2="..") returned 1 [0071.805] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x38b4a28 [0071.805] wcscpy (in: _Dest=0x38b4a28, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm" [0071.805] wcscat (in: _Dest=0x38b4a28, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\" [0071.805] wcscat (in: _Dest=0x38b4a28, _Source="Twitter.Background.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Twitter.Background.winmd") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Twitter.Background.winmd" [0071.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b4a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x798 [0071.806] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2313207f, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x2313207f, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x1030c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Twitter.Windows.dll", cAlternateFileName="TWITTE~1.DLL")) returned 1 [0071.806] wcscmp (_String1="Twitter.Windows.dll", _String2=".") returned 1 [0071.806] wcscmp (_String1="Twitter.Windows.dll", _String2="..") returned 1 [0071.806] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2313207f, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x2313207f, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Twitter.Windows.exe", cAlternateFileName="TWITTE~1.EXE")) returned 1 [0071.806] wcscmp (_String1="Twitter.Windows.exe", _String2=".") returned 1 [0071.806] wcscmp (_String1="Twitter.Windows.exe", _String2="..") returned 1 [0071.806] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2313207f, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x2313207f, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0xf81e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Twitter.Windows.xr.xml", cAlternateFileName="TWITTE~1.XML")) returned 1 [0071.806] wcscmp (_String1="Twitter.Windows.xr.xml", _String2=".") returned 1 [0071.806] wcscmp (_String1="Twitter.Windows.xr.xml", _String2="..") returned 1 [0071.806] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x53ff5a0 [0071.806] wcscpy (in: _Dest=0x53ff5a0, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm" [0071.806] wcscat (in: _Dest=0x53ff5a0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\" [0071.806] wcscat (in: _Dest=0x53ff5a0, _Source="Twitter.Windows.xr.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Twitter.Windows.xr.xml") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Twitter.Windows.xr.xml" [0071.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53ff5a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x79c [0071.807] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x231582f9, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x231582f9, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x2434, dwReserved0=0x0, dwReserved1=0x0, cFileName="VoiceCommands.xml", cAlternateFileName="VOICEC~1.XML")) returned 1 [0071.807] wcscmp (_String1="VoiceCommands.xml", _String2=".") returned 1 [0071.807] wcscmp (_String1="VoiceCommands.xml", _String2="..") returned 1 [0071.807] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb6) returned 0x53ff668 [0071.807] wcscpy (in: _Dest=0x53ff668, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm" [0071.807] wcscat (in: _Dest=0x53ff668, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\" [0071.807] wcscat (in: _Dest=0x53ff668, _Source="VoiceCommands.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\VoiceCommands.xml") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\VoiceCommands.xml" [0071.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53ff668, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a0 [0071.808] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x231582f9, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x231582f9, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x2434, dwReserved0=0x0, dwReserved1=0x0, cFileName="VoiceCommands.xml", cAlternateFileName="VOICEC~1.XML")) returned 0 [0071.808] FindClose (in: hFindFile=0x5445800 | out: hFindFile=0x5445800) returned 1 [0071.808] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b18e0) returned 1 [0071.808] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5426e08) returned 1 [0071.808] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5426728) returned 1 Thread: id = 230 os_tid = 0x184 [0071.809] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x5428660 [0071.809] wcscpy (in: _Dest=0x5428660, _Source="C:\\Program Files\\WindowsApps\\Deleted" | out: _Dest="C:\\Program Files\\WindowsApps\\Deleted") returned="C:\\Program Files\\WindowsApps\\Deleted" [0071.809] wcscat (in: _Dest=0x5428660, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Deleted\\") returned="C:\\Program Files\\WindowsApps\\Deleted\\" [0071.809] wcscat (in: _Dest=0x5428660, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Deleted\\*") returned="C:\\Program Files\\WindowsApps\\Deleted\\*" [0071.809] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b3828 [0071.809] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Deleted\\*", lpFindFileData=0x53b3828 | out: lpFindFileData=0x53b3828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa967d4bd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445800 [0071.810] wcscmp (_String1=".", _String2=".") returned 0 [0071.810] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b3828 | out: lpFindFileData=0x53b3828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa967d4bd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.810] wcscmp (_String1="..", _String2=".") returned 1 [0071.810] wcscmp (_String1="..", _String2="..") returned 0 [0071.810] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b3828 | out: lpFindFileData=0x53b3828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa967d4bd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0071.810] FindClose (in: hFindFile=0x5445800 | out: hFindFile=0x5445800) returned 1 [0071.812] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b3828) returned 1 [0071.812] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5428660) returned 1 [0071.812] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5428500) returned 1 Thread: id = 231 os_tid = 0xd88 [0071.813] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x5446cc0 [0071.813] wcscpy (in: _Dest=0x5446cc0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe" [0071.813] wcscat (in: _Dest=0x5446cc0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\" [0071.813] wcscat (in: _Dest=0x5446cc0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\*" [0071.813] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b3828 [0071.813] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x53b3828 | out: lpFindFileData=0x53b3828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96c0f12e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb3c9c41d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb3c9c41d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444d80 [0072.060] wcscmp (_String1=".", _String2=".") returned 0 [0072.060] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53b3828 | out: lpFindFileData=0x53b3828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96c0f12e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb3c9c41d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb3c9c41d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.060] wcscmp (_String1="..", _String2=".") returned 1 [0072.060] wcscmp (_String1="..", _String2="..") returned 0 [0072.060] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53b3828 | out: lpFindFileData=0x53b3828*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8c8b9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x96d8c8b9, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x96d8c8b9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0072.060] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0072.060] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0072.060] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x53ba908 [0072.060] wcscpy (in: _Dest=0x53ba908, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe" [0072.060] wcscat (in: _Dest=0x53ba908, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\" [0072.060] wcscat (in: _Dest=0x53ba908, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" [0072.076] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53ba908, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c8 [0072.077] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53b3828 | out: lpFindFileData=0x53b3828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96c0f12e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9730ad4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x96c0f12e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0072.077] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0072.077] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0072.077] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x53e71d0 [0072.077] wcscpy (in: _Dest=0x53e71d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe" [0072.077] wcscat (in: _Dest=0x53e71d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\" [0072.077] wcscat (in: _Dest=0x53e71d0, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0072.077] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53e71d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ec [0072.078] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53b3828 | out: lpFindFileData=0x53b3828*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8c8b9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x96db2b17, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x96db2b17, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x296e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0072.078] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0072.078] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0072.078] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x53b9fc0 [0072.078] wcscpy (in: _Dest=0x53b9fc0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe" [0072.078] wcscat (in: _Dest=0x53b9fc0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\" [0072.078] wcscat (in: _Dest=0x53b9fc0, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" [0072.078] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53b9fc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f0 [0072.078] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53b3828 | out: lpFindFileData=0x53b3828*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb3c9c41d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa973141d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3c9c41d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0072.078] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0072.079] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0072.079] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x5450988 [0072.079] wcscpy (in: _Dest=0x5450988, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe" [0072.079] wcscat (in: _Dest=0x5450988, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\" [0072.079] wcscat (in: _Dest=0x5450988, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" [0072.079] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5450988, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f4 [0072.079] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53b3828 | out: lpFindFileData=0x53b3828*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb3c9c41d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa973141d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3c9c41d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0072.079] FindClose (in: hFindFile=0x5444d80 | out: hFindFile=0x5444d80) returned 1 [0072.080] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b3828) returned 1 [0072.080] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5446cc0) returned 1 [0072.080] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a1d70) returned 1 Thread: id = 232 os_tid = 0x1258 [0071.815] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa6) returned 0x388f510 [0071.815] wcscpy (in: _Dest=0x388f510, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe" [0071.815] wcscat (in: _Dest=0x388f510, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\" [0071.815] wcscat (in: _Dest=0x388f510, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\*" [0071.815] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b18e0 [0071.815] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96dd8d87, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb3cc2682, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb3cc2682, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445800 [0071.815] wcscmp (_String1=".", _String2=".") returned 0 [0071.815] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96dd8d87, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb3cc2682, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb3cc2682, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.815] wcscmp (_String1="..", _String2=".") returned 1 [0071.815] wcscmp (_String1="..", _String2="..") returned 0 [0071.815] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dd8d87, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x96dfefce, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x96dfefce, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xec8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0071.815] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0071.815] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0071.815] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x53ff7e8 [0071.815] wcscpy (in: _Dest=0x53ff7e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe" [0071.816] wcscat (in: _Dest=0x53ff7e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\" [0071.816] wcscat (in: _Dest=0x53ff7e8, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" [0071.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53ff7e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a8 [0071.816] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dd8d87, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x96dd8d87, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x96dd8d87, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x13a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0071.816] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0071.816] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0071.816] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x38aae40 [0071.816] wcscpy (in: _Dest=0x38aae40, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe" [0071.816] wcscat (in: _Dest=0x38aae40, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\" [0071.816] wcscat (in: _Dest=0x38aae40, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" [0071.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38aae40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ac [0071.817] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96dfefce, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9785683, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x96dfefce, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0071.817] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0071.817] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0071.817] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x38aaf10 [0071.817] wcscpy (in: _Dest=0x38aaf10, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe" [0071.817] wcscat (in: _Dest=0x38aaf10, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\" [0071.817] wcscat (in: _Dest=0x38aaf10, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0071.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38aaf10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b0 [0071.818] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dfefce, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x96dfefce, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x96dfefce, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2995, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0071.818] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0071.818] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0071.818] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x38aafd8 [0071.818] wcscpy (in: _Dest=0x38aafd8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe" [0071.818] wcscat (in: _Dest=0x38aafd8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\" [0071.818] wcscat (in: _Dest=0x38aafd8, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" [0071.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38aafd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b4 [0071.819] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96dfefce, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa97d9a35, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9764f8c5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0071.819] wcscmp (_String1="Assets", _String2=".") returned 1 [0071.819] wcscmp (_String1="Assets", _String2="..") returned 1 [0071.819] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x5446b50 [0071.819] wcscpy (in: _Dest=0x5446b50, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe" [0071.819] wcscat (in: _Dest=0x5446b50, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\" [0071.819] wcscat (in: _Dest=0x5446b50, _Source="Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" [0071.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5446b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b8 [0071.820] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x977346e6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9853e192, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9853e192, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1023200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Builder3D.exe", cAlternateFileName="")) returned 1 [0071.820] wcscmp (_String1="Builder3D.exe", _String2=".") returned 1 [0071.820] wcscmp (_String1="Builder3D.exe", _String2="..") returned 1 [0071.820] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9853e192, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9bd24bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9853e192, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common", cAlternateFileName="")) returned 1 [0071.820] wcscmp (_String1="Common", _String2=".") returned 1 [0071.820] wcscmp (_String1="Common", _String2="..") returned 1 [0071.820] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x5445b80 [0071.820] wcscpy (in: _Dest=0x5445b80, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe" [0071.820] wcscat (in: _Dest=0x5445b80, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\" [0071.820] wcscat (in: _Dest=0x5445b80, _Source="Common" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Common") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Common" [0071.820] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5445b80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7bc [0071.821] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98566969, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x98573136, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x98573136, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x32000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lib3mfUAP.dll", cAlternateFileName="")) returned 1 [0071.821] wcscmp (_String1="Lib3mfUAP.dll", _String2=".") returned 1 [0071.821] wcscmp (_String1="Lib3mfUAP.dll", _String2="..") returned 1 [0071.821] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb3cc2682, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb3cc2682, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb3cc2682, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0071.821] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0071.821] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0071.821] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe6) returned 0x38ab0a8 [0071.821] wcscpy (in: _Dest=0x38ab0a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe" [0071.821] wcscat (in: _Dest=0x38ab0a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\" [0071.821] wcscat (in: _Dest=0x38ab0a8, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0071.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38ab0a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c0 [0071.822] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98573136, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x98685908, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x98685908, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x6cf18, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0071.822] wcscmp (_String1="resources.pri", _String2=".") returned 1 [0071.822] wcscmp (_String1="resources.pri", _String2="..") returned 1 [0071.822] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x38b66e0 [0071.822] wcscpy (in: _Dest=0x38b66e0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe" [0071.822] wcscat (in: _Dest=0x38b66e0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\" [0071.822] wcscat (in: _Dest=0x38b66e0, _Source="resources.pri" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\resources.pri") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\resources.pri" [0071.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b66e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c4 [0071.823] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98573136, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x98685908, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x98685908, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x6cf18, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 0 [0071.823] FindClose (in: hFindFile=0x5445800 | out: hFindFile=0x5445800) returned 1 [0071.823] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b18e0) returned 1 [0071.823] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388f510) returned 1 [0071.823] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388ecd0) returned 1 Thread: id = 233 os_tid = 0x600 [0071.827] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb2) returned 0x38b67a8 [0071.827] wcscpy (in: _Dest=0x38b67a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe" [0071.827] wcscat (in: _Dest=0x38b67a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\" [0071.827] wcscat (in: _Dest=0x38b67a8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\*" [0071.827] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b18e0 [0071.827] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x339fb10b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb4a05954, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb4a05954, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445680 [0071.880] wcscmp (_String1=".", _String2=".") returned 0 [0071.880] FindNextFileW (in: hFindFile=0x5445680, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x339fb10b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb4a05954, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb4a05954, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.880] wcscmp (_String1="..", _String2=".") returned 1 [0071.880] wcscmp (_String1="..", _String2="..") returned 0 [0071.880] FindNextFileW (in: hFindFile=0x5445680, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33a21364, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33a6d81b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33a6d81b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x16cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0071.880] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0071.880] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0071.880] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x53ba758 [0071.880] wcscpy (in: _Dest=0x53ba758, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe" [0071.880] wcscat (in: _Dest=0x53ba758, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\" [0071.880] wcscat (in: _Dest=0x53ba758, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" [0071.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53ba758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x804 [0071.881] FindNextFileW (in: hFindFile=0x5445680, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x339fb10b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33a21364, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33a21364, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xf40, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0071.881] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0071.881] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0071.881] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x53bb178 [0071.881] wcscpy (in: _Dest=0x53bb178, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe" [0071.881] wcscat (in: _Dest=0x53bb178, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\" [0071.881] wcscat (in: _Dest=0x53bb178, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" [0071.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53bb178, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x808 [0071.882] FindNextFileW (in: hFindFile=0x5445680, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33a6d81b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9cb9e99, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33a6d81b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0071.882] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0071.882] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0071.882] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x53bb9b0 [0071.882] wcscpy (in: _Dest=0x53bb9b0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe" [0071.882] wcscat (in: _Dest=0x53bb9b0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\" [0071.882] wcscat (in: _Dest=0x53bb9b0, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0071.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53bb9b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x80c [0071.883] FindNextFileW (in: hFindFile=0x5445680, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33a6d81b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33a6d81b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33a6d81b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2991, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0071.883] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0071.883] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0071.883] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x53bba80 [0071.883] wcscpy (in: _Dest=0x53bba80, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe" [0071.883] wcscat (in: _Dest=0x53bba80, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\" [0071.883] wcscat (in: _Dest=0x53bba80, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" [0071.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53bba80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x810 [0071.884] FindNextFileW (in: hFindFile=0x5445680, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33a6d81b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33a6d81b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33a6d81b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0071.884] wcscmp (_String1="logo.png", _String2=".") returned 1 [0071.884] wcscmp (_String1="logo.png", _String2="..") returned 1 [0071.884] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x38b6868 [0071.884] wcscpy (in: _Dest=0x38b6868, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe" [0071.884] wcscat (in: _Dest=0x38b6868, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\" [0071.884] wcscat (in: _Dest=0x38b6868, _Source="logo.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\logo.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\logo.png" [0071.884] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b6868, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x814 [0071.885] FindNextFileW (in: hFindFile=0x5445680, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ccfdd0, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9cba947, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33cf6025, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising", cAlternateFileName="MICROS~1.ADV")) returned 1 [0071.885] wcscmp (_String1="Microsoft.Advertising", _String2=".") returned 1 [0071.885] wcscmp (_String1="Microsoft.Advertising", _String2="..") returned 1 [0071.885] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x53bbb60 [0071.885] wcscpy (in: _Dest=0x53bbb60, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe" [0071.885] wcscat (in: _Dest=0x53bbb60, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\" [0071.885] wcscat (in: _Dest=0x53bbb60, _Source="Microsoft.Advertising" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising" [0071.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53bbb60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x818 [0071.886] FindNextFileW (in: hFindFile=0x5445680, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33a93a75, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33ca9b72, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33ca9b72, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3e1998, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.dll", cAlternateFileName="")) returned 1 [0071.886] wcscmp (_String1="Microsoft.Advertising.dll", _String2=".") returned 1 [0071.886] wcscmp (_String1="Microsoft.Advertising.dll", _String2="..") returned 1 [0071.886] FindNextFileW (in: hFindFile=0x5445680, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33ca9b72, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33ccfdd0, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33ccfdd0, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x9598, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.winmd", cAlternateFileName="")) returned 1 [0071.886] wcscmp (_String1="Microsoft.Advertising.winmd", _String2=".") returned 1 [0071.886] wcscmp (_String1="Microsoft.Advertising.winmd", _String2="..") returned 1 [0071.886] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe6) returned 0x53bbc48 [0071.886] wcscpy (in: _Dest=0x53bbc48, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe" [0071.886] wcscat (in: _Dest=0x53bbc48, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\" [0071.886] wcscat (in: _Dest=0x53bbc48, _Source="Microsoft.Advertising.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising.winmd" [0071.887] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53bbc48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x81c [0071.887] FindNextFileW (in: hFindFile=0x5445680, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb4a05954, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb4a05954, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xdfcbee3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0071.887] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0071.887] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0071.887] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x53bbd38 [0071.887] wcscpy (in: _Dest=0x53bbd38, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe" [0071.887] wcscat (in: _Dest=0x53bbd38, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\" [0071.887] wcscat (in: _Dest=0x53bbd38, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0071.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53bbd38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x820 [0071.888] FindNextFileW (in: hFindFile=0x5445680, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33d27ae5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33d27ae5, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33d27ae5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0071.888] wcscmp (_String1="resources.pri", _String2=".") returned 1 [0071.888] wcscmp (_String1="resources.pri", _String2="..") returned 1 [0071.888] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xca) returned 0x53ba5a8 [0071.888] wcscpy (in: _Dest=0x53ba5a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe" [0071.888] wcscat (in: _Dest=0x53ba5a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\" [0071.888] wcscat (in: _Dest=0x53ba5a8, _Source="resources.pri" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\resources.pri") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\resources.pri" [0071.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53ba5a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x824 [0071.889] FindNextFileW (in: hFindFile=0x5445680, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33d27ae5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33d27ae5, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33d27ae5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 0 [0071.889] FindClose (in: hFindFile=0x5445680 | out: hFindFile=0x5445680) returned 1 [0071.890] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b18e0) returned 1 [0071.890] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b67a8) returned 1 [0071.890] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a1ee0) returned 1 Thread: id = 234 os_tid = 0x168 [0071.828] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb2) returned 0x38b6930 [0071.828] wcscpy (in: _Dest=0x38b6930, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe" [0071.828] wcscat (in: _Dest=0x38b6930, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\" [0071.828] wcscat (in: _Dest=0x38b6930, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\*" [0071.829] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b1b48 [0071.829] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x53b1b48 | out: lpFindFileData=0x53b1b48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33d4dd68, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb523798b, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb523798b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444e80 [0072.059] wcscmp (_String1=".", _String2=".") returned 0 [0072.059] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x53b1b48 | out: lpFindFileData=0x53b1b48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33d4dd68, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb523798b, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb523798b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.060] wcscmp (_String1="..", _String2=".") returned 1 [0072.060] wcscmp (_String1="..", _String2="..") returned 0 [0072.060] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x53b1b48 | out: lpFindFileData=0x53b1b48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33d4dd68, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33d4dd68, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33d4dd68, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1318, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0072.060] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0072.060] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0072.060] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x53ba170 [0072.060] wcscpy (in: _Dest=0x53ba170, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe" [0072.060] wcscat (in: _Dest=0x53ba170, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\" [0072.060] wcscat (in: _Dest=0x53ba170, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" [0072.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53ba170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c8 [0072.061] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x53b1b48 | out: lpFindFileData=0x53b1b48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33d4dd68, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33d4dd68, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33d4dd68, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xf40, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0072.061] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0072.061] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0072.061] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x53ba9e0 [0072.061] wcscpy (in: _Dest=0x53ba9e0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe" [0072.061] wcscat (in: _Dest=0x53ba9e0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\" [0072.062] wcscat (in: _Dest=0x53ba9e0, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" [0072.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53ba9e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8cc [0072.062] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x53b1b48 | out: lpFindFileData=0x53b1b48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33d73fc1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9e44ee0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33d73fc1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0072.062] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0072.062] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0072.062] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x54060e8 [0072.062] wcscpy (in: _Dest=0x54060e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe" [0072.062] wcscat (in: _Dest=0x54060e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\" [0072.062] wcscat (in: _Dest=0x54060e8, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxMetadata" [0072.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54060e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d0 [0072.063] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x53b1b48 | out: lpFindFileData=0x53b1b48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33d4dd68, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33d73fc1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33d73fc1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x298f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0072.063] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0072.063] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0072.063] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x54061b8 [0072.063] wcscpy (in: _Dest=0x54061b8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe" [0072.063] wcscat (in: _Dest=0x54061b8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\" [0072.063] wcscat (in: _Dest=0x54061b8, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" [0072.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54061b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d4 [0072.064] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x53b1b48 | out: lpFindFileData=0x53b1b48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33da3978, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33da3978, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33da3978, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0072.064] wcscmp (_String1="logo.png", _String2=".") returned 1 [0072.064] wcscmp (_String1="logo.png", _String2="..") returned 1 [0072.064] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x38b69f0 [0072.064] wcscpy (in: _Dest=0x38b69f0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe" [0072.064] wcscat (in: _Dest=0x38b69f0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\" [0072.064] wcscat (in: _Dest=0x38b69f0, _Source="logo.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\logo.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\logo.png" [0072.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b69f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d8 [0072.065] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x53b1b48 | out: lpFindFileData=0x53b1b48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f2112c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9e45833, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33f47386, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising", cAlternateFileName="MICROS~1.ADV")) returned 1 [0072.065] wcscmp (_String1="Microsoft.Advertising", _String2=".") returned 1 [0072.065] wcscmp (_String1="Microsoft.Advertising", _String2="..") returned 1 [0072.065] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x53fe9b8 [0072.065] wcscpy (in: _Dest=0x53fe9b8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe" [0072.065] wcscat (in: _Dest=0x53fe9b8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\" [0072.065] wcscat (in: _Dest=0x53fe9b8, _Source="Microsoft.Advertising" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" [0072.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53fe9b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8dc [0072.066] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x53b1b48 | out: lpFindFileData=0x53b1b48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33dc9bf6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33f2112c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33f2112c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x31ed98, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.dll", cAlternateFileName="")) returned 1 [0072.066] wcscmp (_String1="Microsoft.Advertising.dll", _String2=".") returned 1 [0072.066] wcscmp (_String1="Microsoft.Advertising.dll", _String2="..") returned 1 [0072.066] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x53b1b48 | out: lpFindFileData=0x53b1b48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33f2112c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33f2112c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33f2112c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x9598, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.winmd", cAlternateFileName="")) returned 1 [0072.066] wcscmp (_String1="Microsoft.Advertising.winmd", _String2=".") returned 1 [0072.066] wcscmp (_String1="Microsoft.Advertising.winmd", _String2="..") returned 1 [0072.066] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe6) returned 0x53feaa0 [0072.066] wcscpy (in: _Dest=0x53feaa0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe" [0072.066] wcscat (in: _Dest=0x53feaa0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\" [0072.066] wcscat (in: _Dest=0x53feaa0, _Source="Microsoft.Advertising.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd" [0072.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53feaa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e0 [0072.067] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x53b1b48 | out: lpFindFileData=0x53b1b48*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb523798b, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb523798b, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xe0183a1, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0072.067] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0072.067] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0072.067] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x53feb90 [0072.067] wcscpy (in: _Dest=0x53feb90, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe" [0072.067] wcscat (in: _Dest=0x53feb90, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\" [0072.067] wcscat (in: _Dest=0x53feb90, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0072.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53feb90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e4 [0072.068] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x53b1b48 | out: lpFindFileData=0x53b1b48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33f47386, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33f6d5e4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33f6d5e4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0072.068] wcscmp (_String1="resources.pri", _String2=".") returned 1 [0072.068] wcscmp (_String1="resources.pri", _String2="..") returned 1 [0072.068] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xca) returned 0x53ba248 [0072.068] wcscpy (in: _Dest=0x53ba248, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe" [0072.068] wcscat (in: _Dest=0x53ba248, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\" [0072.068] wcscat (in: _Dest=0x53ba248, _Source="resources.pri" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\resources.pri") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\resources.pri" [0072.068] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53ba248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e8 [0072.069] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x53b1b48 | out: lpFindFileData=0x53b1b48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33f47386, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33f6d5e4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33f6d5e4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 0 [0072.069] FindClose (in: hFindFile=0x5444e80 | out: hFindFile=0x5444e80) returned 1 [0072.070] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b1b48) returned 1 [0072.070] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b6930) returned 1 [0072.070] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a1588) returned 1 Thread: id = 235 os_tid = 0xfc0 [0071.830] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xaa) returned 0x5446d78 [0071.830] wcscpy (in: _Dest=0x5446d78, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe" [0071.830] wcscat (in: _Dest=0x5446d78, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\" [0071.830] wcscat (in: _Dest=0x5446d78, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\*" [0071.830] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b1db0 [0071.830] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\*", lpFindFileData=0x53b1db0 | out: lpFindFileData=0x53b1db0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfa8fd8, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa9f2aac4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5e205736, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54455c0 [0071.831] wcscmp (_String1=".", _String2=".") returned 0 [0071.831] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x53b1db0 | out: lpFindFileData=0x53b1db0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfa8fd8, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa9f2aac4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5e205736, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.831] wcscmp (_String1="..", _String2=".") returned 1 [0071.831] wcscmp (_String1="..", _String2="..") returned 0 [0071.831] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x53b1db0 | out: lpFindFileData=0x53b1db0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfcf205, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xcdfcf205, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xcdfcf205, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0071.831] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0071.831] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0071.831] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x38b6ab8 [0071.831] wcscpy (in: _Dest=0x38b6ab8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe" [0071.831] wcscat (in: _Dest=0x38b6ab8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\" [0071.831] wcscat (in: _Dest=0x38b6ab8, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxBlockMap.xml" [0071.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b6ab8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d0 [0071.832] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x53b1db0 | out: lpFindFileData=0x53b1db0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfa8fd8, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xcdfa8fd8, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xcdfa8fd8, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xab8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0071.832] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0071.832] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0071.832] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x38b6b88 [0071.832] wcscpy (in: _Dest=0x38b6b88, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe" [0071.832] wcscat (in: _Dest=0x38b6b88, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\" [0071.832] wcscat (in: _Dest=0x38b6b88, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxManifest.xml" [0071.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b6b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d4 [0071.833] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x53b1db0 | out: lpFindFileData=0x53b1db0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfcf205, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xcdfcf205, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xcdfcf205, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x296b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0071.833] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0071.833] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0071.833] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xca) returned 0x389cb38 [0071.833] wcscpy (in: _Dest=0x389cb38, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe" [0071.833] wcscat (in: _Dest=0x389cb38, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\" [0071.833] wcscat (in: _Dest=0x389cb38, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxSignature.p7x" [0071.833] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x389cb38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d8 [0071.834] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x53b1db0 | out: lpFindFileData=0x53b1db0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfcf205, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa9f2be01, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfcf205, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0071.834] wcscmp (_String1="css", _String2=".") returned 1 [0071.834] wcscmp (_String1="css", _String2="..") returned 1 [0071.834] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xae) returned 0x5446c08 [0071.834] wcscpy (in: _Dest=0x5446c08, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe" [0071.834] wcscat (in: _Dest=0x5446c08, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\" [0071.834] wcscat (in: _Dest=0x5446c08, _Source="css" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css" [0071.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5446c08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7dc [0071.835] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x53b1db0 | out: lpFindFileData=0x53b1db0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfcf205, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xcdfcf205, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xcdfcf205, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x127, dwReserved0=0x0, dwReserved1=0x0, cFileName="default.html", cAlternateFileName="")) returned 1 [0071.835] wcscmp (_String1="default.html", _String2=".") returned 1 [0071.835] wcscmp (_String1="default.html", _String2="..") returned 1 [0071.835] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x38b6c58 [0071.835] wcscpy (in: _Dest=0x38b6c58, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe" [0071.835] wcscat (in: _Dest=0x38b6c58, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\" [0071.835] wcscat (in: _Dest=0x38b6c58, _Source="default.html" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\default.html") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\default.html" [0071.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b6c58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e0 [0071.836] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x53b1db0 | out: lpFindFileData=0x53b1db0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfcf205, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa9f2cc20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdff5463, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0071.836] wcscmp (_String1="images", _String2=".") returned 1 [0071.836] wcscmp (_String1="images", _String2="..") returned 1 [0071.836] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb4) returned 0x5470450 [0071.836] wcscpy (in: _Dest=0x5470450, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe" [0071.836] wcscat (in: _Dest=0x5470450, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\" [0071.836] wcscat (in: _Dest=0x5470450, _Source="images" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images" [0071.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5470450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e4 [0071.837] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x53b1db0 | out: lpFindFileData=0x53b1db0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdff5463, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa9f2d5d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdff5463, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0071.837] wcscmp (_String1="js", _String2=".") returned 1 [0071.837] wcscmp (_String1="js", _String2="..") returned 1 [0071.837] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xac) returned 0x5445c38 [0071.837] wcscpy (in: _Dest=0x5445c38, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe" [0071.837] wcscat (in: _Dest=0x5445c38, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\" [0071.837] wcscat (in: _Dest=0x5445c38, _Source="js" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js" [0071.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5445c38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e8 [0071.838] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x53b1db0 | out: lpFindFileData=0x53b1db0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5e205736, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x10032a71, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x10032a71, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0071.838] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0071.838] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0071.838] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xea) returned 0x5450e60 [0071.838] wcscpy (in: _Dest=0x5450e60, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe" [0071.838] wcscat (in: _Dest=0x5450e60, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\" [0071.838] wcscat (in: _Dest=0x5450e60, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0071.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5450e60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ec [0071.839] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x53b1db0 | out: lpFindFileData=0x53b1db0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdff5463, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xcdff5463, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xcdff5463, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0071.839] wcscmp (_String1="resources.pri", _String2=".") returned 1 [0071.839] wcscmp (_String1="resources.pri", _String2="..") returned 1 [0071.839] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x5470510 [0071.839] wcscpy (in: _Dest=0x5470510, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe" [0071.839] wcscat (in: _Dest=0x5470510, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\" [0071.839] wcscat (in: _Dest=0x5470510, _Source="resources.pri" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\resources.pri") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\resources.pri" [0071.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5470510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f0 [0071.839] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x53b1db0 | out: lpFindFileData=0x53b1db0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdff5463, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xcdff5463, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xcdff5463, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 0 [0071.840] FindClose (in: hFindFile=0x54455c0 | out: hFindFile=0x54455c0) returned 1 [0071.840] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b1db0) returned 1 [0071.840] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5446d78) returned 1 [0071.840] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388ed80) returned 1 Thread: id = 236 os_tid = 0x380 [0071.841] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x54705e0 [0071.841] wcscpy (in: _Dest=0x54705e0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe" [0071.841] wcscat (in: _Dest=0x54705e0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\" [0071.841] wcscat (in: _Dest=0x54705e0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\*" [0071.841] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b1db0 [0071.842] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x53b1db0 | out: lpFindFileData=0x53b1db0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdf3689c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa041d8d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5e205736, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f300 [0077.154] wcscmp (_String1=".", _String2=".") returned 0 [0077.154] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x53b1db0 | out: lpFindFileData=0x53b1db0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdf3689c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa041d8d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5e205736, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.154] wcscmp (_String1="..", _String2=".") returned 1 [0077.154] wcscmp (_String1="..", _String2="..") returned 0 [0077.154] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x53b1db0 | out: lpFindFileData=0x53b1db0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdf5cafa, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xcdf5cafa, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xcdf5cafa, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0077.154] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0077.154] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0077.154] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x54b1f18 [0077.154] wcscpy (in: _Dest=0x54b1f18, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe" [0077.154] wcscat (in: _Dest=0x54b1f18, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\" [0077.154] wcscat (in: _Dest=0x54b1f18, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" [0080.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54b1f18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1200 [0080.978] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x53b1db0 | out: lpFindFileData=0x53b1db0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdf3689c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa04335f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdf3689c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0080.978] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0080.978] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0080.978] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x757f778 [0080.978] wcscpy (in: _Dest=0x757f778, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe" [0080.978] wcscat (in: _Dest=0x757f778, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\" [0080.978] wcscat (in: _Dest=0x757f778, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0080.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x757f778, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1910 [0080.979] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x53b1db0 | out: lpFindFileData=0x53b1db0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdf5cafa, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xcdf5cafa, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xcdf5cafa, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x296b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0080.979] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0080.979] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0080.979] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x54baf80 [0080.979] wcscpy (in: _Dest=0x54baf80, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe" [0080.979] wcscat (in: _Dest=0x54baf80, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\" [0080.979] wcscat (in: _Dest=0x54baf80, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" [0080.979] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54baf80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1914 [0080.979] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x53b1db0 | out: lpFindFileData=0x53b1db0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5e205736, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa043ddd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5e205736, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0080.979] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0080.979] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0080.979] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfa) returned 0x75813a0 [0080.979] wcscpy (in: _Dest=0x75813a0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe" [0080.979] wcscat (in: _Dest=0x75813a0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\" [0080.979] wcscat (in: _Dest=0x75813a0, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" [0080.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x75813a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1918 [0080.980] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x53b1db0 | out: lpFindFileData=0x53b1db0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5e205736, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa043ddd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5e205736, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0080.980] FindClose (in: hFindFile=0x389f300 | out: hFindFile=0x389f300) returned 1 [0080.981] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b1db0) returned 1 [0080.981] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54705e0) returned 1 [0091.704] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388b7a0) returned 1 Thread: id = 237 os_tid = 0x518 [0071.843] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xae) returned 0x5446d78 [0071.843] wcscpy (in: _Dest=0x5446d78, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe" [0071.843] wcscat (in: _Dest=0x5446d78, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\" [0071.843] wcscat (in: _Dest=0x5446d78, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*" [0071.843] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b2018 [0071.843] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x53b2018 | out: lpFindFileData=0x53b2018*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x773fa578, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa095f16, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eed6166, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e900 [0076.974] wcscmp (_String1=".", _String2=".") returned 0 [0076.974] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x53b2018 | out: lpFindFileData=0x53b2018*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x773fa578, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa095f16, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eed6166, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.974] wcscmp (_String1="..", _String2=".") returned 1 [0076.974] wcscmp (_String1="..", _String2="..") returned 0 [0076.974] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x53b2018 | out: lpFindFileData=0x53b2018*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x773fa578, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x773fa578, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x773fa578, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0076.974] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0076.974] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0076.974] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x3974690 [0076.974] wcscpy (in: _Dest=0x3974690, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe" [0076.974] wcscat (in: _Dest=0x3974690, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\" [0076.974] wcscat (in: _Dest=0x3974690, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" [0081.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3974690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a3c [0081.066] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x53b2018 | out: lpFindFileData=0x53b2018*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x773fa578, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa096b21, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x773fa578, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0081.066] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0081.066] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0081.066] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x55fcf88 [0081.066] wcscpy (in: _Dest=0x55fcf88, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe" [0081.066] wcscat (in: _Dest=0x55fcf88, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\" [0081.066] wcscat (in: _Dest=0x55fcf88, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0081.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55fcf88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a40 [0081.067] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x53b2018 | out: lpFindFileData=0x53b2018*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x773fa578, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x773fa578, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x773fa578, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x296b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0081.067] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0081.067] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0081.067] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x757f268 [0081.067] wcscpy (in: _Dest=0x757f268, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe" [0081.067] wcscat (in: _Dest=0x757f268, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\" [0081.067] wcscat (in: _Dest=0x757f268, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" [0081.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x757f268, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a44 [0081.068] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x53b2018 | out: lpFindFileData=0x53b2018*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5eed6166, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa097114, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eed6166, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0081.068] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0081.068] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0081.068] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xee) returned 0x7332a08 [0091.748] wcscpy (in: _Dest=0x7332a08, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe" [0091.748] wcscat (in: _Dest=0x7332a08, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\" [0091.748] wcscat (in: _Dest=0x7332a08, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" Thread: id = 238 os_tid = 0xf28 [0071.843] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa4) returned 0x388ecd0 [0071.843] wcscpy (in: _Dest=0x388ecd0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" [0071.843] wcscat (in: _Dest=0x388ecd0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\" [0071.843] wcscat (in: _Dest=0x388ecd0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\*" [0071.843] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b2280 [0071.843] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7746cb84, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa097cbe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eefc3c1, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54450c0 [0072.119] wcscmp (_String1=".", _String2=".") returned 0 [0072.119] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7746cb84, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa097cbe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eefc3c1, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.273] wcscmp (_String1="..", _String2=".") returned 1 [0072.273] wcscmp (_String1="..", _String2="..") returned 0 [0072.273] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77492ec4, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x7509, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConfiguration.xml", cAlternateFileName="")) returned 1 [0072.273] wcscmp (_String1="AppConfiguration.xml", _String2=".") returned 1 [0072.273] wcscmp (_String1="AppConfiguration.xml", _String2="..") returned 1 [0072.273] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xca) returned 0x53bafc8 [0072.273] wcscpy (in: _Dest=0x53bafc8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" [0072.273] wcscat (in: _Dest=0x53bafc8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.273] wcscat (in: _Dest=0x53bafc8, _Source="AppConfiguration.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml" [0072.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53bafc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x560 [0072.274] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7746cb84, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7746cb84, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7746cb84, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x7e84, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0072.274] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0072.274] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0072.274] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x53f7af0 [0072.274] wcscpy (in: _Dest=0x53f7af0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" [0072.274] wcscat (in: _Dest=0x53f7af0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.274] wcscat (in: _Dest=0x53f7af0, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" [0072.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53f7af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa18 [0072.275] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7746cb84, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7746cb84, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7746cb84, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2072, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0072.275] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0072.275] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0072.275] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x53f7880 [0072.275] wcscpy (in: _Dest=0x53f7880, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" [0072.275] wcscat (in: _Dest=0x53f7880, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.275] wcscat (in: _Dest=0x53f7880, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" [0072.275] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53f7880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa1c [0072.276] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa098c51, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0072.276] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0072.276] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0072.276] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x53e8288 [0072.276] wcscpy (in: _Dest=0x53e8288, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" [0072.276] wcscat (in: _Dest=0x53e8288, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.276] wcscat (in: _Dest=0x53e8288, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata" [0072.276] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53e8288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa20 [0072.277] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77492ec4, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x298e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0072.277] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0072.277] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0072.277] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x53f7fd0 [0072.277] wcscpy (in: _Dest=0x53f7fd0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" [0072.277] wcscat (in: _Dest=0x53f7fd0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.277] wcscat (in: _Dest=0x53f7fd0, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" [0072.277] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53f7fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa24 [0072.278] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0991e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0072.278] wcscmp (_String1="Assets", _String2=".") returned 1 [0072.278] wcscmp (_String1="Assets", _String2="..") returned 1 [0072.278] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xae) returned 0x5447058 [0072.278] wcscpy (in: _Dest=0x5447058, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" [0072.278] wcscat (in: _Dest=0x5447058, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.278] wcscat (in: _Dest=0x5447058, _Source="Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets" [0072.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5447058, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa28 [0072.278] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7752b705, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7752b705, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xe958, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClrCompression.dll", cAlternateFileName="")) returned 1 [0072.279] wcscmp (_String1="ClrCompression.dll", _String2=".") returned 1 [0072.279] wcscmp (_String1="ClrCompression.dll", _String2="..") returned 1 [0072.279] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa1412e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7752b705, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Configuration", cAlternateFileName="CONFIG~1")) returned 1 [0072.279] wcscmp (_String1="Configuration", _String2=".") returned 1 [0072.279] wcscmp (_String1="Configuration", _String2="..") returned 1 [0072.279] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x53e8e40 [0072.279] wcscpy (in: _Dest=0x53e8e40, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" [0072.279] wcscat (in: _Dest=0x53e8e40, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.279] wcscat (in: _Dest=0x53e8e40, _Source="Configuration" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration" [0072.279] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53e8e40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa2c [0072.279] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20b499, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7755195b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JsonResources", cAlternateFileName="JSONRE~1")) returned 1 [0072.280] wcscmp (_String1="JsonResources", _String2=".") returned 1 [0072.280] wcscmp (_String1="JsonResources", _String2="..") returned 1 [0072.280] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x53f9448 [0072.281] wcscpy (in: _Dest=0x53f9448, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" [0072.281] wcscat (in: _Dest=0x53f9448, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.281] wcscat (in: _Dest=0x53f9448, _Source="JsonResources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources" [0072.282] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53f9448, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa30 [0072.284] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7755195b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7755195b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7755195b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x211d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MarketConfiguration.xml", cAlternateFileName="")) returned 1 [0072.284] wcscmp (_String1="MarketConfiguration.xml", _String2=".") returned 1 [0072.284] wcscmp (_String1="MarketConfiguration.xml", _String2="..") returned 1 [0072.284] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x53bb0a0 [0072.284] wcscpy (in: _Dest=0x53bb0a0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" [0072.284] wcscat (in: _Dest=0x53bb0a0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.284] wcscat (in: _Dest=0x53bb0a0, _Source="MarketConfiguration.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml" [0072.284] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53bb0a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa34 [0072.285] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x776cf25e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20c37f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x776f534b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising", cAlternateFileName="MICROS~1.ADV")) returned 1 [0072.285] wcscmp (_String1="Microsoft.Advertising", _String2=".") returned 1 [0072.285] wcscmp (_String1="Microsoft.Advertising", _String2="..") returned 1 [0072.285] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x53bb400 [0072.285] wcscpy (in: _Dest=0x53bb400, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" [0072.285] wcscat (in: _Dest=0x53bb400, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.285] wcscat (in: _Dest=0x53bb400, _Source="Microsoft.Advertising" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" [0072.285] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53bb400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa38 [0072.286] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7755195b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7755195b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x776cf25e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x35acb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.dll", cAlternateFileName="")) returned 1 [0072.286] wcscmp (_String1="Microsoft.Advertising.dll", _String2=".") returned 1 [0072.286] wcscmp (_String1="Microsoft.Advertising.dll", _String2="..") returned 1 [0072.286] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x776cf25e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x776cf25e, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x776cf25e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.winmd", cAlternateFileName="")) returned 1 [0072.286] wcscmp (_String1="Microsoft.Advertising.winmd", _String2=".") returned 1 [0072.286] wcscmp (_String1="Microsoft.Advertising.winmd", _String2="..") returned 1 [0072.286] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x546e588 [0072.286] wcscpy (in: _Dest=0x546e588, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" [0072.286] wcscat (in: _Dest=0x546e588, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.286] wcscat (in: _Dest=0x546e588, _Source="Microsoft.Advertising.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd" [0072.286] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x546e588, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa3c [0072.287] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x776f534b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x776f534b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7771b5a1, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x9d800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Aria.ClientTelemetry.dll", cAlternateFileName="")) returned 1 [0072.287] wcscmp (_String1="Microsoft.Aria.ClientTelemetry.dll", _String2=".") returned 1 [0072.287] wcscmp (_String1="Microsoft.Aria.ClientTelemetry.dll", _String2="..") returned 1 [0072.287] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7774199d, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7774199d, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7774199d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Aria.ClientTelemetry.winmd", cAlternateFileName="")) returned 1 [0072.287] wcscmp (_String1="Microsoft.Aria.ClientTelemetry.winmd", _String2=".") returned 1 [0072.287] wcscmp (_String1="Microsoft.Aria.ClientTelemetry.winmd", _String2="..") returned 1 [0072.287] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xea) returned 0x5450798 [0072.287] wcscpy (in: _Dest=0x5450798, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" [0072.287] wcscat (in: _Dest=0x5450798, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.287] wcscat (in: _Dest=0x5450798, _Source="Microsoft.Aria.ClientTelemetry.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd" [0072.287] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5450798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa40 [0072.288] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7774199d, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7774199d, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xbda000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Money.dll", cAlternateFileName="")) returned 1 [0072.288] wcscmp (_String1="Microsoft.Msn.Money.dll", _String2=".") returned 1 [0072.288] wcscmp (_String1="Microsoft.Msn.Money.dll", _String2="..") returned 1 [0072.288] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77b93d5c, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Money.exe", cAlternateFileName="")) returned 1 [0072.288] wcscmp (_String1="Microsoft.Msn.Money.exe", _String2=".") returned 1 [0072.288] wcscmp (_String1="Microsoft.Msn.Money.exe", _String2="..") returned 1 [0072.288] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20dbad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Services", cAlternateFileName="MICROS~1.SER")) returned 1 [0072.288] wcscmp (_String1="Microsoft.Msn.Services", _String2=".") returned 1 [0072.288] wcscmp (_String1="Microsoft.Msn.Services", _String2="..") returned 1 [0072.288] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x53b99d8 [0072.288] wcscpy (in: _Dest=0x53b99d8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" [0072.288] wcscat (in: _Dest=0x53b99d8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.288] wcscat (in: _Dest=0x53b99d8, _Source="Microsoft.Msn.Services" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services" [0072.288] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53b99d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa44 [0072.289] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2911b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Shell", cAlternateFileName="MICROS~1.SHE")) returned 1 [0072.289] wcscmp (_String1="Microsoft.Msn.Shell", _String2=".") returned 1 [0072.289] wcscmp (_String1="Microsoft.Msn.Shell", _String2="..") returned 1 [0072.289] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x53f7a20 [0072.289] wcscpy (in: _Dest=0x53f7a20, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" [0072.289] wcscat (in: _Dest=0x53f7a20, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.289] wcscat (in: _Dest=0x53f7a20, _Source="Microsoft.Msn.Shell" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell" [0072.289] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53f7a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa48 [0072.290] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5eefc3c1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa292b95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eefc3c1, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0072.290] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0072.290] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0072.290] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe4) returned 0x546e668 [0072.290] wcscpy (in: _Dest=0x546e668, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" [0072.290] wcscat (in: _Dest=0x546e668, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.290] wcscat (in: _Dest=0x546e668, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0072.290] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x546e668, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa4c [0072.291] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77bb9eb0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftAdvertising.ini", cAlternateFileName="")) returned 1 [0072.291] wcscmp (_String1="MicrosoftAdvertising.ini", _String2=".") returned 1 [0072.291] wcscmp (_String1="MicrosoftAdvertising.ini", _String2="..") returned 1 [0072.291] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x546e758 [0072.291] wcscpy (in: _Dest=0x546e758, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" [0072.291] wcscat (in: _Dest=0x546e758, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.291] wcscat (in: _Dest=0x546e758, _Source="MicrosoftAdvertising.ini" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MicrosoftAdvertising.ini") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MicrosoftAdvertising.ini" [0072.291] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x546e758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa50 [0072.292] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77be010a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa293090, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77be010a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSAdvertisingJS", cAlternateFileName="MSADVE~1")) returned 1 [0072.292] wcscmp (_String1="MSAdvertisingJS", _String2=".") returned 1 [0072.292] wcscmp (_String1="MSAdvertisingJS", _String2="..") returned 1 [0072.292] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x53f92b8 [0072.292] wcscpy (in: _Dest=0x53f92b8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" [0072.292] wcscat (in: _Dest=0x53f92b8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.292] wcscat (in: _Dest=0x53f92b8, _Source="MSAdvertisingJS" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS" [0072.292] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53f92b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa54 [0072.293] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77be010a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77be010a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77be010a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4413, dwReserved0=0x0, dwReserved1=0x0, cFileName="PlatformConfiguration.xml", cAlternateFileName="")) returned 1 [0072.293] wcscmp (_String1="PlatformConfiguration.xml", _String2=".") returned 1 [0072.293] wcscmp (_String1="PlatformConfiguration.xml", _String2="..") returned 1 [0072.293] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd4) returned 0x546e838 [0072.293] wcscpy (in: _Dest=0x546e838, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" [0072.293] wcscat (in: _Dest=0x546e838, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.293] wcscat (in: _Dest=0x546e838, _Source="PlatformConfiguration.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\PlatformConfiguration.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\PlatformConfiguration.xml" [0072.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x546e838, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa58 [0072.294] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77be010a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77be010a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77c2c6ee, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xdee88, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0072.294] wcscmp (_String1="resources.pri", _String2=".") returned 1 [0072.294] wcscmp (_String1="resources.pri", _String2="..") returned 1 [0072.294] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x53f9768 [0072.294] wcscpy (in: _Dest=0x53f9768, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" [0072.294] wcscat (in: _Dest=0x53f9768, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.294] wcscat (in: _Dest=0x53f9768, _Source="resources.pri" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri" [0072.294] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53f9768, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa5c [0072.295] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c2c6ee, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77c2c6ee, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77c78b89, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xe5200, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLite3Wrapper.dll", cAlternateFileName="")) returned 1 [0072.295] wcscmp (_String1="SQLite3Wrapper.dll", _String2=".") returned 1 [0072.295] wcscmp (_String1="SQLite3Wrapper.dll", _String2="..") returned 1 [0072.295] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c78b89, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77c78b89, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77c78b89, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLiteWrapper.winmd", cAlternateFileName="")) returned 1 [0072.295] wcscmp (_String1="SQLiteWrapper.winmd", _String2=".") returned 1 [0072.295] wcscmp (_String1="SQLiteWrapper.winmd", _String2="..") returned 1 [0072.295] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x53f7540 [0072.295] wcscpy (in: _Dest=0x53f7540, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" [0072.295] wcscat (in: _Dest=0x53f7540, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.295] wcscat (in: _Dest=0x53f7540, _Source="SQLiteWrapper.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\SQLiteWrapper.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\SQLiteWrapper.winmd" [0072.295] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53f7540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa60 [0072.296] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0986e1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 1 [0072.296] wcscmp (_String1="_Resources", _String2=".") returned 1 [0072.296] wcscmp (_String1="_Resources", _String2="..") returned 1 [0072.296] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb6) returned 0x5460fe8 [0072.296] wcscpy (in: _Dest=0x5460fe8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" [0072.296] wcscat (in: _Dest=0x5460fe8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.296] wcscat (in: _Dest=0x5460fe8, _Source="_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources" [0072.296] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5460fe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa64 [0072.297] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0986e1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 0 [0072.297] FindClose (in: hFindFile=0x54450c0 | out: hFindFile=0x54450c0) returned 1 [0072.298] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b2280) returned 1 [0072.298] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388ecd0) returned 1 [0072.298] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38abbc0) returned 1 Thread: id = 239 os_tid = 0xd14 [0071.844] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa8) returned 0x388ed80 [0071.844] wcscpy (in: _Dest=0x388ed80, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe" [0071.844] wcscat (in: _Dest=0x388ed80, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\" [0071.844] wcscat (in: _Dest=0x388ed80, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*" [0071.844] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b24e8 [0071.844] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x53b24e8 | out: lpFindFileData=0x53b24e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70454cf5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa293665, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ea00 [0077.098] wcscmp (_String1=".", _String2=".") returned 0 [0077.098] FindNextFileW (in: hFindFile=0x389ea00, lpFindFileData=0x53b24e8 | out: lpFindFileData=0x53b24e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70454cf5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa293665, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.098] wcscmp (_String1="..", _String2=".") returned 1 [0077.098] wcscmp (_String1="..", _String2="..") returned 0 [0077.098] FindNextFileW (in: hFindFile=0x389ea00, lpFindFileData=0x53b24e8 | out: lpFindFileData=0x53b24e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70454cf5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x70454cf5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x70454cf5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0077.098] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0077.098] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0077.098] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x55fe238 [0077.098] wcscpy (in: _Dest=0x55fe238, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe" [0077.098] wcscat (in: _Dest=0x55fe238, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\" [0077.098] wcscat (in: _Dest=0x55fe238, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" [0081.052] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55fe238, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d4 [0081.053] FindNextFileW (in: hFindFile=0x389ea00, lpFindFileData=0x53b24e8 | out: lpFindFileData=0x53b24e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70454cf5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa293d66, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70454cf5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0081.053] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0081.053] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0081.053] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x3976530 [0081.053] wcscpy (in: _Dest=0x3976530, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe" [0081.053] wcscat (in: _Dest=0x3976530, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\" [0081.053] wcscat (in: _Dest=0x3976530, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0081.053] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3976530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a10 [0081.054] FindNextFileW (in: hFindFile=0x389ea00, lpFindFileData=0x53b24e8 | out: lpFindFileData=0x53b24e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7047af3f, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7047af3f, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7047af3f, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2967, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0081.054] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0081.054] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0081.054] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x55fcd18 [0081.054] wcscpy (in: _Dest=0x55fcd18, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe" [0081.054] wcscat (in: _Dest=0x55fcd18, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\" [0081.054] wcscat (in: _Dest=0x55fcd18, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" [0081.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55fcd18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a14 [0081.054] FindNextFileW (in: hFindFile=0x389ea00, lpFindFileData=0x53b24e8 | out: lpFindFileData=0x53b24e8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5fac1d9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa2942e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0081.054] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0081.055] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0081.055] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x727ea30 [0091.744] wcscpy (in: _Dest=0x727ea30, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe" [0091.744] wcscat (in: _Dest=0x727ea30, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\" [0091.744] wcscat (in: _Dest=0x727ea30, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" Thread: id = 240 os_tid = 0xb24 [0071.844] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9e) returned 0x38ac058 [0071.844] wcscpy (in: _Dest=0x38ac058, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" [0071.844] wcscat (in: _Dest=0x38ac058, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\" [0071.845] wcscat (in: _Dest=0x38ac058, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\*" [0071.845] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b2750 [0071.845] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d4c9e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445100 [0072.120] wcscmp (_String1=".", _String2=".") returned 0 [0072.120] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d4c9e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.218] wcscmp (_String1="..", _String2=".") returned 1 [0072.218] wcscmp (_String1="..", _String2="..") returned 0 [0072.218] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704a11ba, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x502d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConfiguration.xml", cAlternateFileName="")) returned 1 [0072.218] wcscmp (_String1="AppConfiguration.xml", _String2=".") returned 1 [0072.219] wcscmp (_String1="AppConfiguration.xml", _String2="..") returned 1 [0072.219] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x53e76b0 [0072.219] wcscpy (in: _Dest=0x53e76b0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" [0072.219] wcscat (in: _Dest=0x53e76b0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.219] wcscat (in: _Dest=0x53e76b0, _Source="AppConfiguration.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml" [0072.219] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53e76b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x56c [0072.219] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704a11ba, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x6eb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0072.219] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0072.219] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0072.219] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x53e8b20 [0072.219] wcscpy (in: _Dest=0x53e8b20, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" [0072.219] wcscat (in: _Dest=0x53e8b20, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.220] wcscat (in: _Dest=0x53e8b20, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" [0072.220] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53e8b20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9cc [0072.220] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704a11ba, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2092, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0072.220] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0072.220] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0072.220] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x53e8418 [0072.220] wcscpy (in: _Dest=0x53e8418, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" [0072.220] wcscat (in: _Dest=0x53e8418, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.220] wcscat (in: _Dest=0x53e8418, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" [0072.221] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53e8418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d0 [0072.221] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d61ce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0072.221] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0072.221] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0072.221] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb4) returned 0x5461d68 [0072.221] wcscpy (in: _Dest=0x5461d68, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" [0072.221] wcscat (in: _Dest=0x5461d68, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.221] wcscat (in: _Dest=0x5461d68, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata" [0072.221] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5461d68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d4 [0072.222] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704a11ba, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2992, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0072.222] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0072.222] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0072.222] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53e85a8 [0072.222] wcscpy (in: _Dest=0x53e85a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" [0072.222] wcscat (in: _Dest=0x53e85a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.222] wcscat (in: _Dest=0x53e85a8, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" [0072.222] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53e85a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d8 [0072.223] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d69dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0072.223] wcscmp (_String1="Assets", _String2=".") returned 1 [0072.223] wcscmp (_String1="Assets", _String2="..") returned 1 [0072.223] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa8) returned 0x388f510 [0072.223] wcscpy (in: _Dest=0x388f510, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" [0072.223] wcscat (in: _Dest=0x388f510, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.223] wcscat (in: _Dest=0x388f510, _Source="Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets" [0072.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x388f510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9dc [0072.224] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xe958, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClrCompression.dll", cAlternateFileName="")) returned 1 [0072.224] wcscmp (_String1="ClrCompression.dll", _String2=".") returned 1 [0072.224] wcscmp (_String1="ClrCompression.dll", _String2="..") returned 1 [0072.224] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x705138c0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa458f92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x705138c0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Configuration", cAlternateFileName="CONFIG~1")) returned 1 [0072.224] wcscmp (_String1="Configuration", _String2=".") returned 1 [0072.224] wcscmp (_String1="Configuration", _String2="..") returned 1 [0072.224] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb6) returned 0x5461828 [0072.224] wcscpy (in: _Dest=0x5461828, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" [0072.225] wcscat (in: _Dest=0x5461828, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.225] wcscat (in: _Dest=0x5461828, _Source="Configuration" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration" [0072.225] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5461828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e0 [0072.225] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705138c0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x705138c0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x705138c0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x9572, dwReserved0=0x0, dwReserved1=0x0, cFileName="MarketConfiguration.xml", cAlternateFileName="")) returned 1 [0072.225] wcscmp (_String1="MarketConfiguration.xml", _String2=".") returned 1 [0072.225] wcscmp (_String1="MarketConfiguration.xml", _String2="..") returned 1 [0072.225] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xca) returned 0x53b9ee8 [0072.225] wcscpy (in: _Dest=0x53b9ee8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" [0072.226] wcscat (in: _Dest=0x53b9ee8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.226] wcscat (in: _Dest=0x53b9ee8, _Source="MarketConfiguration.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml" [0072.226] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53b9ee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e4 [0072.226] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70585fca, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa459889, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x705ac224, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising", cAlternateFileName="MICROS~1.ADV")) returned 1 [0072.226] wcscmp (_String1="Microsoft.Advertising", _String2=".") returned 1 [0072.226] wcscmp (_String1="Microsoft.Advertising", _String2="..") returned 1 [0072.226] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x53e7e00 [0072.226] wcscpy (in: _Dest=0x53e7e00, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" [0072.227] wcscat (in: _Dest=0x53e7e00, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.227] wcscat (in: _Dest=0x53e7e00, _Source="Microsoft.Advertising" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" [0072.227] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53e7e00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e8 [0072.227] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705138c0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x705138c0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x70585fca, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x35acb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.dll", cAlternateFileName="")) returned 1 [0072.227] wcscmp (_String1="Microsoft.Advertising.dll", _String2=".") returned 1 [0072.227] wcscmp (_String1="Microsoft.Advertising.dll", _String2="..") returned 1 [0072.227] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70585fca, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x70585fca, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x70585fca, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.winmd", cAlternateFileName="")) returned 1 [0072.227] wcscmp (_String1="Microsoft.Advertising.winmd", _String2=".") returned 1 [0072.227] wcscmp (_String1="Microsoft.Advertising.winmd", _String2="..") returned 1 [0072.227] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x38b5500 [0072.228] wcscpy (in: _Dest=0x38b5500, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" [0072.228] wcscat (in: _Dest=0x38b5500, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.228] wcscat (in: _Dest=0x38b5500, _Source="Microsoft.Advertising.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd" [0072.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b5500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9ec [0072.228] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705ac224, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x705ac224, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x705ac224, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x9d800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Aria.ClientTelemetry.dll", cAlternateFileName="")) returned 1 [0072.229] wcscmp (_String1="Microsoft.Aria.ClientTelemetry.dll", _String2=".") returned 1 [0072.229] wcscmp (_String1="Microsoft.Aria.ClientTelemetry.dll", _String2="..") returned 1 [0072.229] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705ac224, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x705ac224, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x705ac224, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Aria.ClientTelemetry.winmd", cAlternateFileName="")) returned 1 [0072.229] wcscmp (_String1="Microsoft.Aria.ClientTelemetry.winmd", _String2=".") returned 1 [0072.229] wcscmp (_String1="Microsoft.Aria.ClientTelemetry.winmd", _String2="..") returned 1 [0072.229] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe4) returned 0x38b55e0 [0072.229] wcscpy (in: _Dest=0x38b55e0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" [0072.229] wcscat (in: _Dest=0x38b55e0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.229] wcscat (in: _Dest=0x38b55e0, _Source="Microsoft.Aria.ClientTelemetry.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd" [0072.229] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b55e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f0 [0072.229] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705ac224, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x705ac224, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa20e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.News.dll", cAlternateFileName="")) returned 1 [0072.230] wcscmp (_String1="Microsoft.Msn.News.dll", _String2=".") returned 1 [0072.230] wcscmp (_String1="Microsoft.Msn.News.dll", _String2="..") returned 1 [0072.230] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7074fc08, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.News.exe", cAlternateFileName="")) returned 1 [0072.230] wcscmp (_String1="Microsoft.Msn.News.exe", _String2=".") returned 1 [0072.230] wcscmp (_String1="Microsoft.Msn.News.exe", _String2="..") returned 1 [0072.230] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45af55, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Services", cAlternateFileName="MICROS~1.SER")) returned 1 [0072.230] wcscmp (_String1="Microsoft.Msn.Services", _String2=".") returned 1 [0072.230] wcscmp (_String1="Microsoft.Msn.Services", _String2="..") returned 1 [0072.230] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x53e7780 [0072.230] wcscpy (in: _Dest=0x53e7780, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" [0072.230] wcscat (in: _Dest=0x53e7780, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.230] wcscat (in: _Dest=0x53e7780, _Source="Microsoft.Msn.Services" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services" [0072.230] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53e7780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f4 [0072.231] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa4624cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Shell", cAlternateFileName="MICROS~1.SHE")) returned 1 [0072.231] wcscmp (_String1="Microsoft.Msn.Shell", _String2=".") returned 1 [0072.231] wcscmp (_String1="Microsoft.Msn.Shell", _String2="..") returned 1 [0072.231] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x53e7850 [0072.231] wcscpy (in: _Dest=0x53e7850, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" [0072.231] wcscat (in: _Dest=0x53e7850, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.231] wcscat (in: _Dest=0x53e7850, _Source="Microsoft.Msn.Shell" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell" [0072.231] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53e7850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f8 [0072.232] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5fac1d9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa466063, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0072.232] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0072.232] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0072.232] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xde) returned 0x546dff8 [0072.232] wcscpy (in: _Dest=0x546dff8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" [0072.232] wcscat (in: _Dest=0x546dff8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.232] wcscat (in: _Dest=0x546dff8, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0072.232] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x546dff8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9fc [0072.233] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x70775e5e, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftAdvertising.ini", cAlternateFileName="")) returned 1 [0072.233] wcscmp (_String1="MicrosoftAdvertising.ini", _String2=".") returned 1 [0072.233] wcscmp (_String1="MicrosoftAdvertising.ini", _String2="..") returned 1 [0072.233] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x53ba3f8 [0072.233] wcscpy (in: _Dest=0x53ba3f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" [0072.233] wcscat (in: _Dest=0x53ba3f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.233] wcscat (in: _Dest=0x53ba3f8, _Source="MicrosoftAdvertising.ini" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MicrosoftAdvertising.ini") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MicrosoftAdvertising.ini" [0072.233] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53ba3f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa00 [0072.234] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa466b87, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSAdvertisingJS", cAlternateFileName="MSADVE~1")) returned 1 [0072.234] wcscmp (_String1="MSAdvertisingJS", _String2=".") returned 1 [0072.234] wcscmp (_String1="MSAdvertisingJS", _String2="..") returned 1 [0072.234] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x53e81c0 [0072.234] wcscpy (in: _Dest=0x53e81c0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" [0072.234] wcscat (in: _Dest=0x53e81c0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.234] wcscat (in: _Dest=0x53e81c0, _Source="MSAdvertisingJS" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS" [0072.234] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53e81c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa04 [0072.235] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x70775e5e, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4413, dwReserved0=0x0, dwReserved1=0x0, cFileName="PlatformConfiguration.xml", cAlternateFileName="")) returned 1 [0072.235] wcscmp (_String1="PlatformConfiguration.xml", _String2=".") returned 1 [0072.235] wcscmp (_String1="PlatformConfiguration.xml", _String2="..") returned 1 [0072.235] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x53bb328 [0072.235] wcscpy (in: _Dest=0x53bb328, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" [0072.235] wcscat (in: _Dest=0x53bb328, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.235] wcscat (in: _Dest=0x53bb328, _Source="PlatformConfiguration.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\PlatformConfiguration.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\PlatformConfiguration.xml" [0072.235] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53bb328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa08 [0072.235] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x70775e5e, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7079c0bc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x6c528, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0072.236] wcscmp (_String1="resources.pri", _String2=".") returned 1 [0072.236] wcscmp (_String1="resources.pri", _String2="..") returned 1 [0072.236] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb6) returned 0x54615e8 [0072.236] wcscpy (in: _Dest=0x54615e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" [0072.236] wcscat (in: _Dest=0x54615e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.236] wcscat (in: _Dest=0x54615e8, _Source="resources.pri" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri" [0072.236] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54615e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa0c [0072.236] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7079c0bc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7079c0bc, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x707c2312, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xe5200, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLite3Wrapper.dll", cAlternateFileName="")) returned 1 [0072.236] wcscmp (_String1="SQLite3Wrapper.dll", _String2=".") returned 1 [0072.236] wcscmp (_String1="SQLite3Wrapper.dll", _String2="..") returned 1 [0072.236] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x707c2312, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x707c2312, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x707c2312, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLiteWrapper.winmd", cAlternateFileName="")) returned 1 [0072.237] wcscmp (_String1="SQLiteWrapper.winmd", _String2=".") returned 1 [0072.237] wcscmp (_String1="SQLiteWrapper.winmd", _String2="..") returned 1 [0072.237] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x53e7100 [0072.237] wcscpy (in: _Dest=0x53e7100, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" [0072.237] wcscat (in: _Dest=0x53e7100, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.237] wcscat (in: _Dest=0x53e7100, _Source="SQLiteWrapper.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\SQLiteWrapper.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\SQLiteWrapper.winmd" [0072.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53e7100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa10 [0072.237] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d5b50, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 1 [0072.237] wcscmp (_String1="_Resources", _String2=".") returned 1 [0072.237] wcscmp (_String1="_Resources", _String2="..") returned 1 [0072.237] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x54462b0 [0072.238] wcscpy (in: _Dest=0x54462b0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" [0072.238] wcscat (in: _Dest=0x54462b0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.238] wcscat (in: _Dest=0x54462b0, _Source="_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources" [0072.238] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54462b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa14 [0072.239] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d5b50, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 0 [0072.239] FindClose (in: hFindFile=0x5445100 | out: hFindFile=0x5445100) returned 1 [0072.239] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b2750) returned 1 [0072.239] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ac058) returned 1 [0072.239] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ac100) returned 1 Thread: id = 241 os_tid = 0xc94 [0071.845] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xac) returned 0x5446ee8 [0071.845] wcscpy (in: _Dest=0x5446ee8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe" [0071.845] wcscat (in: _Dest=0x5446ee8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\" [0071.845] wcscat (in: _Dest=0x5446ee8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*" [0071.845] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b2e88 [0071.845] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x53b2e88 | out: lpFindFileData=0x53b2e88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c254236, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa53d33a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608513a6, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ea80 [0077.100] wcscmp (_String1=".", _String2=".") returned 0 [0077.100] FindNextFileW (in: hFindFile=0x389ea80, lpFindFileData=0x53b2e88 | out: lpFindFileData=0x53b2e88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c254236, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa53d33a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608513a6, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.100] wcscmp (_String1="..", _String2=".") returned 1 [0077.100] wcscmp (_String1="..", _String2="..") returned 0 [0077.100] FindNextFileW (in: hFindFile=0x389ea80, lpFindFileData=0x53b2e88 | out: lpFindFileData=0x53b2e88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c254236, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c254236, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c254236, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0077.100] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0077.100] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0077.100] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xca) returned 0x389e200 [0077.100] wcscpy (in: _Dest=0x389e200, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe" [0077.100] wcscat (in: _Dest=0x389e200, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\" [0077.100] wcscat (in: _Dest=0x389e200, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" [0081.047] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x389e200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d8 [0081.047] FindNextFileW (in: hFindFile=0x389ea80, lpFindFileData=0x53b2e88 | out: lpFindFileData=0x53b2e88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c254236, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa53e492, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c254236, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0081.047] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0081.047] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0081.047] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x55fcc48 [0081.047] wcscpy (in: _Dest=0x55fcc48, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe" [0081.047] wcscat (in: _Dest=0x55fcc48, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\" [0081.047] wcscat (in: _Dest=0x55fcc48, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0081.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55fcc48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a04 [0081.048] FindNextFileW (in: hFindFile=0x389ea80, lpFindFileData=0x53b2e88 | out: lpFindFileData=0x53b2e88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c27a365, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c27a365, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c27a365, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x296b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0081.048] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0081.048] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0081.048] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x757f190 [0081.048] wcscpy (in: _Dest=0x757f190, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe" [0081.048] wcscat (in: _Dest=0x757f190, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\" [0081.048] wcscat (in: _Dest=0x757f190, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" [0081.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x757f190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a08 [0081.049] FindNextFileW (in: hFindFile=0x389ea80, lpFindFileData=0x53b2e88 | out: lpFindFileData=0x53b2e88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x608513a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa53f14b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608513a6, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0081.049] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0081.049] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0081.049] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x7286898 [0081.049] wcscpy (in: _Dest=0x7286898, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe" [0081.049] wcscat (in: _Dest=0x7286898, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\" [0081.049] wcscat (in: _Dest=0x7286898, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" [0081.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7286898, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a0c [0081.050] FindNextFileW (in: hFindFile=0x389ea80, lpFindFileData=0x53b2e88 | out: lpFindFileData=0x53b2e88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x608513a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa53f14b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608513a6, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0081.050] FindClose (in: hFindFile=0x389ea80 | out: hFindFile=0x389ea80) returned 1 [0081.051] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b2e88) returned 1 [0081.051] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5446ee8) returned 1 [0081.051] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388dfc0) returned 1 Thread: id = 242 os_tid = 0xab0 [0071.846] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa2) returned 0x388f510 [0071.846] wcscpy (in: _Dest=0x388f510, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" [0071.846] wcscat (in: _Dest=0x388f510, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\" [0071.846] wcscat (in: _Dest=0x388f510, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\*" [0071.846] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b30f0 [0071.846] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2a05a2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d0219, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608775e5, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445140 [0072.121] wcscmp (_String1=".", _String2=".") returned 0 [0072.121] FindNextFileW (in: hFindFile=0x5445140, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2a05a2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d0219, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608775e5, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.192] wcscmp (_String1="..", _String2=".") returned 1 [0072.192] wcscmp (_String1="..", _String2="..") returned 0 [0072.192] FindNextFileW (in: hFindFile=0x5445140, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c2c683a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x11251, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConfiguration.xml", cAlternateFileName="")) returned 1 [0072.192] wcscmp (_String1="AppConfiguration.xml", _String2=".") returned 1 [0072.192] wcscmp (_String1="AppConfiguration.xml", _String2="..") returned 1 [0072.192] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x53e7370 [0072.192] wcscpy (in: _Dest=0x53e7370, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" [0072.192] wcscat (in: _Dest=0x53e7370, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.193] wcscat (in: _Dest=0x53e7370, _Source="AppConfiguration.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml" [0072.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53e7370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x918 [0072.193] FindNextFileW (in: hFindFile=0x5445140, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c2c683a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x7730, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0072.193] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0072.193] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0072.193] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x53e88c8 [0072.193] wcscpy (in: _Dest=0x53e88c8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" [0072.193] wcscat (in: _Dest=0x53e88c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.193] wcscat (in: _Dest=0x53e88c8, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" [0072.194] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53e88c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x97c [0072.194] FindNextFileW (in: hFindFile=0x5445140, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2a05a2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c2a05a2, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2088, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0072.194] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0072.194] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0072.194] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x53e80f8 [0072.194] wcscpy (in: _Dest=0x53e80f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" [0072.194] wcscat (in: _Dest=0x53e80f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.194] wcscat (in: _Dest=0x53e80f8, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" [0072.194] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53e80f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x980 [0072.195] FindNextFileW (in: hFindFile=0x5445140, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d1b5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0072.195] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0072.195] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0072.195] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb8) returned 0x5461ca8 [0072.195] wcscpy (in: _Dest=0x5461ca8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" [0072.195] wcscat (in: _Dest=0x5461ca8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.195] wcscat (in: _Dest=0x5461ca8, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata" [0072.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5461ca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x984 [0072.196] FindNextFileW (in: hFindFile=0x5445140, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c2c683a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2991, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0072.196] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0072.196] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0072.196] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x53e7440 [0072.196] wcscpy (in: _Dest=0x53e7440, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" [0072.196] wcscat (in: _Dest=0x53e7440, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.196] wcscat (in: _Dest=0x53e7440, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" [0072.196] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53e7440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x988 [0072.197] FindNextFileW (in: hFindFile=0x5445140, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d25c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0072.197] wcscmp (_String1="Assets", _String2=".") returned 1 [0072.197] wcscmp (_String1="Assets", _String2="..") returned 1 [0072.197] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xac) returned 0x5446cc0 [0072.197] wcscpy (in: _Dest=0x5446cc0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" [0072.197] wcscat (in: _Dest=0x5446cc0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.197] wcscat (in: _Dest=0x5446cc0, _Source="Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets" [0072.197] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5446cc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x98c [0072.198] FindNextFileW (in: hFindFile=0x5445140, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c35f15d, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c35f15d, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xe958, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClrCompression.dll", cAlternateFileName="")) returned 1 [0072.198] wcscmp (_String1="ClrCompression.dll", _String2=".") returned 1 [0072.198] wcscmp (_String1="ClrCompression.dll", _String2="..") returned 1 [0072.198] FindNextFileW (in: hFindFile=0x5445140, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c35f15d, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c41d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Configuration", cAlternateFileName="CONFIG~1")) returned 1 [0072.198] wcscmp (_String1="Configuration", _String2=".") returned 1 [0072.198] wcscmp (_String1="Configuration", _String2="..") returned 1 [0072.198] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x53e8738 [0072.198] wcscpy (in: _Dest=0x53e8738, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" [0072.198] wcscat (in: _Dest=0x53e8738, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.198] wcscat (in: _Dest=0x53e8738, _Source="Configuration" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration" [0072.198] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53e8738, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x990 [0072.199] FindNextFileW (in: hFindFile=0x5445140, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c3853b7, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c3853b7, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c3853b7, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x5ab7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MarketConfiguration.xml", cAlternateFileName="")) returned 1 [0072.199] wcscmp (_String1="MarketConfiguration.xml", _String2=".") returned 1 [0072.199] wcscmp (_String1="MarketConfiguration.xml", _String2="..") returned 1 [0072.199] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x53b9c60 [0072.199] wcscpy (in: _Dest=0x53b9c60, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" [0072.199] wcscat (in: _Dest=0x53b9c60, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.199] wcscat (in: _Dest=0x53b9c60, _Source="MarketConfiguration.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml" [0072.199] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53b9c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x994 [0072.200] FindNextFileW (in: hFindFile=0x5445140, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c490576, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c48a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c490576, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising", cAlternateFileName="MICROS~1.ADV")) returned 1 [0072.200] wcscmp (_String1="Microsoft.Advertising", _String2=".") returned 1 [0072.200] wcscmp (_String1="Microsoft.Advertising", _String2="..") returned 1 [0072.200] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xca) returned 0x53bab90 [0072.200] wcscpy (in: _Dest=0x53bab90, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" [0072.200] wcscat (in: _Dest=0x53bab90, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.200] wcscat (in: _Dest=0x53bab90, _Source="Microsoft.Advertising" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" [0072.200] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53bab90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x998 [0072.201] FindNextFileW (in: hFindFile=0x5445140, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c3853b7, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c3853b7, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c46a340, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x35acb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.dll", cAlternateFileName="")) returned 1 [0072.201] wcscmp (_String1="Microsoft.Advertising.dll", _String2=".") returned 1 [0072.201] wcscmp (_String1="Microsoft.Advertising.dll", _String2="..") returned 1 [0072.201] FindNextFileW (in: hFindFile=0x5445140, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c46a340, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c46a340, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c490576, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.winmd", cAlternateFileName="")) returned 1 [0072.201] wcscmp (_String1="Microsoft.Advertising.winmd", _String2=".") returned 1 [0072.201] wcscmp (_String1="Microsoft.Advertising.winmd", _String2="..") returned 1 [0072.201] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd6) returned 0x38b5160 [0072.201] wcscpy (in: _Dest=0x38b5160, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" [0072.201] wcscat (in: _Dest=0x38b5160, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.201] wcscat (in: _Dest=0x38b5160, _Source="Microsoft.Advertising.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd" [0072.201] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b5160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x99c [0072.203] FindNextFileW (in: hFindFile=0x5445140, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c490576, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c490576, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c4b67dc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x9d800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Aria.ClientTelemetry.dll", cAlternateFileName="")) returned 1 [0072.203] wcscmp (_String1="Microsoft.Aria.ClientTelemetry.dll", _String2=".") returned 1 [0072.203] wcscmp (_String1="Microsoft.Aria.ClientTelemetry.dll", _String2="..") returned 1 [0072.203] FindNextFileW (in: hFindFile=0x5445140, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c4dca2a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Aria.ClientTelemetry.winmd", cAlternateFileName="")) returned 1 [0072.203] wcscmp (_String1="Microsoft.Aria.ClientTelemetry.winmd", _String2=".") returned 1 [0072.203] wcscmp (_String1="Microsoft.Aria.ClientTelemetry.winmd", _String2="..") returned 1 [0072.203] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x38b5240 [0072.203] wcscpy (in: _Dest=0x38b5240, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" [0072.203] wcscat (in: _Dest=0x38b5240, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.203] wcscat (in: _Dest=0x38b5240, _Source="Microsoft.Aria.ClientTelemetry.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd" [0072.204] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b5240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a0 [0072.204] FindNextFileW (in: hFindFile=0x5445140, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c5add, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Services", cAlternateFileName="MICROS~1.SER")) returned 1 [0072.204] wcscmp (_String1="Microsoft.Msn.Services", _String2=".") returned 1 [0072.204] wcscmp (_String1="Microsoft.Msn.Services", _String2="..") returned 1 [0072.204] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x53ba098 [0072.204] wcscpy (in: _Dest=0x53ba098, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" [0072.204] wcscat (in: _Dest=0x53ba098, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.204] wcscat (in: _Dest=0x53ba098, _Source="Microsoft.Msn.Services" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services" [0072.204] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53ba098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a4 [0072.205] FindNextFileW (in: hFindFile=0x5445140, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa7402e1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Shell", cAlternateFileName="MICROS~1.SHE")) returned 1 [0072.205] wcscmp (_String1="Microsoft.Msn.Shell", _String2=".") returned 1 [0072.205] wcscmp (_String1="Microsoft.Msn.Shell", _String2="..") returned 1 [0072.205] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x53e7510 [0072.205] wcscpy (in: _Dest=0x53e7510, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" [0072.205] wcscat (in: _Dest=0x53e7510, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.205] wcscat (in: _Dest=0x53e7510, _Source="Microsoft.Msn.Shell" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell" [0072.205] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53e7510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a8 [0072.206] FindNextFileW (in: hFindFile=0x5445140, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c502c94, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c9a1593, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xb8da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Sports.dll", cAlternateFileName="")) returned 1 [0072.206] wcscmp (_String1="Microsoft.Msn.Sports.dll", _String2=".") returned 1 [0072.206] wcscmp (_String1="Microsoft.Msn.Sports.dll", _String2="..") returned 1 [0072.206] FindNextFileW (in: hFindFile=0x5445140, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c9a1593, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c9a1593, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c9a1593, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Sports.exe", cAlternateFileName="")) returned 1 [0072.206] wcscmp (_String1="Microsoft.Msn.Sports.exe", _String2=".") returned 1 [0072.206] wcscmp (_String1="Microsoft.Msn.Sports.exe", _String2="..") returned 1 [0072.206] FindNextFileW (in: hFindFile=0x5445140, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x608775e5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa743364, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608775e5, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0072.206] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0072.206] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0072.206] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x38b5330 [0072.206] wcscpy (in: _Dest=0x38b5330, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" [0072.207] wcscat (in: _Dest=0x38b5330, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.207] wcscat (in: _Dest=0x38b5330, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0072.207] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b5330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9ac [0072.207] FindNextFileW (in: hFindFile=0x5445140, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c9a1593, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c9a1593, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c9a1593, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftAdvertising.ini", cAlternateFileName="")) returned 1 [0072.207] wcscmp (_String1="MicrosoftAdvertising.ini", _String2=".") returned 1 [0072.207] wcscmp (_String1="MicrosoftAdvertising.ini", _String2="..") returned 1 [0072.207] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x53b9d38 [0072.208] wcscpy (in: _Dest=0x53b9d38, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" [0072.208] wcscat (in: _Dest=0x53b9d38, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.208] wcscat (in: _Dest=0x53b9d38, _Source="MicrosoftAdvertising.ini" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MicrosoftAdvertising.ini") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MicrosoftAdvertising.ini" [0072.208] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53b9d38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b0 [0072.208] FindNextFileW (in: hFindFile=0x5445140, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c9a1593, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa743cf4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c9c77d0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSAdvertisingJS", cAlternateFileName="MSADVE~1")) returned 1 [0072.208] wcscmp (_String1="MSAdvertisingJS", _String2=".") returned 1 [0072.208] wcscmp (_String1="MSAdvertisingJS", _String2="..") returned 1 [0072.208] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53e7f68 [0072.208] wcscpy (in: _Dest=0x53e7f68, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" [0072.208] wcscat (in: _Dest=0x53e7f68, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.209] wcscat (in: _Dest=0x53e7f68, _Source="MSAdvertisingJS" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS" [0072.209] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53e7f68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b4 [0072.210] FindNextFileW (in: hFindFile=0x5445140, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c9c77d0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c9c77d0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c9c77d0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4413, dwReserved0=0x0, dwReserved1=0x0, cFileName="PlatformConfiguration.xml", cAlternateFileName="")) returned 1 [0072.210] wcscmp (_String1="PlatformConfiguration.xml", _String2=".") returned 1 [0072.210] wcscmp (_String1="PlatformConfiguration.xml", _String2="..") returned 1 [0072.210] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x38b5420 [0072.210] wcscpy (in: _Dest=0x38b5420, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" [0072.210] wcscat (in: _Dest=0x38b5420, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.210] wcscat (in: _Dest=0x38b5420, _Source="PlatformConfiguration.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\PlatformConfiguration.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\PlatformConfiguration.xml" [0072.210] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b5420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b8 [0072.211] FindNextFileW (in: hFindFile=0x5445140, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c9c77d0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c9c77d0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c9edaa1, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x7f760, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0072.211] wcscmp (_String1="resources.pri", _String2=".") returned 1 [0072.211] wcscmp (_String1="resources.pri", _String2="..") returned 1 [0072.211] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x53e8030 [0072.211] wcscpy (in: _Dest=0x53e8030, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" [0072.211] wcscat (in: _Dest=0x53e8030, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.211] wcscat (in: _Dest=0x53e8030, _Source="resources.pri" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri" [0072.211] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53e8030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9bc [0072.211] FindNextFileW (in: hFindFile=0x5445140, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c9edaa1, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c9edaa1, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6cad2708, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xe5200, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLite3Wrapper.dll", cAlternateFileName="")) returned 1 [0072.211] wcscmp (_String1="SQLite3Wrapper.dll", _String2=".") returned 1 [0072.211] wcscmp (_String1="SQLite3Wrapper.dll", _String2="..") returned 1 [0072.211] FindNextFileW (in: hFindFile=0x5445140, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cad2708, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6cad2708, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6cad2708, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLiteWrapper.winmd", cAlternateFileName="")) returned 1 [0072.211] wcscmp (_String1="SQLiteWrapper.winmd", _String2=".") returned 1 [0072.211] wcscmp (_String1="SQLiteWrapper.winmd", _String2="..") returned 1 [0072.212] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x53e75e0 [0072.212] wcscpy (in: _Dest=0x53e75e0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" [0072.212] wcscat (in: _Dest=0x53e75e0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.212] wcscat (in: _Dest=0x53e75e0, _Source="SQLiteWrapper.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\SQLiteWrapper.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\SQLiteWrapper.winmd" [0072.212] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53e75e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c0 [0072.212] FindNextFileW (in: hFindFile=0x5445140, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6caf896e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa7447d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6caf896e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1 [0072.212] wcscmp (_String1="Themes", _String2=".") returned 1 [0072.212] wcscmp (_String1="Themes", _String2="..") returned 1 [0072.212] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xac) returned 0x5445da8 [0072.212] wcscpy (in: _Dest=0x5445da8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" [0072.213] wcscat (in: _Dest=0x5445da8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.213] wcscat (in: _Dest=0x5445da8, _Source="Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes" [0072.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5445da8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c4 [0072.213] FindNextFileW (in: hFindFile=0x5445140, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d109a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 1 [0072.213] wcscmp (_String1="_Resources", _String2=".") returned 1 [0072.213] wcscmp (_String1="_Resources", _String2="..") returned 1 [0072.213] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb4) returned 0x5461528 [0072.213] wcscpy (in: _Dest=0x5461528, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" [0072.213] wcscat (in: _Dest=0x5461528, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\" [0072.214] wcscat (in: _Dest=0x5461528, _Source="_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources" [0072.214] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5461528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c8 [0072.214] FindNextFileW (in: hFindFile=0x5445140, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d109a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 0 [0072.214] FindClose (in: hFindFile=0x5445140 | out: hFindFile=0x5445140) returned 1 [0072.215] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b30f0) returned 1 [0072.215] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388f510) returned 1 [0072.215] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38abdb8) returned 1 Thread: id = 243 os_tid = 0x126c [0071.847] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xca) returned 0x389e128 [0071.847] wcscpy (in: _Dest=0x389e128, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe" [0071.847] wcscat (in: _Dest=0x389e128, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0071.847] wcscat (in: _Dest=0x389e128, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\*" [0071.847] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b3358 [0071.847] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\*", lpFindFileData=0x53b3358 | out: lpFindFileData=0x53b3358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e476601, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e8c0 [0075.217] wcscmp (_String1=".", _String2=".") returned 0 [0075.217] FindNextFileW (in: hFindFile=0x389e8c0, lpFindFileData=0x53b3358 | out: lpFindFileData=0x53b3358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e476601, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.217] wcscmp (_String1="..", _String2=".") returned 1 [0075.217] wcscmp (_String1="..", _String2="..") returned 0 [0075.217] FindNextFileW (in: hFindFile=0x389e8c0, lpFindFileData=0x53b3358 | out: lpFindFileData=0x53b3358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e4c2aa1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e4c2aa1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e4c2aa1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xfdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0075.217] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0075.217] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0075.217] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x396f5c8 [0075.217] wcscpy (in: _Dest=0x396f5c8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe" [0075.217] wcscat (in: _Dest=0x396f5c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0075.217] wcscat (in: _Dest=0x396f5c8, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml" [0075.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396f5c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcb0 [0075.933] FindNextFileW (in: hFindFile=0x389e8c0, lpFindFileData=0x53b3358 | out: lpFindFileData=0x53b3358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e476601, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e476601, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e476601, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0075.933] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0075.933] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0075.933] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x396eb78 [0075.933] wcscpy (in: _Dest=0x396eb78, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe" [0075.933] wcscat (in: _Dest=0x396eb78, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0075.933] wcscat (in: _Dest=0x396eb78, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml" [0075.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396eb78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf58 [0075.934] FindNextFileW (in: hFindFile=0x389e8c0, lpFindFileData=0x53b3358 | out: lpFindFileData=0x53b3358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e4c2aa1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e4fcf04, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e4fcf04, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2980, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0075.934] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0075.934] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0075.934] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xea) returned 0x393f498 [0075.934] wcscpy (in: _Dest=0x393f498, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe" [0075.934] wcscat (in: _Dest=0x393f498, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0075.934] wcscat (in: _Dest=0x393f498, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x" [0075.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x393f498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf5c [0075.935] FindNextFileW (in: hFindFile=0x389e8c0, lpFindFileData=0x53b3358 | out: lpFindFileData=0x53b3358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e4fcf04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa7d9181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2e4fcf04, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0075.935] wcscmp (_String1="Assets", _String2=".") returned 1 [0075.935] wcscmp (_String1="Assets", _String2="..") returned 1 [0075.935] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd4) returned 0x3934808 [0075.935] wcscpy (in: _Dest=0x3934808, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe" [0075.935] wcscat (in: _Dest=0x3934808, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0075.935] wcscat (in: _Dest=0x3934808, _Source="Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0075.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3934808, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf60 [0075.936] FindNextFileW (in: hFindFile=0x389e8c0, lpFindFileData=0x53b3358 | out: lpFindFileData=0x53b3358*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb7a270e5, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0075.936] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0075.936] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0075.936] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0x3979ca8 [0075.936] wcscpy (in: _Dest=0x3979ca8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe" [0075.936] wcscat (in: _Dest=0x3979ca8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0075.936] wcscat (in: _Dest=0x3979ca8, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata" [0075.936] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3979ca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf64 [0075.937] FindNextFileW (in: hFindFile=0x389e8c0, lpFindFileData=0x53b3358 | out: lpFindFileData=0x53b3358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e622b9b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e648df4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e648df4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xa70, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0075.937] wcscmp (_String1="resources.pri", _String2=".") returned 1 [0075.937] wcscmp (_String1="resources.pri", _String2="..") returned 1 [0075.937] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x396f898 [0075.937] wcscpy (in: _Dest=0x396f898, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe" [0075.937] wcscat (in: _Dest=0x396f898, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0075.937] wcscat (in: _Dest=0x396f898, _Source="resources.pri" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri" [0075.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396f898, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf68 [0075.938] FindNextFileW (in: hFindFile=0x389e8c0, lpFindFileData=0x53b3358 | out: lpFindFileData=0x53b3358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e622b9b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e648df4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e648df4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xa70, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 0 [0075.938] FindClose (in: hFindFile=0x389e8c0 | out: hFindFile=0x389e8c0) returned 1 [0075.939] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b3358) returned 1 [0075.939] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389e128) returned 1 [0075.939] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b90a0) returned 1 Thread: id = 244 os_tid = 0x37c [0071.848] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xae) returned 0x5446590 [0071.848] wcscpy (in: _Dest=0x5446590, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe" [0071.848] wcscat (in: _Dest=0x5446590, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\" [0071.848] wcscat (in: _Dest=0x5446590, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\*" [0071.848] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542f678 [0071.848] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x542f678 | out: lpFindFileData=0x542f678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2cdd5a7d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e9c0 [0077.079] wcscmp (_String1=".", _String2=".") returned 0 [0077.079] FindNextFileW (in: hFindFile=0x389e9c0, lpFindFileData=0x542f678 | out: lpFindFileData=0x542f678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2cdd5a7d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.079] wcscmp (_String1="..", _String2=".") returned 1 [0077.079] wcscmp (_String1="..", _String2="..") returned 0 [0077.079] FindNextFileW (in: hFindFile=0x389e9c0, lpFindFileData=0x542f678 | out: lpFindFileData=0x542f678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ce6e3c6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2ce6e3c6, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2ce6e3c6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0077.079] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0077.079] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0077.079] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x39744e0 [0077.079] wcscpy (in: _Dest=0x39744e0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe" [0077.079] wcscat (in: _Dest=0x39744e0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\" [0077.079] wcscat (in: _Dest=0x39744e0, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" [0081.055] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x39744e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a18 [0081.055] FindNextFileW (in: hFindFile=0x389e9c0, lpFindFileData=0x542f678 | out: lpFindFileData=0x542f678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2cdd5a7d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa935760, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2cdd5a7d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0081.055] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0081.055] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0081.055] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x55fdbb8 [0081.055] wcscpy (in: _Dest=0x55fdbb8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe" [0081.055] wcscat (in: _Dest=0x55fdbb8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\" [0081.055] wcscat (in: _Dest=0x55fdbb8, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0081.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55fdbb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a1c [0081.056] FindNextFileW (in: hFindFile=0x389e9c0, lpFindFileData=0x542f678 | out: lpFindFileData=0x542f678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ce6e3c6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2ce94624, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2ce94624, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2980, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0081.056] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0081.056] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0081.056] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x757fa00 [0081.056] wcscpy (in: _Dest=0x757fa00, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe" [0081.056] wcscat (in: _Dest=0x757fa00, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\" [0081.056] wcscat (in: _Dest=0x757fa00, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" [0081.057] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x757fa00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a20 [0081.057] FindNextFileW (in: hFindFile=0x389e9c0, lpFindFileData=0x542f678 | out: lpFindFileData=0x542f678*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb7a270e5, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0081.057] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0081.057] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0081.057] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xee) returned 0x7286990 [0081.057] wcscpy (in: _Dest=0x7286990, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe" [0081.057] wcscat (in: _Dest=0x7286990, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\" [0081.057] wcscat (in: _Dest=0x7286990, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" [0081.057] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7286990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a24 [0081.058] FindNextFileW (in: hFindFile=0x389e9c0, lpFindFileData=0x542f678 | out: lpFindFileData=0x542f678*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb7a270e5, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0081.058] FindClose (in: hFindFile=0x389e9c0 | out: hFindFile=0x389e9c0) returned 1 [0081.059] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542f678) returned 1 [0081.059] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5446590) returned 1 [0081.059] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a1418) returned 1 Thread: id = 245 os_tid = 0x11e8 [0071.849] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa4) returned 0x388f9e0 [0071.849] wcscpy (in: _Dest=0x388f9e0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe" [0071.849] wcscat (in: _Dest=0x388f9e0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\" [0071.849] wcscat (in: _Dest=0x388f9e0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\*" [0071.849] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5430280 [0071.849] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x5430280 | out: lpFindFileData=0x5430280*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2ceba882, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389eb00 [0077.102] wcscmp (_String1=".", _String2=".") returned 0 [0077.102] FindNextFileW (in: hFindFile=0x389eb00, lpFindFileData=0x5430280 | out: lpFindFileData=0x5430280*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2ceba882, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.103] wcscmp (_String1="..", _String2=".") returned 1 [0077.103] wcscmp (_String1="..", _String2="..") returned 0 [0077.103] FindNextFileW (in: hFindFile=0x389eb00, lpFindFileData=0x5430280 | out: lpFindFileData=0x5430280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cf531ec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2cf79445, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2cf79445, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xe446, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0077.103] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0077.103] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0077.103] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x55fd1f8 [0077.103] wcscpy (in: _Dest=0x55fd1f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe" [0077.103] wcscat (in: _Dest=0x55fd1f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\" [0077.103] wcscat (in: _Dest=0x55fd1f8, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" [0081.035] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55fd1f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19dc [0081.035] FindNextFileW (in: hFindFile=0x389eb00, lpFindFileData=0x5430280 | out: lpFindFileData=0x5430280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cf2cf8e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2cf531ec, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2cf531ec, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x26ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0081.035] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0081.035] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0081.035] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x55fcb78 [0081.035] wcscpy (in: _Dest=0x55fcb78, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe" [0081.035] wcscat (in: _Dest=0x55fcb78, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\" [0081.035] wcscat (in: _Dest=0x55fcb78, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" [0081.035] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55fcb78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19e0 [0081.036] FindNextFileW (in: hFindFile=0x389eb00, lpFindFileData=0x5430280 | out: lpFindFileData=0x5430280*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d0fdc78, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa936cde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d0fdc78, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0081.036] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0081.036] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0081.036] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x3976788 [0081.036] wcscpy (in: _Dest=0x3976788, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe" [0081.036] wcscat (in: _Dest=0x3976788, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\" [0081.036] wcscat (in: _Dest=0x3976788, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0081.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3976788, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19e4 [0081.037] FindNextFileW (in: hFindFile=0x389eb00, lpFindFileData=0x5430280 | out: lpFindFileData=0x5430280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0844c4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d0d79eb, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d0d79eb, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x29a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0081.037] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0081.037] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0081.037] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x55fdae8 [0081.037] wcscpy (in: _Dest=0x55fdae8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe" [0081.037] wcscat (in: _Dest=0x55fdae8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\" [0081.037] wcscat (in: _Dest=0x55fdae8, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" [0081.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55fdae8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19e8 [0081.038] FindNextFileW (in: hFindFile=0x389eb00, lpFindFileData=0x5430280 | out: lpFindFileData=0x5430280*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d1bc83f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa937267, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2db7c876, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0081.038] wcscmp (_String1="Assets", _String2=".") returned 1 [0081.038] wcscmp (_String1="Assets", _String2="..") returned 1 [0081.038] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xae) returned 0x55c7478 [0081.038] wcscpy (in: _Dest=0x55c7478, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe" [0081.038] wcscat (in: _Dest=0x55c7478, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\" [0081.038] wcscat (in: _Dest=0x55c7478, _Source="Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets" [0081.038] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55c7478, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19ec [0081.039] FindNextFileW (in: hFindFile=0x389eb00, lpFindFileData=0x5430280 | out: lpFindFileData=0x5430280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dbabacb, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2dbabacb, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2dbabacb, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xff58, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClrCompression.dll", cAlternateFileName="")) returned 1 [0081.039] wcscmp (_String1="ClrCompression.dll", _String2=".") returned 1 [0081.039] wcscmp (_String1="ClrCompression.dll", _String2="..") returned 1 [0081.039] FindNextFileW (in: hFindFile=0x389eb00, lpFindFileData=0x5430280 | out: lpFindFileData=0x5430280*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dbabacb, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad79c2f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dbabacb, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Configuration", cAlternateFileName="CONFIG~1")) returned 1 [0081.039] wcscmp (_String1="Configuration", _String2=".") returned 1 [0081.039] wcscmp (_String1="Configuration", _String2="..") returned 1 [0081.039] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x39766c0 [0081.039] wcscpy (in: _Dest=0x39766c0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe" [0081.039] wcscat (in: _Dest=0x39766c0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\" [0081.039] wcscat (in: _Dest=0x39766c0, _Source="Configuration" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Configuration") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Configuration" [0081.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x39766c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19f0 [0081.040] FindNextFileW (in: hFindFile=0x389eb00, lpFindFileData=0x5430280 | out: lpFindFileData=0x5430280*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dbabacb, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7a6fb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dbabacb, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Images", cAlternateFileName="")) returned 1 [0081.040] wcscmp (_String1="Images", _String2=".") returned 1 [0081.040] wcscmp (_String1="Images", _String2="..") returned 1 [0081.040] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xae) returned 0x55c70e0 [0081.040] wcscpy (in: _Dest=0x55c70e0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe" [0081.040] wcscat (in: _Dest=0x55c70e0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\" [0081.040] wcscat (in: _Dest=0x55c70e0, _Source="Images" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Images") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Images" [0081.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55c70e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19f4 [0081.040] FindNextFileW (in: hFindFile=0x389eb00, lpFindFileData=0x5430280 | out: lpFindFileData=0x5430280*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd03022, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7ad84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd2927f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising", cAlternateFileName="MICROS~1.ADV")) returned 1 [0081.041] wcscmp (_String1="Microsoft.Advertising", _String2=".") returned 1 [0081.041] wcscmp (_String1="Microsoft.Advertising", _String2="..") returned 1 [0081.041] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x757f928 [0081.041] wcscpy (in: _Dest=0x757f928, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe" [0081.041] wcscat (in: _Dest=0x757f928, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\" [0081.041] wcscat (in: _Dest=0x757f928, _Source="Microsoft.Advertising" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising" [0081.041] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x757f928, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19f8 [0081.041] FindNextFileW (in: hFindFile=0x389eb00, lpFindFileData=0x5430280 | out: lpFindFileData=0x5430280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dbabacb, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2dd03022, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2dd03022, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3ee998, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.dll", cAlternateFileName="")) returned 1 [0081.041] wcscmp (_String1="Microsoft.Advertising.dll", _String2=".") returned 1 [0081.041] wcscmp (_String1="Microsoft.Advertising.dll", _String2="..") returned 1 [0081.041] FindNextFileW (in: hFindFile=0x389eb00, lpFindFileData=0x5430280 | out: lpFindFileData=0x5430280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dd03022, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2dd03022, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2dd03022, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x9b98, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.winmd", cAlternateFileName="")) returned 1 [0081.042] wcscmp (_String1="Microsoft.Advertising.winmd", _String2=".") returned 1 [0081.042] wcscmp (_String1="Microsoft.Advertising.winmd", _String2="..") returned 1 [0081.042] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x727ca58 [0091.743] wcscpy (in: _Dest=0x727ca58, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe" [0091.743] wcscat (in: _Dest=0x727ca58, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\" [0091.743] wcscat (in: _Dest=0x727ca58, _Source="Microsoft.Advertising.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising.winmd" Thread: id = 246 os_tid = 0x11ec [0071.849] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x389e200 [0071.850] wcscpy (in: _Dest=0x389e200, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe" [0071.850] wcscat (in: _Dest=0x389e200, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0071.850] wcscat (in: _Dest=0x389e200, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\*" [0071.850] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5407430 [0071.850] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\*", lpFindFileData=0x5407430 | out: lpFindFileData=0x5407430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68f377c2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaae3acdd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ea00 [0075.248] wcscmp (_String1=".", _String2=".") returned 0 [0075.248] FindNextFileW (in: hFindFile=0x389ea00, lpFindFileData=0x5407430 | out: lpFindFileData=0x5407430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68f377c2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaae3acdd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.248] wcscmp (_String1="..", _String2=".") returned 1 [0075.248] wcscmp (_String1="..", _String2="..") returned 0 [0075.248] FindNextFileW (in: hFindFile=0x389ea00, lpFindFileData=0x5407430 | out: lpFindFileData=0x5407430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68f377c2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68f377c2, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68f377c2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0075.248] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0075.248] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0075.248] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x393eec8 [0075.249] wcscpy (in: _Dest=0x393eec8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe" [0075.249] wcscat (in: _Dest=0x393eec8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0075.249] wcscat (in: _Dest=0x393eec8, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml" [0075.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x393eec8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcd4 [0075.821] FindNextFileW (in: hFindFile=0x389ea00, lpFindFileData=0x5407430 | out: lpFindFileData=0x5407430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68f377c2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68f377c2, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68f377c2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x39a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0075.821] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0075.821] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0075.821] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x393e708 [0075.822] wcscpy (in: _Dest=0x393e708, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe" [0075.822] wcscat (in: _Dest=0x393e708, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0075.822] wcscat (in: _Dest=0x393e708, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml" [0075.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x393e708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb4 [0075.822] FindNextFileW (in: hFindFile=0x389ea00, lpFindFileData=0x5407430 | out: lpFindFileData=0x5407430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68f5da18, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68f5da18, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68f5da18, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x299d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0075.822] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0075.822] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0075.822] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xee) returned 0x393f3a0 [0075.822] wcscpy (in: _Dest=0x393f3a0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe" [0075.822] wcscat (in: _Dest=0x393f3a0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0075.822] wcscat (in: _Dest=0x393f3a0, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x" [0075.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x393f3a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb8 [0075.823] FindNextFileW (in: hFindFile=0x389ea00, lpFindFileData=0x5407430 | out: lpFindFileData=0x5407430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68f5da18, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaae3d897, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x68f83c76, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0075.823] wcscmp (_String1="Assets", _String2=".") returned 1 [0075.823] wcscmp (_String1="Assets", _String2="..") returned 1 [0075.823] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x3934648 [0075.823] wcscpy (in: _Dest=0x3934648, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe" [0075.823] wcscat (in: _Dest=0x3934648, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0075.823] wcscat (in: _Dest=0x3934648, _Source="Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0075.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3934648, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdbc [0075.824] FindNextFileW (in: hFindFile=0x389ea00, lpFindFileData=0x5407430 | out: lpFindFileData=0x5407430*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x61f43dfb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaae3e4bd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0075.824] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0075.824] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0075.824] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x3979b90 [0075.824] wcscpy (in: _Dest=0x3979b90, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe" [0075.824] wcscat (in: _Dest=0x3979b90, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0075.824] wcscat (in: _Dest=0x3979b90, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata" [0075.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3979b90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc0 [0075.825] FindNextFileW (in: hFindFile=0x389ea00, lpFindFileData=0x5407430 | out: lpFindFileData=0x5407430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68f83c76, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68f83c76, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68f83c76, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0075.825] wcscmp (_String1="resources.pri", _String2=".") returned 1 [0075.825] wcscmp (_String1="resources.pri", _String2="..") returned 1 [0075.825] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe6) returned 0x396ff28 [0075.825] wcscpy (in: _Dest=0x396ff28, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe" [0075.825] wcscat (in: _Dest=0x396ff28, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0075.825] wcscat (in: _Dest=0x396ff28, _Source="resources.pri" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri" [0075.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396ff28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc4 [0075.826] FindNextFileW (in: hFindFile=0x389ea00, lpFindFileData=0x5407430 | out: lpFindFileData=0x5407430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68f83c76, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68f83c76, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68f83c76, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 0 [0075.826] FindClose (in: hFindFile=0x389ea00 | out: hFindFile=0x389ea00) returned 1 [0075.826] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5407430) returned 1 [0075.826] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389e200) returned 1 [0075.826] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389c8b0) returned 1 Thread: id = 247 os_tid = 0xb10 [0071.850] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb2) returned 0x54616a8 [0071.850] wcscpy (in: _Dest=0x54616a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe" [0071.850] wcscat (in: _Dest=0x54616a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\" [0071.850] wcscat (in: _Dest=0x54616a8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\*" [0071.850] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a18c8 [0071.850] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x53a18c8 | out: lpFindFileData=0x53a18c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68a98ed8, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaaebc8e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e980 [0077.059] wcscmp (_String1=".", _String2=".") returned 0 [0077.059] FindNextFileW (in: hFindFile=0x389e980, lpFindFileData=0x53a18c8 | out: lpFindFileData=0x53a18c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68a98ed8, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaaebc8e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.059] wcscmp (_String1="..", _String2=".") returned 1 [0077.059] wcscmp (_String1="..", _String2="..") returned 0 [0077.059] FindNextFileW (in: hFindFile=0x389e980, lpFindFileData=0x53a18c8 | out: lpFindFileData=0x53a18c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68a98ed8, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68a98ed8, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68a98ed8, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0077.059] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0077.059] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0077.059] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x3974408 [0077.059] wcscpy (in: _Dest=0x3974408, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe" [0077.059] wcscat (in: _Dest=0x3974408, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\" [0077.059] wcscat (in: _Dest=0x3974408, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" [0081.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3974408, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c8 [0081.060] FindNextFileW (in: hFindFile=0x389e980, lpFindFileData=0x53a18c8 | out: lpFindFileData=0x53a18c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68a98ed8, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaaebe349, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x68a98ed8, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0081.060] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0081.060] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0081.060] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x55fcde8 [0081.060] wcscpy (in: _Dest=0x55fcde8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe" [0081.060] wcscat (in: _Dest=0x55fcde8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\" [0081.060] wcscat (in: _Dest=0x55fcde8, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0081.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55fcde8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a28 [0081.061] FindNextFileW (in: hFindFile=0x389e980, lpFindFileData=0x53a18c8 | out: lpFindFileData=0x53a18c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68a98ed8, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68a98ed8, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68a98ed8, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x299d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0081.061] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0081.061] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0081.061] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x732cfc8 [0091.747] wcscpy (in: _Dest=0x732cfc8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe" [0091.747] wcscat (in: _Dest=0x732cfc8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\" [0091.747] wcscat (in: _Dest=0x732cfc8, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" Thread: id = 248 os_tid = 0x11e0 [0071.851] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 0x20 [0077.324] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", dwFileAttributes=0x20) returned 1 [0077.331] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x123c [0077.331] GetFileSizeEx (in: hFile=0x123c, lpFileSize=0xc97fb2c | out: lpFileSize=0xc97fb2c*=42674) returned 1 [0077.331] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0xa6ae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.331] ReadFile (in: hFile=0x123c, lpBuffer=0xc97fab0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc97faac, lpOverlapped=0x0 | out: lpBuffer=0xc97fab0*, lpNumberOfBytesRead=0xc97faac*=0x4, lpOverlapped=0x0) returned 1 [0077.333] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.333] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.333] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559938 [0077.333] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559960 [0077.333] NtQuerySystemTime (in: CurrentTime=0xc97fa8c | out: CurrentTime=0xc97fa8c*=132260136344960314) returned 0x0 [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0x2518fff [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0xa8eda8bb [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0xf23681a [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0x49398bff [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0xd4b83fc [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0x9791564a [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0xbab6daf1 [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0x53e10580 [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0x5f80aa19 [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0xdca70d3d [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0xf83994e2 [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0x61efe183 [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0xd0626115 [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0xcc6e32b0 [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0x3817a89a [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0x8d22d17 [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0xca2096a9 [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0x3a83c8b2 [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0x1d439bc3 [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0xdb2bd87c [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0x7a0838ab [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0x20dacf15 [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0x1da4adc1 [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0x762f9590 [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0x228069f9 [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0x8fb1f9 [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0x53e30f64 [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0xcc47a2e0 [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0xa7132 [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0x36f01fee [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0xdb75de58 [0077.333] RtlRandom (in: Seed=0xc97fa98 | out: Seed=0xc97fa98) returned 0x2e74dea7 [0077.342] ReadFile (in: hFile=0x123c, lpBuffer=0x55b88a0, nNumberOfBytesToRead=0xa6b2, lpNumberOfBytesRead=0xc97fa88, lpOverlapped=0x0 | out: lpBuffer=0x55b88a0*, lpNumberOfBytesRead=0xc97fa88*=0xa6b2, lpOverlapped=0x0) returned 1 [0077.344] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.344] WriteFile (in: hFile=0x123c, lpBuffer=0x55fe8e0*, nNumberOfBytesToWrite=0xa6b2, lpNumberOfBytesWritten=0xc97fa84, lpOverlapped=0x0 | out: lpBuffer=0x55fe8e0*, lpNumberOfBytesWritten=0xc97fa84*=0xa6b2, lpOverlapped=0x0) returned 1 [0081.208] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1708 [0081.208] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a17a8 [0081.208] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a17a8) returned 1 [0081.208] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55fe8e0) returned 1 [0091.760] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55b88a0) returned 1 [0091.760] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497610) returned 1 [0091.761] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5608) returned 1 [0091.761] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x57) returned 0x75840a0 [0091.761] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.761] WriteFile (hFile=0x123c, lpBuffer=0x758a300, nNumberOfBytesToWrite=0x13b, lpNumberOfBytesWritten=0xc97faec, lpOverlapped=0x0) Thread: id = 249 os_tid = 0xa68 [0071.853] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 0x20 [0077.330] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", dwFileAttributes=0x20) returned 1 [0077.371] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1240 [0077.371] GetFileSizeEx (in: hFile=0x1240, lpFileSize=0xc9ffbc8 | out: lpFileSize=0xc9ffbc8*=6004) returned 1 [0077.371] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x1770, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.371] ReadFile (in: hFile=0x1240, lpBuffer=0xc9ffb4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc9ffb48, lpOverlapped=0x0 | out: lpBuffer=0xc9ffb4c*, lpNumberOfBytesRead=0xc9ffb48*=0x4, lpOverlapped=0x0) returned 1 [0077.378] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.378] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.378] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559960 [0077.378] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a00 [0077.378] NtQuerySystemTime (in: CurrentTime=0xc9ffb28 | out: CurrentTime=0xc9ffb28*=132260136345429046) returned 0x0 [0077.378] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0x547c9a88 [0077.378] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0x9293b2bc [0077.378] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0x1dfd57ed [0077.378] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0x43f391e6 [0077.378] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0x2e395741 [0077.378] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0x422e1376 [0077.378] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0x6a4417b9 [0077.378] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0xf8cc4f65 [0077.378] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0xb24ded9b [0077.378] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0x9ecbec19 [0077.378] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0xcf19deb0 [0077.378] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0x648dc27c [0077.378] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0x1a286547 [0077.378] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0xf2e805ff [0077.378] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0x82adc3e9 [0077.378] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0x39179bb1 [0077.378] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0xfa63f5da [0077.378] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0x7fe2705a [0077.378] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0xb6f68bdf [0077.378] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0xdf640fa6 [0077.378] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0xbf2dd76a [0077.378] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0xc07410e9 [0077.378] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0x8c4c3dac [0077.378] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0xbe50015d [0077.378] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0x419da2e6 [0077.378] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0x7dd0599a [0077.378] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0xc845e318 [0077.378] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0xdadae9f2 [0077.378] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0x5f1f92c8 [0077.378] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0x950890a0 [0077.378] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0xed51299b [0077.379] RtlRandom (in: Seed=0xc9ffb34 | out: Seed=0xc9ffb34) returned 0xb313fb0a [0077.387] ReadFile (in: hFile=0x1240, lpBuffer=0x560b0e8, nNumberOfBytesToRead=0x1774, lpNumberOfBytesRead=0xc9ffb24, lpOverlapped=0x0 | out: lpBuffer=0x560b0e8*, lpNumberOfBytesRead=0xc9ffb24*=0x1774, lpOverlapped=0x0) returned 1 [0077.388] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.388] WriteFile (in: hFile=0x1240, lpBuffer=0x56178f0*, nNumberOfBytesToWrite=0x1774, lpNumberOfBytesWritten=0xc9ffb20, lpOverlapped=0x0 | out: lpBuffer=0x56178f0*, lpNumberOfBytesWritten=0xc9ffb20*=0x1774, lpOverlapped=0x0) returned 1 [0081.209] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a17a8 [0081.209] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a17f8 [0081.209] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a17f8) returned 1 [0081.209] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x56178f0) Thread: id = 250 os_tid = 0xf88 [0071.854] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 0x20 [0077.332] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", dwFileAttributes=0x20) returned 1 [0077.343] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1240 [0077.346] GetFileSizeEx (in: hFile=0x1240, lpFileSize=0xca7f894 | out: lpFileSize=0xca7f894*=40) returned 1 [0077.346] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.346] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559960 [0077.346] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a00 [0077.346] NtQuerySystemTime (in: CurrentTime=0xca7f7f4 | out: CurrentTime=0xca7f7f4*=132260136345116380) returned 0x0 [0077.346] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0x7d6a0f72 [0077.346] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0x99df30f6 [0077.346] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0x87100859 [0077.346] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0x9d6f2c30 [0077.346] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0xfe539f09 [0077.346] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0x8ff111eb [0077.346] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0xefb0d9d7 [0077.346] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0x763ff4a [0077.346] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0x933cd44e [0077.346] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0x55b118a2 [0077.346] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0xc8a3a667 [0077.346] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0x56021ffc [0077.346] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0x78806d13 [0077.346] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0x4aed75b2 [0077.346] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0x50d0421c [0077.346] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0xa4be52ee [0077.346] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0x5329ecef [0077.346] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0x8d102c85 [0077.346] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0xd798f397 [0077.346] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0x1b602160 [0077.347] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0xb2518c9e [0077.347] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0xdb9b916d [0077.347] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0x1899c7f0 [0077.347] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0xce6bbfe3 [0077.347] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0xdf17f879 [0077.347] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0x3baec75d [0077.347] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0x1dc66d0 [0077.347] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0x1639212 [0077.347] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0x997a6ba1 [0077.347] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0x85b5c51b [0077.347] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0x9b686624 [0077.347] RtlRandom (in: Seed=0xca7f800 | out: Seed=0xca7f800) returned 0x6111a7a6 [0077.357] ReadFile (in: hFile=0x1240, lpBuffer=0x560b0e8, nNumberOfBytesToRead=0x28, lpNumberOfBytesRead=0xca7f7f0, lpOverlapped=0x0 | out: lpBuffer=0x560b0e8*, lpNumberOfBytesRead=0xca7f7f0*=0x28, lpOverlapped=0x0) returned 1 [0077.358] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.358] WriteFile (in: hFile=0x1240, lpBuffer=0x56178f0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0xca7f7ec, lpOverlapped=0x0 | out: lpBuffer=0x56178f0*, lpNumberOfBytesWritten=0xca7f7ec*=0x28, lpOverlapped=0x0) returned 1 [0077.359] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.359] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a00 [0077.360] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a00) returned 1 [0077.360] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x56178f0) returned 1 [0077.360] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x560b0e8) returned 1 [0077.360] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0077.360] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5650) returned 1 [0077.360] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x49) returned 0x38ff9c0 [0077.360] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.360] WriteFile (in: hFile=0x1240, lpBuffer=0x38b8d20*, nNumberOfBytesToWrite=0x12d, lpNumberOfBytesWritten=0xca7f854, lpOverlapped=0x0 | out: lpBuffer=0x38b8d20*, lpNumberOfBytesWritten=0xca7f854*=0x12d, lpOverlapped=0x0) returned 1 [0077.363] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b8d20) returned 1 [0077.363] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ffa18) returned 1 [0077.363] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a00) returned 1 [0077.363] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ff9c0) returned 1 [0077.363] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559910) returned 1 [0077.363] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559960) returned 1 [0077.363] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a28) returned 1 [0077.363] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a50) returned 1 [0077.363] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa6) returned 0x54de0e0 [0077.363] wcscpy (in: _Dest=0x54de0e0, _Source="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" | out: _Dest="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" [0077.363] wcscat (in: _Dest=0x54de0e0, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.mailto[knoocknoo@cock.li].a0a70") returned="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.mailto[knoocknoo@cock.li].a0a70" [0077.363] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.mailto[knoocknoo@cock.li].a0a70", NtPathName=0xca7f80c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.363] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x3975658 [0077.365] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3975658) returned 1 [0077.365] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a16f8) returned 1 [0077.365] NtQueryInformationFile (in: FileHandle=0x1240, IoStatusBlock=0xca7f818, FileInformation=0xca7f7f0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xca7f818, FileInformation=0xca7f7f0) returned 0x0 [0077.365] NtSetInformationFile (FileHandle=0x1240, IoStatusBlock=0xca7f818, FileInformation=0xca7f7f0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0077.366] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54de0e0) returned 1 [0077.366] FlushFileBuffers (hFile=0x1240) returned 1 [0077.368] CloseHandle (hObject=0x1240) returned 1 [0077.368] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x38ff9c0 [0077.368] wcscpy (in: _Dest=0x38ff9c0, _Source="C:\\$GetCurrent\\Logs\\" | out: _Dest="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\" [0077.368] wcscat (in: _Dest=0x38ff9c0, _Source="A0A70-Readme.txt" | out: _Dest="C:\\$GetCurrent\\Logs\\A0A70-Readme.txt") returned="C:\\$GetCurrent\\Logs\\A0A70-Readme.txt" [0077.368] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\A0A70-Readme.txt" (normalized: "c:\\$getcurrent\\logs\\a0a70-readme.txt")) returned 0xffffffff [0077.368] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\A0A70-Readme.txt" (normalized: "c:\\$getcurrent\\logs\\a0a70-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1244 [0077.369] WriteFile (in: hFile=0x1244, lpBuffer=0x38ab1f8*, nNumberOfBytesToWrite=0x6f4, lpNumberOfBytesWritten=0xca7f814, lpOverlapped=0x0 | out: lpBuffer=0x38ab1f8*, lpNumberOfBytesWritten=0xca7f814*=0x6f4, lpOverlapped=0x0) returned 1 [0077.370] CloseHandle (hObject=0x1244) returned 1 [0077.370] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ff9c0) returned 1 [0077.370] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b2488) returned 1 Thread: id = 251 os_tid = 0xfa8 [0071.854] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x26) returned 0x38a68b0 [0071.854] wcscpy (in: _Dest=0x38a68b0, _Source="C:\\Recovery\\Logs" | out: _Dest="C:\\Recovery\\Logs") returned="C:\\Recovery\\Logs" [0071.854] wcscat (in: _Dest=0x38a68b0, _Source="\\" | out: _Dest="C:\\Recovery\\Logs\\") returned="C:\\Recovery\\Logs\\" [0071.854] wcscat (in: _Dest=0x38a68b0, _Source="*" | out: _Dest="C:\\Recovery\\Logs\\*") returned="C:\\Recovery\\Logs\\*" [0071.854] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5462bf8 [0071.865] FindFirstFileW (in: lpFileName="C:\\Recovery\\Logs\\*", lpFindFileData=0x5462bf8 | out: lpFindFileData=0x5462bf8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x28e9c3a2, ftLastAccessTime.dwHighDateTime=0x1d32795, ftLastWriteTime.dwLowDateTime=0x28e9c3a2, ftLastWriteTime.dwHighDateTime=0x1d32795, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ea80 [0075.529] wcscmp (_String1=".", _String2=".") returned 0 [0075.529] FindNextFileW (in: hFindFile=0x389ea80, lpFindFileData=0x5462bf8 | out: lpFindFileData=0x5462bf8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x28e9c3a2, ftLastAccessTime.dwHighDateTime=0x1d32795, ftLastWriteTime.dwLowDateTime=0x28e9c3a2, ftLastWriteTime.dwHighDateTime=0x1d32795, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.529] wcscmp (_String1="..", _String2=".") returned 1 [0075.529] wcscmp (_String1="..", _String2="..") returned 0 [0075.529] FindNextFileW (in: hFindFile=0x389ea80, lpFindFileData=0x5462bf8 | out: lpFindFileData=0x5462bf8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x28e9c3a2, ftLastAccessTime.dwHighDateTime=0x1d32795, ftLastWriteTime.dwLowDateTime=0x28e9c3a2, ftLastWriteTime.dwHighDateTime=0x1d32795, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.529] FindClose (in: hFindFile=0x389ea80 | out: hFindFile=0x389ea80) returned 1 [0075.529] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5462bf8) returned 1 [0075.532] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a68b0) returned 1 [0075.532] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6880) returned 1 Thread: id = 252 os_tid = 0x12c8 [0071.866] GetFileAttributesW (lpFileName="C:\\Recovery\\ReAgentOld.xml" (normalized: "c:\\recovery\\reagentold.xml")) returned 0x2020 [0077.246] SetFileAttributesW (lpFileName="C:\\Recovery\\ReAgentOld.xml", dwFileAttributes=0x20) returned 1 [0077.299] CreateFileW (lpFileName="C:\\Recovery\\ReAgentOld.xml" (normalized: "c:\\recovery\\reagentold.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1230 [0077.299] GetFileSizeEx (in: hFile=0x1230, lpFileSize=0xcb7fd60 | out: lpFileSize=0xcb7fd60*=1006) returned 1 [0077.299] SetFilePointerEx (in: hFile=0x1230, liDistanceToMove=0x3ea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.299] ReadFile (in: hFile=0x1230, lpBuffer=0xcb7fce4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xcb7fce0, lpOverlapped=0x0 | out: lpBuffer=0xcb7fce4*, lpNumberOfBytesRead=0xcb7fce0*=0x4, lpOverlapped=0x0) returned 1 [0077.301] SetFilePointerEx (in: hFile=0x1230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.301] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.301] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559938 [0077.301] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559960 [0077.301] NtQuerySystemTime (in: CurrentTime=0xcb7fcc0 | out: CurrentTime=0xcb7fcc0*=132260136344648055) returned 0x0 [0077.301] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0xfbc99338 [0077.301] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0x37d5d39a [0077.301] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0x29a70a7e [0077.301] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0x73e2d8fa [0077.301] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0xa386c1ec [0077.301] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0xf7188edc [0077.301] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0x113686e5 [0077.301] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0xedbdaa31 [0077.302] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0x10a32dc3 [0077.302] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0x2d16f05d [0077.302] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0x93f3567f [0077.302] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0xa589d528 [0077.302] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0xc8b637f2 [0077.302] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0x7ffb89e5 [0077.302] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0xc932d423 [0077.302] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0xabe7c95c [0077.302] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0x9efa4f15 [0077.302] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0xf93354f [0077.302] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0x44bb45c9 [0077.302] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0x8554d1ac [0077.302] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0x168f5eeb [0077.302] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0x751675c2 [0077.302] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0x11450522 [0077.302] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0xb646e2d6 [0077.302] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0x8afa3c27 [0077.302] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0x1a1a297f [0077.302] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0x25da1c0c [0077.302] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0x6dd832ac [0077.302] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0x86b16ebb [0077.302] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0xefabf072 [0077.302] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0xfc8695c9 [0077.302] RtlRandom (in: Seed=0xcb7fccc | out: Seed=0xcb7fccc) returned 0x30ded6af [0077.312] ReadFile (in: hFile=0x1230, lpBuffer=0x55b88a0, nNumberOfBytesToRead=0x3ee, lpNumberOfBytesRead=0xcb7fcbc, lpOverlapped=0x0 | out: lpBuffer=0x55b88a0*, lpNumberOfBytesRead=0xcb7fcbc*=0x3ee, lpOverlapped=0x0) returned 1 [0077.312] SetFilePointerEx (in: hFile=0x1230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.312] WriteFile (in: hFile=0x1230, lpBuffer=0x55fe8e0*, nNumberOfBytesToWrite=0x3ee, lpNumberOfBytesWritten=0xcb7fcb8, lpOverlapped=0x0 | out: lpBuffer=0x55fe8e0*, lpNumberOfBytesWritten=0xcb7fcb8*=0x3ee, lpOverlapped=0x0) returned 1 [0077.314] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.314] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559960 [0077.314] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559960) returned 1 [0077.314] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55fe8e0) returned 1 [0077.314] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55b88a0) returned 1 [0077.314] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0077.314] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5608) returned 1 [0077.314] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x29) returned 0x5531d58 [0077.314] SetFilePointerEx (in: hFile=0x1230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.314] WriteFile (in: hFile=0x1230, lpBuffer=0x388c6a0*, nNumberOfBytesToWrite=0x10d, lpNumberOfBytesWritten=0xcb7fd20, lpOverlapped=0x0 | out: lpBuffer=0x388c6a0*, lpNumberOfBytesWritten=0xcb7fd20*=0x10d, lpOverlapped=0x0) returned 1 [0077.315] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388c6a0) returned 1 [0077.315] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5531dc8) returned 1 [0077.315] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559960) returned 1 [0077.316] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5531d58) returned 1 [0077.316] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559910) returned 1 [0077.316] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559938) returned 1 [0077.316] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559988) returned 1 [0077.316] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55599b0) returned 1 [0077.316] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x76) returned 0x38d06a0 [0077.316] wcscpy (in: _Dest=0x38d06a0, _Source="C:\\Recovery\\ReAgentOld.xml" | out: _Dest="C:\\Recovery\\ReAgentOld.xml") returned="C:\\Recovery\\ReAgentOld.xml" [0077.316] wcscat (in: _Dest=0x38d06a0, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Recovery\\ReAgentOld.xml.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Recovery\\ReAgentOld.xml.mailto[knoocknoo@cock.li].a0a70" [0077.316] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Recovery\\ReAgentOld.xml.mailto[knoocknoo@cock.li].a0a70", NtPathName=0xcb7fcd8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Recovery\\ReAgentOld.xml.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.316] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8c) returned 0x549f4d0 [0077.317] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549f4d0) returned 1 [0077.317] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3977a18) returned 1 [0077.317] NtQueryInformationFile (in: FileHandle=0x1230, IoStatusBlock=0xcb7fce4, FileInformation=0xcb7fcbc, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xcb7fce4, FileInformation=0xcb7fcbc) returned 0x0 [0077.317] NtSetInformationFile (FileHandle=0x1230, IoStatusBlock=0xcb7fce4, FileInformation=0xcb7fcbc, Length=0x28, FileInformationClass=0x4) returned 0x0 [0077.318] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38d06a0) returned 1 [0077.318] FlushFileBuffers (hFile=0x1230) returned 1 [0077.319] CloseHandle (hObject=0x1230) returned 1 [0077.319] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3c) returned 0x38a59b0 [0077.319] wcscpy (in: _Dest=0x38a59b0, _Source="C:\\Recovery\\" | out: _Dest="C:\\Recovery\\") returned="C:\\Recovery\\" [0077.319] wcscat (in: _Dest=0x38a59b0, _Source="A0A70-Readme.txt" | out: _Dest="C:\\Recovery\\A0A70-Readme.txt") returned="C:\\Recovery\\A0A70-Readme.txt" [0077.319] GetFileAttributesW (lpFileName="C:\\Recovery\\A0A70-Readme.txt" (normalized: "c:\\recovery\\a0a70-readme.txt")) returned 0xffffffff [0077.320] CreateFileW (lpFileName="C:\\Recovery\\A0A70-Readme.txt" (normalized: "c:\\recovery\\a0a70-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1230 [0077.320] WriteFile (in: hFile=0x1230, lpBuffer=0x38ab1f8*, nNumberOfBytesToWrite=0x6f4, lpNumberOfBytesWritten=0xcb7fce0, lpOverlapped=0x0 | out: lpBuffer=0x38ab1f8*, lpNumberOfBytesWritten=0xcb7fce0*=0x6f4, lpOverlapped=0x0) returned 1 [0077.321] CloseHandle (hObject=0x1230) returned 1 [0077.321] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a59b0) returned 1 [0077.321] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54452c0) returned 1 Thread: id = 253 os_tid = 0x137c [0071.866] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa8) returned 0x388f930 [0071.866] wcscpy (in: _Dest=0x388f930, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe" [0071.866] wcscat (in: _Dest=0x388f930, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\" [0071.866] wcscat (in: _Dest=0x388f930, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\*" [0071.866] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5462728 [0071.866] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x5462728 | out: lpFindFileData=0x5462728*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ae5394, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaaf17e9e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445080 [0072.157] wcscmp (_String1=".", _String2=".") returned 0 [0072.157] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5462728 | out: lpFindFileData=0x5462728*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ae5394, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaaf17e9e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.157] wcscmp (_String1="..", _String2=".") returned 1 [0072.157] wcscmp (_String1="..", _String2="..") returned 0 [0072.157] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5462728 | out: lpFindFileData=0x5462728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ae5394, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68ae5394, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68ae5394, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x44a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0072.157] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0072.157] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0072.157] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x53e7d30 [0072.157] wcscpy (in: _Dest=0x53e7d30, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe" [0072.157] wcscat (in: _Dest=0x53e7d30, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\" [0072.157] wcscat (in: _Dest=0x53e7d30, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" [0072.157] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53e7d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x91c [0072.158] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5462728 | out: lpFindFileData=0x5462728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ae5394, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68ae5394, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68ae5394, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x276d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0072.158] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0072.158] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0072.158] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x53e79f0 [0072.158] wcscpy (in: _Dest=0x53e79f0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe" [0072.158] wcscat (in: _Dest=0x53e79f0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\" [0072.158] wcscat (in: _Dest=0x53e79f0, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" [0072.158] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53e79f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x920 [0072.159] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5462728 | out: lpFindFileData=0x5462728*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ae5394, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaaf18f1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x68ae5394, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0072.159] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0072.159] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0072.159] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53fec90 [0072.159] wcscpy (in: _Dest=0x53fec90, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe" [0072.159] wcscat (in: _Dest=0x53fec90, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\" [0072.159] wcscat (in: _Dest=0x53fec90, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0072.159] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53fec90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x924 [0072.159] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5462728 | out: lpFindFileData=0x5462728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ae5394, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68ae5394, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68ae5394, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x29c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0072.160] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0072.160] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0072.160] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x53e72a0 [0072.160] wcscpy (in: _Dest=0x53e72a0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe" [0072.160] wcscat (in: _Dest=0x53e72a0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\" [0072.160] wcscat (in: _Dest=0x53e72a0, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" [0072.160] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53e72a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x928 [0072.160] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5462728 | out: lpFindFileData=0x5462728*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ae5394, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaafbd2f7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x68bca1ad, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0072.160] wcscmp (_String1="Assets", _String2=".") returned 1 [0072.161] wcscmp (_String1="Assets", _String2="..") returned 1 [0072.161] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb2) returned 0x54612e8 [0072.161] wcscpy (in: _Dest=0x54612e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe" [0072.161] wcscat (in: _Dest=0x54612e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\" [0072.161] wcscat (in: _Dest=0x54612e8, _Source="Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets" [0072.161] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54612e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x92c [0072.161] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5462728 | out: lpFindFileData=0x5462728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68bca1ad, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68bca1ad, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68c62b19, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1d1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="CallsApp.exe", cAlternateFileName="")) returned 1 [0072.162] wcscmp (_String1="CallsApp.exe", _String2=".") returned 1 [0072.162] wcscmp (_String1="CallsApp.exe", _String2="..") returned 1 [0072.162] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5462728 | out: lpFindFileData=0x5462728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68c62b19, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68c62b19, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68c62b19, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CallsApp.winmd", cAlternateFileName="")) returned 1 [0072.162] wcscmp (_String1="CallsApp.winmd", _String2=".") returned 1 [0072.162] wcscmp (_String1="CallsApp.winmd", _String2="..") returned 1 [0072.162] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x53e7920 [0072.162] wcscpy (in: _Dest=0x53e7920, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe" [0072.162] wcscat (in: _Dest=0x53e7920, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\" [0072.162] wcscat (in: _Dest=0x53e7920, _Source="CallsApp.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsApp.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsApp.winmd" [0072.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53e7920, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x930 [0072.162] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5462728 | out: lpFindFileData=0x5462728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68c62b19, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68c62b19, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68d6db88, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x330200, dwReserved0=0x0, dwReserved1=0x0, cFileName="CallsCore.dll", cAlternateFileName="")) returned 1 [0072.163] wcscmp (_String1="CallsCore.dll", _String2=".") returned 1 [0072.163] wcscmp (_String1="CallsCore.dll", _String2="..") returned 1 [0072.163] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5462728 | out: lpFindFileData=0x5462728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68d6db88, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68d6db88, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68d6db88, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x14400, dwReserved0=0x0, dwReserved1=0x0, cFileName="CallsCore.winmd", cAlternateFileName="")) returned 1 [0072.163] wcscmp (_String1="CallsCore.winmd", _String2=".") returned 1 [0072.163] wcscmp (_String1="CallsCore.winmd", _String2="..") returned 1 [0072.163] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x53e7ac0 [0072.163] wcscpy (in: _Dest=0x53e7ac0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe" [0072.163] wcscat (in: _Dest=0x53e7ac0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\" [0072.163] wcscat (in: _Dest=0x53e7ac0, _Source="CallsCore.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsCore.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsCore.winmd" [0072.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53e7ac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x934 [0072.163] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5462728 | out: lpFindFileData=0x5462728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68d6db88, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68d6db88, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68e78f63, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x59800, dwReserved0=0x0, dwReserved1=0x0, cFileName="CallsPresenters.dll", cAlternateFileName="")) returned 1 [0072.163] wcscmp (_String1="CallsPresenters.dll", _String2=".") returned 1 [0072.163] wcscmp (_String1="CallsPresenters.dll", _String2="..") returned 1 [0072.164] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5462728 | out: lpFindFileData=0x5462728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68e78f63, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68e78f63, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68e78f63, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="CallsResources.dll", cAlternateFileName="")) returned 1 [0072.164] wcscmp (_String1="CallsResources.dll", _String2=".") returned 1 [0072.164] wcscmp (_String1="CallsResources.dll", _String2="..") returned 1 [0072.164] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5462728 | out: lpFindFileData=0x5462728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68e78f63, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68e78f63, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68e78f63, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="CallsResources.winmd", cAlternateFileName="")) returned 1 [0072.164] wcscmp (_String1="CallsResources.winmd", _String2=".") returned 1 [0072.164] wcscmp (_String1="CallsResources.winmd", _String2="..") returned 1 [0072.164] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x53ba830 [0072.164] wcscpy (in: _Dest=0x53ba830, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe" [0072.164] wcscat (in: _Dest=0x53ba830, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\" [0072.164] wcscat (in: _Dest=0x53ba830, _Source="CallsResources.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsResources.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsResources.winmd" [0072.164] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53ba830, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x938 [0072.164] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5462728 | out: lpFindFileData=0x5462728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68e78f63, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68e78f63, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68e78f63, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x3cc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="CallsRTShims.dll", cAlternateFileName="")) returned 1 [0072.164] wcscmp (_String1="CallsRTShims.dll", _String2=".") returned 1 [0072.165] wcscmp (_String1="CallsRTShims.dll", _String2="..") returned 1 [0072.165] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5462728 | out: lpFindFileData=0x5462728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68e9ee55, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68e9ee55, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68e9ee55, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="CallsRTShims.winmd", cAlternateFileName="")) returned 1 [0072.165] wcscmp (_String1="CallsRTShims.winmd", _String2=".") returned 1 [0072.165] wcscmp (_String1="CallsRTShims.winmd", _String2="..") returned 1 [0072.165] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xca) returned 0x53b9ab0 [0072.165] wcscpy (in: _Dest=0x53b9ab0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe" [0072.165] wcscat (in: _Dest=0x53b9ab0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\" [0072.165] wcscat (in: _Dest=0x53b9ab0, _Source="CallsRTShims.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsRTShims.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsRTShims.winmd" [0072.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53b9ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x93c [0072.166] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5462728 | out: lpFindFileData=0x5462728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68e9ee55, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68e9ee55, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68e9ee55, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.People.Controls.winmd", cAlternateFileName="")) returned 1 [0072.166] wcscmp (_String1="Microsoft.People.Controls.winmd", _String2=".") returned 1 [0072.166] wcscmp (_String1="Microsoft.People.Controls.winmd", _String2="..") returned 1 [0072.166] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe4) returned 0x38b4af8 [0072.166] wcscpy (in: _Dest=0x38b4af8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe" [0072.166] wcscat (in: _Dest=0x38b4af8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\" [0072.166] wcscat (in: _Dest=0x38b4af8, _Source="Microsoft.People.Controls.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Microsoft.People.Controls.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Microsoft.People.Controls.winmd" [0072.166] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b4af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x940 [0072.166] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5462728 | out: lpFindFileData=0x5462728*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x61f43dfb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x134444f, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x134444f, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0072.166] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0072.167] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0072.167] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x38b4be8 [0072.167] wcscpy (in: _Dest=0x38b4be8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe" [0072.167] wcscat (in: _Dest=0x38b4be8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\" [0072.167] wcscat (in: _Dest=0x38b4be8, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0072.167] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b4be8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x944 [0072.167] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5462728 | out: lpFindFileData=0x5462728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68e9ee55, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68e9ee55, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68e9ee55, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x51c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PersonPicture.UAP.dll", cAlternateFileName="")) returned 1 [0072.167] wcscmp (_String1="PersonPicture.UAP.dll", _String2=".") returned 1 [0072.167] wcscmp (_String1="PersonPicture.UAP.dll", _String2="..") returned 1 [0072.168] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5462728 | out: lpFindFileData=0x5462728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ec50b7, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68ec50b7, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68ec50b7, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x26770, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0072.168] wcscmp (_String1="resources.pri", _String2=".") returned 1 [0072.168] wcscmp (_String1="resources.pri", _String2="..") returned 1 [0072.168] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x38b4cd8 [0072.168] wcscpy (in: _Dest=0x38b4cd8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe" [0072.168] wcscat (in: _Dest=0x38b4cd8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\" [0072.168] wcscat (in: _Dest=0x38b4cd8, _Source="resources.pri" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\resources.pri") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\resources.pri" [0072.168] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b4cd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x948 [0072.168] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5462728 | out: lpFindFileData=0x5462728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ec50b7, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68ec50b7, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68ec50b7, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsPhoneReservedAppInfo.xml", cAlternateFileName="")) returned 1 [0072.168] wcscmp (_String1="WindowsPhoneReservedAppInfo.xml", _String2=".") returned 1 [0072.168] wcscmp (_String1="WindowsPhoneReservedAppInfo.xml", _String2="..") returned 1 [0072.169] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe4) returned 0x38b4da0 [0072.169] wcscpy (in: _Dest=0x38b4da0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe" [0072.169] wcscat (in: _Dest=0x38b4da0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\" [0072.169] wcscat (in: _Dest=0x38b4da0, _Source="WindowsPhoneReservedAppInfo.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\WindowsPhoneReservedAppInfo.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\WindowsPhoneReservedAppInfo.xml" [0072.169] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b4da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x94c [0072.169] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x5462728 | out: lpFindFileData=0x5462728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ec50b7, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68ec50b7, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68ec50b7, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsPhoneReservedAppInfo.xml", cAlternateFileName="")) returned 0 [0072.169] FindClose (in: hFindFile=0x5445080 | out: hFindFile=0x5445080) returned 1 [0072.170] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5462728) returned 1 [0072.170] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388f930) returned 1 [0072.170] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388e5f0) returned 1 Thread: id = 254 os_tid = 0x12a0 [0071.867] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x38b8960 [0071.867] wcscpy (in: _Dest=0x38b8960, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe" [0071.867] wcscat (in: _Dest=0x38b8960, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\" [0071.867] wcscat (in: _Dest=0x38b8960, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\*" [0071.867] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5463800 [0071.867] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x5463800 | out: lpFindFileData=0x5463800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd526822a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab021835, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628cd443, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ec00 [0077.007] wcscmp (_String1=".", _String2=".") returned 0 [0077.007] FindNextFileW (in: hFindFile=0x389ec00, lpFindFileData=0x5463800 | out: lpFindFileData=0x5463800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd526822a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab021835, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628cd443, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.007] wcscmp (_String1="..", _String2=".") returned 1 [0077.007] wcscmp (_String1="..", _String2="..") returned 0 [0077.007] FindNextFileW (in: hFindFile=0x389ec00, lpFindFileData=0x5463800 | out: lpFindFileData=0x5463800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd528e480, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xd528e480, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xd528e480, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0077.007] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0077.007] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0077.007] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x54f19a0 [0077.007] wcscpy (in: _Dest=0x54f19a0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe" [0077.007] wcscat (in: _Dest=0x54f19a0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\" [0077.007] wcscat (in: _Dest=0x54f19a0, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" [0081.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f19a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a38 [0081.065] FindNextFileW (in: hFindFile=0x389ec00, lpFindFileData=0x5463800 | out: lpFindFileData=0x5463800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd526822a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab022752, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd526822a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0081.065] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0081.065] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0081.065] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x7330398 [0091.748] wcscpy (in: _Dest=0x7330398, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe" [0091.748] wcscat (in: _Dest=0x7330398, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\" [0091.748] wcscat (in: _Dest=0x7330398, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" Thread: id = 255 os_tid = 0xd90 [0071.867] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb2) returned 0x54615e8 [0071.867] wcscpy (in: _Dest=0x54615e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe" [0071.867] wcscat (in: _Dest=0x54615e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\" [0071.867] wcscat (in: _Dest=0x54615e8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\*" [0071.867] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5462990 [0071.868] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x5462990 | out: lpFindFileData=0x5462990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5373138, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab088494, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628cd443, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444d00 [0072.171] wcscmp (_String1=".", _String2=".") returned 0 [0072.171] FindNextFileW (in: hFindFile=0x5444d00, lpFindFileData=0x5462990 | out: lpFindFileData=0x5462990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5373138, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab088494, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628cd443, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.171] wcscmp (_String1="..", _String2=".") returned 1 [0072.171] wcscmp (_String1="..", _String2="..") returned 0 [0072.171] FindNextFileW (in: hFindFile=0x5444d00, lpFindFileData=0x5462990 | out: lpFindFileData=0x5462990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5373138, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xd5373138, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xd5373138, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x24ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0072.171] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0072.171] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0072.172] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x53ba320 [0072.172] wcscpy (in: _Dest=0x53ba320, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe" [0072.172] wcscat (in: _Dest=0x53ba320, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\" [0072.172] wcscat (in: _Dest=0x53ba320, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" [0072.172] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53ba320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x950 [0072.172] FindNextFileW (in: hFindFile=0x5444d00, lpFindFileData=0x5462990 | out: lpFindFileData=0x5462990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5373138, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xd5373138, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xd5373138, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xd4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0072.172] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0072.172] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0072.172] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x53bb250 [0072.172] wcscpy (in: _Dest=0x53bb250, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe" [0072.172] wcscat (in: _Dest=0x53bb250, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\" [0072.172] wcscat (in: _Dest=0x53bb250, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" [0072.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53bb250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x954 [0072.173] FindNextFileW (in: hFindFile=0x5444d00, lpFindFileData=0x5462990 | out: lpFindFileData=0x5462990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5373138, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08a798, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd5373138, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0072.173] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0072.173] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0072.173] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x53e7b90 [0072.173] wcscpy (in: _Dest=0x53e7b90, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe" [0072.173] wcscat (in: _Dest=0x53e7b90, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\" [0072.173] wcscat (in: _Dest=0x53e7b90, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0072.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53e7b90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x958 [0072.174] FindNextFileW (in: hFindFile=0x5444d00, lpFindFileData=0x5462990 | out: lpFindFileData=0x5462990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5373138, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xd5373138, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xd5373138, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2992, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0072.174] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0072.174] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0072.174] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x38b4e90 [0072.174] wcscpy (in: _Dest=0x38b4e90, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe" [0072.174] wcscat (in: _Dest=0x38b4e90, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\" [0072.174] wcscat (in: _Dest=0x38b4e90, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" [0072.174] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b4e90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x95c [0072.175] FindNextFileW (in: hFindFile=0x5444d00, lpFindFileData=0x5462990 | out: lpFindFileData=0x5462990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd53994f2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08aff3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd53994f2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0072.175] wcscmp (_String1="Assets", _String2=".") returned 1 [0072.175] wcscmp (_String1="Assets", _String2="..") returned 1 [0072.175] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x53e8350 [0072.175] wcscpy (in: _Dest=0x53e8350, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe" [0072.175] wcscat (in: _Dest=0x53e8350, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\" [0072.175] wcscat (in: _Dest=0x53e8350, _Source="Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets" [0072.175] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53e8350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x960 [0072.176] FindNextFileW (in: hFindFile=0x5444d00, lpFindFileData=0x5462990 | out: lpFindFileData=0x5462990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53994f2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xd53994f2, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xd53994f2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xff58, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClrCompression.dll", cAlternateFileName="")) returned 1 [0072.176] wcscmp (_String1="ClrCompression.dll", _String2=".") returned 1 [0072.176] wcscmp (_String1="ClrCompression.dll", _String2="..") returned 1 [0072.176] FindNextFileW (in: hFindFile=0x5444d00, lpFindFileData=0x5462990 | out: lpFindFileData=0x5462990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53994f2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xd53994f2, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x508c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConnectivityStore.Windows.dll", cAlternateFileName="")) returned 1 [0072.176] wcscmp (_String1="ConnectivityStore.Windows.dll", _String2=".") returned 1 [0072.176] wcscmp (_String1="ConnectivityStore.Windows.dll", _String2="..") returned 1 [0072.176] FindNextFileW (in: hFindFile=0x5444d00, lpFindFileData=0x5462990 | out: lpFindFileData=0x5462990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xd547e1a3, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConnectivityStore.Windows.exe", cAlternateFileName="")) returned 1 [0072.176] wcscmp (_String1="ConnectivityStore.Windows.exe", _String2=".") returned 1 [0072.176] wcscmp (_String1="ConnectivityStore.Windows.exe", _String2="..") returned 1 [0072.176] FindNextFileW (in: hFindFile=0x5444d00, lpFindFileData=0x5462990 | out: lpFindFileData=0x5462990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08b876, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FAQ", cAlternateFileName="")) returned 1 [0072.176] wcscmp (_String1="FAQ", _String2=".") returned 1 [0072.176] wcscmp (_String1="FAQ", _String2="..") returned 1 [0072.177] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb6) returned 0x5461a68 [0072.177] wcscpy (in: _Dest=0x5461a68, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe" [0072.177] wcscat (in: _Dest=0x5461a68, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\" [0072.177] wcscat (in: _Dest=0x5461a68, _Source="FAQ" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ" [0072.177] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5461a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x964 [0072.177] FindNextFileW (in: hFindFile=0x5444d00, lpFindFileData=0x5462990 | out: lpFindFileData=0x5462990*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x628cd443, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xab08dbee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628cd443, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0072.177] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0072.177] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0072.177] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x38b4f70 [0072.177] wcscpy (in: _Dest=0x38b4f70, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe" [0072.178] wcscat (in: _Dest=0x38b4f70, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\" [0072.178] wcscat (in: _Dest=0x38b4f70, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0072.178] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b4f70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x968 [0072.178] FindNextFileW (in: hFindFile=0x5444d00, lpFindFileData=0x5462990 | out: lpFindFileData=0x5462990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xd547e1a3, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xcc36, dwReserved0=0x0, dwReserved1=0x0, cFileName="Package.StoreAssociation.xml", cAlternateFileName="")) returned 1 [0072.178] wcscmp (_String1="Package.StoreAssociation.xml", _String2=".") returned 1 [0072.178] wcscmp (_String1="Package.StoreAssociation.xml", _String2="..") returned 1 [0072.178] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x38b5070 [0072.178] wcscpy (in: _Dest=0x38b5070, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe" [0072.178] wcscat (in: _Dest=0x38b5070, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\" [0072.178] wcscat (in: _Dest=0x38b5070, _Source="Package.StoreAssociation.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Package.StoreAssociation.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Package.StoreAssociation.xml" [0072.179] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b5070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x96c [0072.179] FindNextFileW (in: hFindFile=0x5444d00, lpFindFileData=0x5462990 | out: lpFindFileData=0x5462990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xd547e1a3, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x6980, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0072.179] wcscmp (_String1="resources.pri", _String2=".") returned 1 [0072.179] wcscmp (_String1="resources.pri", _String2="..") returned 1 [0072.179] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xca) returned 0x53baab8 [0072.179] wcscpy (in: _Dest=0x53baab8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe" [0072.179] wcscat (in: _Dest=0x53baab8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\" [0072.179] wcscat (in: _Dest=0x53baab8, _Source="resources.pri" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\resources.pri") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\resources.pri" [0072.180] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53baab8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x970 [0072.180] FindNextFileW (in: hFindFile=0x5444d00, lpFindFileData=0x5462990 | out: lpFindFileData=0x5462990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08e5b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TermsOfService", cAlternateFileName="TERMSO~1")) returned 1 [0072.180] wcscmp (_String1="TermsOfService", _String2=".") returned 1 [0072.180] wcscmp (_String1="TermsOfService", _String2="..") returned 1 [0072.180] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x53b9b88 [0072.180] wcscpy (in: _Dest=0x53b9b88, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe" [0072.180] wcscat (in: _Dest=0x53b9b88, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\" [0072.180] wcscat (in: _Dest=0x53b9b88, _Source="TermsOfService" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService" [0072.180] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53b9b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x974 [0072.181] FindNextFileW (in: hFindFile=0x5444d00, lpFindFileData=0x5462990 | out: lpFindFileData=0x5462990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5373138, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab089e41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd5373138, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 1 [0072.181] wcscmp (_String1="_Resources", _String2=".") returned 1 [0072.181] wcscmp (_String1="_Resources", _String2="..") returned 1 [0072.181] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x53e7c60 [0072.181] wcscpy (in: _Dest=0x53e7c60, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe" [0072.181] wcscat (in: _Dest=0x53e7c60, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\" [0072.181] wcscat (in: _Dest=0x53e7c60, _Source="_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\_Resources" [0072.181] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53e7c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x978 [0072.182] FindNextFileW (in: hFindFile=0x5444d00, lpFindFileData=0x5462990 | out: lpFindFileData=0x5462990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5373138, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab089e41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd5373138, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 0 [0072.182] FindClose (in: hFindFile=0x5444d00 | out: hFindFile=0x5444d00) returned 1 [0072.182] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5462990) returned 1 [0072.182] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54615e8) returned 1 [0072.182] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a19d8) returned 1 Thread: id = 256 os_tid = 0xd34 [0071.868] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xde) returned 0x38b8bc0 [0071.868] wcscpy (in: _Dest=0x38b8bc0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe" [0071.868] wcscat (in: _Dest=0x38b8bc0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0071.868] wcscat (in: _Dest=0x38b8bc0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\*" [0071.868] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5463a68 [0071.868] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\*", lpFindFileData=0x5463a68 | out: lpFindFileData=0x5463a68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d296410, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb9355ef2, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb9355ef2, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ef40 [0074.833] wcscmp (_String1=".", _String2=".") returned 0 [0074.833] FindNextFileW (in: hFindFile=0x389ef40, lpFindFileData=0x5463a68 | out: lpFindFileData=0x5463a68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d296410, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb9355ef2, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb9355ef2, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.833] wcscmp (_String1="..", _String2=".") returned 1 [0074.833] wcscmp (_String1="..", _String2="..") returned 0 [0074.833] FindNextFileW (in: hFindFile=0x389ef40, lpFindFileData=0x5463a68 | out: lpFindFileData=0x5463a68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d2bc66a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9d2bc66a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9d2bc66a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1142, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0074.833] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0074.833] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0074.834] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x53fdda0 [0074.834] wcscpy (in: _Dest=0x53fdda0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe" [0074.834] wcscat (in: _Dest=0x53fdda0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0074.834] wcscat (in: _Dest=0x53fdda0, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml" [0074.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53fdda0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbbc [0074.834] FindNextFileW (in: hFindFile=0x389ef40, lpFindFileData=0x5463a68 | out: lpFindFileData=0x5463a68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d296410, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9d296410, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9d296410, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x349, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0074.834] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0074.834] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0074.834] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x53fdea8 [0074.834] wcscpy (in: _Dest=0x53fdea8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe" [0074.834] wcscat (in: _Dest=0x53fdea8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0074.834] wcscat (in: _Dest=0x53fdea8, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml" [0074.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53fdea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbc0 [0074.835] FindNextFileW (in: hFindFile=0x389ef40, lpFindFileData=0x5463a68 | out: lpFindFileData=0x5463a68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d2bc66a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9d2bc66a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9d2bc66a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x299d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0074.835] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0074.835] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0074.835] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfe) returned 0x39726a8 [0074.835] wcscpy (in: _Dest=0x39726a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe" [0074.835] wcscat (in: _Dest=0x39726a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0074.835] wcscat (in: _Dest=0x39726a8, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x" [0074.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x39726a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbc4 [0074.836] FindNextFileW (in: hFindFile=0x389ef40, lpFindFileData=0x5463a68 | out: lpFindFileData=0x5463a68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d2bc66a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab13f343, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d32ed7f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0074.836] wcscmp (_String1="Assets", _String2=".") returned 1 [0074.836] wcscmp (_String1="Assets", _String2="..") returned 1 [0074.836] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x396ea88 [0074.836] wcscpy (in: _Dest=0x396ea88, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe" [0074.836] wcscat (in: _Dest=0x396ea88, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0074.836] wcscat (in: _Dest=0x396ea88, _Source="Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0074.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x396ea88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbc8 [0074.837] FindNextFileW (in: hFindFile=0x389ef40, lpFindFileData=0x5463a68 | out: lpFindFileData=0x5463a68*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb9355ef2, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb9355ef2, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb9355ef2, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0074.837] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0074.837] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0074.837] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11e) returned 0x39727b0 [0074.837] wcscpy (in: _Dest=0x39727b0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe" [0074.837] wcscat (in: _Dest=0x39727b0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0074.837] wcscat (in: _Dest=0x39727b0, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata" [0074.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x39727b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbcc [0074.838] FindNextFileW (in: hFindFile=0x389ef40, lpFindFileData=0x5463a68 | out: lpFindFileData=0x5463a68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d37b231, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9d37b231, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9d37b231, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xb10, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0074.838] wcscmp (_String1="resources.pri", _String2=".") returned 1 [0074.838] wcscmp (_String1="resources.pri", _String2="..") returned 1 [0074.838] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf6) returned 0x54a3a00 [0074.838] wcscpy (in: _Dest=0x54a3a00, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe" [0074.838] wcscat (in: _Dest=0x54a3a00, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0074.838] wcscat (in: _Dest=0x54a3a00, _Source="resources.pri" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri" [0074.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54a3a00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbd0 [0074.839] FindNextFileW (in: hFindFile=0x389ef40, lpFindFileData=0x5463a68 | out: lpFindFileData=0x5463a68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d37b231, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9d37b231, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9d37b231, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xb10, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 0 [0074.839] FindClose (in: hFindFile=0x389ef40 | out: hFindFile=0x389ef40) returned 1 [0074.840] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5463a68) returned 1 [0074.840] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b8bc0) returned 1 [0074.840] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388aff8) returned 1 Thread: id = 257 os_tid = 0x9f0 [0071.869] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb8) returned 0x5461768 [0071.869] wcscpy (in: _Dest=0x5461768, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe" [0071.869] wcscat (in: _Dest=0x5461768, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\" [0071.869] wcscat (in: _Dest=0x5461768, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\*" [0071.869] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5462e60 [0071.869] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x5462e60 | out: lpFindFileData=0x5462e60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c531351, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb932fcac, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb932fcac, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54453c0 [0077.211] wcscmp (_String1=".", _String2=".") returned 0 [0077.211] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x5462e60 | out: lpFindFileData=0x5462e60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c531351, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb932fcac, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb932fcac, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.211] wcscmp (_String1="..", _String2=".") returned 1 [0077.211] wcscmp (_String1="..", _String2="..") returned 0 [0077.211] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x5462e60 | out: lpFindFileData=0x5462e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5575af, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9c5575af, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9c5575af, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x19db, dwReserved0=0x0, dwReserved1=0x0, cFileName="256x256.png", cAlternateFileName="")) returned 1 [0077.211] wcscmp (_String1="256x256.png", _String2=".") returned 1 [0077.211] wcscmp (_String1="256x256.png", _String2="..") returned 1 [0077.211] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x389df78 [0077.211] wcscpy (in: _Dest=0x389df78, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe" [0077.211] wcscat (in: _Dest=0x389df78, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\" [0077.211] wcscat (in: _Dest=0x389df78, _Source="256x256.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\256x256.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\256x256.png" [0080.943] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x389df78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1224 [0080.944] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x5462e60 | out: lpFindFileData=0x5462e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5575af, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9c5575af, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9c5575af, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x55db, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0080.944] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0080.944] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0080.944] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd6) returned 0x5bab520 [0080.944] wcscpy (in: _Dest=0x5bab520, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe" [0080.944] wcscat (in: _Dest=0x5bab520, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\" [0080.944] wcscat (in: _Dest=0x5bab520, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" [0080.944] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5bab520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18dc [0080.944] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x5462e60 | out: lpFindFileData=0x5462e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c57d803, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9cdf7b05, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9cdf7b05, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxClickHandler.exe", cAlternateFileName="")) returned 1 [0080.945] wcscmp (_String1="AppxClickHandler.exe", _String2=".") returned 1 [0080.945] wcscmp (_String1="AppxClickHandler.exe", _String2="..") returned 1 [0080.945] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x5462e60 | out: lpFindFileData=0x5462e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cdf7b05, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9cdf7b05, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9cdf7b05, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxClickHandler.winmd", cAlternateFileName="")) returned 1 [0080.945] wcscmp (_String1="AppxClickHandler.winmd", _String2=".") returned 1 [0080.945] wcscmp (_String1="AppxClickHandler.winmd", _String2="..") returned 1 [0080.945] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x54ba548 [0080.945] wcscpy (in: _Dest=0x54ba548, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe" [0080.945] wcscat (in: _Dest=0x54ba548, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\" [0080.945] wcscat (in: _Dest=0x54ba548, _Source="AppxClickHandler.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxClickHandler.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxClickHandler.winmd" [0080.945] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54ba548, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e0 [0080.945] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x5462e60 | out: lpFindFileData=0x5462e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c531351, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9c531351, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9c531351, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xff4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0080.946] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0080.946] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0080.946] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd6) returned 0x5bab600 [0080.946] wcscpy (in: _Dest=0x5bab600, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe" [0080.946] wcscat (in: _Dest=0x5bab600, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\" [0080.946] wcscat (in: _Dest=0x5bab600, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" [0080.946] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5bab600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e4 [0080.946] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x5462e60 | out: lpFindFileData=0x5462e60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c5575af, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab228e06, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9c5575af, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0080.946] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0080.946] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0080.946] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x75800c0 [0080.946] wcscpy (in: _Dest=0x75800c0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe" [0080.946] wcscat (in: _Dest=0x75800c0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\" [0080.946] wcscat (in: _Dest=0x75800c0, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0080.947] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x75800c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e8 [0080.947] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x5462e60 | out: lpFindFileData=0x5462e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5575af, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9c5575af, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9c5575af, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x29c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0080.947] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0080.947] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0080.947] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x5bab6e0 [0080.947] wcscpy (in: _Dest=0x5bab6e0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe" [0080.947] wcscat (in: _Dest=0x5bab6e0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\" [0080.947] wcscat (in: _Dest=0x5bab6e0, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" [0080.947] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5bab6e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18ec [0080.948] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x5462e60 | out: lpFindFileData=0x5462e60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdf7b05, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab2732ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d1b15f4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0080.948] wcscmp (_String1="Assets", _String2=".") returned 1 [0080.948] wcscmp (_String1="Assets", _String2="..") returned 1 [0080.948] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x55fdc88 [0080.948] wcscpy (in: _Dest=0x55fdc88, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe" [0080.948] wcscat (in: _Dest=0x55fdc88, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\" [0080.948] wcscat (in: _Dest=0x55fdc88, _Source="Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0080.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55fdc88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f0 [0080.949] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x5462e60 | out: lpFindFileData=0x5462e60*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb932fcac, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xfe80d855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe80d855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0080.949] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0080.949] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0080.949] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf8) returned 0x5ba20f8 [0080.949] wcscpy (in: _Dest=0x5ba20f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe" [0080.949] wcscat (in: _Dest=0x5ba20f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\" [0080.949] wcscat (in: _Dest=0x5ba20f8, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0080.949] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba20f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f4 [0080.953] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x5462e60 | out: lpFindFileData=0x5462e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d1d7849, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9d1d7849, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9d1d7849, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xcff8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0080.953] wcscmp (_String1="resources.pri", _String2=".") returned 1 [0080.953] wcscmp (_String1="resources.pri", _String2="..") returned 1 [0080.953] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x757f6a0 [0080.953] wcscpy (in: _Dest=0x757f6a0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe" [0080.953] wcscat (in: _Dest=0x757f6a0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\" [0080.953] wcscat (in: _Dest=0x757f6a0, _Source="resources.pri" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\resources.pri") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\resources.pri" [0080.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x757f6a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f8 [0080.953] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x5462e60 | out: lpFindFileData=0x5462e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d1d7849, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9d1d7849, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9d1d7849, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xcff8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 0 [0080.953] FindClose (in: hFindFile=0x54453c0 | out: hFindFile=0x54453c0) returned 1 [0080.954] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5462e60) returned 1 [0080.954] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5461768) returned 1 [0080.954] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388b0e0) returned 1 Thread: id = 258 os_tid = 0x60 [0071.869] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x38b8e60 [0071.869] wcscpy (in: _Dest=0x38b8e60, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe" [0071.869] wcscat (in: _Dest=0x38b8e60, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\" [0071.869] wcscat (in: _Dest=0x38b8e60, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\*" [0071.869] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5463cd0 [0071.870] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x5463cd0 | out: lpFindFileData=0x5463cd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c3b24a6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb932fcac, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb932fcac, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e8c0 [0076.951] wcscmp (_String1=".", _String2=".") returned 0 [0076.951] FindNextFileW (in: hFindFile=0x389e8c0, lpFindFileData=0x5463cd0 | out: lpFindFileData=0x5463cd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c3b24a6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb932fcac, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb932fcac, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.951] wcscmp (_String1="..", _String2=".") returned 1 [0076.951] wcscmp (_String1="..", _String2="..") returned 0 [0076.951] FindNextFileW (in: hFindFile=0x389e8c0, lpFindFileData=0x5463cd0 | out: lpFindFileData=0x5463cd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c50b0ee, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9c50b0ee, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9c50b0ee, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0076.951] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0076.951] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0076.951] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54f1518 [0076.951] wcscpy (in: _Dest=0x54f1518, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe" [0076.951] wcscat (in: _Dest=0x54f1518, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\" [0076.951] wcscat (in: _Dest=0x54f1518, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" [0081.068] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f1518, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a48 [0081.069] FindNextFileW (in: hFindFile=0x389e8c0, lpFindFileData=0x5463cd0 | out: lpFindFileData=0x5463cd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c3b24a6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab4afc0f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9c3b24a6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0081.069] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0081.069] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0081.069] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x73335a8 [0091.749] wcscpy (in: _Dest=0x73335a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe" [0091.749] wcscat (in: _Dest=0x73335a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\" [0091.749] wcscat (in: _Dest=0x73335a8, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" Thread: id = 259 os_tid = 0xb58 [0071.870] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x38b8f30 [0071.870] wcscpy (in: _Dest=0x38b8f30, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe" [0071.870] wcscat (in: _Dest=0x38b8f30, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\" [0071.870] wcscat (in: _Dest=0x38b8f30, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\*" [0071.870] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5463f38 [0071.870] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\*", lpFindFileData=0x5463f38 | out: lpFindFileData=0x5463f38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fe54df6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbad8fd68, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad8fd68, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ec80 [0077.147] wcscmp (_String1=".", _String2=".") returned 0 [0077.147] FindNextFileW (in: hFindFile=0x389ec80, lpFindFileData=0x5463f38 | out: lpFindFileData=0x5463f38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fe54df6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbad8fd68, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad8fd68, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.147] wcscmp (_String1="..", _String2=".") returned 1 [0077.147] wcscmp (_String1="..", _String2="..") returned 0 [0077.147] FindNextFileW (in: hFindFile=0x389ec80, lpFindFileData=0x5463f38 | out: lpFindFileData=0x5463f38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe54df6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fe54df6, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fe54df6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xc9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0077.147] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0077.147] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0077.147] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x396f6b8 [0077.147] wcscpy (in: _Dest=0x396f6b8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe" [0077.147] wcscat (in: _Dest=0x396f6b8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\" [0077.147] wcscat (in: _Dest=0x396f6b8, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxBlockMap.xml" [0081.005] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396f6b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11f0 [0081.006] FindNextFileW (in: hFindFile=0x389ec80, lpFindFileData=0x5463f38 | out: lpFindFileData=0x5463f38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe54df6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fe54df6, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fe54df6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x39f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0081.006] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0081.006] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0081.006] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x54b8ce8 [0081.006] wcscpy (in: _Dest=0x54b8ce8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe" [0081.006] wcscat (in: _Dest=0x54b8ce8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\" [0081.006] wcscat (in: _Dest=0x54b8ce8, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxManifest.xml" [0081.006] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54b8ce8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1984 [0081.007] FindNextFileW (in: hFindFile=0x389ec80, lpFindFileData=0x5463f38 | out: lpFindFileData=0x5463f38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe54df6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fe54df6, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fe54df6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x296e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0081.007] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0081.007] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0081.007] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe4) returned 0x54b8838 [0081.007] wcscpy (in: _Dest=0x54b8838, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe" [0081.007] wcscat (in: _Dest=0x54b8838, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\" [0081.007] wcscat (in: _Dest=0x54b8838, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxSignature.p7x" [0081.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54b8838, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1988 [0081.008] FindNextFileW (in: hFindFile=0x389ec80, lpFindFileData=0x5463f38 | out: lpFindFileData=0x5463f38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fe54df6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab549f27, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fed1b77, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0081.008] wcscmp (_String1="Assets", _String2=".") returned 1 [0081.008] wcscmp (_String1="Assets", _String2="..") returned 1 [0081.008] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x7580ae0 [0081.008] wcscpy (in: _Dest=0x7580ae0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe" [0081.008] wcscat (in: _Dest=0x7580ae0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\" [0081.008] wcscat (in: _Dest=0x7580ae0, _Source="Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" [0081.008] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7580ae0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x198c [0081.009] FindNextFileW (in: hFindFile=0x389ec80, lpFindFileData=0x5463f38 | out: lpFindFileData=0x5463f38*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbad8fd68, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbad8fd68, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad8fd68, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0081.009] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0081.009] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0081.009] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x104) returned 0x766a208 [0091.714] wcscpy (in: _Dest=0x766a208, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe" [0091.714] wcscat (in: _Dest=0x766a208, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\" [0091.714] wcscat (in: _Dest=0x766a208, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\microsoft.system.package.metadata" Thread: id = 260 os_tid = 0xce8 [0071.871] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa8) returned 0x388f5c0 [0071.871] wcscpy (in: _Dest=0x388f5c0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe" [0071.871] wcscat (in: _Dest=0x388f5c0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\" [0071.871] wcscat (in: _Dest=0x388f5c0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\*" [0071.871] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54630c8 [0071.871] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x54630c8 | out: lpFindFileData=0x54630c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed19195, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbad4389d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad4389d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e880 [0077.030] wcscmp (_String1=".", _String2=".") returned 0 [0077.030] FindNextFileW (in: hFindFile=0x389e880, lpFindFileData=0x54630c8 | out: lpFindFileData=0x54630c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed19195, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbad4389d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad4389d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.030] wcscmp (_String1="..", _String2=".") returned 1 [0077.031] wcscmp (_String1="..", _String2="..") returned 0 [0077.031] FindNextFileW (in: hFindFile=0x389e880, lpFindFileData=0x54630c8 | out: lpFindFileData=0x54630c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee96925, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7ee96925, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7ee96925, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0077.031] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0077.031] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0077.031] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x53f7e30 [0077.031] wcscpy (in: _Dest=0x53f7e30, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe" [0077.031] wcscat (in: _Dest=0x53f7e30, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\" [0077.031] wcscat (in: _Dest=0x53f7e30, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" [0081.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53f7e30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a2c [0081.062] FindNextFileW (in: hFindFile=0x389e880, lpFindFileData=0x54630c8 | out: lpFindFileData=0x54630c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed19195, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab5eb5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7ed19195, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0081.062] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0081.062] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0081.062] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x3976210 [0081.062] wcscpy (in: _Dest=0x3976210, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe" [0081.062] wcscat (in: _Dest=0x3976210, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\" [0081.062] wcscat (in: _Dest=0x3976210, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0081.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3976210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a30 [0081.063] FindNextFileW (in: hFindFile=0x389e880, lpFindFileData=0x54630c8 | out: lpFindFileData=0x54630c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee96925, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7eebcb7e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7eebcb7e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x296e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0081.063] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0081.063] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0081.063] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x55fceb8 [0081.063] wcscpy (in: _Dest=0x55fceb8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe" [0081.063] wcscat (in: _Dest=0x55fceb8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\" [0081.063] wcscat (in: _Dest=0x55fceb8, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" [0081.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55fceb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a34 [0081.064] FindNextFileW (in: hFindFile=0x389e880, lpFindFileData=0x54630c8 | out: lpFindFileData=0x54630c8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbad4389d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbad4389d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad4389d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0081.064] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0081.064] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0081.064] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x732e860 [0091.747] wcscpy (in: _Dest=0x732e860, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe" [0091.747] wcscat (in: _Dest=0x732e860, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\" [0091.748] wcscat (in: _Dest=0x732e860, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" Thread: id = 261 os_tid = 0xdd4 [0071.871] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9e) returned 0x38ac790 [0071.871] wcscpy (in: _Dest=0x38ac790, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe" [0071.871] wcscat (in: _Dest=0x38ac790, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\" [0071.871] wcscat (in: _Dest=0x38ac790, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\*" [0071.871] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5463330 [0071.871] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x5463330 | out: lpFindFileData=0x5463330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7eee2de1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbad69af3, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad69af3, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e880 [0075.383] wcscmp (_String1=".", _String2=".") returned 0 [0075.383] FindNextFileW (in: hFindFile=0x389e880, lpFindFileData=0x5463330 | out: lpFindFileData=0x5463330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7eee2de1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbad69af3, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad69af3, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.383] wcscmp (_String1="..", _String2=".") returned 1 [0075.383] wcscmp (_String1="..", _String2="..") returned 0 [0075.383] FindNextFileW (in: hFindFile=0x389e880, lpFindFileData=0x5463330 | out: lpFindFileData=0x5463330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7eee2de1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7eee2de1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7eee2de1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x7cf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0075.383] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0075.383] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0075.383] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x39758b0 [0075.384] wcscpy (in: _Dest=0x39758b0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe" [0075.384] wcscat (in: _Dest=0x39758b0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\" [0075.384] wcscat (in: _Dest=0x39758b0, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" [0075.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x39758b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xce0 [0075.801] FindNextFileW (in: hFindFile=0x389e880, lpFindFileData=0x5463330 | out: lpFindFileData=0x5463330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7eee2de1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7eee2de1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7eee2de1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x15b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0075.801] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0075.801] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0075.801] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x3975e28 [0075.801] wcscpy (in: _Dest=0x3975e28, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe" [0075.801] wcscat (in: _Dest=0x3975e28, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\" [0075.801] wcscat (in: _Dest=0x3975e28, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" [0075.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3975e28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd70 [0075.802] FindNextFileW (in: hFindFile=0x389e880, lpFindFileData=0x5463330 | out: lpFindFileData=0x5463330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ef09035, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab5edb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7ef09035, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0075.802] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0075.802] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0075.802] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb4) returned 0x3904a20 [0075.802] wcscpy (in: _Dest=0x3904a20, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe" [0075.802] wcscat (in: _Dest=0x3904a20, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\" [0075.802] wcscat (in: _Dest=0x3904a20, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0075.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3904a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd74 [0075.803] FindNextFileW (in: hFindFile=0x389e880, lpFindFileData=0x5463330 | out: lpFindFileData=0x5463330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7eee2de1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7ef09035, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7ef09035, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2995, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0075.803] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0075.803] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0075.803] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x3975bd0 [0075.803] wcscpy (in: _Dest=0x3975bd0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe" [0075.803] wcscat (in: _Dest=0x3975bd0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\" [0075.803] wcscat (in: _Dest=0x3975bd0, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" [0075.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3975bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd78 [0075.803] FindNextFileW (in: hFindFile=0x389e880, lpFindFileData=0x5463330 | out: lpFindFileData=0x5463330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f2d055d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6bff9c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f8f31a9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0075.803] wcscmp (_String1="Assets", _String2=".") returned 1 [0075.803] wcscmp (_String1="Assets", _String2="..") returned 1 [0075.803] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa8) returned 0x54de2f0 [0075.803] wcscpy (in: _Dest=0x54de2f0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe" [0075.804] wcscat (in: _Dest=0x54de2f0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\" [0075.804] wcscat (in: _Dest=0x54de2f0, _Source="Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0075.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54de2f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd7c [0075.804] FindNextFileW (in: hFindFile=0x389e880, lpFindFileData=0x5463330 | out: lpFindFileData=0x5463330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f8f31a9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f8f31a9, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f8f31a9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xff58, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClrCompression.dll", cAlternateFileName="")) returned 1 [0075.804] wcscmp (_String1="ClrCompression.dll", _String2=".") returned 1 [0075.804] wcscmp (_String1="ClrCompression.dll", _String2="..") returned 1 [0075.804] FindNextFileW (in: hFindFile=0x389e880, lpFindFileData=0x5463330 | out: lpFindFileData=0x5463330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f8f31a9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c0da4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content", cAlternateFileName="")) returned 1 [0075.804] wcscmp (_String1="Content", _String2=".") returned 1 [0075.804] wcscmp (_String1="Content", _String2="..") returned 1 [0075.804] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xaa) returned 0x5446870 [0075.804] wcscpy (in: _Dest=0x5446870, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe" [0075.804] wcscat (in: _Dest=0x5446870, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\" [0075.805] wcscat (in: _Dest=0x5446870, _Source="Content" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content" [0075.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5446870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd80 [0075.805] FindNextFileW (in: hFindFile=0x389e880, lpFindFileData=0x5463330 | out: lpFindFileData=0x5463330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa28bd5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fa28bd5, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fa28bd5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.CPub.BackgroundTasks.winmd", cAlternateFileName="")) returned 1 [0075.805] wcscmp (_String1="Microsoft.CPub.BackgroundTasks.winmd", _String2=".") returned 1 [0075.805] wcscmp (_String1="Microsoft.CPub.BackgroundTasks.winmd", _String2="..") returned 1 [0075.805] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe4) returned 0x396ed58 [0075.805] wcscpy (in: _Dest=0x396ed58, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe" [0075.805] wcscat (in: _Dest=0x396ed58, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\" [0075.805] wcscat (in: _Dest=0x396ed58, _Source="Microsoft.CPub.BackgroundTasks.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Microsoft.CPub.BackgroundTasks.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Microsoft.CPub.BackgroundTasks.winmd" [0075.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396ed58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd84 [0075.806] FindNextFileW (in: hFindFile=0x389e880, lpFindFileData=0x5463330 | out: lpFindFileData=0x5463330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa4ee54, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fa4ee54, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fa4ee54, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.CPub.SkuInterop.winmd", cAlternateFileName="")) returned 1 [0075.806] wcscmp (_String1="Microsoft.CPub.SkuInterop.winmd", _String2=".") returned 1 [0075.806] wcscmp (_String1="Microsoft.CPub.SkuInterop.winmd", _String2="..") returned 1 [0075.806] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x54f1178 [0075.806] wcscpy (in: _Dest=0x54f1178, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe" [0075.806] wcscat (in: _Dest=0x54f1178, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\" [0075.806] wcscat (in: _Dest=0x54f1178, _Source="Microsoft.CPub.SkuInterop.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Microsoft.CPub.SkuInterop.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Microsoft.CPub.SkuInterop.winmd" [0075.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f1178, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd88 [0075.807] FindNextFileW (in: hFindFile=0x389e880, lpFindFileData=0x5463330 | out: lpFindFileData=0x5463330*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbad69af3, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbad69af3, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad69af3, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0075.807] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0075.807] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0075.807] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xde) returned 0x54f1260 [0075.807] wcscpy (in: _Dest=0x54f1260, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe" [0075.807] wcscat (in: _Dest=0x54f1260, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\" [0075.807] wcscat (in: _Dest=0x54f1260, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0075.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54f1260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd8c [0075.808] FindNextFileW (in: hFindFile=0x389e880, lpFindFileData=0x5463330 | out: lpFindFileData=0x5463330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fa4ee54, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c7513, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fa750b2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0075.808] wcscmp (_String1="Resources", _String2=".") returned 1 [0075.808] wcscmp (_String1="Resources", _String2="..") returned 1 [0075.808] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xae) returned 0x5446928 [0075.808] wcscpy (in: _Dest=0x5446928, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe" [0075.808] wcscat (in: _Dest=0x5446928, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\" [0075.808] wcscat (in: _Dest=0x5446928, _Source="Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources" [0075.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5446928, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd90 [0075.809] FindNextFileW (in: hFindFile=0x389e880, lpFindFileData=0x5463330 | out: lpFindFileData=0x5463330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa4ee54, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fa4ee54, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fa4ee54, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x206c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0075.809] wcscmp (_String1="resources.pri", _String2=".") returned 1 [0075.809] wcscmp (_String1="resources.pri", _String2="..") returned 1 [0075.809] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb6) returned 0x39050e0 [0075.809] wcscpy (in: _Dest=0x39050e0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe" [0075.809] wcscat (in: _Dest=0x39050e0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\" [0075.809] wcscat (in: _Dest=0x39050e0, _Source="resources.pri" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\resources.pri") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\resources.pri" [0075.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x39050e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd94 [0075.809] FindNextFileW (in: hFindFile=0x389e880, lpFindFileData=0x5463330 | out: lpFindFileData=0x5463330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fac1569, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fac1569, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fac1569, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SkuInterop.dll", cAlternateFileName="")) returned 1 [0075.810] wcscmp (_String1="SkuInterop.dll", _String2=".") returned 1 [0075.810] wcscmp (_String1="SkuInterop.dll", _String2="..") returned 1 [0075.810] FindNextFileW (in: hFindFile=0x389e880, lpFindFileData=0x5463330 | out: lpFindFileData=0x5463330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fac1569, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fac1569, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fac1569, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x31000, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreRatingPromotion.dll", cAlternateFileName="")) returned 1 [0075.810] wcscmp (_String1="StoreRatingPromotion.dll", _String2=".") returned 1 [0075.810] wcscmp (_String1="StoreRatingPromotion.dll", _String2="..") returned 1 [0075.810] FindNextFileW (in: hFindFile=0x389e880, lpFindFileData=0x5463330 | out: lpFindFileData=0x5463330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fac1569, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fb59ed3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fb59ed3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreRatingPromotion.winmd", cAlternateFileName="")) returned 1 [0075.810] wcscmp (_String1="StoreRatingPromotion.winmd", _String2=".") returned 1 [0075.810] wcscmp (_String1="StoreRatingPromotion.winmd", _String2="..") returned 1 [0075.810] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x3973910 [0075.810] wcscpy (in: _Dest=0x3973910, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe" [0075.810] wcscat (in: _Dest=0x3973910, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\" [0075.810] wcscat (in: _Dest=0x3973910, _Source="StoreRatingPromotion.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\StoreRatingPromotion.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\StoreRatingPromotion.winmd" [0075.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3973910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd98 [0075.810] FindNextFileW (in: hFindFile=0x389e880, lpFindFileData=0x5463330 | out: lpFindFileData=0x5463330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fb59ed3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fdbc483, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fdbc483, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x63c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="WhatsNew.Store.dll", cAlternateFileName="")) returned 1 [0075.810] wcscmp (_String1="WhatsNew.Store.dll", _String2=".") returned 1 [0075.810] wcscmp (_String1="WhatsNew.Store.dll", _String2="..") returned 1 [0075.811] FindNextFileW (in: hFindFile=0x389e880, lpFindFileData=0x5463330 | out: lpFindFileData=0x5463330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fdbc483, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fdbc483, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fdbc483, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WhatsNew.Store.exe", cAlternateFileName="")) returned 1 [0075.811] wcscmp (_String1="WhatsNew.Store.exe", _String2=".") returned 1 [0075.811] wcscmp (_String1="WhatsNew.Store.exe", _String2="..") returned 1 [0075.811] FindNextFileW (in: hFindFile=0x389e880, lpFindFileData=0x5463330 | out: lpFindFileData=0x5463330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f0140b4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab5ed36f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f2aa2da, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 1 [0075.811] wcscmp (_String1="_Resources", _String2=".") returned 1 [0075.811] wcscmp (_String1="_Resources", _String2="..") returned 1 [0075.811] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x54469e0 [0075.811] wcscpy (in: _Dest=0x54469e0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe" [0075.811] wcscat (in: _Dest=0x54469e0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\" [0075.811] wcscat (in: _Dest=0x54469e0, _Source="_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources" [0075.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54469e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd9c [0075.811] FindNextFileW (in: hFindFile=0x389e880, lpFindFileData=0x5463330 | out: lpFindFileData=0x5463330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f0140b4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab5ed36f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f2aa2da, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 0 [0075.811] FindClose (in: hFindFile=0x389e880 | out: hFindFile=0x389e880) returned 1 [0075.812] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5463330) returned 1 [0075.812] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ac790) returned 1 [0075.812] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38abf08) returned 1 Thread: id = 262 os_tid = 0xdc4 [0071.872] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xae) returned 0x5446420 [0071.872] wcscpy (in: _Dest=0x5446420, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe" [0071.872] wcscat (in: _Dest=0x5446420, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\" [0071.872] wcscat (in: _Dest=0x5446420, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\*" [0071.872] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5463598 [0071.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x5463598 | out: lpFindFileData=0x5463598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x287b925a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbd8a0611, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8a0611, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ec40 [0077.109] wcscmp (_String1=".", _String2=".") returned 0 [0077.109] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x5463598 | out: lpFindFileData=0x5463598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x287b925a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbd8a0611, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8a0611, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.110] wcscmp (_String1="..", _String2=".") returned 1 [0077.110] wcscmp (_String1="..", _String2="..") returned 0 [0077.110] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x5463598 | out: lpFindFileData=0x5463598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28851bc4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x28851bc4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x28851bc4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0077.110] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0077.110] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0077.110] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x389e2d8 [0077.110] wcscpy (in: _Dest=0x389e2d8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe" [0077.110] wcscat (in: _Dest=0x389e2d8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\" [0077.110] wcscat (in: _Dest=0x389e2d8, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" [0081.009] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x389e2d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1990 [0081.010] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x5463598 | out: lpFindFileData=0x5463598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x287b925a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab841b4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x287b925a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0081.010] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0081.010] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0081.010] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x55fc9d8 [0081.010] wcscpy (in: _Dest=0x55fc9d8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe" [0081.010] wcscat (in: _Dest=0x55fc9d8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\" [0081.010] wcscat (in: _Dest=0x55fc9d8, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0081.010] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55fc9d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1994 [0081.010] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x5463598 | out: lpFindFileData=0x5463598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28851bc4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x28877e22, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x28877e22, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x299a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0081.010] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0081.010] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0081.010] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x7580bb8 [0081.010] wcscpy (in: _Dest=0x7580bb8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe" [0081.011] wcscat (in: _Dest=0x7580bb8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\" [0081.011] wcscat (in: _Dest=0x7580bb8, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" [0081.011] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7580bb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1998 [0081.011] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x5463598 | out: lpFindFileData=0x5463598*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbd8a0611, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbd8a0611, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8a0611, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0081.011] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0081.011] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0081.011] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xee) returned 0x72866a8 [0081.011] wcscpy (in: _Dest=0x72866a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe" [0081.011] wcscat (in: _Dest=0x72866a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\" [0081.011] wcscat (in: _Dest=0x72866a8, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" [0081.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x72866a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x199c [0081.012] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x5463598 | out: lpFindFileData=0x5463598*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbd8a0611, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbd8a0611, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8a0611, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0081.012] FindClose (in: hFindFile=0x389ec40 | out: hFindFile=0x389ec40) returned 1 [0081.013] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5463598) returned 1 [0081.013] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5446420) returned 1 [0081.013] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a1640) returned 1 Thread: id = 263 os_tid = 0xc20 [0071.873] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x389e2d8 [0071.873] wcscpy (in: _Dest=0x389e2d8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe" [0071.873] wcscat (in: _Dest=0x389e2d8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\" [0071.873] wcscat (in: _Dest=0x389e2d8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\*" [0071.873] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54641a0 [0071.873] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\*", lpFindFileData=0x54641a0 | out: lpFindFileData=0x54641a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29a48b6f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbd8c685e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8c685e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ee40 [0075.380] wcscmp (_String1=".", _String2=".") returned 0 [0075.380] FindNextFileW (in: hFindFile=0x389ee40, lpFindFileData=0x54641a0 | out: lpFindFileData=0x54641a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29a48b6f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbd8c685e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8c685e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.381] wcscmp (_String1="..", _String2=".") returned 1 [0075.381] wcscmp (_String1="..", _String2="..") returned 0 [0075.381] FindNextFileW (in: hFindFile=0x389ee40, lpFindFileData=0x54641a0 | out: lpFindFileData=0x54641a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29a6edc8, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29a6edc8, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29a6edc8, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1649, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0075.381] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0075.381] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0075.381] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xea) returned 0x393db68 [0075.381] wcscpy (in: _Dest=0x393db68, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe" [0075.381] wcscat (in: _Dest=0x393db68, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\" [0075.381] wcscat (in: _Dest=0x393db68, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\AppxBlockMap.xml" [0075.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x393db68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcdc [0075.813] FindNextFileW (in: hFindFile=0x389ee40, lpFindFileData=0x54641a0 | out: lpFindFileData=0x54641a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29a48b6f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29a48b6f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29a48b6f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x334, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0075.813] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0075.813] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0075.813] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xea) returned 0x393e610 [0075.813] wcscpy (in: _Dest=0x393e610, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe" [0075.813] wcscat (in: _Dest=0x393e610, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\" [0075.814] wcscat (in: _Dest=0x393e610, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\AppxManifest.xml" [0075.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x393e610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xda0 [0075.814] FindNextFileW (in: hFindFile=0x389ee40, lpFindFileData=0x54641a0 | out: lpFindFileData=0x54641a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29a6edc8, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29a95021, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29a95021, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2996, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0075.814] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0075.814] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0075.814] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x393f1b0 [0075.814] wcscpy (in: _Dest=0x393f1b0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe" [0075.814] wcscat (in: _Dest=0x393f1b0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\" [0075.814] wcscat (in: _Dest=0x393f1b0, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\AppxSignature.p7x" [0075.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x393f1b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xda4 [0075.815] FindNextFileW (in: hFindFile=0x389ee40, lpFindFileData=0x54641a0 | out: lpFindFileData=0x54641a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29a95021, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab9559ab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x29c3c6c4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0075.815] wcscmp (_String1="Assets", _String2=".") returned 1 [0075.815] wcscmp (_String1="Assets", _String2="..") returned 1 [0075.815] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd6) returned 0x3934568 [0075.815] wcscpy (in: _Dest=0x3934568, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe" [0075.815] wcscat (in: _Dest=0x3934568, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\" [0075.815] wcscat (in: _Dest=0x3934568, _Source="Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0075.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3934568, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xda8 [0075.816] FindNextFileW (in: hFindFile=0x389ee40, lpFindFileData=0x54641a0 | out: lpFindFileData=0x54641a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbd8c685e, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbd8c685e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8c685e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0075.816] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0075.816] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0075.816] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10c) returned 0x3979a78 [0075.816] wcscpy (in: _Dest=0x3979a78, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe" [0075.816] wcscat (in: _Dest=0x3979a78, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\" [0075.816] wcscat (in: _Dest=0x3979a78, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\microsoft.system.package.metadata" [0075.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3979a78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdac [0075.817] FindNextFileW (in: hFindFile=0x389ee40, lpFindFileData=0x54641a0 | out: lpFindFileData=0x54641a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29c3c6c4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29c3c6c4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29c3c6c4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xb38, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0075.817] wcscmp (_String1="resources.pri", _String2=".") returned 1 [0075.817] wcscmp (_String1="resources.pri", _String2="..") returned 1 [0075.817] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe4) returned 0x396fd48 [0075.817] wcscpy (in: _Dest=0x396fd48, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe" [0075.817] wcscat (in: _Dest=0x396fd48, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\" [0075.817] wcscat (in: _Dest=0x396fd48, _Source="resources.pri" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\resources.pri") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\resources.pri" [0075.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396fd48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb0 [0075.818] FindNextFileW (in: hFindFile=0x389ee40, lpFindFileData=0x54641a0 | out: lpFindFileData=0x54641a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29c3c6c4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29c3c6c4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29c3c6c4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xb38, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 0 [0075.818] FindClose (in: hFindFile=0x389ee40 | out: hFindFile=0x389ee40) returned 1 [0075.818] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54641a0) returned 1 [0075.818] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389e2d8) returned 1 [0075.818] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3883850) returned 1 Thread: id = 264 os_tid = 0xc10 [0071.873] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa6) returned 0x388f7d0 [0071.873] wcscpy (in: _Dest=0x388f7d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" [0071.873] wcscat (in: _Dest=0x388f7d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\" [0071.873] wcscat (in: _Dest=0x388f7d0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\*" [0071.873] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5464408 [0071.873] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x5464408 | out: lpFindFileData=0x5464408*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2889e07b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbd8a0611, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8a0611, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389eb40 [0077.105] wcscmp (_String1=".", _String2=".") returned 0 [0077.105] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x5464408 | out: lpFindFileData=0x5464408*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2889e07b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbd8a0611, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8a0611, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.105] wcscmp (_String1="..", _String2=".") returned 1 [0077.105] wcscmp (_String1="..", _String2="..") returned 0 [0077.105] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x5464408 | out: lpFindFileData=0x5464408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x288c42d4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x288c42d4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x288c42d4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xa458, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0077.105] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0077.106] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0077.106] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x55fd2c8 [0077.106] wcscpy (in: _Dest=0x55fd2c8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" [0077.106] wcscat (in: _Dest=0x55fd2c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\" [0077.106] wcscat (in: _Dest=0x55fd2c8, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" [0081.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55fd2c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11e4 [0081.021] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x5464408 | out: lpFindFileData=0x5464408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2889e07b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x288c42d4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x288c42d4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x7bc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0081.021] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0081.021] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0081.021] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x55fcaa8 [0081.021] wcscpy (in: _Dest=0x55fcaa8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" [0081.021] wcscat (in: _Dest=0x55fcaa8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\" [0081.021] wcscat (in: _Dest=0x55fcaa8, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" [0081.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55fcaa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19a4 [0081.022] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x5464408 | out: lpFindFileData=0x5464408*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2891078c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab9bb295, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2891078c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0081.022] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0081.022] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0081.022] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x3975a40 [0081.022] wcscpy (in: _Dest=0x3975a40, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" [0081.022] wcscat (in: _Dest=0x3975a40, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\" [0081.022] wcscat (in: _Dest=0x3975a40, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0081.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3975a40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19a8 [0081.023] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x5464408 | out: lpFindFileData=0x5464408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x288c42d4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2891078c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2891078c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x29c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0081.023] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0081.023] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0081.023] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x55fda18 [0081.023] wcscpy (in: _Dest=0x55fda18, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" [0081.023] wcscat (in: _Dest=0x55fda18, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\" [0081.023] wcscat (in: _Dest=0x55fda18, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" [0081.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55fda18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19ac [0081.024] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x5464408 | out: lpFindFileData=0x5464408*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2895cc43, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabb21004, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28bc9f4c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0081.024] wcscmp (_String1="Assets", _String2=".") returned 1 [0081.024] wcscmp (_String1="Assets", _String2="..") returned 1 [0081.024] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x55c73c0 [0081.024] wcscpy (in: _Dest=0x55c73c0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" [0081.024] wcscat (in: _Dest=0x55c73c0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\" [0081.024] wcscat (in: _Dest=0x55c73c0, _Source="Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets" [0081.024] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55c73c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19b0 [0081.025] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x5464408 | out: lpFindFileData=0x5464408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28bc9f4c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x28bc9f4c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x28bc9f4c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x166, dwReserved0=0x0, dwReserved1=0x0, cFileName="BuildInfo.xml", cAlternateFileName="")) returned 1 [0081.025] wcscmp (_String1="BuildInfo.xml", _String2=".") returned 1 [0081.025] wcscmp (_String1="BuildInfo.xml", _String2="..") returned 1 [0081.025] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x3975d60 [0081.025] wcscpy (in: _Dest=0x3975d60, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" [0081.025] wcscat (in: _Dest=0x3975d60, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\" [0081.025] wcscat (in: _Dest=0x3975d60, _Source="BuildInfo.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\BuildInfo.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\BuildInfo.xml" [0081.025] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3975d60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19b4 [0081.026] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x5464408 | out: lpFindFileData=0x5464408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28bc9f4c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x28bc9f4c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x28bc9f4c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xff58, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClrCompression.dll", cAlternateFileName="")) returned 1 [0081.026] wcscmp (_String1="ClrCompression.dll", _String2=".") returned 1 [0081.026] wcscmp (_String1="ClrCompression.dll", _String2="..") returned 1 [0081.026] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x5464408 | out: lpFindFileData=0x5464408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28bc9f4c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x28f11322, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x28f11322, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x929200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessagingApplication.dll", cAlternateFileName="")) returned 1 [0081.026] wcscmp (_String1="MessagingApplication.dll", _String2=".") returned 1 [0081.026] wcscmp (_String1="MessagingApplication.dll", _String2="..") returned 1 [0081.026] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x5464408 | out: lpFindFileData=0x5464408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28f11322, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x28f11322, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x28f11322, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessagingApplication.exe", cAlternateFileName="")) returned 1 [0081.026] wcscmp (_String1="MessagingApplication.exe", _String2=".") returned 1 [0081.026] wcscmp (_String1="MessagingApplication.exe", _String2="..") returned 1 [0081.026] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x5464408 | out: lpFindFileData=0x5464408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28f11322, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x28f83a32, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x28f83a32, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xcd800, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessagingEntityExtractionProxy.dll", cAlternateFileName="")) returned 1 [0081.026] wcscmp (_String1="MessagingEntityExtractionProxy.dll", _String2=".") returned 1 [0081.026] wcscmp (_String1="MessagingEntityExtractionProxy.dll", _String2="..") returned 1 [0081.026] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x5464408 | out: lpFindFileData=0x5464408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28f83a32, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x28fcfeee, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x28fcfeee, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x255000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessagingNativeBase.dll", cAlternateFileName="")) returned 1 [0081.026] wcscmp (_String1="MessagingNativeBase.dll", _String2=".") returned 1 [0081.026] wcscmp (_String1="MessagingNativeBase.dll", _String2="..") returned 1 [0081.026] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x5464408 | out: lpFindFileData=0x5464408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28fcfeee, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x291e5fe7, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x291e5fe7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x478400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessagingNativeCore.dll", cAlternateFileName="")) returned 1 [0081.026] wcscmp (_String1="MessagingNativeCore.dll", _String2=".") returned 1 [0081.026] wcscmp (_String1="MessagingNativeCore.dll", _String2="..") returned 1 [0081.026] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x5464408 | out: lpFindFileData=0x5464408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x291e5fe7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2920c240, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2920c240, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x7ee00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessagingNativeStubExternal.dll", cAlternateFileName="")) returned 1 [0081.026] wcscmp (_String1="MessagingNativeStubExternal.dll", _String2=".") returned 1 [0081.026] wcscmp (_String1="MessagingNativeStubExternal.dll", _String2="..") returned 1 [0081.026] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x5464408 | out: lpFindFileData=0x5464408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2920c240, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2920c240, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2920c240, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Apps.Messaging.Base.winmd", cAlternateFileName="")) returned 1 [0081.026] wcscmp (_String1="Microsoft.Apps.Messaging.Base.winmd", _String2=".") returned 1 [0081.026] wcscmp (_String1="Microsoft.Apps.Messaging.Base.winmd", _String2="..") returned 1 [0081.026] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xea) returned 0x72867a0 [0081.026] wcscpy (in: _Dest=0x72867a0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" [0081.026] wcscat (in: _Dest=0x72867a0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\" [0081.026] wcscat (in: _Dest=0x72867a0, _Source="Microsoft.Apps.Messaging.Base.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.Apps.Messaging.Base.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.Apps.Messaging.Base.winmd" [0081.027] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x72867a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19b8 [0081.027] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x5464408 | out: lpFindFileData=0x5464408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2920c240, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2920c240, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2920c240, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Apps.Messaging.External.winmd", cAlternateFileName="")) returned 1 [0081.027] wcscmp (_String1="Microsoft.Apps.Messaging.External.winmd", _String2=".") returned 1 [0081.027] wcscmp (_String1="Microsoft.Apps.Messaging.External.winmd", _String2="..") returned 1 [0081.027] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba2af8 [0081.027] wcscpy (in: _Dest=0x5ba2af8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" [0081.027] wcscat (in: _Dest=0x5ba2af8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\" [0081.027] wcscat (in: _Dest=0x5ba2af8, _Source="Microsoft.Apps.Messaging.External.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.Apps.Messaging.External.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.Apps.Messaging.External.winmd" [0081.027] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba2af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19bc [0081.028] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x5464408 | out: lpFindFileData=0x5464408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2923249a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2923249a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2923249a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Apps.Messaging.Internal.winmd", cAlternateFileName="")) returned 1 [0081.028] wcscmp (_String1="Microsoft.Apps.Messaging.Internal.winmd", _String2=".") returned 1 [0081.028] wcscmp (_String1="Microsoft.Apps.Messaging.Internal.winmd", _String2="..") returned 1 [0081.028] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba21f8 [0081.028] wcscpy (in: _Dest=0x5ba21f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" [0081.028] wcscat (in: _Dest=0x5ba21f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\" [0081.028] wcscat (in: _Dest=0x5ba21f8, _Source="Microsoft.Apps.Messaging.Internal.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.Apps.Messaging.Internal.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.Apps.Messaging.Internal.winmd" [0081.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba21f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c0 [0081.029] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x5464408 | out: lpFindFileData=0x5464408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2923249a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x292a4baf, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x292a4baf, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x125e98, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Graphics.Canvas.dll", cAlternateFileName="")) returned 1 [0081.029] wcscmp (_String1="Microsoft.Graphics.Canvas.dll", _String2=".") returned 1 [0081.029] wcscmp (_String1="Microsoft.Graphics.Canvas.dll", _String2="..") returned 1 [0081.029] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x5464408 | out: lpFindFileData=0x5464408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x292a4baf, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x292f1061, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x292f1061, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2b498, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Graphics.Canvas.winmd", cAlternateFileName="")) returned 1 [0081.029] wcscmp (_String1="Microsoft.Graphics.Canvas.winmd", _String2=".") returned 1 [0081.029] wcscmp (_String1="Microsoft.Graphics.Canvas.winmd", _String2="..") returned 1 [0081.029] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x54b8dd8 [0081.029] wcscpy (in: _Dest=0x54b8dd8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" [0081.029] wcscat (in: _Dest=0x54b8dd8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\" [0081.029] wcscat (in: _Dest=0x54b8dd8, _Source="Microsoft.Graphics.Canvas.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.Graphics.Canvas.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.Graphics.Canvas.winmd" [0081.029] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54b8dd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c4 [0081.030] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x5464408 | out: lpFindFileData=0x5464408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x292f1061, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x293d5e87, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x293d5e87, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x201400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.People.AutoSuggest.dll", cAlternateFileName="")) returned 1 [0081.030] wcscmp (_String1="Microsoft.People.AutoSuggest.dll", _String2=".") returned 1 [0081.030] wcscmp (_String1="Microsoft.People.AutoSuggest.dll", _String2="..") returned 1 [0081.030] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x5464408 | out: lpFindFileData=0x5464408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x293d5e87, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x293d5e87, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x293d5e87, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.People.AutoSuggest.winmd", cAlternateFileName="")) returned 1 [0081.030] wcscmp (_String1="Microsoft.People.AutoSuggest.winmd", _String2=".") returned 1 [0081.030] wcscmp (_String1="Microsoft.People.AutoSuggest.winmd", _String2="..") returned 1 [0081.030] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x54b8ec8 [0081.030] wcscpy (in: _Dest=0x54b8ec8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" [0081.030] wcscat (in: _Dest=0x54b8ec8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\" [0081.030] wcscat (in: _Dest=0x54b8ec8, _Source="Microsoft.People.AutoSuggest.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.People.AutoSuggest.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.People.AutoSuggest.winmd" [0081.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54b8ec8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c8 [0081.031] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x5464408 | out: lpFindFileData=0x5464408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x293d5e87, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x293d5e87, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x293d5e87, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.People.Controls.winmd", cAlternateFileName="")) returned 1 [0081.031] wcscmp (_String1="Microsoft.People.Controls.winmd", _String2=".") returned 1 [0081.031] wcscmp (_String1="Microsoft.People.Controls.winmd", _String2="..") returned 1 [0081.031] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x54b8fb8 [0081.031] wcscpy (in: _Dest=0x54b8fb8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" [0081.031] wcscat (in: _Dest=0x54b8fb8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\" [0081.031] wcscat (in: _Dest=0x54b8fb8, _Source="Microsoft.People.Controls.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.People.Controls.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.People.Controls.winmd" [0081.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54b8fb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19cc [0081.031] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x5464408 | out: lpFindFileData=0x5464408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x293d5e87, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29494a4f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29494a4f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1c9800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.People.Relevance.dll", cAlternateFileName="")) returned 1 [0081.031] wcscmp (_String1="Microsoft.People.Relevance.dll", _String2=".") returned 1 [0081.031] wcscmp (_String1="Microsoft.People.Relevance.dll", _String2="..") returned 1 [0081.032] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x5464408 | out: lpFindFileData=0x5464408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29494a4f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x294baca8, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x294baca8, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.People.Relevance.winmd", cAlternateFileName="")) returned 1 [0081.032] wcscmp (_String1="Microsoft.People.Relevance.winmd", _String2=".") returned 1 [0081.032] wcscmp (_String1="Microsoft.People.Relevance.winmd", _String2="..") returned 1 [0081.032] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe4) returned 0x54b9378 [0081.032] wcscpy (in: _Dest=0x54b9378, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" [0081.032] wcscat (in: _Dest=0x54b9378, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\" [0081.032] wcscat (in: _Dest=0x54b9378, _Source="Microsoft.People.Relevance.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.People.Relevance.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.People.Relevance.winmd" [0081.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54b9378, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19d0 [0081.032] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x5464408 | out: lpFindFileData=0x5464408*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbd8a0611, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xfbac0b62, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfbac0b62, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0081.032] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0081.032] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0081.032] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe6) returned 0x54ba638 [0081.032] wcscpy (in: _Dest=0x54ba638, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" [0081.032] wcscat (in: _Dest=0x54ba638, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\" [0081.032] wcscat (in: _Dest=0x54ba638, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0081.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54ba638, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19d4 [0081.033] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x5464408 | out: lpFindFileData=0x5464408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x294baca8, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2950715f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2950715f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x52000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PersonPicture.UAP.dll", cAlternateFileName="")) returned 1 [0081.033] wcscmp (_String1="PersonPicture.UAP.dll", _String2=".") returned 1 [0081.033] wcscmp (_String1="PersonPicture.UAP.dll", _String2="..") returned 1 [0081.033] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x5464408 | out: lpFindFileData=0x5464408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2950715f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2952d3b8, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2952d3b8, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x400c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0081.033] wcscmp (_String1="resources.pri", _String2=".") returned 1 [0081.033] wcscmp (_String1="resources.pri", _String2="..") returned 1 [0081.033] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x39762d8 [0081.033] wcscpy (in: _Dest=0x39762d8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" [0081.033] wcscat (in: _Dest=0x39762d8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\" [0081.034] wcscat (in: _Dest=0x39762d8, _Source="resources.pri" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\resources.pri") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\resources.pri" [0081.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x39762d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19d8 [0081.034] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x5464408 | out: lpFindFileData=0x5464408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2952d3b8, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29553616, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29553616, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreRatingPromotion.dll", cAlternateFileName="")) returned 1 [0081.034] wcscmp (_String1="StoreRatingPromotion.dll", _String2=".") returned 1 [0081.034] wcscmp (_String1="StoreRatingPromotion.dll", _String2="..") returned 1 [0081.034] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x5464408 | out: lpFindFileData=0x5464408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29553616, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29553616, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29553616, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreRatingPromotion.winmd", cAlternateFileName="")) returned 1 [0081.034] wcscmp (_String1="StoreRatingPromotion.winmd", _String2=".") returned 1 [0081.034] wcscmp (_String1="StoreRatingPromotion.winmd", _String2="..") returned 1 [0081.034] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x766c288 [0091.715] wcscpy (in: _Dest=0x766c288, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe" [0091.715] wcscat (in: _Dest=0x766c288, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\" [0091.715] wcscat (in: _Dest=0x766c288, _Source="StoreRatingPromotion.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\StoreRatingPromotion.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\StoreRatingPromotion.winmd" Thread: id = 265 os_tid = 0xfac [0071.898] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x38b2338 [0071.898] wcscpy (in: _Dest=0x38b2338, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft") returned="C:\\Program Files\\Reference Assemblies\\Microsoft" [0071.898] wcscat (in: _Dest=0x38b2338, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\" [0071.898] wcscat (in: _Dest=0x38b2338, _Source="*" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\*") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\*" [0071.898] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5464670 [0071.898] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\*", lpFindFileData=0x5464670 | out: lpFindFileData=0x5464670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe795770f, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe795770f, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe795770f, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445340 [0077.207] wcscmp (_String1=".", _String2=".") returned 0 [0077.207] FindNextFileW (in: hFindFile=0x5445340, lpFindFileData=0x5464670 | out: lpFindFileData=0x5464670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe795770f, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe795770f, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe795770f, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.207] wcscmp (_String1="..", _String2=".") returned 1 [0077.207] wcscmp (_String1="..", _String2="..") returned 0 [0077.207] FindNextFileW (in: hFindFile=0x5445340, lpFindFileData=0x5464670 | out: lpFindFileData=0x5464670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe795770f, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79a3b1b, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79a3b1b, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 1 [0077.207] wcscmp (_String1="Framework", _String2=".") returned 1 [0077.207] wcscmp (_String1="Framework", _String2="..") returned 1 [0077.207] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x74) returned 0x38d0920 [0077.207] wcscpy (in: _Dest=0x38d0920, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft") returned="C:\\Program Files\\Reference Assemblies\\Microsoft" [0077.207] wcscat (in: _Dest=0x38d0920, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\" [0077.207] wcscat (in: _Dest=0x38d0920, _Source="Framework" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework" [0080.954] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38d0920, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1220 [0080.955] FindNextFileW (in: hFindFile=0x5445340, lpFindFileData=0x5464670 | out: lpFindFileData=0x5464670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe795770f, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79a3b1b, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79a3b1b, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0 [0080.955] FindClose (in: hFindFile=0x5445340 | out: hFindFile=0x5445340) returned 1 [0080.955] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5464670) returned 1 [0080.955] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b2338) returned 1 [0080.955] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541ac00) returned 1 Thread: id = 266 os_tid = 0x10a8 [0071.901] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5467620 [0071.901] wcscpy (in: _Dest=0x5467620, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft" [0071.901] wcscat (in: _Dest=0x5467620, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\" [0071.901] wcscat (in: _Dest=0x5467620, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\*") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\*" [0071.901] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54648d8 [0071.901] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\*", lpFindFileData=0x54648d8 | out: lpFindFileData=0x54648d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a165b3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ed00 [0076.056] wcscmp (_String1=".", _String2=".") returned 0 [0076.056] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x54648d8 | out: lpFindFileData=0x54648d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a165b3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.056] wcscmp (_String1="..", _String2=".") returned 1 [0076.056] wcscmp (_String1="..", _String2="..") returned 0 [0076.056] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x54648d8 | out: lpFindFileData=0x54648d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a165b3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a8888e, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a8888e, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 1 [0076.056] wcscmp (_String1="Framework", _String2=".") returned 1 [0076.056] wcscmp (_String1="Framework", _String2="..") returned 1 [0076.056] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x80) returned 0x3977c38 [0076.056] wcscpy (in: _Dest=0x3977c38, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft" [0076.056] wcscat (in: _Dest=0x3977c38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\" [0076.056] wcscat (in: _Dest=0x3977c38, _Source="Framework" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework" [0081.101] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3977c38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1108 [0081.102] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x54648d8 | out: lpFindFileData=0x54648d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a165b3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a8888e, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a8888e, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0 [0081.102] FindClose (in: hFindFile=0x389ed00 | out: hFindFile=0x389ed00) returned 1 [0081.102] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54648d8) returned 1 [0081.102] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5467620) returned 1 [0081.102] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38aa4c8) returned 1 Thread: id = 267 os_tid = 0x1268 [0071.901] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 0x20 [0077.109] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0081.535] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cd8 [0081.535] GetFileSizeEx (in: hFile=0x1cd8, lpFileSize=0xd2ff75c | out: lpFileSize=0xd2ff75c*=69632) returned 1 [0081.535] SetFilePointerEx (in: hFile=0x1cd8, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.536] ReadFile (in: hFile=0x1cd8, lpBuffer=0xd2ff6e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xd2ff6dc, lpOverlapped=0x0 | out: lpBuffer=0xd2ff6e0*, lpNumberOfBytesRead=0xd2ff6dc*=0x4, lpOverlapped=0x0) returned 1 [0081.539] SetFilePointerEx (in: hFile=0x1cd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.539] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 268 os_tid = 0x1404 [0071.902] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 0x20 [0077.107] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0081.539] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cdc [0081.539] GetFileSizeEx (in: hFile=0x1cdc, lpFileSize=0xd37fe0c | out: lpFileSize=0xd37fe0c*=69632) returned 1 [0081.539] SetFilePointerEx (in: hFile=0x1cdc, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.539] ReadFile (in: hFile=0x1cdc, lpBuffer=0xd37fd90, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xd37fd8c, lpOverlapped=0x0 | out: lpBuffer=0xd37fd90*, lpNumberOfBytesRead=0xd37fd8c*=0x4, lpOverlapped=0x0) returned 1 [0081.541] SetFilePointerEx (in: hFile=0x1cdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.541] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 269 os_tid = 0x1408 [0071.902] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 0x20 [0077.104] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0081.540] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ce0 [0081.541] GetFileSizeEx (in: hFile=0x1ce0, lpFileSize=0xd3ff7dc | out: lpFileSize=0xd3ff7dc*=69632) returned 1 [0081.541] SetFilePointerEx (in: hFile=0x1ce0, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.541] ReadFile (in: hFile=0x1ce0, lpBuffer=0xd3ff760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xd3ff75c, lpOverlapped=0x0 | out: lpBuffer=0xd3ff760*, lpNumberOfBytesRead=0xd3ff75c*=0x4, lpOverlapped=0x0) returned 1 [0081.542] SetFilePointerEx (in: hFile=0x1ce0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.542] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 270 os_tid = 0x140c [0071.903] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 0x20 [0077.102] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0081.542] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ce4 [0081.543] GetFileSizeEx (in: hFile=0x1ce4, lpFileSize=0xd47f9c0 | out: lpFileSize=0xd47f9c0*=69632) returned 1 [0081.543] SetFilePointerEx (in: hFile=0x1ce4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.543] ReadFile (in: hFile=0x1ce4, lpBuffer=0xd47f944, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xd47f940, lpOverlapped=0x0 | out: lpBuffer=0xd47f944*, lpNumberOfBytesRead=0xd47f940*=0x4, lpOverlapped=0x0) returned 1 [0081.544] SetFilePointerEx (in: hFile=0x1ce4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.544] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 271 os_tid = 0x1410 [0071.903] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 0x20 [0077.099] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0081.544] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ce8 [0081.544] GetFileSizeEx (in: hFile=0x1ce8, lpFileSize=0xd4ffce4 | out: lpFileSize=0xd4ffce4*=69632) returned 1 [0081.544] SetFilePointerEx (in: hFile=0x1ce8, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.544] ReadFile (in: hFile=0x1ce8, lpBuffer=0xd4ffc68, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xd4ffc64, lpOverlapped=0x0 | out: lpBuffer=0xd4ffc68*, lpNumberOfBytesRead=0xd4ffc64*=0x4, lpOverlapped=0x0) returned 1 [0081.546] SetFilePointerEx (in: hFile=0x1ce8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.546] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 272 os_tid = 0x1414 [0071.904] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 0x20 [0076.398] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0076.399] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1134 [0076.409] GetFileSizeEx (in: hFile=0x1134, lpFileSize=0xd57fbf4 | out: lpFileSize=0xd57fbf4*=69632) returned 1 [0076.409] SetFilePointerEx (in: hFile=0x1134, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.409] ReadFile (in: hFile=0x1134, lpBuffer=0xd57fb78, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xd57fb74, lpOverlapped=0x0 | out: lpBuffer=0xd57fb78*, lpNumberOfBytesRead=0xd57fb74*=0x4, lpOverlapped=0x0) returned 1 [0076.415] SetFilePointerEx (in: hFile=0x1134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.415] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559d70 [0076.415] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559898 [0076.415] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559938 [0076.415] NtQuerySystemTime (in: CurrentTime=0xd57fb54 | out: CurrentTime=0xd57fb54*=132260136335741538) returned 0x0 [0076.415] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0xc7bed6d1 [0076.415] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0x7642f0b5 [0076.415] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0xc231571a [0076.415] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0xf2f274d1 [0076.415] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0x55491875 [0076.415] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0xa4fef073 [0076.415] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0x22a56237 [0076.415] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0x8f8f7379 [0076.416] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0xbd9616c3 [0076.416] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0xa88f6c1b [0076.416] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0x6dd736f [0076.416] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0x161117b4 [0076.416] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0xb8fa9e4b [0076.416] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0x5e6b013c [0076.416] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0xba5cdb4 [0076.416] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0xf092963d [0076.416] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0xdb652a44 [0076.416] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0x313cf0df [0076.416] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0x69b7b462 [0076.416] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0xf139654e [0076.416] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0x18b890ef [0076.416] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0x5118c033 [0076.416] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0x774bdaa4 [0076.416] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0xc5a56ca5 [0076.416] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0xa2723ff7 [0076.416] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0xae47997 [0076.416] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0xcc5bde46 [0076.416] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0xfd81a5cf [0076.416] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0x3e3cacd7 [0076.416] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0x185712db [0076.416] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0x4f2767e0 [0076.416] RtlRandom (in: Seed=0xd57fb60 | out: Seed=0xd57fb60) returned 0xe29effe8 [0076.434] SetFilePointerEx (in: hFile=0x1134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.434] ReadFile (in: hFile=0x1134, lpBuffer=0x54fe820, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xd57fb34, lpOverlapped=0x0 | out: lpBuffer=0x54fe820*, lpNumberOfBytesRead=0xd57fb34*=0xc800, lpOverlapped=0x0) returned 1 [0076.436] SetFilePointerEx (in: hFile=0x1134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.436] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0076.436] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0076.436] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55599b0 [0076.436] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55599b0) returned 1 [0076.437] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5534050 [0076.437] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c30 [0076.437] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c80 [0076.437] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559c80) returned 1 [0076.437] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.437] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0076.437] WriteFile (in: hFile=0x1134, lpBuffer=0x5534050*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xd57fb34, lpOverlapped=0x0 | out: lpBuffer=0x5534050*, lpNumberOfBytesWritten=0xd57fb34*=0xc800, lpOverlapped=0x0) returned 1 [0076.439] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5534050) returned 1 [0076.439] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54fe820) returned 1 [0076.439] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x83) returned 0x549cf38 [0076.439] SetFilePointerEx (in: hFile=0x1134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.439] WriteFile (in: hFile=0x1134, lpBuffer=0x54a2b30*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0xd57fbb4, lpOverlapped=0x0 | out: lpBuffer=0x54a2b30*, lpNumberOfBytesWritten=0xd57fbb4*=0x167, lpOverlapped=0x0) returned 1 [0076.441] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a2b30) returned 1 [0076.441] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549d688) returned 1 [0076.441] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a50) returned 1 [0076.441] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549cf38) returned 1 [0076.441] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559c30) returned 1 [0076.441] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559898) returned 1 [0076.441] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55598c0) returned 1 [0076.441] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55598e8) returned 1 [0076.442] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x3971d90 [0076.442] wcscpy (in: _Dest=0x3971d90, _Source="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" [0076.442] wcscat (in: _Dest=0x3971d90, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70" [0076.442] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0xd57fb6c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.442] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xde) returned 0x54f0040 Thread: id = 273 os_tid = 0x1418 [0071.937] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 0x20 [0077.081] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0077.081] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x11cc [0077.081] GetFileSizeEx (in: hFile=0x11cc, lpFileSize=0xd5ffe60 | out: lpFileSize=0xd5ffe60*=69632) returned 1 [0077.082] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.082] ReadFile (in: hFile=0x11cc, lpBuffer=0xd5ffde4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xd5ffde0, lpOverlapped=0x0 | out: lpBuffer=0xd5ffde4*, lpNumberOfBytesRead=0xd5ffde0*=0x4, lpOverlapped=0x0) returned 1 [0077.083] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.083] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4e78 [0077.083] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ea0 [0077.083] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ec8 [0077.083] NtQuerySystemTime (in: CurrentTime=0xd5ffdc0 | out: CurrentTime=0xd5ffdc0*=132260136342460209) returned 0x0 [0077.083] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0x42bfd590 [0077.083] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0x1eff9d84 [0077.083] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0xb940ca7b [0077.083] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0xf51a288 [0077.083] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0xa1c70dbf [0077.083] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0xe7a90007 [0077.083] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0xb6b87ecd [0077.083] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0x8543ee8b [0077.083] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0x8259168a [0077.083] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0xe230a3ab [0077.083] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0x3152ebad [0077.083] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0xbdaebcfc [0077.084] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0xaf507f07 [0077.084] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0x713eaf8b [0077.084] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0xf02ea548 [0077.084] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0x816160b2 [0077.084] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0x2559dc07 [0077.084] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0x3bf34035 [0077.084] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0x745f9e87 [0077.084] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0xf617b964 [0077.084] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0xea00cc3a [0077.084] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0x13582de8 [0077.084] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0xe223f999 [0077.084] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0x63245064 [0077.084] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0x784f58d8 [0077.084] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0xacc009c1 [0077.084] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0xefb7f90a [0077.084] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0x751c5f61 [0077.084] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0xcaab51df [0077.084] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0x3fb48c6 [0077.084] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0x117f317e [0077.084] RtlRandom (in: Seed=0xd5ffdcc | out: Seed=0xd5ffdcc) returned 0x97feb7b0 [0077.093] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.093] ReadFile (in: hFile=0x11cc, lpBuffer=0x557f888, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xd5ffda0, lpOverlapped=0x0 | out: lpBuffer=0x557f888*, lpNumberOfBytesRead=0xd5ffda0*=0xc800, lpOverlapped=0x0) returned 1 [0077.094] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.094] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0077.094] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0077.094] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4fb8 [0077.094] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4fb8) returned 1 [0077.095] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x558c090 [0077.095] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4e78 [0077.095] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ec8 [0077.095] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4ec8) returned 1 [0077.095] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0077.095] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0077.095] WriteFile (in: hFile=0x11cc, lpBuffer=0x558c090*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xd5ffda0, lpOverlapped=0x0 | out: lpBuffer=0x558c090*, lpNumberOfBytesWritten=0xd5ffda0*=0xc800, lpOverlapped=0x0) returned 1 [0081.202] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x558c090) returned 1 [0091.758] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x557f888) returned 1 [0091.758] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6b) returned 0x766d3e8 [0091.758] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.758] WriteFile (hFile=0x11cc, lpBuffer=0xe537ed0, nNumberOfBytesToWrite=0x14f, lpNumberOfBytesWritten=0xd5ffe20, lpOverlapped=0x0) Thread: id = 274 os_tid = 0x141c [0071.938] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x38b5c48 [0071.938] wcscpy (in: _Dest=0x38b5c48, _Source="C:\\Program Files\\Common Files\\DESIGNER" | out: _Dest="C:\\Program Files\\Common Files\\DESIGNER") returned="C:\\Program Files\\Common Files\\DESIGNER" [0071.938] wcscat (in: _Dest=0x38b5c48, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\DESIGNER\\") returned="C:\\Program Files\\Common Files\\DESIGNER\\" [0071.938] wcscat (in: _Dest=0x38b5c48, _Source="*" | out: _Dest="C:\\Program Files\\Common Files\\DESIGNER\\*") returned="C:\\Program Files\\Common Files\\DESIGNER\\*" [0071.938] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5464b40 [0071.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x5464b40 | out: lpFindFileData=0x5464b40*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445900 [0077.205] wcscmp (_String1=".", _String2=".") returned 0 [0077.205] FindNextFileW (in: hFindFile=0x5445900, lpFindFileData=0x5464b40 | out: lpFindFileData=0x5464b40*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.205] wcscmp (_String1="..", _String2=".") returned 1 [0077.205] wcscmp (_String1="..", _String2="..") returned 0 [0077.205] FindNextFileW (in: hFindFile=0x5445900, lpFindFileData=0x5464b40 | out: lpFindFileData=0x5464b40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5c8c3a00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.OLB", cAlternateFileName="")) returned 1 [0077.205] wcscmp (_String1="MSADDNDR.OLB", _String2=".") returned 1 [0077.205] wcscmp (_String1="MSADDNDR.OLB", _String2="..") returned 1 [0077.205] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x68) returned 0x396e5a0 [0077.205] wcscpy (in: _Dest=0x396e5a0, _Source="C:\\Program Files\\Common Files\\DESIGNER" | out: _Dest="C:\\Program Files\\Common Files\\DESIGNER") returned="C:\\Program Files\\Common Files\\DESIGNER" [0077.205] wcscat (in: _Dest=0x396e5a0, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\DESIGNER\\") returned="C:\\Program Files\\Common Files\\DESIGNER\\" [0077.205] wcscat (in: _Dest=0x396e5a0, _Source="MSADDNDR.OLB" | out: _Dest="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" [0080.966] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396e5a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1214 [0080.966] FindNextFileW (in: hFindFile=0x5445900, lpFindFileData=0x5464b40 | out: lpFindFileData=0x5464b40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5c8c3a00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.OLB", cAlternateFileName="")) returned 0 [0080.966] FindClose (in: hFindFile=0x5445900 | out: hFindFile=0x5445900) returned 1 [0080.967] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5464b40) returned 1 [0080.967] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b5c48) returned 1 [0080.967] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5428240) returned 1 Thread: id = 275 os_tid = 0x1420 [0071.938] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x38b5ca8 [0071.938] wcscpy (in: _Dest=0x38b5ca8, _Source="C:\\Program Files\\Common Files\\Services" | out: _Dest="C:\\Program Files\\Common Files\\Services") returned="C:\\Program Files\\Common Files\\Services" [0071.938] wcscat (in: _Dest=0x38b5ca8, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\Services\\") returned="C:\\Program Files\\Common Files\\Services\\" [0071.939] wcscat (in: _Dest=0x38b5ca8, _Source="*" | out: _Dest="C:\\Program Files\\Common Files\\Services\\*") returned="C:\\Program Files\\Common Files\\Services\\*" [0071.939] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5464da8 [0071.939] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x5464da8 | out: lpFindFileData=0x5464da8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e840 [0075.352] wcscmp (_String1=".", _String2=".") returned 0 [0075.354] FindNextFileW (in: hFindFile=0x389e840, lpFindFileData=0x5464da8 | out: lpFindFileData=0x5464da8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.354] wcscmp (_String1="..", _String2=".") returned 1 [0075.355] wcscmp (_String1="..", _String2="..") returned 0 [0075.355] FindNextFileW (in: hFindFile=0x389e840, lpFindFileData=0x5464da8 | out: lpFindFileData=0x5464da8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440ad34a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440ad34a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440ad34a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0075.355] wcscmp (_String1="verisign.bmp", _String2=".") returned 1 [0075.355] wcscmp (_String1="verisign.bmp", _String2="..") returned 1 [0075.355] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x68) returned 0x396df80 [0075.355] wcscpy (in: _Dest=0x396df80, _Source="C:\\Program Files\\Common Files\\Services" | out: _Dest="C:\\Program Files\\Common Files\\Services") returned="C:\\Program Files\\Common Files\\Services" [0075.355] wcscat (in: _Dest=0x396df80, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\Services\\") returned="C:\\Program Files\\Common Files\\Services\\" [0075.355] wcscat (in: _Dest=0x396df80, _Source="verisign.bmp" | out: _Dest="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned="C:\\Program Files\\Common Files\\Services\\verisign.bmp" [0075.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396df80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcd8 [0075.819] FindNextFileW (in: hFindFile=0x389e840, lpFindFileData=0x5464da8 | out: lpFindFileData=0x5464da8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440ad34a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440ad34a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440ad34a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0075.820] FindClose (in: hFindFile=0x389e840 | out: hFindFile=0x389e840) returned 1 [0075.820] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5464da8) returned 1 [0075.820] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b5ca8) returned 1 [0075.820] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54284a8) returned 1 Thread: id = 276 os_tid = 0x1424 [0071.940] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x5428500 [0071.940] wcscpy (in: _Dest=0x5428500, _Source="C:\\Program Files\\UNP\\CampaignManager" | out: _Dest="C:\\Program Files\\UNP\\CampaignManager") returned="C:\\Program Files\\UNP\\CampaignManager" [0071.940] wcscat (in: _Dest=0x5428500, _Source="\\" | out: _Dest="C:\\Program Files\\UNP\\CampaignManager\\") returned="C:\\Program Files\\UNP\\CampaignManager\\" [0071.940] wcscat (in: _Dest=0x5428500, _Source="*" | out: _Dest="C:\\Program Files\\UNP\\CampaignManager\\*") returned="C:\\Program Files\\UNP\\CampaignManager\\*" [0071.940] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5465010 [0071.940] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\*", lpFindFileData=0x5465010 | out: lpFindFileData=0x5465010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x749f4454, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa747febb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f640 [0075.015] wcscmp (_String1=".", _String2=".") returned 0 [0075.016] FindNextFileW (in: hFindFile=0x389f640, lpFindFileData=0x5465010 | out: lpFindFileData=0x5465010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x749f4454, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa747febb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.031] wcscmp (_String1="..", _String2=".") returned 1 [0075.031] wcscmp (_String1="..", _String2="..") returned 0 [0075.031] FindNextFileW (in: hFindFile=0x389f640, lpFindFileData=0x5465010 | out: lpFindFileData=0x5465010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x865d24d3, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xce2469cc, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x26, dwReserved0=0x0, dwReserved1=0x0, cFileName="CampaignCatalog.json", cAlternateFileName="CAMPAI~1.JSO")) returned 1 [0075.031] wcscmp (_String1="CampaignCatalog.json", _String2=".") returned 1 [0075.040] wcscmp (_String1="CampaignCatalog.json", _String2="..") returned 1 [0075.040] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x74) returned 0x38d0c20 [0075.040] wcscpy (in: _Dest=0x38d0c20, _Source="C:\\Program Files\\UNP\\CampaignManager" | out: _Dest="C:\\Program Files\\UNP\\CampaignManager") returned="C:\\Program Files\\UNP\\CampaignManager" [0075.040] wcscat (in: _Dest=0x38d0c20, _Source="\\" | out: _Dest="C:\\Program Files\\UNP\\CampaignManager\\") returned="C:\\Program Files\\UNP\\CampaignManager\\" [0075.040] wcscat (in: _Dest=0x38d0c20, _Source="CampaignCatalog.json" | out: _Dest="C:\\Program Files\\UNP\\CampaignManager\\CampaignCatalog.json") returned="C:\\Program Files\\UNP\\CampaignManager\\CampaignCatalog.json" [0081.111] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d0c20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1acc [0081.112] FindNextFileW (in: hFindFile=0x389f640, lpFindFileData=0x5465010 | out: lpFindFileData=0x5465010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa74805fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Campaigns", cAlternateFileName="CAMPAI~1")) returned 1 [0081.112] wcscmp (_String1="Campaigns", _String2=".") returned 1 [0081.112] wcscmp (_String1="Campaigns", _String2="..") returned 1 [0081.112] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x6e96590 [0081.112] wcscpy (in: _Dest=0x6e96590, _Source="C:\\Program Files\\UNP\\CampaignManager" | out: _Dest="C:\\Program Files\\UNP\\CampaignManager") returned="C:\\Program Files\\UNP\\CampaignManager" [0081.112] wcscat (in: _Dest=0x6e96590, _Source="\\" | out: _Dest="C:\\Program Files\\UNP\\CampaignManager\\") returned="C:\\Program Files\\UNP\\CampaignManager\\" [0081.112] wcscat (in: _Dest=0x6e96590, _Source="Campaigns" | out: _Dest="C:\\Program Files\\UNP\\CampaignManager\\Campaigns") returned="C:\\Program Files\\UNP\\CampaignManager\\Campaigns" [0081.112] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x6e96590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ad0 [0081.113] FindNextFileW (in: hFindFile=0x389f640, lpFindFileData=0x5465010 | out: lpFindFileData=0x5465010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa74805fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Campaigns", cAlternateFileName="CAMPAI~1")) returned 0 [0081.113] FindClose (in: hFindFile=0x389f640 | out: hFindFile=0x389f640) returned 1 [0081.113] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5465010) returned 1 [0081.113] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5428500) returned 1 [0081.113] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5428a80) returned 1 Thread: id = 277 os_tid = 0x1428 [0071.940] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x38) returned 0x54458c0 [0071.940] wcscpy (in: _Dest=0x54458c0, _Source="C:\\Program Files\\UNP\\Logs" | out: _Dest="C:\\Program Files\\UNP\\Logs") returned="C:\\Program Files\\UNP\\Logs" [0071.940] wcscat (in: _Dest=0x54458c0, _Source="\\" | out: _Dest="C:\\Program Files\\UNP\\Logs\\") returned="C:\\Program Files\\UNP\\Logs\\" [0071.940] wcscat (in: _Dest=0x54458c0, _Source="*" | out: _Dest="C:\\Program Files\\UNP\\Logs\\*") returned="C:\\Program Files\\UNP\\Logs\\*" [0071.940] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5465278 [0071.940] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\*", lpFindFileData=0x5465278 | out: lpFindFileData=0x5465278*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c52ff94, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x9126a3e3, ftLastAccessTime.dwHighDateTime=0x1d5e1e4, ftLastWriteTime.dwLowDateTime=0x9126a3e3, ftLastWriteTime.dwHighDateTime=0x1d5e1e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f680 [0075.041] wcscmp (_String1=".", _String2=".") returned 0 [0075.041] FindNextFileW (in: hFindFile=0x389f680, lpFindFileData=0x5465278 | out: lpFindFileData=0x5465278*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c52ff94, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x9126a3e3, ftLastAccessTime.dwHighDateTime=0x1d5e1e4, ftLastWriteTime.dwLowDateTime=0x9126a3e3, ftLastWriteTime.dwHighDateTime=0x1d5e1e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.041] wcscmp (_String1="..", _String2=".") returned 1 [0075.041] wcscmp (_String1="..", _String2="..") returned 0 [0075.041] FindNextFileW (in: hFindFile=0x389f680, lpFindFileData=0x5465278 | out: lpFindFileData=0x5465278*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x9126a3e3, ftLastAccessTime.dwHighDateTime=0x1d5e1e4, ftLastWriteTime.dwLowDateTime=0x9126a3e3, ftLastWriteTime.dwHighDateTime=0x1d5e1e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.001.etl", cAlternateFileName="UN6414~1.ETL")) returned 1 [0075.041] wcscmp (_String1="UniversalNotificationPlatform.001.etl", _String2=".") returned 1 [0075.041] wcscmp (_String1="UniversalNotificationPlatform.001.etl", _String2="..") returned 1 [0075.041] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x80) returned 0x54097a8 [0075.041] wcscpy (in: _Dest=0x54097a8, _Source="C:\\Program Files\\UNP\\Logs" | out: _Dest="C:\\Program Files\\UNP\\Logs") returned="C:\\Program Files\\UNP\\Logs" [0075.041] wcscat (in: _Dest=0x54097a8, _Source="\\" | out: _Dest="C:\\Program Files\\UNP\\Logs\\") returned="C:\\Program Files\\UNP\\Logs\\" [0075.041] wcscat (in: _Dest=0x54097a8, _Source="UniversalNotificationPlatform.001.etl" | out: _Dest="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.001.etl") returned="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.001.etl" [0081.114] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54097a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc38 [0081.114] FindNextFileW (in: hFindFile=0x389f680, lpFindFileData=0x5465278 | out: lpFindFileData=0x5465278*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xf95053af, ftLastAccessTime.dwHighDateTime=0x1d5d805, ftLastWriteTime.dwLowDateTime=0x9b236e, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.002.etl", cAlternateFileName="UN8F7C~1.ETL")) returned 1 [0081.114] wcscmp (_String1="UniversalNotificationPlatform.002.etl", _String2=".") returned 1 [0081.115] wcscmp (_String1="UniversalNotificationPlatform.002.etl", _String2="..") returned 1 [0081.115] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x80) returned 0x39786d8 [0081.115] wcscpy (in: _Dest=0x39786d8, _Source="C:\\Program Files\\UNP\\Logs" | out: _Dest="C:\\Program Files\\UNP\\Logs") returned="C:\\Program Files\\UNP\\Logs" [0081.115] wcscat (in: _Dest=0x39786d8, _Source="\\" | out: _Dest="C:\\Program Files\\UNP\\Logs\\") returned="C:\\Program Files\\UNP\\Logs\\" [0081.115] wcscat (in: _Dest=0x39786d8, _Source="UniversalNotificationPlatform.002.etl" | out: _Dest="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.002.etl") returned="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.002.etl" [0081.115] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x39786d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ad4 [0081.115] FindNextFileW (in: hFindFile=0x389f680, lpFindFileData=0x5465278 | out: lpFindFileData=0x5465278*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x5c983e05, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5f01bf05, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.003.etl", cAlternateFileName="UN3A48~1.ETL")) returned 1 [0081.115] wcscmp (_String1="UniversalNotificationPlatform.003.etl", _String2=".") returned 1 [0081.115] wcscmp (_String1="UniversalNotificationPlatform.003.etl", _String2="..") returned 1 [0081.115] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x80) returned 0x3978760 [0081.115] wcscpy (in: _Dest=0x3978760, _Source="C:\\Program Files\\UNP\\Logs" | out: _Dest="C:\\Program Files\\UNP\\Logs") returned="C:\\Program Files\\UNP\\Logs" [0081.115] wcscat (in: _Dest=0x3978760, _Source="\\" | out: _Dest="C:\\Program Files\\UNP\\Logs\\") returned="C:\\Program Files\\UNP\\Logs\\" [0081.115] wcscat (in: _Dest=0x3978760, _Source="UniversalNotificationPlatform.003.etl" | out: _Dest="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.003.etl") returned="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.003.etl" [0081.115] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3978760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ad8 [0081.116] FindNextFileW (in: hFindFile=0x389f680, lpFindFileData=0x5465278 | out: lpFindFileData=0x5465278*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4308f96d, ftLastAccessTime.dwHighDateTime=0x1d41dc4, ftLastWriteTime.dwLowDateTime=0x4416619d, ftLastWriteTime.dwHighDateTime=0x1d41dc4, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.004.etl", cAlternateFileName="UNE414~1.ETL")) returned 1 [0081.116] wcscmp (_String1="UniversalNotificationPlatform.004.etl", _String2=".") returned 1 [0081.116] wcscmp (_String1="UniversalNotificationPlatform.004.etl", _String2="..") returned 1 [0081.116] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x80) returned 0x39787e8 [0081.116] wcscpy (in: _Dest=0x39787e8, _Source="C:\\Program Files\\UNP\\Logs" | out: _Dest="C:\\Program Files\\UNP\\Logs") returned="C:\\Program Files\\UNP\\Logs" [0081.116] wcscat (in: _Dest=0x39787e8, _Source="\\" | out: _Dest="C:\\Program Files\\UNP\\Logs\\") returned="C:\\Program Files\\UNP\\Logs\\" [0081.116] wcscat (in: _Dest=0x39787e8, _Source="UniversalNotificationPlatform.004.etl" | out: _Dest="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.004.etl") returned="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.004.etl" [0081.116] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x39787e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1adc [0081.117] FindNextFileW (in: hFindFile=0x389f680, lpFindFileData=0x5465278 | out: lpFindFileData=0x5465278*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x74f27e5, ftLastAccessTime.dwHighDateTime=0x1d3aafc, ftLastWriteTime.dwLowDateTime=0xb20ade5, ftLastWriteTime.dwHighDateTime=0x1d3aafc, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.005.etl", cAlternateFileName="UN7020~1.ETL")) returned 1 [0081.117] wcscmp (_String1="UniversalNotificationPlatform.005.etl", _String2=".") returned 1 [0081.117] wcscmp (_String1="UniversalNotificationPlatform.005.etl", _String2="..") returned 1 [0081.117] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x80) returned 0x3977b28 [0081.117] wcscpy (in: _Dest=0x3977b28, _Source="C:\\Program Files\\UNP\\Logs" | out: _Dest="C:\\Program Files\\UNP\\Logs") returned="C:\\Program Files\\UNP\\Logs" [0081.117] wcscat (in: _Dest=0x3977b28, _Source="\\" | out: _Dest="C:\\Program Files\\UNP\\Logs\\") returned="C:\\Program Files\\UNP\\Logs\\" [0081.117] wcscat (in: _Dest=0x3977b28, _Source="UniversalNotificationPlatform.005.etl" | out: _Dest="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.005.etl") returned="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.005.etl" [0081.117] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3977b28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ae0 [0081.118] FindNextFileW (in: hFindFile=0x389f680, lpFindFileData=0x5465278 | out: lpFindFileData=0x5465278*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x2211c845, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4ddc6c38, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.006.etl", cAlternateFileName="UN4AAB~1.ETL")) returned 1 [0081.118] wcscmp (_String1="UniversalNotificationPlatform.006.etl", _String2=".") returned 1 [0081.118] wcscmp (_String1="UniversalNotificationPlatform.006.etl", _String2="..") returned 1 [0081.118] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x80) returned 0x3977a18 [0081.118] wcscpy (in: _Dest=0x3977a18, _Source="C:\\Program Files\\UNP\\Logs" | out: _Dest="C:\\Program Files\\UNP\\Logs") returned="C:\\Program Files\\UNP\\Logs" [0081.118] wcscat (in: _Dest=0x3977a18, _Source="\\" | out: _Dest="C:\\Program Files\\UNP\\Logs\\") returned="C:\\Program Files\\UNP\\Logs\\" [0081.118] wcscat (in: _Dest=0x3977a18, _Source="UniversalNotificationPlatform.006.etl" | out: _Dest="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.006.etl") returned="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.006.etl" [0081.118] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3977a18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ae4 [0081.119] FindNextFileW (in: hFindFile=0x389f680, lpFindFileData=0x5465278 | out: lpFindFileData=0x5465278*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xdb15d668, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xde0c0235, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.007.etl", cAlternateFileName="UN1B88~1.ETL")) returned 1 [0081.119] wcscmp (_String1="UniversalNotificationPlatform.007.etl", _String2=".") returned 1 [0081.119] wcscmp (_String1="UniversalNotificationPlatform.007.etl", _String2="..") returned 1 [0081.119] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x80) returned 0x3977aa0 [0081.119] wcscpy (in: _Dest=0x3977aa0, _Source="C:\\Program Files\\UNP\\Logs" | out: _Dest="C:\\Program Files\\UNP\\Logs") returned="C:\\Program Files\\UNP\\Logs" [0081.119] wcscat (in: _Dest=0x3977aa0, _Source="\\" | out: _Dest="C:\\Program Files\\UNP\\Logs\\") returned="C:\\Program Files\\UNP\\Logs\\" [0081.119] wcscat (in: _Dest=0x3977aa0, _Source="UniversalNotificationPlatform.007.etl" | out: _Dest="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.007.etl") returned="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.007.etl" [0081.119] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3977aa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ae8 [0081.120] FindNextFileW (in: hFindFile=0x389f680, lpFindFileData=0x5465278 | out: lpFindFileData=0x5465278*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x264f31cb, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x361fe290, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.008.etl", cAlternateFileName="UNFF10~1.ETL")) returned 1 [0081.120] wcscmp (_String1="UniversalNotificationPlatform.008.etl", _String2=".") returned 1 [0081.120] wcscmp (_String1="UniversalNotificationPlatform.008.etl", _String2="..") returned 1 [0081.120] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x80) returned 0x3978100 [0081.120] wcscpy (in: _Dest=0x3978100, _Source="C:\\Program Files\\UNP\\Logs" | out: _Dest="C:\\Program Files\\UNP\\Logs") returned="C:\\Program Files\\UNP\\Logs" [0081.120] wcscat (in: _Dest=0x3978100, _Source="\\" | out: _Dest="C:\\Program Files\\UNP\\Logs\\") returned="C:\\Program Files\\UNP\\Logs\\" [0081.120] wcscat (in: _Dest=0x3978100, _Source="UniversalNotificationPlatform.008.etl" | out: _Dest="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.008.etl") returned="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.008.etl" [0081.120] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3978100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aec [0081.120] FindNextFileW (in: hFindFile=0x389f680, lpFindFileData=0x5465278 | out: lpFindFileData=0x5465278*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x86f819e6, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x885ec92b, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.009.etl", cAlternateFileName="UNB5F0~1.ETL")) returned 1 [0081.120] wcscmp (_String1="UniversalNotificationPlatform.009.etl", _String2=".") returned 1 [0081.120] wcscmp (_String1="UniversalNotificationPlatform.009.etl", _String2="..") returned 1 [0081.120] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x80) returned 0x3977bb0 [0081.120] wcscpy (in: _Dest=0x3977bb0, _Source="C:\\Program Files\\UNP\\Logs" | out: _Dest="C:\\Program Files\\UNP\\Logs") returned="C:\\Program Files\\UNP\\Logs" [0081.121] wcscat (in: _Dest=0x3977bb0, _Source="\\" | out: _Dest="C:\\Program Files\\UNP\\Logs\\") returned="C:\\Program Files\\UNP\\Logs\\" [0081.121] wcscat (in: _Dest=0x3977bb0, _Source="UniversalNotificationPlatform.009.etl" | out: _Dest="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.009.etl") returned="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.009.etl" [0081.121] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3977bb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1af0 [0081.121] FindNextFileW (in: hFindFile=0x389f680, lpFindFileData=0x5465278 | out: lpFindFileData=0x5465278*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xcd3f87c1, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xce292e60, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.010.etl", cAlternateFileName="UNIVER~4.ETL")) returned 1 [0081.121] wcscmp (_String1="UniversalNotificationPlatform.010.etl", _String2=".") returned 1 [0081.121] wcscmp (_String1="UniversalNotificationPlatform.010.etl", _String2="..") returned 1 [0081.121] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x80) returned 0x3978188 [0081.121] wcscpy (in: _Dest=0x3978188, _Source="C:\\Program Files\\UNP\\Logs" | out: _Dest="C:\\Program Files\\UNP\\Logs") returned="C:\\Program Files\\UNP\\Logs" [0081.121] wcscat (in: _Dest=0x3978188, _Source="\\" | out: _Dest="C:\\Program Files\\UNP\\Logs\\") returned="C:\\Program Files\\UNP\\Logs\\" [0081.121] wcscat (in: _Dest=0x3978188, _Source="UniversalNotificationPlatform.010.etl" | out: _Dest="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.010.etl") returned="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.010.etl" [0081.121] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3978188, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1af4 [0081.122] FindNextFileW (in: hFindFile=0x389f680, lpFindFileData=0x5465278 | out: lpFindFileData=0x5465278*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb6ecb1, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x107a2333, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0x107a2333, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.021.etl", cAlternateFileName="UNIVER~3.ETL")) returned 1 [0081.122] wcscmp (_String1="UniversalNotificationPlatform.021.etl", _String2=".") returned 1 [0081.122] wcscmp (_String1="UniversalNotificationPlatform.021.etl", _String2="..") returned 1 [0081.122] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x80) returned 0x3976a28 [0081.122] wcscpy (in: _Dest=0x3976a28, _Source="C:\\Program Files\\UNP\\Logs" | out: _Dest="C:\\Program Files\\UNP\\Logs") returned="C:\\Program Files\\UNP\\Logs" [0081.122] wcscat (in: _Dest=0x3976a28, _Source="\\" | out: _Dest="C:\\Program Files\\UNP\\Logs\\") returned="C:\\Program Files\\UNP\\Logs\\" [0081.122] wcscat (in: _Dest=0x3976a28, _Source="UniversalNotificationPlatform.021.etl" | out: _Dest="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.021.etl") returned="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.021.etl" [0081.122] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3976a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1af8 [0081.123] FindNextFileW (in: hFindFile=0x389f680, lpFindFileData=0x5465278 | out: lpFindFileData=0x5465278*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb6ecb1, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0xcb6ecb1, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0xcd5eb67, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.022.etl", cAlternateFileName="UNIVER~2.ETL")) returned 1 [0081.123] wcscmp (_String1="UniversalNotificationPlatform.022.etl", _String2=".") returned 1 [0081.123] wcscmp (_String1="UniversalNotificationPlatform.022.etl", _String2="..") returned 1 [0081.123] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x80) returned 0x3977198 [0081.123] wcscpy (in: _Dest=0x3977198, _Source="C:\\Program Files\\UNP\\Logs" | out: _Dest="C:\\Program Files\\UNP\\Logs") returned="C:\\Program Files\\UNP\\Logs" [0081.123] wcscat (in: _Dest=0x3977198, _Source="\\" | out: _Dest="C:\\Program Files\\UNP\\Logs\\") returned="C:\\Program Files\\UNP\\Logs\\" [0081.123] wcscat (in: _Dest=0x3977198, _Source="UniversalNotificationPlatform.022.etl" | out: _Dest="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.022.etl") returned="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.022.etl" [0081.123] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3977198, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1afc [0081.124] FindNextFileW (in: hFindFile=0x389f680, lpFindFileData=0x5465278 | out: lpFindFileData=0x5465278*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749ce1ef, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x749ce1ef, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x94dd5302, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.029.etl", cAlternateFileName="UNIVER~1.ETL")) returned 1 [0081.124] wcscmp (_String1="UniversalNotificationPlatform.029.etl", _String2=".") returned 1 [0081.124] wcscmp (_String1="UniversalNotificationPlatform.029.etl", _String2="..") returned 1 [0081.124] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x80) returned 0x3977330 [0081.124] wcscpy (in: _Dest=0x3977330, _Source="C:\\Program Files\\UNP\\Logs" | out: _Dest="C:\\Program Files\\UNP\\Logs") returned="C:\\Program Files\\UNP\\Logs" [0081.124] wcscat (in: _Dest=0x3977330, _Source="\\" | out: _Dest="C:\\Program Files\\UNP\\Logs\\") returned="C:\\Program Files\\UNP\\Logs\\" [0081.124] wcscat (in: _Dest=0x3977330, _Source="UniversalNotificationPlatform.029.etl" | out: _Dest="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.029.etl") returned="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.029.etl" [0081.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3977330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b00 [0081.125] FindNextFileW (in: hFindFile=0x389f680, lpFindFileData=0x5465278 | out: lpFindFileData=0x5465278*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749ce1ef, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x749ce1ef, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x94dd5302, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.029.etl", cAlternateFileName="UNIVER~1.ETL")) returned 0 [0081.125] FindClose (in: hFindFile=0x389f680 | out: hFindFile=0x389f680) returned 1 [0081.125] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5465278) returned 1 [0081.125] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54458c0) returned 1 [0081.125] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54459c0) returned 1 Thread: id = 278 os_tid = 0x142c [0071.941] GetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\Task.xml" (normalized: "c:\\program files\\unp\\task.xml")) returned 0x20 [0077.182] SetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\Task.xml", dwFileAttributes=0x20) returned 1 [0077.183] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Task.xml" (normalized: "c:\\program files\\unp\\task.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1208 [0077.183] GetFileSizeEx (in: hFile=0x1208, lpFileSize=0xd87fd44 | out: lpFileSize=0xd87fd44*=3206) returned 1 [0077.183] SetFilePointerEx (in: hFile=0x1208, liDistanceToMove=0xc82, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.183] ReadFile (in: hFile=0x1208, lpBuffer=0xd87fcc8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xd87fcc4, lpOverlapped=0x0 | out: lpBuffer=0xd87fcc8*, lpNumberOfBytesRead=0xd87fcc4*=0x4, lpOverlapped=0x0) returned 1 [0077.184] SetFilePointerEx (in: hFile=0x1208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.184] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a50a8 [0077.184] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ec8 [0077.184] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4fb8 [0077.184] NtQuerySystemTime (in: CurrentTime=0xd87fca4 | out: CurrentTime=0xd87fca4*=132260136343397607) returned 0x0 [0077.184] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0xe3781fc6 [0077.184] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0x882c93a [0077.184] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0xea079636 [0077.184] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0xfae73e9 [0077.185] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0xc07b8237 [0077.185] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0xd17c2199 [0077.185] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0x338db01c [0077.185] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0xdf04d97e [0077.185] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0xb12cc0d8 [0077.185] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0x2e86a42e [0077.185] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0xa5e2ea96 [0077.185] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0x830c7060 [0077.185] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0xa744e497 [0077.185] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0xaadb9c8e [0077.185] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0xfc73aae8 [0077.185] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0x51dec91d [0077.185] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0x6f90398d [0077.185] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0xc5bc8956 [0077.185] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0x4b4bec12 [0077.185] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0xdbe2a749 [0077.185] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0x7e256961 [0077.185] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0x40695b03 [0077.185] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0xade57ee1 [0077.185] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0x535e29f3 [0077.185] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0xcbf8bebe [0077.185] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0x3bf7fb19 [0077.185] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0xdb4088d1 [0077.185] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0x987aca41 [0077.185] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0xeea02697 [0077.185] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0xefb8e12f [0077.185] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0xb7ec1207 [0077.185] RtlRandom (in: Seed=0xd87fcb0 | out: Seed=0xd87fcb0) returned 0x3b3d62c2 [0077.194] ReadFile (in: hFile=0x1208, lpBuffer=0x55b88a0, nNumberOfBytesToRead=0xc86, lpNumberOfBytesRead=0xd87fca0, lpOverlapped=0x0 | out: lpBuffer=0x55b88a0*, lpNumberOfBytesRead=0xd87fca0*=0xc86, lpOverlapped=0x0) returned 1 [0077.194] SetFilePointerEx (in: hFile=0x1208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.194] WriteFile (in: hFile=0x1208, lpBuffer=0x55fe8e0*, nNumberOfBytesToWrite=0xc86, lpNumberOfBytesWritten=0xd87fc9c, lpOverlapped=0x0 | out: lpBuffer=0x55fe8e0*, lpNumberOfBytesWritten=0xd87fc9c*=0xc86, lpOverlapped=0x0) returned 1 [0077.195] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4fb8 [0077.196] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5058 [0077.196] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5058) returned 1 [0077.196] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55fe8e0) returned 1 [0077.196] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55b88a0) returned 1 [0077.196] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0077.196] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5608) returned 1 [0077.196] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d) returned 0x38a5058 [0077.196] SetFilePointerEx (in: hFile=0x1208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.196] WriteFile (in: hFile=0x1208, lpBuffer=0x549c970*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0xd87fd04, lpOverlapped=0x0 | out: lpBuffer=0x549c970*, lpNumberOfBytesWritten=0xd87fd04*=0x101, lpOverlapped=0x0) returned 1 [0077.197] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549c970) returned 1 [0077.197] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a50a8) returned 1 [0077.197] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a50d0) returned 1 [0077.197] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5058) returned 1 [0077.197] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4fb8) returned 1 [0077.197] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4ec8) returned 1 [0077.198] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4fe0) returned 1 [0077.198] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5030) returned 1 [0077.198] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7c) returned 0x3977a18 [0077.198] wcscpy (in: _Dest=0x3977a18, _Source="C:\\Program Files\\UNP\\Task.xml" | out: _Dest="C:\\Program Files\\UNP\\Task.xml") returned="C:\\Program Files\\UNP\\Task.xml" [0077.198] wcscat (in: _Dest=0x3977a18, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Program Files\\UNP\\Task.xml.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Program Files\\UNP\\Task.xml.mailto[knoocknoo@cock.li].a0a70" [0077.198] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\UNP\\Task.xml.mailto[knoocknoo@cock.li].a0a70", NtPathName=0xd87fcbc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\UNP\\Task.xml.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.198] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x92) returned 0x5426548 [0077.198] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5426548) returned 1 [0077.199] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549d3b8) returned 1 [0077.199] NtQueryInformationFile (in: FileHandle=0x1208, IoStatusBlock=0xd87fcc8, FileInformation=0xd87fca0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xd87fcc8, FileInformation=0xd87fca0) returned 0x0 [0077.199] NtSetInformationFile (FileHandle=0x1208, IoStatusBlock=0xd87fcc8, FileInformation=0xd87fca0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0077.199] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3977a18) returned 1 [0077.200] FlushFileBuffers (hFile=0x1208) returned 1 [0077.200] CloseHandle (hObject=0x1208) returned 1 [0077.201] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x38ffd88 [0077.201] wcscpy (in: _Dest=0x38ffd88, _Source="C:\\Program Files\\UNP\\" | out: _Dest="C:\\Program Files\\UNP\\") returned="C:\\Program Files\\UNP\\" [0077.201] wcscat (in: _Dest=0x38ffd88, _Source="A0A70-Readme.txt" | out: _Dest="C:\\Program Files\\UNP\\A0A70-Readme.txt") returned="C:\\Program Files\\UNP\\A0A70-Readme.txt" [0077.201] GetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\A0A70-Readme.txt" (normalized: "c:\\program files\\unp\\a0a70-readme.txt")) returned 0xffffffff [0077.201] CreateFileW (lpFileName="C:\\Program Files\\UNP\\A0A70-Readme.txt" (normalized: "c:\\program files\\unp\\a0a70-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1208 [0077.202] WriteFile (in: hFile=0x1208, lpBuffer=0x38ab1f8*, nNumberOfBytesToWrite=0x6f4, lpNumberOfBytesWritten=0xd87fcc4, lpOverlapped=0x0 | out: lpBuffer=0x38ab1f8*, lpNumberOfBytesWritten=0xd87fcc4*=0x6f4, lpOverlapped=0x0) returned 1 [0077.203] CloseHandle (hObject=0x1208) returned 1 [0077.203] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ffd88) returned 1 [0077.203] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b290) returned 1 Thread: id = 279 os_tid = 0x1430 [0071.942] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x5428660 [0071.942] wcscpy (in: _Dest=0x5428660, _Source="C:\\Program Files\\MSBuild\\Microsoft" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft") returned="C:\\Program Files\\MSBuild\\Microsoft" [0071.942] wcscat (in: _Dest=0x5428660, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\" [0071.942] wcscat (in: _Dest=0x5428660, _Source="*" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\*") returned="C:\\Program Files\\MSBuild\\Microsoft\\*" [0071.942] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54654e0 [0071.942] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\*", lpFindFileData=0x54654e0 | out: lpFindFileData=0x54654e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79312f8, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79312f8, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ed40 [0076.057] wcscmp (_String1=".", _String2=".") returned 0 [0076.057] FindNextFileW (in: hFindFile=0x389ed40, lpFindFileData=0x54654e0 | out: lpFindFileData=0x54654e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79312f8, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79312f8, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.057] wcscmp (_String1="..", _String2=".") returned 1 [0076.057] wcscmp (_String1="..", _String2="..") returned 0 [0076.057] FindNextFileW (in: hFindFile=0x389ed40, lpFindFileData=0x54654e0 | out: lpFindFileData=0x54654e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79312f8, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79312f8, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 1 [0076.058] wcscmp (_String1="Windows Workflow Foundation", _String2=".") returned 1 [0076.058] wcscmp (_String1="Windows Workflow Foundation", _String2="..") returned 1 [0076.058] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7e) returned 0x3977e58 [0076.058] wcscpy (in: _Dest=0x3977e58, _Source="C:\\Program Files\\MSBuild\\Microsoft" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft") returned="C:\\Program Files\\MSBuild\\Microsoft" [0076.058] wcscat (in: _Dest=0x3977e58, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\" [0076.058] wcscat (in: _Dest=0x3977e58, _Source="Windows Workflow Foundation" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation" [0081.099] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3977e58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aac [0081.100] FindNextFileW (in: hFindFile=0x389ed40, lpFindFileData=0x54654e0 | out: lpFindFileData=0x54654e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79312f8, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79312f8, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0 [0081.100] FindClose (in: hFindFile=0x389ed40 | out: hFindFile=0x389ed40) returned 1 [0081.100] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54654e0) returned 1 [0081.100] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5428660) returned 1 [0081.100] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54430a0) returned 1 Thread: id = 280 os_tid = 0x1434 [0071.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml")) returned 0x20 [0077.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml", dwFileAttributes=0x20) returned 1 [0077.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x11f0 [0077.111] GetFileSizeEx (in: hFile=0x11f0, lpFileSize=0xd97fe5c | out: lpFileSize=0xd97fe5c*=5944055) returned 1 [0077.111] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x5ab2f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.111] ReadFile (in: hFile=0x11f0, lpBuffer=0xd97fde0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xd97fddc, lpOverlapped=0x0 | out: lpBuffer=0xd97fde0*, lpNumberOfBytesRead=0xd97fddc*=0x4, lpOverlapped=0x0) returned 1 [0077.113] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.113] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5030 [0077.113] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a50a8 [0077.113] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4fb8 [0077.113] NtQuerySystemTime (in: CurrentTime=0xd97fdbc | out: CurrentTime=0xd97fdbc*=132260136342772928) returned 0x0 [0077.113] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0xd414a9bf [0077.113] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0x322a60ec [0077.113] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0x135c311f [0077.113] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0x8633c96e [0077.113] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0x6c26599a [0077.113] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0x4a8c9ec [0077.113] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0xbe20435c [0077.113] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0x6e65746a [0077.113] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0xa6c98d62 [0077.113] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0xc9b97cde [0077.113] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0xc2a1e499 [0077.113] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0xeed1003f [0077.113] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0xde9d7b5e [0077.113] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0x17382206 [0077.113] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0x7b5a85f8 [0077.113] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0x8bb247c9 [0077.114] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0xcaed0c71 [0077.114] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0xac30db3b [0077.114] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0xa542c30e [0077.114] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0xdbb9108e [0077.114] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0xe8437be8 [0077.114] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0x2c3001f2 [0077.114] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0xc334faa6 [0077.114] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0xf9af5b7d [0077.114] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0x69628f72 [0077.114] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0x7983db15 [0077.114] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0x86a1d23f [0077.114] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0xdbdeb837 [0077.114] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0xd7394c40 [0077.114] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0x9e86039c [0077.114] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0x7c4da895 [0077.114] RtlRandom (in: Seed=0xd97fdc8 | out: Seed=0xd97fdc8) returned 0x26138e3d [0077.123] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.123] ReadFile (in: hFile=0x11f0, lpBuffer=0x5598898, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xd97fd74, lpOverlapped=0x0 | out: lpBuffer=0x5598898*, lpNumberOfBytesRead=0xd97fd74*=0xc800, lpOverlapped=0x0) returned 1 [0077.125] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.125] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5608 [0077.125] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0077.125] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4fb8 [0077.125] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4fb8) returned 1 [0077.126] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x55a50a0 [0077.127] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4fb8 [0077.127] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4fe0 [0077.127] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4fe0) returned 1 [0077.127] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0077.127] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5608) returned 1 [0077.127] WriteFile (in: hFile=0x11f0, lpBuffer=0x55a50a0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xd97fd74, lpOverlapped=0x0 | out: lpBuffer=0x55a50a0*, lpNumberOfBytesWritten=0xd97fd74*=0xc800, lpOverlapped=0x0) returned 1 [0077.129] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55a50a0) returned 1 [0077.129] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x2e1800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.130] ReadFile (in: hFile=0x11f0, lpBuffer=0x5598898, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xd97fd74, lpOverlapped=0x0 | out: lpBuffer=0x5598898*, lpNumberOfBytesRead=0xd97fd74*=0xc800, lpOverlapped=0x0) returned 1 [0077.131] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x2e1800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.131] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5890 [0077.131] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5496e90 [0077.131] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4fe0 [0077.131] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4fe0) returned 1 [0077.132] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x55a50a0 [0077.133] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4fe0 [0077.133] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5030 [0077.133] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5030) returned 1 [0077.133] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496e90) returned 1 [0077.133] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5890) returned 1 [0077.133] WriteFile (in: hFile=0x11f0, lpBuffer=0x55a50a0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xd97fd74, lpOverlapped=0x0 | out: lpBuffer=0x55a50a0*, lpNumberOfBytesWritten=0xd97fd74*=0xc800, lpOverlapped=0x0) returned 1 [0077.135] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55a50a0) returned 1 [0077.135] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x59eaf7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.135] ReadFile (in: hFile=0x11f0, lpBuffer=0x5598898, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xd97fd74, lpOverlapped=0x0 | out: lpBuffer=0x5598898*, lpNumberOfBytesRead=0xd97fd74*=0xc800, lpOverlapped=0x0) returned 1 [0077.136] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x59eaf7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.136] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0077.136] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5496a58 [0077.136] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5030 [0077.136] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5030) returned 1 [0077.137] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x55a50a0 [0077.137] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5030 [0077.137] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a50d0 [0077.137] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a50d0) returned 1 [0077.137] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496a58) returned 1 [0077.137] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0077.137] WriteFile (in: hFile=0x11f0, lpBuffer=0x55a50a0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xd97fd74, lpOverlapped=0x0 | out: lpBuffer=0x55a50a0*, lpNumberOfBytesWritten=0xd97fd74*=0xc800, lpOverlapped=0x0) returned 1 [0077.138] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55a50a0) returned 1 [0077.138] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x542b250 [0077.139] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.139] WriteFile (in: hFile=0x11f0, lpBuffer=0x5470778*, nNumberOfBytesToWrite=0x151, lpNumberOfBytesWritten=0xd97fe1c, lpOverlapped=0x0 | out: lpBuffer=0x5470778*, lpNumberOfBytesWritten=0xd97fe1c*=0x151, lpOverlapped=0x0) returned 1 [0077.140] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5470778) returned 1 [0077.140] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5531fc0) returned 1 [0077.140] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5030) returned 1 [0077.140] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5531ee0) returned 1 [0077.140] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542b250) returned 1 [0077.140] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a50a8) returned 1 [0077.140] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5058) returned 1 [0077.140] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4ec8) returned 1 [0077.140] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa6) returned 0x54deb30 [0077.140] wcscpy (in: _Dest=0x54deb30, _Source="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" [0077.140] wcscat (in: _Dest=0x54deb30, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.mailto[knoocknoo@cock.li].a0a70" [0077.140] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.mailto[knoocknoo@cock.li].a0a70", NtPathName=0xd97fdd4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\AppXManifest.xml.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.140] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x3975270 [0077.141] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3975270) returned 1 [0077.141] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a2050) returned 1 [0077.141] NtQueryInformationFile (in: FileHandle=0x11f0, IoStatusBlock=0xd97fde0, FileInformation=0xd97fdb8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xd97fde0, FileInformation=0xd97fdb8) returned 0x0 [0077.141] NtSetInformationFile (FileHandle=0x11f0, IoStatusBlock=0xd97fde0, FileInformation=0xd97fdb8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0077.142] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54deb30) returned 1 [0077.142] FlushFileBuffers (hFile=0x11f0) returned 1 [0077.144] CloseHandle (hObject=0x11f0) returned 1 [0077.144] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x68) returned 0x396e4c0 [0077.144] wcscpy (in: _Dest=0x396e4c0, _Source="C:\\Program Files\\Microsoft Office\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0077.144] wcscat (in: _Dest=0x396e4c0, _Source="A0A70-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\A0A70-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\A0A70-Readme.txt" [0077.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\A0A70-Readme.txt" (normalized: "c:\\program files\\microsoft office\\a0a70-readme.txt")) returned 0xffffffff [0077.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\A0A70-Readme.txt" (normalized: "c:\\program files\\microsoft office\\a0a70-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11f0 [0077.145] WriteFile (in: hFile=0x11f0, lpBuffer=0x38ab1f8*, nNumberOfBytesToWrite=0x6f4, lpNumberOfBytesWritten=0xd97fddc, lpOverlapped=0x0 | out: lpBuffer=0x38ab1f8*, lpNumberOfBytesWritten=0xd97fddc*=0x6f4, lpOverlapped=0x0) returned 1 [0077.146] CloseHandle (hObject=0x11f0) returned 1 [0077.146] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396e4c0) returned 1 [0077.146] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b23a8) returned 1 Thread: id = 281 os_tid = 0x1438 [0071.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 0x220 [0077.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml", dwFileAttributes=0x20) returned 1 [0077.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1208 [0077.159] GetFileSizeEx (in: hFile=0x1208, lpFileSize=0xd9ff93c | out: lpFileSize=0xd9ff93c*=281) returned 1 [0077.159] SetFilePointerEx (in: hFile=0x1208, liDistanceToMove=0x115, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.159] ReadFile (in: hFile=0x1208, lpBuffer=0xd9ff8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xd9ff8bc, lpOverlapped=0x0 | out: lpBuffer=0xd9ff8c0*, lpNumberOfBytesRead=0xd9ff8bc*=0x4, lpOverlapped=0x0) returned 1 [0077.161] SetFilePointerEx (in: hFile=0x1208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.161] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a50a8 [0077.161] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ec8 [0077.161] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4fb8 [0077.161] NtQuerySystemTime (in: CurrentTime=0xd9ff89c | out: CurrentTime=0xd9ff89c*=132260136343241436) returned 0x0 [0077.161] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0xfde236f9 [0077.161] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0x31704f9c [0077.161] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0x112b879a [0077.161] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0xbe85503c [0077.161] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0xfb3df179 [0077.161] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0x34df9e57 [0077.161] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0xaaea9314 [0077.161] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0x950875e0 [0077.161] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0x359be76 [0077.161] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0x9f78bd9 [0077.161] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0x9f48e34b [0077.161] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0x2794771a [0077.161] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0x628df5cf [0077.161] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0x71a40faf [0077.161] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0x14ab793a [0077.161] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0x89385bbc [0077.161] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0x4c2e63d6 [0077.161] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0x26ee0f9c [0077.161] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0xdafc59c8 [0077.161] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0x7081a5ec [0077.161] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0x3efb4279 [0077.161] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0x5714023b [0077.161] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0x8adfaba5 [0077.161] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0xedb10f5b [0077.161] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0x5c699307 [0077.161] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0xa90fde75 [0077.161] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0xbddd6b05 [0077.161] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0x70819603 [0077.161] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0xa7b4f601 [0077.161] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0xb3fda427 [0077.161] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0xbdbdd125 [0077.162] RtlRandom (in: Seed=0xd9ff8a8 | out: Seed=0xd9ff8a8) returned 0xa6a9e612 [0077.172] ReadFile (in: hFile=0x1208, lpBuffer=0x55b88a0, nNumberOfBytesToRead=0x119, lpNumberOfBytesRead=0xd9ff898, lpOverlapped=0x0 | out: lpBuffer=0x55b88a0*, lpNumberOfBytesRead=0xd9ff898*=0x119, lpOverlapped=0x0) returned 1 [0077.172] SetFilePointerEx (in: hFile=0x1208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.172] WriteFile (in: hFile=0x1208, lpBuffer=0x55fe8e0*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0xd9ff894, lpOverlapped=0x0 | out: lpBuffer=0x55fe8e0*, lpNumberOfBytesWritten=0xd9ff894*=0x119, lpOverlapped=0x0) returned 1 [0077.173] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4fb8 [0077.173] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5058 [0077.173] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5058) returned 1 [0077.173] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55fe8e0) returned 1 [0077.173] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55b88a0) returned 1 [0077.173] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0077.173] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5608) returned 1 [0077.173] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x39) returned 0x38a5890 [0077.173] SetFilePointerEx (in: hFile=0x1208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.173] WriteFile (in: hFile=0x1208, lpBuffer=0x388c6a0*, nNumberOfBytesToWrite=0x11d, lpNumberOfBytesWritten=0xd9ff8fc, lpOverlapped=0x0 | out: lpBuffer=0x388c6a0*, lpNumberOfBytesWritten=0xd9ff8fc*=0x11d, lpOverlapped=0x0) returned 1 [0077.175] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388c6a0) returned 1 [0077.175] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a59b0) returned 1 [0077.175] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5058) returned 1 [0077.175] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5890) returned 1 [0077.175] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4fb8) returned 1 [0077.175] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4ec8) returned 1 [0077.175] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4fe0) returned 1 [0077.175] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5030) returned 1 [0077.175] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb2) returned 0x3906220 [0077.176] wcscpy (in: _Dest=0x3906220, _Source="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" [0077.176] wcscat (in: _Dest=0x3906220, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.mailto[knoocknoo@cock.li].a0a70" [0077.176] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.mailto[knoocknoo@cock.li].a0a70", NtPathName=0xd9ff8b4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.176] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x55fd538 [0077.177] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55fd538) returned 1 [0077.177] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3974cf8) returned 1 [0077.177] NtQueryInformationFile (in: FileHandle=0x1208, IoStatusBlock=0xd9ff8c0, FileInformation=0xd9ff898, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xd9ff8c0, FileInformation=0xd9ff898) returned 0x0 [0077.177] NtSetInformationFile (FileHandle=0x1208, IoStatusBlock=0xd9ff8c0, FileInformation=0xd9ff898, Length=0x28, FileInformationClass=0x4) returned 0x0 [0077.178] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3906220) returned 1 [0077.178] FlushFileBuffers (hFile=0x1208) returned 1 [0077.179] CloseHandle (hObject=0x1208) returned 1 [0077.180] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x68) returned 0x396e530 [0077.180] wcscpy (in: _Dest=0x396e530, _Source="C:\\Program Files\\Microsoft Office\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0077.180] wcscat (in: _Dest=0x396e530, _Source="A0A70-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\A0A70-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\A0A70-Readme.txt" [0077.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\A0A70-Readme.txt" (normalized: "c:\\program files\\microsoft office\\a0a70-readme.txt")) returned 0x20 [0077.180] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396e530) returned 1 [0077.180] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388fba0) returned 1 Thread: id = 282 os_tid = 0x143c [0071.947] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x542b800 [0071.947] wcscpy (in: _Dest=0x542b800, _Source="C:\\Program Files\\Microsoft Office\\Office16" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office16") returned="C:\\Program Files\\Microsoft Office\\Office16" [0071.947] wcscat (in: _Dest=0x542b800, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office16\\") returned="C:\\Program Files\\Microsoft Office\\Office16\\" [0071.947] wcscat (in: _Dest=0x542b800, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office16\\*") returned="C:\\Program Files\\Microsoft Office\\Office16\\*" [0071.947] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5465748 [0071.947] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\*", lpFindFileData=0x5465748 | out: lpFindFileData=0x5465748*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9e7b530, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa146f18e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda9a8629, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e780 [0076.244] wcscmp (_String1=".", _String2=".") returned 0 [0076.244] FindNextFileW (in: hFindFile=0x389e780, lpFindFileData=0x5465748 | out: lpFindFileData=0x5465748*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9e7b530, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa146f18e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda9a8629, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.244] wcscmp (_String1="..", _String2=".") returned 1 [0076.244] wcscmp (_String1="..", _String2="..") returned 0 [0076.244] FindNextFileW (in: hFindFile=0x389e780, lpFindFileData=0x5465748 | out: lpFindFileData=0x5465748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd502d600, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0xd9e7b530, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd502d600, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x2a9c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPP.HTM", cAlternateFileName="")) returned 1 [0076.244] wcscmp (_String1="OSPP.HTM", _String2=".") returned 1 [0076.244] wcscmp (_String1="OSPP.HTM", _String2="..") returned 1 [0076.245] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x68) returned 0x396d8f0 [0076.245] wcscpy (in: _Dest=0x396d8f0, _Source="C:\\Program Files\\Microsoft Office\\Office16" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office16") returned="C:\\Program Files\\Microsoft Office\\Office16" [0076.245] wcscat (in: _Dest=0x396d8f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office16\\") returned="C:\\Program Files\\Microsoft Office\\Office16\\" [0076.245] wcscat (in: _Dest=0x396d8f0, _Source="OSPP.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" [0081.074] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396d8f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1174 [0081.075] FindNextFileW (in: hFindFile=0x389e780, lpFindFileData=0x5465748 | out: lpFindFileData=0x5465748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9ea17a8, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x17103, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPP.VBS", cAlternateFileName="")) returned 1 [0081.075] wcscmp (_String1="OSPP.VBS", _String2=".") returned 1 [0081.075] wcscmp (_String1="OSPP.VBS", _String2="..") returned 1 [0081.075] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x68) returned 0x5ba7a48 [0081.075] wcscpy (in: _Dest=0x5ba7a48, _Source="C:\\Program Files\\Microsoft Office\\Office16" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office16") returned="C:\\Program Files\\Microsoft Office\\Office16" [0081.075] wcscat (in: _Dest=0x5ba7a48, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office16\\") returned="C:\\Program Files\\Microsoft Office\\Office16\\" [0081.075] wcscat (in: _Dest=0x5ba7a48, _Source="OSPP.VBS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" [0081.075] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba7a48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a58 [0081.075] FindNextFileW (in: hFindFile=0x389e780, lpFindFileData=0x5465748 | out: lpFindFileData=0x5465748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x6a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPREARM.EXE", cAlternateFileName="OSPPRE~1.EXE")) returned 1 [0081.075] wcscmp (_String1="OSPPREARM.EXE", _String2=".") returned 1 [0081.075] wcscmp (_String1="OSPPREARM.EXE", _String2="..") returned 1 [0081.075] FindNextFileW (in: hFindFile=0x389e780, lpFindFileData=0x5465748 | out: lpFindFileData=0x5465748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd502d600, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0xda9a8629, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd502d600, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x8df0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLERROR.XML", cAlternateFileName="")) returned 1 [0081.075] wcscmp (_String1="SLERROR.XML", _String2=".") returned 1 [0081.076] wcscmp (_String1="SLERROR.XML", _String2="..") returned 1 [0081.076] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6e) returned 0xe0182c8 [0091.750] wcscpy (in: _Dest=0xe0182c8, _Source="C:\\Program Files\\Microsoft Office\\Office16" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office16") returned="C:\\Program Files\\Microsoft Office\\Office16" [0091.750] wcscat (in: _Dest=0xe0182c8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office16\\") returned="C:\\Program Files\\Microsoft Office\\Office16\\" [0091.750] wcscat (in: _Dest=0xe0182c8, _Source="SLERROR.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" Thread: id = 283 os_tid = 0x1440 [0071.950] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6a) returned 0x5467da0 [0071.950] wcscpy (in: _Dest=0x5467da0, _Source="C:\\Program Files\\Microsoft Office\\PackageManifests" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests") returned="C:\\Program Files\\Microsoft Office\\PackageManifests" [0071.950] wcscat (in: _Dest=0x5467da0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\" [0071.950] wcscat (in: _Dest=0x5467da0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\*") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\*" [0071.950] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54659b0 [0071.950] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\*", lpFindFileData=0x54659b0 | out: lpFindFileData=0x54659b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf982bd9c, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f140 [0077.150] wcscmp (_String1=".", _String2=".") returned 0 [0077.150] FindNextFileW (in: hFindFile=0x389f140, lpFindFileData=0x54659b0 | out: lpFindFileData=0x54659b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf982bd9c, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.152] wcscmp (_String1="..", _String2=".") returned 1 [0077.152] wcscmp (_String1="..", _String2="..") returned 0 [0077.152] FindNextFileW (in: hFindFile=0x389f140, lpFindFileData=0x54659b0 | out: lpFindFileData=0x54659b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x834f7581, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x834f7581, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83ea71ba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5e91c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml", cAlternateFileName="APA05A~1.XML")) returned 1 [0077.152] wcscmp (_String1="AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml", _String2=".") returned 1 [0077.152] wcscmp (_String1="AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml", _String2="..") returned 1 [0077.152] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x54b26f8 [0077.152] wcscpy (in: _Dest=0x54b26f8, _Source="C:\\Program Files\\Microsoft Office\\PackageManifests" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests") returned="C:\\Program Files\\Microsoft Office\\PackageManifests" [0077.152] wcscat (in: _Dest=0x54b26f8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\" [0077.152] wcscat (in: _Dest=0x54b26f8, _Source="AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" [0080.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54b26f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11fc [0080.982] FindNextFileW (in: hFindFile=0x389f140, lpFindFileData=0x54659b0 | out: lpFindFileData=0x54659b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8351d7a8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8351d7a8, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e3474a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml", cAlternateFileName="APAD0B~1.XML")) returned 1 [0080.982] wcscmp (_String1="AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml", _String2=".") returned 1 [0080.982] wcscmp (_String1="AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml", _String2="..") returned 1 [0080.982] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x5bac080 [0080.982] wcscpy (in: _Dest=0x5bac080, _Source="C:\\Program Files\\Microsoft Office\\PackageManifests" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests") returned="C:\\Program Files\\Microsoft Office\\PackageManifests" [0080.982] wcscat (in: _Dest=0x5bac080, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\" [0080.982] wcscat (in: _Dest=0x5bac080, _Source="AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" [0080.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5bac080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x191c [0080.983] FindNextFileW (in: hFindFile=0x389f140, lpFindFileData=0x54659b0 | out: lpFindFileData=0x54659b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x838fd5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x838fd5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xc3863, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml", cAlternateFileName="APEDE2~1.XML")) returned 1 [0080.983] wcscmp (_String1="AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml", _String2=".") returned 1 [0080.983] wcscmp (_String1="AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml", _String2="..") returned 1 [0080.983] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x5bab7c0 [0080.983] wcscpy (in: _Dest=0x5bab7c0, _Source="C:\\Program Files\\Microsoft Office\\PackageManifests" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests") returned="C:\\Program Files\\Microsoft Office\\PackageManifests" [0080.983] wcscat (in: _Dest=0x5bab7c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\" [0080.983] wcscat (in: _Dest=0x5bab7c0, _Source="AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" [0080.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5bab7c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1920 [0080.984] FindNextFileW (in: hFindFile=0x389f140, lpFindFileData=0x54659b0 | out: lpFindFileData=0x54659b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml", cAlternateFileName="AP51DE~1.XML")) returned 1 [0080.984] wcscmp (_String1="AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml", _String2=".") returned 1 [0080.984] wcscmp (_String1="AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml", _String2="..") returned 1 [0080.984] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x5bac4e0 [0080.984] wcscpy (in: _Dest=0x5bac4e0, _Source="C:\\Program Files\\Microsoft Office\\PackageManifests" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests") returned="C:\\Program Files\\Microsoft Office\\PackageManifests" [0080.984] wcscat (in: _Dest=0x5bac4e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\" [0080.984] wcscat (in: _Dest=0x5bac4e0, _Source="AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" [0080.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5bac4e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1924 [0080.985] FindNextFileW (in: hFindFile=0x389f140, lpFindFileData=0x54659b0 | out: lpFindFileData=0x54659b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83485006, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83485006, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x841a1e52, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x79381, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml", cAlternateFileName="APPXMA~4.XML")) returned 1 [0080.985] wcscmp (_String1="AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml", _String2=".") returned 1 [0080.985] wcscmp (_String1="AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml", _String2="..") returned 1 [0080.985] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x5bab8a0 [0080.985] wcscpy (in: _Dest=0x5bab8a0, _Source="C:\\Program Files\\Microsoft Office\\PackageManifests" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests") returned="C:\\Program Files\\Microsoft Office\\PackageManifests" [0080.985] wcscat (in: _Dest=0x5bab8a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\" [0080.985] wcscat (in: _Dest=0x5bab8a0, _Source="AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" [0080.985] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5bab8a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1928 [0080.985] FindNextFileW (in: hFindFile=0x389f140, lpFindFileData=0x54659b0 | out: lpFindFileData=0x54659b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x834d1316, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x834d1316, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83ecd099, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml", cAlternateFileName="APCEE5~1.XML")) returned 1 [0080.985] wcscmp (_String1="AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml", _String2=".") returned 1 [0080.985] wcscmp (_String1="AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml", _String2="..") returned 1 [0080.985] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x5bab980 [0080.985] wcscpy (in: _Dest=0x5bab980, _Source="C:\\Program Files\\Microsoft Office\\PackageManifests" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests") returned="C:\\Program Files\\Microsoft Office\\PackageManifests" [0080.985] wcscat (in: _Dest=0x5bab980, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\" [0080.985] wcscat (in: _Dest=0x5bab980, _Source="AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" [0080.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5bab980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x192c [0080.986] FindNextFileW (in: hFindFile=0x389f140, lpFindFileData=0x54659b0 | out: lpFindFileData=0x54659b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83e3474a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83e3474a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84214453, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3df10, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml", cAlternateFileName="AP557F~1.XML")) returned 1 [0080.986] wcscmp (_String1="AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml", _String2=".") returned 1 [0080.986] wcscmp (_String1="AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml", _String2="..") returned 1 [0080.986] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x5baba60 [0080.986] wcscpy (in: _Dest=0x5baba60, _Source="C:\\Program Files\\Microsoft Office\\PackageManifests" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests") returned="C:\\Program Files\\Microsoft Office\\PackageManifests" [0080.986] wcscat (in: _Dest=0x5baba60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\" [0080.986] wcscat (in: _Dest=0x5baba60, _Source="AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" [0080.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5baba60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1930 [0080.987] FindNextFileW (in: hFindFile=0x389f140, lpFindFileData=0x54659b0 | out: lpFindFileData=0x54659b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x839bc0c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x839bc0c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml", cAlternateFileName="APE193~1.XML")) returned 1 [0080.987] wcscmp (_String1="AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml", _String2=".") returned 1 [0080.987] wcscmp (_String1="AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml", _String2="..") returned 1 [0080.987] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x5babb40 [0080.987] wcscpy (in: _Dest=0x5babb40, _Source="C:\\Program Files\\Microsoft Office\\PackageManifests" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests") returned="C:\\Program Files\\Microsoft Office\\PackageManifests" [0080.987] wcscat (in: _Dest=0x5babb40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\" [0080.987] wcscat (in: _Dest=0x5babb40, _Source="AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" [0080.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5babb40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1934 [0080.988] FindNextFileW (in: hFindFile=0x389f140, lpFindFileData=0x54659b0 | out: lpFindFileData=0x54659b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x834d1316, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x834d1316, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e3474a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x112a4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml", cAlternateFileName="APC1E2~1.XML")) returned 1 [0080.988] wcscmp (_String1="AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml", _String2=".") returned 1 [0080.988] wcscmp (_String1="AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml", _String2="..") returned 1 [0080.988] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x5babc20 [0080.988] wcscpy (in: _Dest=0x5babc20, _Source="C:\\Program Files\\Microsoft Office\\PackageManifests" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests") returned="C:\\Program Files\\Microsoft Office\\PackageManifests" [0080.988] wcscat (in: _Dest=0x5babc20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\" [0080.988] wcscat (in: _Dest=0x5babc20, _Source="AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" [0080.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5babc20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1938 [0080.989] FindNextFileW (in: hFindFile=0x389f140, lpFindFileData=0x54659b0 | out: lpFindFileData=0x54659b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x841a1e52, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4bfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml", cAlternateFileName="APC422~1.XML")) returned 1 [0080.989] wcscmp (_String1="AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml", _String2=".") returned 1 [0080.989] wcscmp (_String1="AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml", _String2="..") returned 1 [0080.989] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x5babde0 [0080.989] wcscpy (in: _Dest=0x5babde0, _Source="C:\\Program Files\\Microsoft Office\\PackageManifests" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests") returned="C:\\Program Files\\Microsoft Office\\PackageManifests" [0080.989] wcscat (in: _Dest=0x5babde0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\" [0080.989] wcscat (in: _Dest=0x5babde0, _Source="AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" [0080.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5babde0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x193c [0080.990] FindNextFileW (in: hFindFile=0x389f140, lpFindFileData=0x54659b0 | out: lpFindFileData=0x54659b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84391d75, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xba5e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml", cAlternateFileName="AP2169~1.XML")) returned 1 [0080.990] wcscmp (_String1="AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml", _String2=".") returned 1 [0080.990] wcscmp (_String1="AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml", _String2="..") returned 1 [0080.990] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x5bac160 [0080.990] wcscpy (in: _Dest=0x5bac160, _Source="C:\\Program Files\\Microsoft Office\\PackageManifests" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests") returned="C:\\Program Files\\Microsoft Office\\PackageManifests" [0080.990] wcscat (in: _Dest=0x5bac160, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\" [0080.990] wcscat (in: _Dest=0x5bac160, _Source="AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" [0080.990] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5bac160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1940 [0080.990] FindNextFileW (in: hFindFile=0x389f140, lpFindFileData=0x54659b0 | out: lpFindFileData=0x54659b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83ea71ba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml", cAlternateFileName="AP7BBA~1.XML")) returned 1 [0080.991] wcscmp (_String1="AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml", _String2=".") returned 1 [0080.991] wcscmp (_String1="AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml", _String2="..") returned 1 [0080.991] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x5bac780 [0080.991] wcscpy (in: _Dest=0x5bac780, _Source="C:\\Program Files\\Microsoft Office\\PackageManifests" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests") returned="C:\\Program Files\\Microsoft Office\\PackageManifests" [0080.991] wcscat (in: _Dest=0x5bac780, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\" [0080.991] wcscat (in: _Dest=0x5bac780, _Source="AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" [0080.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5bac780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1944 [0080.991] FindNextFileW (in: hFindFile=0x389f140, lpFindFileData=0x54659b0 | out: lpFindFileData=0x54659b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83e0e651, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83e0e651, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml", cAlternateFileName="APEF10~1.XML")) returned 1 [0080.991] wcscmp (_String1="AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml", _String2=".") returned 1 [0080.991] wcscmp (_String1="AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml", _String2="..") returned 1 [0080.991] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x5babec0 [0080.991] wcscpy (in: _Dest=0x5babec0, _Source="C:\\Program Files\\Microsoft Office\\PackageManifests" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests") returned="C:\\Program Files\\Microsoft Office\\PackageManifests" [0080.991] wcscat (in: _Dest=0x5babec0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\" [0080.992] wcscat (in: _Dest=0x5babec0, _Source="AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" [0080.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5babec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1948 [0080.992] FindNextFileW (in: hFindFile=0x389f140, lpFindFileData=0x54659b0 | out: lpFindFileData=0x54659b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x838fd5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x838fd5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x863, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml", cAlternateFileName="AP5F49~1.XML")) returned 1 [0080.992] wcscmp (_String1="AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml", _String2=".") returned 1 [0080.992] wcscmp (_String1="AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml", _String2="..") returned 1 [0080.992] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x5bac240 [0080.992] wcscpy (in: _Dest=0x5bac240, _Source="C:\\Program Files\\Microsoft Office\\PackageManifests" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests") returned="C:\\Program Files\\Microsoft Office\\PackageManifests" [0080.992] wcscat (in: _Dest=0x5bac240, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\" [0080.992] wcscat (in: _Dest=0x5bac240, _Source="AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" [0080.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5bac240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x194c [0080.993] FindNextFileW (in: hFindFile=0x389f140, lpFindFileData=0x54659b0 | out: lpFindFileData=0x54659b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83ea71ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83ea71ba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84214453, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x863, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml", cAlternateFileName="APB0FE~1.XML")) returned 1 [0080.993] wcscmp (_String1="AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml", _String2=".") returned 1 [0080.993] wcscmp (_String1="AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml", _String2="..") returned 1 [0080.993] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x5bac320 [0080.993] wcscpy (in: _Dest=0x5bac320, _Source="C:\\Program Files\\Microsoft Office\\PackageManifests" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests") returned="C:\\Program Files\\Microsoft Office\\PackageManifests" [0080.993] wcscat (in: _Dest=0x5bac320, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\" [0080.993] wcscat (in: _Dest=0x5bac320, _Source="AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" [0080.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5bac320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1950 [0080.994] FindNextFileW (in: hFindFile=0x389f140, lpFindFileData=0x54659b0 | out: lpFindFileData=0x54659b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf982bd9c, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf982bd9c, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x34b4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml", cAlternateFileName="AP8AF5~1.XML")) returned 1 [0080.994] wcscmp (_String1="AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml", _String2=".") returned 1 [0080.994] wcscmp (_String1="AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml", _String2="..") returned 1 [0080.994] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x5bac5c0 [0080.994] wcscpy (in: _Dest=0x5bac5c0, _Source="C:\\Program Files\\Microsoft Office\\PackageManifests" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests") returned="C:\\Program Files\\Microsoft Office\\PackageManifests" [0080.994] wcscat (in: _Dest=0x5bac5c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\" [0080.994] wcscat (in: _Dest=0x5bac5c0, _Source="AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" [0080.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5bac5c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1954 [0080.995] FindNextFileW (in: hFindFile=0x389f140, lpFindFileData=0x54659b0 | out: lpFindFileData=0x54659b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e3474a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml", cAlternateFileName="APF26A~1.XML")) returned 1 [0080.995] wcscmp (_String1="AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml", _String2=".") returned 1 [0080.995] wcscmp (_String1="AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml", _String2="..") returned 1 [0080.995] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x5bac400 [0080.995] wcscpy (in: _Dest=0x5bac400, _Source="C:\\Program Files\\Microsoft Office\\PackageManifests" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests") returned="C:\\Program Files\\Microsoft Office\\PackageManifests" [0080.995] wcscat (in: _Dest=0x5bac400, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\" [0080.995] wcscat (in: _Dest=0x5bac400, _Source="AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" [0080.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5bac400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1958 [0080.996] FindNextFileW (in: hFindFile=0x389f140, lpFindFileData=0x54659b0 | out: lpFindFileData=0x54659b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xbf2f172d, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0xbf2f172d, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xbf33deae, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml", cAlternateFileName="APC553~1.XML")) returned 1 [0080.996] wcscmp (_String1="AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml", _String2=".") returned 1 [0080.996] wcscmp (_String1="AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml", _String2="..") returned 1 [0080.996] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x5bac6a0 [0080.996] wcscpy (in: _Dest=0x5bac6a0, _Source="C:\\Program Files\\Microsoft Office\\PackageManifests" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests") returned="C:\\Program Files\\Microsoft Office\\PackageManifests" [0080.996] wcscat (in: _Dest=0x5bac6a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\" [0080.996] wcscat (in: _Dest=0x5bac6a0, _Source="AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" [0080.996] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5bac6a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x195c [0080.996] FindNextFileW (in: hFindFile=0x389f140, lpFindFileData=0x54659b0 | out: lpFindFileData=0x54659b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xbf2f172d, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0xbf2f172d, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xbf2f172d, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x53d21, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml", cAlternateFileName="AP9FA1~1.XML")) returned 1 [0080.996] wcscmp (_String1="AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml", _String2=".") returned 1 [0080.996] wcscmp (_String1="AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml", _String2="..") returned 1 [0080.996] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x5bac860 [0080.996] wcscpy (in: _Dest=0x5bac860, _Source="C:\\Program Files\\Microsoft Office\\PackageManifests" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests") returned="C:\\Program Files\\Microsoft Office\\PackageManifests" [0080.996] wcscat (in: _Dest=0x5bac860, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\" [0080.997] wcscat (in: _Dest=0x5bac860, _Source="AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" [0080.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5bac860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1960 [0080.997] FindNextFileW (in: hFindFile=0x389f140, lpFindFileData=0x54659b0 | out: lpFindFileData=0x54659b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83ea71ba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3a41, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml", cAlternateFileName="AP330B~1.XML")) returned 1 [0080.997] wcscmp (_String1="AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml", _String2=".") returned 1 [0080.997] wcscmp (_String1="AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml", _String2="..") returned 1 [0080.997] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x5baccc0 [0080.997] wcscpy (in: _Dest=0x5baccc0, _Source="C:\\Program Files\\Microsoft Office\\PackageManifests" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests") returned="C:\\Program Files\\Microsoft Office\\PackageManifests" [0080.997] wcscat (in: _Dest=0x5baccc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\" [0080.998] wcscat (in: _Dest=0x5baccc0, _Source="AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" [0080.998] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5baccc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1964 [0080.998] FindNextFileW (in: hFindFile=0x389f140, lpFindFileData=0x54659b0 | out: lpFindFileData=0x54659b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x831d63af, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83543a09, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x573e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml", cAlternateFileName="APPXMA~1.XML")) returned 1 [0080.998] wcscmp (_String1="AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml", _String2=".") returned 1 [0080.998] wcscmp (_String1="AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml", _String2="..") returned 1 [0080.998] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x5bacda0 [0080.998] wcscpy (in: _Dest=0x5bacda0, _Source="C:\\Program Files\\Microsoft Office\\PackageManifests" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests") returned="C:\\Program Files\\Microsoft Office\\PackageManifests" [0080.998] wcscat (in: _Dest=0x5bacda0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\" [0080.998] wcscat (in: _Dest=0x5bacda0, _Source="AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" [0080.998] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5bacda0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1968 [0080.999] FindNextFileW (in: hFindFile=0x389f140, lpFindFileData=0x54659b0 | out: lpFindFileData=0x54659b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83e3474a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83e3474a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml", cAlternateFileName="AP6206~1.XML")) returned 1 [0080.999] wcscmp (_String1="AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml", _String2=".") returned 1 [0080.999] wcscmp (_String1="AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml", _String2="..") returned 1 [0080.999] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x5bace80 [0080.999] wcscpy (in: _Dest=0x5bace80, _Source="C:\\Program Files\\Microsoft Office\\PackageManifests" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests") returned="C:\\Program Files\\Microsoft Office\\PackageManifests" [0080.999] wcscat (in: _Dest=0x5bace80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\" [0080.999] wcscat (in: _Dest=0x5bace80, _Source="AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" [0080.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5bace80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x196c [0081.000] FindNextFileW (in: hFindFile=0x389f140, lpFindFileData=0x54659b0 | out: lpFindFileData=0x54659b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x834d1316, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x834d1316, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8351d7a8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xfdea, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml", cAlternateFileName="APD1EA~1.XML")) returned 1 [0081.000] wcscmp (_String1="AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml", _String2=".") returned 1 [0081.000] wcscmp (_String1="AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml", _String2="..") returned 1 [0081.000] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x5bacbe0 [0081.000] wcscpy (in: _Dest=0x5bacbe0, _Source="C:\\Program Files\\Microsoft Office\\PackageManifests" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests") returned="C:\\Program Files\\Microsoft Office\\PackageManifests" [0081.000] wcscat (in: _Dest=0x5bacbe0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\" [0081.000] wcscat (in: _Dest=0x5bacbe0, _Source="AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" [0081.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5bacbe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1970 [0081.001] FindNextFileW (in: hFindFile=0x389f140, lpFindFileData=0x54659b0 | out: lpFindFileData=0x54659b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83ea71ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83ea71ba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x841a1e52, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml", cAlternateFileName="AP6EFE~1.XML")) returned 1 [0081.001] wcscmp (_String1="AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml", _String2=".") returned 1 [0081.001] wcscmp (_String1="AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml", _String2="..") returned 1 [0081.001] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x3934568 [0081.001] wcscpy (in: _Dest=0x3934568, _Source="C:\\Program Files\\Microsoft Office\\PackageManifests" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests") returned="C:\\Program Files\\Microsoft Office\\PackageManifests" [0081.001] wcscat (in: _Dest=0x3934568, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\" [0081.001] wcscat (in: _Dest=0x3934568, _Source="AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" [0081.001] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3934568, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1974 [0081.002] FindNextFileW (in: hFindFile=0x389f140, lpFindFileData=0x54659b0 | out: lpFindFileData=0x54659b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf982bd9c, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf98c485a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml", cAlternateFileName="APB63F~1.XML")) returned 1 [0081.002] wcscmp (_String1="AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml", _String2=".") returned 1 [0081.002] wcscmp (_String1="AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml", _String2="..") returned 1 [0081.002] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x3934648 [0081.002] wcscpy (in: _Dest=0x3934648, _Source="C:\\Program Files\\Microsoft Office\\PackageManifests" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests") returned="C:\\Program Files\\Microsoft Office\\PackageManifests" [0081.002] wcscat (in: _Dest=0x3934648, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\" [0081.002] wcscat (in: _Dest=0x3934648, _Source="AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" [0081.002] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3934648, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1978 [0081.002] FindNextFileW (in: hFindFile=0x389f140, lpFindFileData=0x54659b0 | out: lpFindFileData=0x54659b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x839bc0c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x839bc0c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml", cAlternateFileName="APB913~1.XML")) returned 1 [0081.002] wcscmp (_String1="AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml", _String2=".") returned 1 [0081.002] wcscmp (_String1="AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml", _String2="..") returned 1 [0081.002] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x53fcda0 [0081.002] wcscpy (in: _Dest=0x53fcda0, _Source="C:\\Program Files\\Microsoft Office\\PackageManifests" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests") returned="C:\\Program Files\\Microsoft Office\\PackageManifests" [0081.003] wcscat (in: _Dest=0x53fcda0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\" [0081.003] wcscat (in: _Dest=0x53fcda0, _Source="AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" [0081.003] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53fcda0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x197c [0081.003] FindNextFileW (in: hFindFile=0x389f140, lpFindFileData=0x54659b0 | out: lpFindFileData=0x54659b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x838fd5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x838fd5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml", cAlternateFileName="AP4637~1.XML")) returned 1 [0081.003] wcscmp (_String1="AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml", _String2=".") returned 1 [0081.003] wcscmp (_String1="AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml", _String2="..") returned 1 [0081.003] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x54a3ba0 [0091.711] wcscpy (in: _Dest=0x54a3ba0, _Source="C:\\Program Files\\Microsoft Office\\PackageManifests" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests") returned="C:\\Program Files\\Microsoft Office\\PackageManifests" [0091.711] wcscat (in: _Dest=0x54a3ba0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\" [0091.711] wcscat (in: _Dest=0x54a3ba0, _Source="AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" Thread: id = 284 os_tid = 0x1444 [0071.951] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x38b6128 [0071.951] wcscpy (in: _Dest=0x38b6128, _Source="C:\\Program Files\\Microsoft Office\\root" | out: _Dest="C:\\Program Files\\Microsoft Office\\root") returned="C:\\Program Files\\Microsoft Office\\root" [0071.951] wcscat (in: _Dest=0x38b6128, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\") returned="C:\\Program Files\\Microsoft Office\\root\\" [0071.951] wcscat (in: _Dest=0x38b6128, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\*") returned="C:\\Program Files\\Microsoft Office\\root\\*" [0071.951] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5465c18 [0071.951] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\*", lpFindFileData=0x5465c18 | out: lpFindFileData=0x5465c18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ef40 [0075.042] wcscmp (_String1=".", _String2=".") returned 0 [0075.042] FindNextFileW (in: hFindFile=0x389ef40, lpFindFileData=0x5465c18 | out: lpFindFileData=0x5465c18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.042] wcscmp (_String1="..", _String2=".") returned 1 [0075.042] wcscmp (_String1="..", _String2="..") returned 0 [0075.042] FindNextFileW (in: hFindFile=0x389ef40, lpFindFileData=0x5465c18 | out: lpFindFileData=0x5465c18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86813dc4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2ca2e08, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2ca2e08, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="client", cAlternateFileName="")) returned 1 [0075.042] wcscmp (_String1="client", _String2=".") returned 1 [0075.043] wcscmp (_String1="client", _String2="..") returned 1 [0075.043] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x38fcab8 [0075.043] wcscpy (in: _Dest=0x38fcab8, _Source="C:\\Program Files\\Microsoft Office\\root" | out: _Dest="C:\\Program Files\\Microsoft Office\\root") returned="C:\\Program Files\\Microsoft Office\\root" [0075.043] wcscat (in: _Dest=0x38fcab8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\") returned="C:\\Program Files\\Microsoft Office\\root\\" [0075.043] wcscat (in: _Dest=0x38fcab8, _Source="client" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\client") returned="C:\\Program Files\\Microsoft Office\\root\\client" [0081.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38fcab8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc3c [0081.126] FindNextFileW (in: hFindFile=0x389ef40, lpFindFileData=0x5465c18 | out: lpFindFileData=0x5465c18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0081.126] wcscmp (_String1="CLIPART", _String2=".") returned 1 [0081.126] wcscmp (_String1="CLIPART", _String2="..") returned 1 [0081.126] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x6e965f8 [0081.126] wcscpy (in: _Dest=0x6e965f8, _Source="C:\\Program Files\\Microsoft Office\\root" | out: _Dest="C:\\Program Files\\Microsoft Office\\root") returned="C:\\Program Files\\Microsoft Office\\root" [0081.126] wcscat (in: _Dest=0x6e965f8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\") returned="C:\\Program Files\\Microsoft Office\\root\\" [0081.126] wcscat (in: _Dest=0x6e965f8, _Source="CLIPART" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\CLIPART") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART" [0081.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x6e965f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b04 [0081.127] FindNextFileW (in: hFindFile=0x389ef40, lpFindFileData=0x5465c18 | out: lpFindFileData=0x5465c18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Themes 16", cAlternateFileName="DOCUME~1")) returned 1 [0081.127] wcscmp (_String1="Document Themes 16", _String2=".") returned 1 [0081.127] wcscmp (_String1="Document Themes 16", _String2="..") returned 1 [0081.127] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x74) returned 0x38d2420 [0081.127] wcscpy (in: _Dest=0x38d2420, _Source="C:\\Program Files\\Microsoft Office\\root" | out: _Dest="C:\\Program Files\\Microsoft Office\\root") returned="C:\\Program Files\\Microsoft Office\\root" [0081.127] wcscat (in: _Dest=0x38d2420, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\") returned="C:\\Program Files\\Microsoft Office\\root\\" [0081.127] wcscat (in: _Dest=0x38d2420, _Source="Document Themes 16" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16" [0081.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38d2420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b08 [0081.128] FindNextFileW (in: hFindFile=0x389ef40, lpFindFileData=0x5465c18 | out: lpFindFileData=0x5465c18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114f5747, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114f5747, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flattener", cAlternateFileName="FLATTE~1")) returned 1 [0081.128] wcscmp (_String1="Flattener", _String2=".") returned 1 [0081.128] wcscmp (_String1="Flattener", _String2="..") returned 1 [0081.128] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x5ba7888 [0081.128] wcscpy (in: _Dest=0x5ba7888, _Source="C:\\Program Files\\Microsoft Office\\root" | out: _Dest="C:\\Program Files\\Microsoft Office\\root") returned="C:\\Program Files\\Microsoft Office\\root" [0081.128] wcscat (in: _Dest=0x5ba7888, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\") returned="C:\\Program Files\\Microsoft Office\\root\\" [0081.128] wcscat (in: _Dest=0x5ba7888, _Source="Flattener" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\Flattener") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener" [0081.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba7888, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b0c [0081.129] FindNextFileW (in: hFindFile=0x389ef40, lpFindFileData=0x5465c18 | out: lpFindFileData=0x5465c18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fre", cAlternateFileName="")) returned 1 [0081.129] wcscmp (_String1="fre", _String2=".") returned 1 [0081.129] wcscmp (_String1="fre", _String2="..") returned 1 [0081.129] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x7583260 [0081.129] wcscpy (in: _Dest=0x7583260, _Source="C:\\Program Files\\Microsoft Office\\root" | out: _Dest="C:\\Program Files\\Microsoft Office\\root") returned="C:\\Program Files\\Microsoft Office\\root" [0081.129] wcscat (in: _Dest=0x7583260, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\") returned="C:\\Program Files\\Microsoft Office\\root\\" [0081.129] wcscat (in: _Dest=0x7583260, _Source="fre" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\fre") returned="C:\\Program Files\\Microsoft Office\\root\\fre" [0081.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7583260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b10 [0081.130] FindNextFileW (in: hFindFile=0x389ef40, lpFindFileData=0x5465c18 | out: lpFindFileData=0x5465c18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd1f5fb21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b2abe77, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2abe77, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1 [0081.130] wcscmp (_String1="Integration", _String2=".") returned 1 [0081.130] wcscmp (_String1="Integration", _String2="..") returned 1 [0081.130] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x5ba7b98 [0081.130] wcscpy (in: _Dest=0x5ba7b98, _Source="C:\\Program Files\\Microsoft Office\\root" | out: _Dest="C:\\Program Files\\Microsoft Office\\root") returned="C:\\Program Files\\Microsoft Office\\root" [0081.130] wcscat (in: _Dest=0x5ba7b98, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\") returned="C:\\Program Files\\Microsoft Office\\root\\" [0081.130] wcscat (in: _Dest=0x5ba7b98, _Source="Integration" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\Integration") returned="C:\\Program Files\\Microsoft Office\\root\\Integration" [0081.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba7b98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b14 [0081.131] FindNextFileW (in: hFindFile=0x389ef40, lpFindFileData=0x5465c18 | out: lpFindFileData=0x5465c18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2687c83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee308135, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Licenses16", cAlternateFileName="LICENS~1")) returned 1 [0081.131] wcscmp (_String1="Licenses16", _String2=".") returned 1 [0081.131] wcscmp (_String1="Licenses16", _String2="..") returned 1 [0081.131] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x5ba72d8 [0081.131] wcscpy (in: _Dest=0x5ba72d8, _Source="C:\\Program Files\\Microsoft Office\\root" | out: _Dest="C:\\Program Files\\Microsoft Office\\root") returned="C:\\Program Files\\Microsoft Office\\root" [0081.131] wcscat (in: _Dest=0x5ba72d8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\") returned="C:\\Program Files\\Microsoft Office\\root\\" [0081.131] wcscat (in: _Dest=0x5ba72d8, _Source="Licenses16" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\Licenses16") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16" [0081.131] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba72d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b18 [0081.132] FindNextFileW (in: hFindFile=0x389ef40, lpFindFileData=0x5465c18 | out: lpFindFileData=0x5465c18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee45f66d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x983c2c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="loc", cAlternateFileName="")) returned 1 [0081.132] wcscmp (_String1="loc", _String2=".") returned 1 [0081.132] wcscmp (_String1="loc", _String2="..") returned 1 [0081.132] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x75833e0 [0081.132] wcscpy (in: _Dest=0x75833e0, _Source="C:\\Program Files\\Microsoft Office\\root" | out: _Dest="C:\\Program Files\\Microsoft Office\\root") returned="C:\\Program Files\\Microsoft Office\\root" [0081.132] wcscat (in: _Dest=0x75833e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\") returned="C:\\Program Files\\Microsoft Office\\root\\" [0081.132] wcscat (in: _Dest=0x75833e0, _Source="loc" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\loc") returned="C:\\Program Files\\Microsoft Office\\root\\loc" [0081.132] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x75833e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b1c [0081.133] FindNextFileW (in: hFindFile=0x389ef40, lpFindFileData=0x5465c18 | out: lpFindFileData=0x5465c18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mcxml", cAlternateFileName="")) returned 1 [0081.133] wcscmp (_String1="mcxml", _String2=".") returned 1 [0081.133] wcscmp (_String1="mcxml", _String2="..") returned 1 [0081.133] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x6e96660 [0081.133] wcscpy (in: _Dest=0x6e96660, _Source="C:\\Program Files\\Microsoft Office\\root" | out: _Dest="C:\\Program Files\\Microsoft Office\\root") returned="C:\\Program Files\\Microsoft Office\\root" [0081.133] wcscat (in: _Dest=0x6e96660, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\") returned="C:\\Program Files\\Microsoft Office\\root\\" [0081.133] wcscat (in: _Dest=0x6e96660, _Source="mcxml" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\mcxml") returned="C:\\Program Files\\Microsoft Office\\root\\mcxml" [0081.133] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x6e96660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b20 [0081.134] FindNextFileW (in: hFindFile=0x389ef40, lpFindFileData=0x5465c18 | out: lpFindFileData=0x5465c18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office16", cAlternateFileName="")) returned 1 [0081.134] wcscmp (_String1="Office16", _String2=".") returned 1 [0081.134] wcscmp (_String1="Office16", _String2="..") returned 1 [0081.134] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x6e966c8 [0081.134] wcscpy (in: _Dest=0x6e966c8, _Source="C:\\Program Files\\Microsoft Office\\root" | out: _Dest="C:\\Program Files\\Microsoft Office\\root") returned="C:\\Program Files\\Microsoft Office\\root" [0081.134] wcscat (in: _Dest=0x6e966c8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\") returned="C:\\Program Files\\Microsoft Office\\root\\" [0081.134] wcscat (in: _Dest=0x6e966c8, _Source="Office16" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\Office16") returned="C:\\Program Files\\Microsoft Office\\root\\Office16" [0081.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x6e966c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b24 [0081.135] FindNextFileW (in: hFindFile=0x389ef40, lpFindFileData=0x5465c18 | out: lpFindFileData=0x5465c18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8396fbd3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b1a0d3d, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b1a0d3d, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rsod", cAlternateFileName="")) returned 1 [0081.135] wcscmp (_String1="rsod", _String2=".") returned 1 [0081.135] wcscmp (_String1="rsod", _String2="..") returned 1 [0081.135] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x75832c0 [0081.135] wcscpy (in: _Dest=0x75832c0, _Source="C:\\Program Files\\Microsoft Office\\root" | out: _Dest="C:\\Program Files\\Microsoft Office\\root") returned="C:\\Program Files\\Microsoft Office\\root" [0081.135] wcscat (in: _Dest=0x75832c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\") returned="C:\\Program Files\\Microsoft Office\\root\\" [0081.135] wcscat (in: _Dest=0x75832c0, _Source="rsod" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\rsod") returned="C:\\Program Files\\Microsoft Office\\root\\rsod" [0081.135] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x75832c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b28 [0081.135] FindNextFileW (in: hFindFile=0x389ef40, lpFindFileData=0x5465c18 | out: lpFindFileData=0x5465c18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb48c20e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb48c20e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0081.135] wcscmp (_String1="Stationery", _String2=".") returned 1 [0081.135] wcscmp (_String1="Stationery", _String2="..") returned 1 [0081.135] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x5ba76c8 [0081.135] wcscpy (in: _Dest=0x5ba76c8, _Source="C:\\Program Files\\Microsoft Office\\root" | out: _Dest="C:\\Program Files\\Microsoft Office\\root") returned="C:\\Program Files\\Microsoft Office\\root" [0081.135] wcscat (in: _Dest=0x5ba76c8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\") returned="C:\\Program Files\\Microsoft Office\\root\\" [0081.136] wcscat (in: _Dest=0x5ba76c8, _Source="Stationery" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\Stationery") returned="C:\\Program Files\\Microsoft Office\\root\\Stationery" [0081.136] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba76c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b2c [0081.136] FindNextFileW (in: hFindFile=0x389ef40, lpFindFileData=0x5465c18 | out: lpFindFileData=0x5465c18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0081.136] wcscmp (_String1="Templates", _String2=".") returned 1 [0081.136] wcscmp (_String1="Templates", _String2="..") returned 1 [0081.136] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x5ba78f8 [0081.136] wcscpy (in: _Dest=0x5ba78f8, _Source="C:\\Program Files\\Microsoft Office\\root" | out: _Dest="C:\\Program Files\\Microsoft Office\\root") returned="C:\\Program Files\\Microsoft Office\\root" [0081.136] wcscat (in: _Dest=0x5ba78f8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\") returned="C:\\Program Files\\Microsoft Office\\root\\" [0081.136] wcscat (in: _Dest=0x5ba78f8, _Source="Templates" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\Templates") returned="C:\\Program Files\\Microsoft Office\\root\\Templates" [0081.136] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba78f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b30 [0081.137] FindNextFileW (in: hFindFile=0x389ef40, lpFindFileData=0x5465c18 | out: lpFindFileData=0x5465c18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VFS", cAlternateFileName="")) returned 1 [0081.137] wcscmp (_String1="VFS", _String2=".") returned 1 [0081.137] wcscmp (_String1="VFS", _String2="..") returned 1 [0081.137] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x7583c20 [0081.137] wcscpy (in: _Dest=0x7583c20, _Source="C:\\Program Files\\Microsoft Office\\root" | out: _Dest="C:\\Program Files\\Microsoft Office\\root") returned="C:\\Program Files\\Microsoft Office\\root" [0081.137] wcscat (in: _Dest=0x7583c20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\") returned="C:\\Program Files\\Microsoft Office\\root\\" [0081.137] wcscat (in: _Dest=0x7583c20, _Source="VFS" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\VFS") returned="C:\\Program Files\\Microsoft Office\\root\\VFS" [0081.137] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7583c20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b34 [0081.138] FindNextFileW (in: hFindFile=0x389ef40, lpFindFileData=0x5465c18 | out: lpFindFileData=0x5465c18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VFS", cAlternateFileName="")) returned 0 [0081.138] FindClose (in: hFindFile=0x389ef40 | out: hFindFile=0x389ef40) returned 1 [0081.138] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5465c18) returned 1 [0081.138] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b6128) returned 1 [0081.138] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54288c8) returned 1 Thread: id = 285 os_tid = 0x1448 [0071.951] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 0x20 [0076.916] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0076.928] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1198 [0076.928] GetFileSizeEx (in: hFile=0x1198, lpFileSize=0xdbff758 | out: lpFileSize=0xdbff758*=69632) returned 1 [0076.928] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.931] ReadFile (in: hFile=0x1198, lpBuffer=0xdbff6dc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xdbff6d8, lpOverlapped=0x0 | out: lpBuffer=0xdbff6dc*, lpNumberOfBytesRead=0xdbff6d8*=0x4, lpOverlapped=0x0) returned 1 [0076.936] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.936] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ea0 [0076.936] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a52b0 [0076.936] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4e00 [0076.936] NtQuerySystemTime (in: CurrentTime=0xdbff6b8 | out: CurrentTime=0xdbff6b8*=132260136340907223) returned 0x0 [0076.936] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0xf29b8234 [0076.936] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0x94ba3110 [0076.936] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0xa5ec0a0d [0076.936] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0x31d7269c [0076.936] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0xeb642980 [0076.936] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0xfbdc84ab [0076.936] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0xbdc40143 [0076.936] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0x8bc1a788 [0076.936] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0x83e7a857 [0076.936] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0x3bfbfce9 [0076.936] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0xc379b11a [0076.936] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0x189a9bab [0076.936] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0x828669fe [0076.936] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0xe2cc49de [0076.936] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0xeae2e2bb [0076.936] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0xd51d6d83 [0076.936] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0xe2a06168 [0076.936] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0xfae42564 [0076.936] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0x27997ee1 [0076.936] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0x66573321 [0076.936] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0x835db94b [0076.936] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0xd69d9d92 [0076.936] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0xdcf1d2b0 [0076.936] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0x9ed3cf4a [0076.936] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0x863eb331 [0076.936] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0x66d9f002 [0076.937] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0x997a4e81 [0076.937] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0x564221a6 [0076.937] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0x8a5a66aa [0076.937] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0xe4b02e37 [0076.937] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0x88a2c722 [0076.937] RtlRandom (in: Seed=0xdbff6c4 | out: Seed=0xdbff6c4) returned 0x7981d871 [0076.946] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.946] ReadFile (in: hFile=0x1198, lpBuffer=0x547d7c0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xdbff698, lpOverlapped=0x0 | out: lpBuffer=0x547d7c0*, lpNumberOfBytesRead=0xdbff698*=0xc800, lpOverlapped=0x0) returned 1 [0076.947] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.947] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5890 [0076.947] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x54970e8 [0076.947] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4e00 [0076.947] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e00) returned 1 [0076.948] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5489fc8 [0076.948] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4f68 [0076.948] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5030 [0076.949] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5030) returned 1 [0076.949] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54970e8) returned 1 [0076.949] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5890) returned 1 [0076.949] WriteFile (in: hFile=0x1198, lpBuffer=0x5489fc8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xdbff698, lpOverlapped=0x0 | out: lpBuffer=0x5489fc8*, lpNumberOfBytesWritten=0xdbff698*=0xc800, lpOverlapped=0x0) returned 1 [0076.952] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5489fc8) returned 1 [0076.952] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x547d7c0) returned 1 [0076.952] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6b) returned 0x54970e8 [0076.952] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.952] WriteFile (in: hFile=0x1198, lpBuffer=0x54a2b30*, nNumberOfBytesToWrite=0x14f, lpNumberOfBytesWritten=0xdbff718, lpOverlapped=0x0 | out: lpBuffer=0x54a2b30*, lpNumberOfBytesWritten=0xdbff718*=0x14f, lpOverlapped=0x0) returned 1 [0076.954] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a2b30) returned 1 [0076.954] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496a58) returned 1 [0076.954] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e00) returned 1 [0076.954] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54970e8) returned 1 [0076.954] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4f68) returned 1 [0076.954] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a52b0) returned 1 [0076.954] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5210) returned 1 [0076.954] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e50) returned 1 [0076.954] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x38a1ee0 [0076.954] wcscpy (in: _Dest=0x38a1ee0, _Source="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" [0076.954] wcscat (in: _Dest=0x38a1ee0, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70" [0076.954] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0xdbff6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.954] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x3972340 Thread: id = 286 os_tid = 0x144c [0071.952] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 0x20 [0077.058] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0077.059] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x11c4 [0077.059] GetFileSizeEx (in: hFile=0x11c4, lpFileSize=0xdc7fbd4 | out: lpFileSize=0xdc7fbd4*=69632) returned 1 [0077.060] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.060] ReadFile (in: hFile=0x11c4, lpBuffer=0xdc7fb58, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xdc7fb54, lpOverlapped=0x0 | out: lpBuffer=0xdc7fb58*, lpNumberOfBytesRead=0xdc7fb54*=0x4, lpOverlapped=0x0) returned 1 [0077.061] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.061] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4e78 [0077.061] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ea0 [0077.061] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ec8 [0077.061] NtQuerySystemTime (in: CurrentTime=0xdc7fb34 | out: CurrentTime=0xdc7fb34*=132260136342147826) returned 0x0 [0077.061] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0x352ec0f1 [0077.061] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0xbe516698 [0077.061] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0x3634a18b [0077.061] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0x4809bad5 [0077.061] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0x58b3dc30 [0077.061] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0xb7bc191 [0077.061] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0x5f117eb [0077.061] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0x4ad444b7 [0077.061] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0xa6c3acc1 [0077.061] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0x7d6784f7 [0077.061] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0x19b0fbb1 [0077.061] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0x12050df7 [0077.061] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0x4076e8da [0077.061] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0xd96fbcda [0077.061] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0x955e7e93 [0077.061] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0x698f755e [0077.061] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0x3c57856f [0077.062] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0xc436f3df [0077.062] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0xfc91eef9 [0077.062] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0xa4a6bea0 [0077.062] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0xce1dc0be [0077.062] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0x431059ef [0077.062] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0x7e70037c [0077.062] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0x6da55382 [0077.062] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0xaed3b955 [0077.062] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0x4d4add30 [0077.062] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0xd6a9c333 [0077.062] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0x689b8a97 [0077.062] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0x221d51ec [0077.062] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0x43b49641 [0077.062] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0x812dce3c [0077.062] RtlRandom (in: Seed=0xdc7fb40 | out: Seed=0xdc7fb40) returned 0xb8707f07 [0077.072] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.072] ReadFile (in: hFile=0x11c4, lpBuffer=0x557f888, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xdc7fb14, lpOverlapped=0x0 | out: lpBuffer=0x557f888*, lpNumberOfBytesRead=0xdc7fb14*=0xc800, lpOverlapped=0x0) returned 1 [0077.073] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.073] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0077.073] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0077.073] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4fb8 [0077.073] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4fb8) returned 1 [0077.074] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x558c090 [0077.075] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4e78 [0077.075] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ec8 [0077.075] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4ec8) returned 1 [0077.075] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0077.075] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0077.076] WriteFile (in: hFile=0x11c4, lpBuffer=0x558c090*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xdc7fb14, lpOverlapped=0x0 | out: lpBuffer=0x558c090*, lpNumberOfBytesWritten=0xdc7fb14*=0xc800, lpOverlapped=0x0) returned 1 [0077.077] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x558c090) returned 1 [0077.078] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x557f888) returned 1 [0077.078] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x73) returned 0x38d09a0 [0077.078] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.078] WriteFile (in: hFile=0x11c4, lpBuffer=0x54a2b30*, nNumberOfBytesToWrite=0x157, lpNumberOfBytesWritten=0xdc7fb94, lpOverlapped=0x0 | out: lpBuffer=0x54a2b30*, lpNumberOfBytesWritten=0xdc7fb94*=0x157, lpOverlapped=0x0) returned 1 [0077.080] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a2b30) returned 1 [0077.080] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38d0d20) returned 1 [0077.080] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4ec8) returned 1 [0077.080] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38d09a0) returned 1 [0077.080] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e78) returned 1 [0077.081] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4ea0) returned 1 [0077.081] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4ef0) returned 1 [0077.081] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4f68) returned 1 [0077.081] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb8) returned 0x3905e60 [0077.081] wcscpy (in: _Dest=0x3905e60, _Source="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" [0077.081] wcscat (in: _Dest=0x3905e60, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.mailto[knoocknoo@cock.li].a0a70" [0077.081] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0xdc7fb4c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.081] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x389e128 Thread: id = 287 os_tid = 0x1450 [0071.952] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 0x20 [0076.911] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0076.913] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1194 [0076.914] GetFileSizeEx (in: hFile=0x1194, lpFileSize=0xdcffa0c | out: lpFileSize=0xdcffa0c*=69632) returned 1 [0076.914] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.914] ReadFile (in: hFile=0x1194, lpBuffer=0xdcff990, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xdcff98c, lpOverlapped=0x0 | out: lpBuffer=0xdcff990*, lpNumberOfBytesRead=0xdcff98c*=0x4, lpOverlapped=0x0) returned 1 [0076.917] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.917] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5210 [0076.917] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a52b0 [0076.917] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ea0 [0076.917] NtQuerySystemTime (in: CurrentTime=0xdcff96c | out: CurrentTime=0xdcff96c*=132260136340741749) returned 0x0 [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0x5818b825 [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0x1870e592 [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0x9b34fe61 [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0x1fdfff96 [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0x12baa77b [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0x7ebfbf43 [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0xdf8e2b6 [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0x3eb3f9e7 [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0x3355e924 [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0x96908610 [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0x430e4134 [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0x954d525c [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0x4351bf03 [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0x325d0b80 [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0x2b53f599 [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0x77ec4e98 [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0x50e0b32f [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0x6ec14a90 [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0x7cc2db9b [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0xa2874c11 [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0x8689e5fe [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0x234129e5 [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0x7c5ab4e4 [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0x745f85fa [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0xb011a565 [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0xd5db1ba1 [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0xac13b532 [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0x77fa0767 [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0x72b52067 [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0xc2092202 [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0xc0dc41b6 [0076.917] RtlRandom (in: Seed=0xdcff978 | out: Seed=0xdcff978) returned 0x43fd3c8b [0076.927] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.927] ReadFile (in: hFile=0x1194, lpBuffer=0x547d7c0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xdcff94c, lpOverlapped=0x0 | out: lpBuffer=0x547d7c0*, lpNumberOfBytesRead=0xdcff94c*=0xc800, lpOverlapped=0x0) returned 1 [0076.928] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0076.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0076.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4f68 [0076.929] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4f68) returned 1 [0076.929] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5489fc8 [0076.930] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5210 [0076.930] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4e78 [0076.930] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e78) returned 1 [0076.930] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.930] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0076.930] WriteFile (in: hFile=0x1194, lpBuffer=0x5489fc8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xdcff94c, lpOverlapped=0x0 | out: lpBuffer=0x5489fc8*, lpNumberOfBytesWritten=0xdcff94c*=0xc800, lpOverlapped=0x0) returned 1 [0076.932] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5489fc8) returned 1 [0076.932] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x547d7c0) returned 1 [0076.932] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6f) returned 0x5496b48 [0076.932] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.932] WriteFile (in: hFile=0x1194, lpBuffer=0x54a2b30*, nNumberOfBytesToWrite=0x153, lpNumberOfBytesWritten=0xdcff9cc, lpOverlapped=0x0 | out: lpBuffer=0x54a2b30*, lpNumberOfBytesWritten=0xdcff9cc*=0x153, lpOverlapped=0x0) returned 1 [0076.934] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a2b30) returned 1 [0076.934] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496d28) returned 1 [0076.934] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e78) returned 1 [0076.934] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496b48) returned 1 [0076.934] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5210) returned 1 [0076.934] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a52b0) returned 1 [0076.934] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e00) returned 1 [0076.934] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e50) returned 1 [0076.934] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb4) returned 0x3905860 [0076.934] wcscpy (in: _Dest=0x3905860, _Source="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" [0076.935] wcscat (in: _Dest=0x3905860, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70" [0076.935] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0xdcff984, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.935] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xca) returned 0x39745b8 Thread: id = 288 os_tid = 0x1454 [0071.953] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 0x20 [0076.876] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0076.893] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1190 [0076.893] GetFileSizeEx (in: hFile=0x1190, lpFileSize=0xdd7f914 | out: lpFileSize=0xdd7f914*=69632) returned 1 [0076.893] SetFilePointerEx (in: hFile=0x1190, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.893] ReadFile (in: hFile=0x1190, lpBuffer=0xdd7f898, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xdd7f894, lpOverlapped=0x0 | out: lpBuffer=0xdd7f898*, lpNumberOfBytesRead=0xdd7f894*=0x4, lpOverlapped=0x0) returned 1 [0076.897] SetFilePointerEx (in: hFile=0x1190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.897] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a52b0 [0076.897] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4e00 [0076.897] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ea0 [0076.897] NtQuerySystemTime (in: CurrentTime=0xdd7f874 | out: CurrentTime=0xdd7f874*=132260136340585256) returned 0x0 [0076.897] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0xbebc175b [0076.897] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0x1ddb74b6 [0076.897] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0xb46591f1 [0076.897] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0x1100ff32 [0076.897] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0x8abee91a [0076.897] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0x459fa092 [0076.897] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0x93f407aa [0076.897] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0xcde62a24 [0076.897] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0x70f9fe3b [0076.897] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0xf90e5b4c [0076.897] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0x7baf3c77 [0076.897] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0x7a19ea4 [0076.897] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0xda58d369 [0076.897] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0xc77e842 [0076.897] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0xcc165e4f [0076.897] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0x94741df4 [0076.897] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0x5df3e66b [0076.897] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0x244f3d81 [0076.897] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0x51c832d8 [0076.897] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0x42ca659 [0076.897] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0xa4b47b6f [0076.897] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0xaa8b80b7 [0076.897] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0xd412eb61 [0076.897] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0x87d0587b [0076.897] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0xebdf6ef [0076.897] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0xe43a1120 [0076.897] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0xf3bfe9 [0076.897] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0xb371dd3d [0076.897] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0x62790768 [0076.897] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0x41eed89a [0076.897] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0x8c843d51 [0076.898] RtlRandom (in: Seed=0xdd7f880 | out: Seed=0xdd7f880) returned 0x8e4f789e [0076.906] SetFilePointerEx (in: hFile=0x1190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.906] ReadFile (in: hFile=0x1190, lpBuffer=0x547d7c0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xdd7f854, lpOverlapped=0x0 | out: lpBuffer=0x547d7c0*, lpNumberOfBytesRead=0xdd7f854*=0xc800, lpOverlapped=0x0) returned 1 [0076.909] SetFilePointerEx (in: hFile=0x1190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.909] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0076.909] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0076.909] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4f68 [0076.909] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4f68) returned 1 [0076.910] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5489fc8 [0076.910] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5210 [0076.910] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a52b0 [0076.910] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a52b0) returned 1 [0076.910] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.910] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0076.910] WriteFile (in: hFile=0x1190, lpBuffer=0x5489fc8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xdd7f854, lpOverlapped=0x0 | out: lpBuffer=0x5489fc8*, lpNumberOfBytesWritten=0xdd7f854*=0xc800, lpOverlapped=0x0) returned 1 [0076.912] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5489fc8) returned 1 [0076.912] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x547d7c0) returned 1 [0076.912] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6b) returned 0x5496b48 [0076.912] SetFilePointerEx (in: hFile=0x1190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.912] WriteFile (in: hFile=0x1190, lpBuffer=0x54a2b30*, nNumberOfBytesToWrite=0x14f, lpNumberOfBytesWritten=0xdd7f8d4, lpOverlapped=0x0 | out: lpBuffer=0x54a2b30*, lpNumberOfBytesWritten=0xdd7f8d4*=0x14f, lpOverlapped=0x0) returned 1 [0076.914] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a2b30) returned 1 [0076.915] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496d28) returned 1 [0076.915] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e78) returned 1 [0076.915] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496b48) returned 1 [0076.915] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5210) returned 1 [0076.915] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e00) returned 1 [0076.915] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e50) returned 1 [0076.915] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4ef0) returned 1 [0076.915] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x38a1588 [0076.915] wcscpy (in: _Dest=0x38a1588, _Source="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" [0076.915] wcscat (in: _Dest=0x38a1588, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70" [0076.915] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0xdd7f88c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.915] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x39725b0 Thread: id = 289 os_tid = 0x1458 [0071.953] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 0x20 [0077.030] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0077.036] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x11bc [0077.036] GetFileSizeEx (in: hFile=0x11bc, lpFileSize=0xddff7e0 | out: lpFileSize=0xddff7e0*=69632) returned 1 [0077.039] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.041] ReadFile (in: hFile=0x11bc, lpBuffer=0xddff764, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xddff760, lpOverlapped=0x0 | out: lpBuffer=0xddff764*, lpNumberOfBytesRead=0xddff760*=0x4, lpOverlapped=0x0) returned 1 [0077.044] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.044] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5210 [0077.044] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a52b0 [0077.044] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ea0 [0077.044] NtQuerySystemTime (in: CurrentTime=0xddff740 | out: CurrentTime=0xddff740*=132260136341991542) returned 0x0 [0077.044] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0x45549856 [0077.044] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0xcf905a06 [0077.044] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0x1f243490 [0077.044] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0x2d88c7d1 [0077.044] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0x72521daa [0077.044] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0x4ad48357 [0077.044] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0xb5e9e0ec [0077.044] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0x338423c8 [0077.044] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0xeed0a3da [0077.044] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0x3ecc6ea7 [0077.044] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0xf9d9b4c0 [0077.044] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0x544727b4 [0077.044] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0x5857ea96 [0077.044] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0x97411944 [0077.044] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0x6f3b77cb [0077.044] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0xd4449f0d [0077.044] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0xf52a775e [0077.044] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0x6f06070a [0077.044] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0x23a082d3 [0077.044] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0xe25badf4 [0077.044] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0x63d39c19 [0077.044] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0xe19604dc [0077.044] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0x5eb64833 [0077.044] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0x414d7c9a [0077.044] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0x67b5b4e7 [0077.044] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0x89567f26 [0077.044] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0x36d6ac9d [0077.044] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0x1b379e60 [0077.044] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0x9de60ff1 [0077.044] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0x4d094d28 [0077.045] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0xcbf27d1 [0077.045] RtlRandom (in: Seed=0xddff74c | out: Seed=0xddff74c) returned 0x26debe08 [0077.054] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.054] ReadFile (in: hFile=0x11bc, lpBuffer=0x547d7c0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xddff720, lpOverlapped=0x0 | out: lpBuffer=0x547d7c0*, lpNumberOfBytesRead=0xddff720*=0xc800, lpOverlapped=0x0) returned 1 [0077.055] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.055] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0077.055] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0077.055] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4f68 [0077.055] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4f68) returned 1 [0077.056] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5489fc8 [0077.056] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5210 [0077.056] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4e78 [0077.056] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e78) returned 1 [0077.056] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0077.056] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0077.056] WriteFile (in: hFile=0x11bc, lpBuffer=0x5489fc8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xddff720, lpOverlapped=0x0 | out: lpBuffer=0x5489fc8*, lpNumberOfBytesWritten=0xddff720*=0xc800, lpOverlapped=0x0) returned 1 [0081.206] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5489fc8) returned 1 [0091.760] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x547d7c0) returned 1 [0091.760] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6f) returned 0x766d460 [0091.760] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.760] WriteFile (hFile=0x11bc, lpBuffer=0x54060e8, nNumberOfBytesToWrite=0x153, lpNumberOfBytesWritten=0xddff7a0, lpOverlapped=0x0) Thread: id = 290 os_tid = 0x145c [0071.954] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 0x20 [0077.006] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx", dwFileAttributes=0x20) returned 1 [0077.010] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x11b4 [0077.010] GetFileSizeEx (in: hFile=0x11b4, lpFileSize=0xde7faa0 | out: lpFileSize=0xde7faa0*=1052672) returned 1 [0077.010] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x100ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.010] ReadFile (in: hFile=0x11b4, lpBuffer=0xde7fa24, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xde7fa20, lpOverlapped=0x0 | out: lpBuffer=0xde7fa24*, lpNumberOfBytesRead=0xde7fa20*=0x4, lpOverlapped=0x0) returned 1 [0077.015] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.015] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5210 [0077.015] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a52b0 [0077.015] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ea0 [0077.015] NtQuerySystemTime (in: CurrentTime=0xde7fa00 | out: CurrentTime=0xde7fa00*=132260136341679124) returned 0x0 [0077.015] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0x28e24d71 [0077.015] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0xc0314231 [0077.015] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0x80ecd6f8 [0077.015] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0x95a6964d [0077.015] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0xbcfeb698 [0077.015] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0xc82ce7f2 [0077.015] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0x9620636 [0077.015] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0x1447a634 [0077.015] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0xc4ed3ef6 [0077.015] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0xe2325412 [0077.015] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0x9bfab3e3 [0077.015] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0x126c3133 [0077.015] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0x2d029260 [0077.015] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0x549b6d6a [0077.015] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0x8233618f [0077.015] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0xe5d0510e [0077.015] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0xab2f56a5 [0077.015] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0x4782045a [0077.015] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0x86abc9d3 [0077.015] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0xc9429fbe [0077.015] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0x9d8060d9 [0077.015] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0x3b2c55d0 [0077.015] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0x6868392b [0077.016] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0x18d77ee3 [0077.016] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0xe95d9592 [0077.016] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0x8417b1bf [0077.016] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0xa4016d00 [0077.016] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0xbc09e4b1 [0077.016] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0xe0227698 [0077.016] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0x7a534de8 [0077.016] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0xdd7659af [0077.016] RtlRandom (in: Seed=0xde7fa0c | out: Seed=0xde7fa0c) returned 0xabfbed64 [0077.025] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.025] ReadFile (in: hFile=0x11b4, lpBuffer=0x547d7c0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xde7f9b8, lpOverlapped=0x0 | out: lpBuffer=0x547d7c0*, lpNumberOfBytesRead=0xde7f9b8*=0xc800, lpOverlapped=0x0) returned 1 [0077.026] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.026] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0077.026] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0077.026] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4f68 [0077.027] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4f68) returned 1 [0077.027] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5489fc8 [0077.028] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5210 [0077.028] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4e78 [0077.028] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e78) returned 1 [0077.028] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0077.028] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0077.028] WriteFile (in: hFile=0x11b4, lpBuffer=0x5489fc8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xde7f9b8, lpOverlapped=0x0 | out: lpBuffer=0x5489fc8*, lpNumberOfBytesWritten=0xde7f9b8*=0xc800, lpOverlapped=0x0) returned 1 [0077.031] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5489fc8) returned 1 [0077.031] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x89800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.031] ReadFile (in: hFile=0x11b4, lpBuffer=0x547d7c0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xde7f9b8, lpOverlapped=0x0 | out: lpBuffer=0x547d7c0*, lpNumberOfBytesRead=0xde7f9b8*=0xc800, lpOverlapped=0x0) returned 1 [0077.032] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x89800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.032] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5890 [0077.032] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5496e90 [0077.032] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4e78 [0077.032] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e78) returned 1 [0077.033] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5489fc8 [0077.034] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4e78 [0077.034] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4fb8 [0077.034] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4fb8) returned 1 [0077.034] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496e90) returned 1 [0077.034] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5890) returned 1 [0077.034] WriteFile (in: hFile=0x11b4, lpBuffer=0x5489fc8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xde7f9b8, lpOverlapped=0x0 | out: lpBuffer=0x5489fc8*, lpNumberOfBytesWritten=0xde7f9b8*=0xc800, lpOverlapped=0x0) returned 1 [0077.035] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5489fc8) returned 1 [0077.035] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0xf4800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.035] ReadFile (in: hFile=0x11b4, lpBuffer=0x547d7c0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xde7f9b8, lpOverlapped=0x0 | out: lpBuffer=0x547d7c0*, lpNumberOfBytesRead=0xde7f9b8*=0xc800, lpOverlapped=0x0) returned 1 [0077.037] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0xf4800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.037] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0077.037] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5496a58 [0077.037] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ea0 [0077.037] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4ea0) returned 1 [0077.038] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5489fc8 [0077.038] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ea0 [0077.038] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5058 [0077.038] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5058) returned 1 [0077.038] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496a58) returned 1 [0077.038] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0077.038] WriteFile (in: hFile=0x11b4, lpBuffer=0x5489fc8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xde7f9b8, lpOverlapped=0x0 | out: lpBuffer=0x5489fc8*, lpNumberOfBytesWritten=0xde7f9b8*=0xc800, lpOverlapped=0x0) returned 1 [0077.039] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5489fc8) returned 1 [0077.039] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x542ba70 [0077.039] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.039] WriteFile (in: hFile=0x11b4, lpBuffer=0x54a2b30*, nNumberOfBytesToWrite=0x191, lpNumberOfBytesWritten=0xde7fa60, lpOverlapped=0x0 | out: lpBuffer=0x54a2b30*, lpNumberOfBytesWritten=0xde7fa60*=0x191, lpOverlapped=0x0) returned 1 [0077.042] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a2b30) returned 1 [0077.042] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0077.042] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5030) returned 1 [0077.042] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54970e8) returned 1 [0077.042] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542ba70) returned 1 [0077.042] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a52b0) returned 1 [0077.042] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e00) returned 1 [0077.042] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e50) returned 1 [0077.042] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb2) returned 0x3906160 [0077.042] wcscpy (in: _Dest=0x3906160, _Source="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" [0077.042] wcscat (in: _Dest=0x3906160, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.mailto[knoocknoo@cock.li].a0a70" [0077.042] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0xde7fa18, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.042] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x53f7130 Thread: id = 291 os_tid = 0x1460 [0071.954] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 0x20 [0076.859] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", dwFileAttributes=0x20) returned 1 [0076.870] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x118c [0076.871] GetFileSizeEx (in: hFile=0x118c, lpFileSize=0xdeff7e8 | out: lpFileSize=0xdeff7e8*=69632) returned 1 [0076.874] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.874] ReadFile (in: hFile=0x118c, lpBuffer=0xdeff76c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xdeff768, lpOverlapped=0x0 | out: lpBuffer=0xdeff76c*, lpNumberOfBytesRead=0xdeff768*=0x4, lpOverlapped=0x0) returned 1 [0076.878] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.878] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ea0 [0076.878] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ec8 [0076.878] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ef0 [0076.878] NtQuerySystemTime (in: CurrentTime=0xdeff748 | out: CurrentTime=0xdeff748*=132260136340429188) returned 0x0 [0076.878] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0x6d96544b [0076.878] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0x3273b383 [0076.878] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0x23d82bdb [0076.878] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0x6fd7cb71 [0076.878] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0x29c19647 [0076.879] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0x7ddb50ad [0076.879] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0x543f3e37 [0076.879] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0x4538b80d [0076.879] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0x214432ed [0076.879] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0x55f60162 [0076.879] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0x369f91f0 [0076.879] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0x8c55d108 [0076.879] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0x430c07b2 [0076.879] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0x64e38e63 [0076.879] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0x8d56195c [0076.879] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0x97bd7411 [0076.879] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0xdee873f1 [0076.879] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0xb371c88e [0076.879] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0x8ba18cec [0076.879] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0xc382a8f8 [0076.879] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0xaa66cb32 [0076.879] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0xdcd100f9 [0076.879] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0xbb5e4e17 [0076.879] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0xe185c499 [0076.879] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0xc7554566 [0076.879] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0x88fb7e05 [0076.879] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0xd8cd0b26 [0076.879] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0x31cc32ce [0076.879] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0x83366742 [0076.879] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0xafa23796 [0076.879] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0x6b60378a [0076.879] RtlRandom (in: Seed=0xdeff754 | out: Seed=0xdeff754) returned 0xd88d41f9 [0076.888] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.888] ReadFile (in: hFile=0x118c, lpBuffer=0x547d7c0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xdeff728, lpOverlapped=0x0 | out: lpBuffer=0x547d7c0*, lpNumberOfBytesRead=0xdeff728*=0xc800, lpOverlapped=0x0) returned 1 [0076.890] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.890] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0076.890] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0076.890] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4fe0 [0076.890] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4fe0) returned 1 [0076.891] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5489fc8 [0076.891] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5210 [0076.891] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a52b0 [0076.892] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a52b0) returned 1 [0076.892] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.892] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0076.892] WriteFile (in: hFile=0x118c, lpBuffer=0x5489fc8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xdeff728, lpOverlapped=0x0 | out: lpBuffer=0x5489fc8*, lpNumberOfBytesWritten=0xdeff728*=0xc800, lpOverlapped=0x0) returned 1 [0076.895] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5489fc8) returned 1 [0076.895] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x547d7c0) returned 1 [0076.895] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7d) returned 0x3977f68 [0076.895] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.895] WriteFile (in: hFile=0x118c, lpBuffer=0x54a2b30*, nNumberOfBytesToWrite=0x161, lpNumberOfBytesWritten=0xdeff7a8, lpOverlapped=0x0 | out: lpBuffer=0x54a2b30*, lpNumberOfBytesWritten=0xdeff7a8*=0x161, lpOverlapped=0x0) returned 1 [0076.907] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a2b30) returned 1 [0076.907] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3977ff0) returned 1 [0076.907] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e78) returned 1 [0076.907] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3977f68) returned 1 [0076.908] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5210) returned 1 [0076.908] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4ec8) returned 1 [0076.908] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4f68) returned 1 [0076.908] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4fb8) returned 1 [0076.908] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x3972270 [0076.908] wcscpy (in: _Dest=0x3972270, _Source="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" [0076.908] wcscat (in: _Dest=0x3972270, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.mailto[knoocknoo@cock.li].a0a70" [0076.908] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0xdeff760, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.908] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x3935448 Thread: id = 292 os_tid = 0x1464 [0071.955] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 0x20 [0076.976] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0076.987] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x11ac [0076.990] GetFileSizeEx (in: hFile=0x11ac, lpFileSize=0xdf7fce4 | out: lpFileSize=0xdf7fce4*=69632) returned 1 [0076.990] SetFilePointerEx (in: hFile=0x11ac, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.990] ReadFile (in: hFile=0x11ac, lpBuffer=0xdf7fc68, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xdf7fc64, lpOverlapped=0x0 | out: lpBuffer=0xdf7fc68*, lpNumberOfBytesRead=0xdf7fc64*=0x4, lpOverlapped=0x0) returned 1 [0076.995] SetFilePointerEx (in: hFile=0x11ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.995] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ea0 [0076.995] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a52b0 [0076.995] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4e00 [0076.995] NtQuerySystemTime (in: CurrentTime=0xdf7fc44 | out: CurrentTime=0xdf7fc44*=132260136341522998) returned 0x0 [0076.995] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0x7cc374a7 [0076.995] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0x27a9df52 [0076.995] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0xa1f5f4dc [0076.995] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0xc26a4eaf [0076.995] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0x9daa8252 [0076.995] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0xfd0e4898 [0076.995] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0x94a883e2 [0076.995] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0x3a7ac74e [0076.995] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0xfce4a60f [0076.995] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0x57cb027 [0076.995] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0x75ee4961 [0076.995] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0xa1d66ee [0076.995] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0x9c7f2128 [0076.996] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0xb4aeaf0d [0076.996] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0x87e9ef21 [0076.996] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0xce1adc8e [0076.996] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0x5ed5841e [0076.996] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0x415d039b [0076.996] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0x5a4aca3d [0076.996] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0x1052be4e [0076.996] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0x9dc1f6fc [0076.996] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0x2cd66dbf [0076.996] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0x31e708c1 [0076.996] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0xa5ab0b07 [0076.996] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0xd73db4ef [0076.996] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0x5697df69 [0076.996] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0x438edf49 [0076.996] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0x81790d50 [0076.996] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0x19733c61 [0076.996] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0xfbb50851 [0076.996] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0x16e9b5bb [0076.996] RtlRandom (in: Seed=0xdf7fc50 | out: Seed=0xdf7fc50) returned 0x7dbc3a13 [0077.005] SetFilePointerEx (in: hFile=0x11ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.005] ReadFile (in: hFile=0x11ac, lpBuffer=0x547d7c0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xdf7fc24, lpOverlapped=0x0 | out: lpBuffer=0x547d7c0*, lpNumberOfBytesRead=0xdf7fc24*=0xc800, lpOverlapped=0x0) returned 1 [0077.007] SetFilePointerEx (in: hFile=0x11ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.007] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5890 [0077.007] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x54970e8 [0077.007] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4e00 [0077.007] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e00) returned 1 [0077.008] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5489fc8 [0077.009] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4f68 [0077.009] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5030 [0077.009] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5030) returned 1 [0077.009] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54970e8) returned 1 [0077.009] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5890) returned 1 [0077.009] WriteFile (in: hFile=0x11ac, lpBuffer=0x5489fc8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xdf7fc24, lpOverlapped=0x0 | out: lpBuffer=0x5489fc8*, lpNumberOfBytesWritten=0xdf7fc24*=0xc800, lpOverlapped=0x0) returned 1 [0077.011] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5489fc8) returned 1 [0077.011] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x547d7c0) returned 1 [0077.011] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x77) returned 0x38d1020 [0077.011] SetFilePointerEx (in: hFile=0x11ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.011] WriteFile (in: hFile=0x11ac, lpBuffer=0x54a2b30*, nNumberOfBytesToWrite=0x15b, lpNumberOfBytesWritten=0xdf7fca4, lpOverlapped=0x0 | out: lpBuffer=0x54a2b30*, lpNumberOfBytesWritten=0xdf7fca4*=0x15b, lpOverlapped=0x0) returned 1 [0077.013] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a2b30) returned 1 [0077.013] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38d08a0) returned 1 [0077.013] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e00) returned 1 [0077.013] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38d1020) returned 1 [0077.013] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4f68) returned 1 [0077.013] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a52b0) returned 1 [0077.013] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5210) returned 1 [0077.013] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e50) returned 1 [0077.013] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x3975590 [0077.013] wcscpy (in: _Dest=0x3975590, _Source="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" [0077.013] wcscat (in: _Dest=0x3975590, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70" [0077.013] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0xdf7fc5c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.013] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x54b21b8 Thread: id = 293 os_tid = 0x1468 [0071.956] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8a) returned 0x38a71a0 [0071.956] wcscpy (in: _Dest=0x38a71a0, _Source="C:\\Program Files\\Windows Defender Advanced Threat Protection\\en-US" | out: _Dest="C:\\Program Files\\Windows Defender Advanced Threat Protection\\en-US") returned="C:\\Program Files\\Windows Defender Advanced Threat Protection\\en-US" [0071.956] wcscat (in: _Dest=0x38a71a0, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Defender Advanced Threat Protection\\en-US\\") returned="C:\\Program Files\\Windows Defender Advanced Threat Protection\\en-US\\" [0071.956] wcscat (in: _Dest=0x38a71a0, _Source="*" | out: _Dest="C:\\Program Files\\Windows Defender Advanced Threat Protection\\en-US\\*") returned="C:\\Program Files\\Windows Defender Advanced Threat Protection\\en-US\\*" [0071.956] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5461ff0 [0071.956] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender Advanced Threat Protection\\en-US\\*", lpFindFileData=0x5461ff0 | out: lpFindFileData=0x5461ff0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fde773, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54452c0 [0077.323] wcscmp (_String1=".", _String2=".") returned 0 [0077.323] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5461ff0 | out: lpFindFileData=0x5461ff0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fde773, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.323] wcscmp (_String1="..", _String2=".") returned 1 [0077.323] wcscmp (_String1="..", _String2="..") returned 0 [0077.323] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5461ff0 | out: lpFindFileData=0x5461ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea62ba2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x67afd900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsSense.exe.mui", cAlternateFileName="")) returned 1 [0077.323] wcscmp (_String1="MsSense.exe.mui", _String2=".") returned 1 [0077.323] wcscmp (_String1="MsSense.exe.mui", _String2="..") returned 1 [0077.323] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5461ff0 | out: lpFindFileData=0x5461ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea62ba2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x67afd900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsSense.exe.mui", cAlternateFileName="")) returned 0 [0077.323] FindClose (in: hFindFile=0x54452c0 | out: hFindFile=0x54452c0) returned 1 [0077.323] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5461ff0) returned 1 [0077.323] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a71a0) returned 1 [0077.323] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a95f8) returned 1 Thread: id = 294 os_tid = 0x146c [0071.956] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x5445580 [0071.956] wcscpy (in: _Dest=0x5445580, _Source="C:\\Users\\Default\\AppData" | out: _Dest="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0071.956] wcscat (in: _Dest=0x5445580, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\") returned="C:\\Users\\Default\\AppData\\" [0071.956] wcscat (in: _Dest=0x5445580, _Source="*" | out: _Dest="C:\\Users\\Default\\AppData\\*") returned="C:\\Users\\Default\\AppData\\*" [0071.956] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5462258 [0071.956] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\*", lpFindFileData=0x5462258 | out: lpFindFileData=0x5462258*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3aee4d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0082.344] wcscmp (_String1=".", _String2=".") returned 0 [0082.344] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5462258 | out: lpFindFileData=0x5462258*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3aee4d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.352] wcscmp (_String1="..", _String2=".") returned 1 [0082.352] wcscmp (_String1="..", _String2="..") returned 0 [0082.352] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5462258 | out: lpFindFileData=0x5462258*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0082.352] wcscmp (_String1="Local", _String2=".") returned 1 [0082.352] wcscmp (_String1="Local", _String2="..") returned 1 [0082.352] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3e) returned 0x5ba8060 [0082.352] wcscpy (in: _Dest=0x5ba8060, _Source="C:\\Users\\Default\\AppData" | out: _Dest="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0082.352] wcscat (in: _Dest=0x5ba8060, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\") returned="C:\\Users\\Default\\AppData\\" [0082.352] wcscat (in: _Dest=0x5ba8060, _Source="Local" | out: _Dest="C:\\Users\\Default\\AppData\\Local") returned="C:\\Users\\Default\\AppData\\Local" [0082.353] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba8060, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d8c [0082.353] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5462258 | out: lpFindFileData=0x5462258*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8c01f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0082.353] wcscmp (_String1="Roaming", _String2=".") returned 1 [0082.353] wcscmp (_String1="Roaming", _String2="..") returned 1 [0082.353] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x42) returned 0x397dd68 [0082.353] wcscpy (in: _Dest=0x397dd68, _Source="C:\\Users\\Default\\AppData" | out: _Dest="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0082.353] wcscat (in: _Dest=0x397dd68, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\") returned="C:\\Users\\Default\\AppData\\" [0082.353] wcscat (in: _Dest=0x397dd68, _Source="Roaming" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming") returned="C:\\Users\\Default\\AppData\\Roaming" [0082.353] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x397dd68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dac [0082.354] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5462258 | out: lpFindFileData=0x5462258*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8c01f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0082.354] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0082.354] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5462258) returned 1 [0082.354] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445580) returned 1 [0082.354] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445980) returned 1 Thread: id = 295 os_tid = 0x1470 [0071.959] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x5466af0 [0071.959] wcscpy (in: _Dest=0x5466af0, _Source="C:\\Users\\Default\\Application Data" | out: _Dest="C:\\Users\\Default\\Application Data") returned="C:\\Users\\Default\\Application Data" [0071.959] wcscat (in: _Dest=0x5466af0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Application Data\\") returned="C:\\Users\\Default\\Application Data\\" [0071.959] wcscat (in: _Dest=0x5466af0, _Source="*" | out: _Dest="C:\\Users\\Default\\Application Data\\*") returned="C:\\Users\\Default\\Application Data\\*" [0071.959] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54624c0 [0071.959] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Application Data\\*", lpFindFileData=0x54624c0 | out: lpFindFileData=0x54624c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.602] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54624c0) returned 1 [0074.603] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5466af0) returned 1 [0074.603] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5443140) returned 1 Thread: id = 296 os_tid = 0x1474 [0071.960] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x54455c0 [0071.960] wcscpy (in: _Dest=0x54455c0, _Source="C:\\Users\\Default\\Cookies" | out: _Dest="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0071.960] wcscat (in: _Dest=0x54455c0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Cookies\\") returned="C:\\Users\\Default\\Cookies\\" [0071.960] wcscat (in: _Dest=0x54455c0, _Source="*" | out: _Dest="C:\\Users\\Default\\Cookies\\*") returned="C:\\Users\\Default\\Cookies\\*" [0071.960] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b5508 [0071.960] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Cookies\\*", lpFindFileData=0x53b5508 | out: lpFindFileData=0x53b5508*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.043] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b5508) returned 1 [0075.043] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54455c0) returned 1 [0075.043] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445440) returned 1 Thread: id = 297 os_tid = 0x1478 [0071.961] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x5445600 [0071.961] wcscpy (in: _Dest=0x5445600, _Source="C:\\Users\\Default\\Desktop" | out: _Dest="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0071.961] wcscat (in: _Dest=0x5445600, _Source="\\" | out: _Dest="C:\\Users\\Default\\Desktop\\") returned="C:\\Users\\Default\\Desktop\\" [0071.961] wcscat (in: _Dest=0x5445600, _Source="*" | out: _Dest="C:\\Users\\Default\\Desktop\\*") returned="C:\\Users\\Default\\Desktop\\*" [0071.961] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b18e0 [0071.961] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*", lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389eec0 [0076.327] wcscmp (_String1=".", _String2=".") returned 0 [0076.327] FindNextFileW (in: hFindFile=0x389eec0, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.327] wcscmp (_String1="..", _String2=".") returned 1 [0076.327] wcscmp (_String1="..", _String2="..") returned 0 [0076.327] FindNextFileW (in: hFindFile=0x389eec0, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.327] FindClose (in: hFindFile=0x389eec0 | out: hFindFile=0x389eec0) returned 1 [0076.327] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b18e0) returned 1 [0076.327] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445600) returned 1 [0076.327] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445a00) returned 1 Thread: id = 298 os_tid = 0x147c [0071.961] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x537bab8 [0071.961] wcscpy (in: _Dest=0x537bab8, _Source="C:\\Users\\Default\\Documents" | out: _Dest="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0071.961] wcscat (in: _Dest=0x537bab8, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0071.962] wcscat (in: _Dest=0x537bab8, _Source="*" | out: _Dest="C:\\Users\\Default\\Documents\\*") returned="C:\\Users\\Default\\Documents\\*" [0071.962] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5407900 [0071.962] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*", lpFindFileData=0x5407900 | out: lpFindFileData=0x5407900*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445800 [0082.344] wcscmp (_String1=".", _String2=".") returned 0 [0082.344] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x5407900 | out: lpFindFileData=0x5407900*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.344] wcscmp (_String1="..", _String2=".") returned 1 [0082.344] wcscmp (_String1="..", _String2="..") returned 0 [0082.344] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x5407900 | out: lpFindFileData=0x5407900*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0082.344] wcscmp (_String1="My Music", _String2=".") returned 1 [0082.344] wcscmp (_String1="My Music", _String2="..") returned 1 [0082.345] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x397dd18 [0082.345] wcscpy (in: _Dest=0x397dd18, _Source="C:\\Users\\Default\\Documents" | out: _Dest="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0082.345] wcscat (in: _Dest=0x397dd18, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0082.345] wcscat (in: _Dest=0x397dd18, _Source="My Music" | out: _Dest="C:\\Users\\Default\\Documents\\My Music") returned="C:\\Users\\Default\\Documents\\My Music" [0082.345] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x397dd18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1da0 [0082.345] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x5407900 | out: lpFindFileData=0x5407900*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0082.345] wcscmp (_String1="My Pictures", _String2=".") returned 1 [0082.345] wcscmp (_String1="My Pictures", _String2="..") returned 1 [0082.345] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x757ec30 [0082.346] wcscpy (in: _Dest=0x757ec30, _Source="C:\\Users\\Default\\Documents" | out: _Dest="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0082.346] wcscat (in: _Dest=0x757ec30, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0082.346] wcscat (in: _Dest=0x757ec30, _Source="My Pictures" | out: _Dest="C:\\Users\\Default\\Documents\\My Pictures") returned="C:\\Users\\Default\\Documents\\My Pictures" [0082.346] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x757ec30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1da4 [0082.346] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x5407900 | out: lpFindFileData=0x5407900*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0082.346] wcscmp (_String1="My Videos", _String2=".") returned 1 [0082.346] wcscmp (_String1="My Videos", _String2="..") returned 1 [0082.346] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x757e340 [0082.346] wcscpy (in: _Dest=0x757e340, _Source="C:\\Users\\Default\\Documents" | out: _Dest="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0082.346] wcscat (in: _Dest=0x757e340, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0082.346] wcscat (in: _Dest=0x757e340, _Source="My Videos" | out: _Dest="C:\\Users\\Default\\Documents\\My Videos") returned="C:\\Users\\Default\\Documents\\My Videos" [0082.346] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x757e340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1da8 [0082.350] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x5407900 | out: lpFindFileData=0x5407900*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0082.350] FindClose (in: hFindFile=0x5445800 | out: hFindFile=0x5445800) returned 1 [0082.351] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5407900) returned 1 [0082.351] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537bab8) returned 1 [0082.351] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445740) returned 1 Thread: id = 299 os_tid = 0x1480 [0071.963] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x537bb00 [0071.963] wcscpy (in: _Dest=0x537bb00, _Source="C:\\Users\\Default\\Downloads" | out: _Dest="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0071.963] wcscat (in: _Dest=0x537bb00, _Source="\\" | out: _Dest="C:\\Users\\Default\\Downloads\\") returned="C:\\Users\\Default\\Downloads\\" [0071.963] wcscat (in: _Dest=0x537bb00, _Source="*" | out: _Dest="C:\\Users\\Default\\Downloads\\*") returned="C:\\Users\\Default\\Downloads\\*" [0071.963] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d0a90 [0071.965] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*", lpFindFileData=0x53d0a90 | out: lpFindFileData=0x53d0a90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba12f0 [0079.758] wcscmp (_String1=".", _String2=".") returned 0 [0079.758] FindNextFileW (in: hFindFile=0x5ba12f0, lpFindFileData=0x53d0a90 | out: lpFindFileData=0x53d0a90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.758] wcscmp (_String1="..", _String2=".") returned 1 [0079.758] wcscmp (_String1="..", _String2="..") returned 0 [0079.758] FindNextFileW (in: hFindFile=0x5ba12f0, lpFindFileData=0x53d0a90 | out: lpFindFileData=0x53d0a90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0079.758] FindClose (in: hFindFile=0x5ba12f0 | out: hFindFile=0x5ba12f0) returned 1 [0079.759] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d0a90) returned 1 [0079.759] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537bb00) returned 1 [0079.759] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445380) returned 1 Thread: id = 300 os_tid = 0x1484 [0071.966] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x537bb48 [0071.966] wcscpy (in: _Dest=0x537bb48, _Source="C:\\Users\\Default\\Favorites" | out: _Dest="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0071.966] wcscat (in: _Dest=0x537bb48, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\") returned="C:\\Users\\Default\\Favorites\\" [0071.966] wcscat (in: _Dest=0x537bb48, _Source="*" | out: _Dest="C:\\Users\\Default\\Favorites\\*") returned="C:\\Users\\Default\\Favorites\\*" [0071.966] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53cedb0 [0071.966] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*", lpFindFileData=0x53cedb0 | out: lpFindFileData=0x53cedb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0082.342] wcscmp (_String1=".", _String2=".") returned 0 [0082.342] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53cedb0 | out: lpFindFileData=0x53cedb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.342] wcscmp (_String1="..", _String2=".") returned 1 [0082.342] wcscmp (_String1="..", _String2="..") returned 0 [0082.342] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53cedb0 | out: lpFindFileData=0x53cedb0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0082.342] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0082.342] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53cedb0) returned 1 [0082.342] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537bb48) returned 1 [0082.342] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445840) returned 1 Thread: id = 301 os_tid = 0x1488 [0071.968] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x32) returned 0x5445640 [0071.968] wcscpy (in: _Dest=0x5445640, _Source="C:\\Users\\Default\\Links" | out: _Dest="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0071.968] wcscat (in: _Dest=0x5445640, _Source="\\" | out: _Dest="C:\\Users\\Default\\Links\\") returned="C:\\Users\\Default\\Links\\" [0071.968] wcscat (in: _Dest=0x5445640, _Source="*" | out: _Dest="C:\\Users\\Default\\Links\\*") returned="C:\\Users\\Default\\Links\\*" [0071.968] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53cf018 [0071.968] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*", lpFindFileData=0x53cf018 | out: lpFindFileData=0x53cf018*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba12f0 [0079.760] wcscmp (_String1=".", _String2=".") returned 0 [0079.760] FindNextFileW (in: hFindFile=0x5ba12f0, lpFindFileData=0x53cf018 | out: lpFindFileData=0x53cf018*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.760] wcscmp (_String1="..", _String2=".") returned 1 [0079.761] wcscmp (_String1="..", _String2="..") returned 0 [0079.761] FindNextFileW (in: hFindFile=0x5ba12f0, lpFindFileData=0x53cf018 | out: lpFindFileData=0x53cf018*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0079.761] FindClose (in: hFindFile=0x5ba12f0 | out: hFindFile=0x5ba12f0) returned 1 [0079.761] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53cf018) returned 1 [0079.761] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445640) returned 1 [0079.761] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537c688) returned 1 Thread: id = 302 os_tid = 0x148c [0071.968] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x5466f50 [0071.968] wcscpy (in: _Dest=0x5466f50, _Source="C:\\Users\\Default\\Local Settings" | out: _Dest="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0071.968] wcscat (in: _Dest=0x5466f50, _Source="\\" | out: _Dest="C:\\Users\\Default\\Local Settings\\") returned="C:\\Users\\Default\\Local Settings\\" [0071.968] wcscat (in: _Dest=0x5466f50, _Source="*" | out: _Dest="C:\\Users\\Default\\Local Settings\\*") returned="C:\\Users\\Default\\Local Settings\\*" [0071.968] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53cf280 [0071.968] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Local Settings\\*", lpFindFileData=0x53cf280 | out: lpFindFileData=0x53cf280*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.605] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53cf280) returned 1 [0074.605] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5466f50) returned 1 [0074.605] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b2d8) returned 1 Thread: id = 303 os_tid = 0x1490 [0071.969] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x32) returned 0x5445680 [0071.969] wcscpy (in: _Dest=0x5445680, _Source="C:\\Users\\Default\\Music" | out: _Dest="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0071.969] wcscat (in: _Dest=0x5445680, _Source="\\" | out: _Dest="C:\\Users\\Default\\Music\\") returned="C:\\Users\\Default\\Music\\" [0071.969] wcscat (in: _Dest=0x5445680, _Source="*" | out: _Dest="C:\\Users\\Default\\Music\\*") returned="C:\\Users\\Default\\Music\\*" [0071.969] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53cf4e8 [0071.969] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*", lpFindFileData=0x53cf4e8 | out: lpFindFileData=0x53cf4e8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f40 [0082.340] wcscmp (_String1=".", _String2=".") returned 0 [0082.340] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x53cf4e8 | out: lpFindFileData=0x53cf4e8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.340] wcscmp (_String1="..", _String2=".") returned 1 [0082.340] wcscmp (_String1="..", _String2="..") returned 0 [0082.340] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x53cf4e8 | out: lpFindFileData=0x53cf4e8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0082.340] FindClose (in: hFindFile=0x5444f40 | out: hFindFile=0x5444f40) returned 1 [0082.341] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53cf4e8) returned 1 [0082.341] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445680) returned 1 [0082.341] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537c6c0) returned 1 Thread: id = 304 os_tid = 0x1494 [0071.970] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x537bb90 [0071.970] wcscpy (in: _Dest=0x537bb90, _Source="C:\\Users\\Default\\My Documents" | out: _Dest="C:\\Users\\Default\\My Documents") returned="C:\\Users\\Default\\My Documents" [0071.970] wcscat (in: _Dest=0x537bb90, _Source="\\" | out: _Dest="C:\\Users\\Default\\My Documents\\") returned="C:\\Users\\Default\\My Documents\\" [0071.970] wcscat (in: _Dest=0x537bb90, _Source="*" | out: _Dest="C:\\Users\\Default\\My Documents\\*") returned="C:\\Users\\Default\\My Documents\\*" [0071.970] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53cf750 [0071.970] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\My Documents\\*", lpFindFileData=0x53cf750 | out: lpFindFileData=0x53cf750*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.605] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53cf750) returned 1 [0074.605] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537bb90) returned 1 [0074.605] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b320) returned 1 Thread: id = 305 os_tid = 0x1498 [0071.971] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x5445780 [0071.971] wcscpy (in: _Dest=0x5445780, _Source="C:\\Users\\Default\\NetHood" | out: _Dest="C:\\Users\\Default\\NetHood") returned="C:\\Users\\Default\\NetHood" [0071.971] wcscat (in: _Dest=0x5445780, _Source="\\" | out: _Dest="C:\\Users\\Default\\NetHood\\") returned="C:\\Users\\Default\\NetHood\\" [0071.971] wcscat (in: _Dest=0x5445780, _Source="*" | out: _Dest="C:\\Users\\Default\\NetHood\\*") returned="C:\\Users\\Default\\NetHood\\*" [0071.971] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53cf9b8 [0071.971] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\NetHood\\*", lpFindFileData=0x53cf9b8 | out: lpFindFileData=0x53cf9b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.606] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53cf9b8) returned 1 [0074.606] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445780) returned 1 [0074.606] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445340) returned 1 Thread: id = 306 os_tid = 0x149c [0071.971] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x38) returned 0x5445800 [0071.971] wcscpy (in: _Dest=0x5445800, _Source="C:\\Users\\Default\\Pictures" | out: _Dest="C:\\Users\\Default\\Pictures") returned="C:\\Users\\Default\\Pictures" [0071.971] wcscat (in: _Dest=0x5445800, _Source="\\" | out: _Dest="C:\\Users\\Default\\Pictures\\") returned="C:\\Users\\Default\\Pictures\\" [0071.971] wcscat (in: _Dest=0x5445800, _Source="*" | out: _Dest="C:\\Users\\Default\\Pictures\\*") returned="C:\\Users\\Default\\Pictures\\*" [0071.971] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53cfc20 [0071.971] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*", lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f40 [0082.189] wcscmp (_String1=".", _String2=".") returned 0 [0082.189] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.189] wcscmp (_String1="..", _String2=".") returned 1 [0082.189] wcscmp (_String1="..", _String2="..") returned 0 [0082.189] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0082.189] FindClose (in: hFindFile=0x5444f40 | out: hFindFile=0x5444f40) returned 1 [0082.190] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53cfc20) returned 1 [0082.190] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445800) returned 1 [0082.190] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54456c0) returned 1 Thread: id = 307 os_tid = 0x14a0 [0071.972] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x537bd40 [0071.972] wcscpy (in: _Dest=0x537bd40, _Source="C:\\Users\\Default\\PrintHood" | out: _Dest="C:\\Users\\Default\\PrintHood") returned="C:\\Users\\Default\\PrintHood" [0071.972] wcscat (in: _Dest=0x537bd40, _Source="\\" | out: _Dest="C:\\Users\\Default\\PrintHood\\") returned="C:\\Users\\Default\\PrintHood\\" [0071.972] wcscat (in: _Dest=0x537bd40, _Source="*" | out: _Dest="C:\\Users\\Default\\PrintHood\\*") returned="C:\\Users\\Default\\PrintHood\\*" [0071.972] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d0cf8 [0071.972] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\PrintHood\\*", lpFindFileData=0x53d0cf8 | out: lpFindFileData=0x53d0cf8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.607] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d0cf8) returned 1 [0074.607] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537bd40) returned 1 [0074.607] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445540) returned 1 Thread: id = 308 os_tid = 0x14a4 [0071.973] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x34) returned 0x5444ac0 [0071.973] wcscpy (in: _Dest=0x5444ac0, _Source="C:\\Users\\Default\\Recent" | out: _Dest="C:\\Users\\Default\\Recent") returned="C:\\Users\\Default\\Recent" [0071.973] wcscat (in: _Dest=0x5444ac0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Recent\\") returned="C:\\Users\\Default\\Recent\\" [0071.973] wcscat (in: _Dest=0x5444ac0, _Source="*" | out: _Dest="C:\\Users\\Default\\Recent\\*") returned="C:\\Users\\Default\\Recent\\*" [0071.973] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53cfe88 [0071.973] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Recent\\*", lpFindFileData=0x53cfe88 | out: lpFindFileData=0x53cfe88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.608] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53cfe88) returned 1 [0074.608] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444ac0) returned 1 [0074.608] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537c6f8) returned 1 Thread: id = 309 os_tid = 0x14a8 [0071.974] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3e) returned 0x537bc68 [0071.974] wcscpy (in: _Dest=0x537bc68, _Source="C:\\Users\\Default\\Saved Games" | out: _Dest="C:\\Users\\Default\\Saved Games") returned="C:\\Users\\Default\\Saved Games" [0071.974] wcscat (in: _Dest=0x537bc68, _Source="\\" | out: _Dest="C:\\Users\\Default\\Saved Games\\") returned="C:\\Users\\Default\\Saved Games\\" [0071.974] wcscat (in: _Dest=0x537bc68, _Source="*" | out: _Dest="C:\\Users\\Default\\Saved Games\\*") returned="C:\\Users\\Default\\Saved Games\\*" [0071.974] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d00f0 [0071.974] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*", lpFindFileData=0x53d00f0 | out: lpFindFileData=0x53d00f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445740 [0082.459] wcscmp (_String1=".", _String2=".") returned 0 [0082.459] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x53d00f0 | out: lpFindFileData=0x53d00f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.459] wcscmp (_String1="..", _String2=".") returned 1 [0082.459] wcscmp (_String1="..", _String2="..") returned 0 [0082.459] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x53d00f0 | out: lpFindFileData=0x53d00f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0082.459] FindClose (in: hFindFile=0x5445740 | out: hFindFile=0x5445740) returned 1 [0082.459] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d00f0) returned 1 [0082.459] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537bc68) returned 1 [0082.459] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b3f8) returned 1 Thread: id = 310 os_tid = 0x14ac [0071.974] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x34) returned 0x5444b00 [0071.975] wcscpy (in: _Dest=0x5444b00, _Source="C:\\Users\\Default\\SendTo" | out: _Dest="C:\\Users\\Default\\SendTo") returned="C:\\Users\\Default\\SendTo" [0071.975] wcscat (in: _Dest=0x5444b00, _Source="\\" | out: _Dest="C:\\Users\\Default\\SendTo\\") returned="C:\\Users\\Default\\SendTo\\" [0071.975] wcscat (in: _Dest=0x5444b00, _Source="*" | out: _Dest="C:\\Users\\Default\\SendTo\\*") returned="C:\\Users\\Default\\SendTo\\*" [0071.975] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d0358 [0071.975] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\SendTo\\*", lpFindFileData=0x53d0358 | out: lpFindFileData=0x53d0358*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.609] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d0358) returned 1 [0074.609] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444b00) returned 1 [0074.609] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537c730) returned 1 Thread: id = 311 os_tid = 0x14b0 [0071.976] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3c) returned 0x537bdd0 [0071.976] wcscpy (in: _Dest=0x537bdd0, _Source="C:\\Users\\Default\\Start Menu" | out: _Dest="C:\\Users\\Default\\Start Menu") returned="C:\\Users\\Default\\Start Menu" [0071.976] wcscat (in: _Dest=0x537bdd0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Start Menu\\") returned="C:\\Users\\Default\\Start Menu\\" [0071.976] wcscat (in: _Dest=0x537bdd0, _Source="*" | out: _Dest="C:\\Users\\Default\\Start Menu\\*") returned="C:\\Users\\Default\\Start Menu\\*" [0071.976] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d0f60 [0071.976] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Start Menu\\*", lpFindFileData=0x53d0f60 | out: lpFindFileData=0x53d0f60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.610] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d0f60) returned 1 [0074.610] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537bdd0) returned 1 [0074.610] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445a40) returned 1 Thread: id = 312 os_tid = 0x14b4 [0071.976] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x537be60 [0071.976] wcscpy (in: _Dest=0x537be60, _Source="C:\\Users\\Default\\Templates" | out: _Dest="C:\\Users\\Default\\Templates") returned="C:\\Users\\Default\\Templates" [0071.976] wcscat (in: _Dest=0x537be60, _Source="\\" | out: _Dest="C:\\Users\\Default\\Templates\\") returned="C:\\Users\\Default\\Templates\\" [0071.976] wcscat (in: _Dest=0x537be60, _Source="*" | out: _Dest="C:\\Users\\Default\\Templates\\*") returned="C:\\Users\\Default\\Templates\\*" [0071.976] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d1b68 [0071.976] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Templates\\*", lpFindFileData=0x53d1b68 | out: lpFindFileData=0x53d1b68*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.611] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d1b68) returned 1 [0074.611] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537be60) returned 1 [0074.611] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54453c0) returned 1 Thread: id = 313 os_tid = 0x14b8 [0071.977] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x34) returned 0x5444e40 [0071.977] wcscpy (in: _Dest=0x5444e40, _Source="C:\\Users\\Default\\Videos" | out: _Dest="C:\\Users\\Default\\Videos") returned="C:\\Users\\Default\\Videos" [0071.977] wcscat (in: _Dest=0x5444e40, _Source="\\" | out: _Dest="C:\\Users\\Default\\Videos\\") returned="C:\\Users\\Default\\Videos\\" [0071.977] wcscat (in: _Dest=0x5444e40, _Source="*" | out: _Dest="C:\\Users\\Default\\Videos\\*") returned="C:\\Users\\Default\\Videos\\*" [0071.977] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53cdf40 [0071.977] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*", lpFindFileData=0x53cdf40 | out: lpFindFileData=0x53cdf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0082.327] wcscmp (_String1=".", _String2=".") returned 0 [0082.327] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53cdf40 | out: lpFindFileData=0x53cdf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.327] wcscmp (_String1="..", _String2=".") returned 1 [0082.327] wcscmp (_String1="..", _String2="..") returned 0 [0082.327] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53cdf40 | out: lpFindFileData=0x53cdf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0082.327] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0082.328] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53cdf40) returned 1 [0082.328] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444e40) returned 1 [0082.328] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537c768) returned 1 Thread: id = 314 os_tid = 0x14bc [0071.978] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x5429000 [0071.978] wcscpy (in: _Dest=0x5429000, _Source="C:\\Program Files\\Windows Mail\\en-US" | out: _Dest="C:\\Program Files\\Windows Mail\\en-US") returned="C:\\Program Files\\Windows Mail\\en-US" [0071.978] wcscat (in: _Dest=0x5429000, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Mail\\en-US\\") returned="C:\\Program Files\\Windows Mail\\en-US\\" [0071.979] wcscat (in: _Dest=0x5429000, _Source="*" | out: _Dest="C:\\Program Files\\Windows Mail\\en-US\\*") returned="C:\\Program Files\\Windows Mail\\en-US\\*" [0071.979] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53ce1a8 [0071.979] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Mail\\en-US\\*", lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa90b7e0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54457c0 [0077.157] wcscmp (_String1=".", _String2=".") returned 0 [0077.157] FindNextFileW (in: hFindFile=0x54457c0, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa90b7e0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.157] wcscmp (_String1="..", _String2=".") returned 1 [0077.157] wcscmp (_String1="..", _String2="..") returned 0 [0077.157] FindNextFileW (in: hFindFile=0x54457c0, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b922184, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75fdf500, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x7a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoeres.dll.mui", cAlternateFileName="")) returned 1 [0077.157] wcscmp (_String1="msoeres.dll.mui", _String2=".") returned 1 [0077.157] wcscmp (_String1="msoeres.dll.mui", _String2="..") returned 1 [0077.157] FindNextFileW (in: hFindFile=0x54457c0, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb5e4e0, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x74ccc800, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 1 [0077.157] wcscmp (_String1="WinMail.exe.mui", _String2=".") returned 1 [0077.157] wcscmp (_String1="WinMail.exe.mui", _String2="..") returned 1 [0077.157] FindNextFileW (in: hFindFile=0x54457c0, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb5e4e0, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x74ccc800, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 0 [0077.157] FindClose (in: hFindFile=0x54457c0 | out: hFindFile=0x54457c0) returned 1 [0077.157] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ce1a8) returned 1 [0077.157] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5429000) returned 1 [0077.157] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5442d30) returned 1 Thread: id = 315 os_tid = 0x14c0 [0071.979] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x542b868 [0071.979] wcscpy (in: _Dest=0x542b868, _Source="C:\\Program Files\\Windows Security\\BrowserCore" | out: _Dest="C:\\Program Files\\Windows Security\\BrowserCore") returned="C:\\Program Files\\Windows Security\\BrowserCore" [0071.979] wcscat (in: _Dest=0x542b868, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Security\\BrowserCore\\") returned="C:\\Program Files\\Windows Security\\BrowserCore\\" [0071.979] wcscat (in: _Dest=0x542b868, _Source="*" | out: _Dest="C:\\Program Files\\Windows Security\\BrowserCore\\*") returned="C:\\Program Files\\Windows Security\\BrowserCore\\*" [0071.979] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53ce410 [0071.979] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Security\\BrowserCore\\*", lpFindFileData=0x53ce410 | out: lpFindFileData=0x53ce410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92ad688, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445480 [0077.222] wcscmp (_String1=".", _String2=".") returned 0 [0077.222] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x53ce410 | out: lpFindFileData=0x53ce410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92ad688, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.222] wcscmp (_String1="..", _String2=".") returned 1 [0077.222] wcscmp (_String1="..", _String2="..") returned 0 [0077.222] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x53ce410 | out: lpFindFileData=0x53ce410*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5845b6dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x5845b6dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x5845b6dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x139a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrowserCore.exe", cAlternateFileName="")) returned 1 [0077.222] wcscmp (_String1="BrowserCore.exe", _String2=".") returned 1 [0077.222] wcscmp (_String1="BrowserCore.exe", _String2="..") returned 1 [0077.222] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x53ce410 | out: lpFindFileData=0x53ce410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa92ae2d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0077.222] wcscmp (_String1="en-US", _String2=".") returned 1 [0077.222] wcscmp (_String1="en-US", _String2="..") returned 1 [0077.222] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x68) returned 0x396e610 [0077.222] wcscpy (in: _Dest=0x396e610, _Source="C:\\Program Files\\Windows Security\\BrowserCore" | out: _Dest="C:\\Program Files\\Windows Security\\BrowserCore") returned="C:\\Program Files\\Windows Security\\BrowserCore" [0077.222] wcscat (in: _Dest=0x396e610, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Security\\BrowserCore\\") returned="C:\\Program Files\\Windows Security\\BrowserCore\\" [0077.222] wcscat (in: _Dest=0x396e610, _Source="en-US" | out: _Dest="C:\\Program Files\\Windows Security\\BrowserCore\\en-US") returned="C:\\Program Files\\Windows Security\\BrowserCore\\en-US" [0080.939] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x396e610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x122c [0080.939] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x53ce410 | out: lpFindFileData=0x53ce410*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5845b6dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x5845b6dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x5845b6dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="")) returned 1 [0080.939] wcscmp (_String1="manifest.json", _String2=".") returned 1 [0080.939] wcscmp (_String1="manifest.json", _String2="..") returned 1 [0080.939] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x78) returned 0x38d06a0 [0080.939] wcscpy (in: _Dest=0x38d06a0, _Source="C:\\Program Files\\Windows Security\\BrowserCore" | out: _Dest="C:\\Program Files\\Windows Security\\BrowserCore") returned="C:\\Program Files\\Windows Security\\BrowserCore" [0080.940] wcscat (in: _Dest=0x38d06a0, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Security\\BrowserCore\\") returned="C:\\Program Files\\Windows Security\\BrowserCore\\" [0080.940] wcscat (in: _Dest=0x38d06a0, _Source="manifest.json" | out: _Dest="C:\\Program Files\\Windows Security\\BrowserCore\\manifest.json") returned="C:\\Program Files\\Windows Security\\BrowserCore\\manifest.json" [0080.940] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d06a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d8 [0080.940] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x53ce410 | out: lpFindFileData=0x53ce410*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5845b6dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x5845b6dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x5845b6dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="")) returned 0 [0080.940] FindClose (in: hFindFile=0x5445480 | out: hFindFile=0x5445480) returned 1 [0080.941] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ce410) returned 1 [0080.941] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542b868) returned 1 [0080.941] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541b078) returned 1 Thread: id = 316 os_tid = 0x14c4 [0071.980] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x5468630 [0071.980] wcscpy (in: _Dest=0x5468630, _Source="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC") returned="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC" [0071.980] wcscat (in: _Dest=0x5468630, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\") returned="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\" [0071.980] wcscat (in: _Dest=0x5468630, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\*") returned="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\*" [0071.980] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53ce678 [0071.980] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\*", lpFindFileData=0x53ce678 | out: lpFindFileData=0x53ce678*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdec183d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdec183d6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ef80 [0075.044] wcscmp (_String1=".", _String2=".") returned 0 [0075.044] FindNextFileW (in: hFindFile=0x389ef80, lpFindFileData=0x53ce678 | out: lpFindFileData=0x53ce678*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdec183d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdec183d6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.044] wcscmp (_String1="..", _String2=".") returned 1 [0075.044] wcscmp (_String1="..", _String2="..") returned 0 [0075.044] FindNextFileW (in: hFindFile=0x389ef80, lpFindFileData=0x53ce678 | out: lpFindFileData=0x53ce678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdec183d6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xdec183d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdec183d6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Esl", cAlternateFileName="")) returned 1 [0075.044] wcscmp (_String1="Esl", _String2=".") returned 1 [0075.044] wcscmp (_String1="Esl", _String2="..") returned 1 [0075.044] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x396db90 [0075.044] wcscpy (in: _Dest=0x396db90, _Source="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC") returned="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC" [0075.044] wcscat (in: _Dest=0x396db90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\") returned="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\" [0075.044] wcscat (in: _Dest=0x396db90, _Source="Esl" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl") returned="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl" [0081.139] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x396db90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc40 [0081.140] FindNextFileW (in: hFindFile=0x389ef80, lpFindFileData=0x53ce678 | out: lpFindFileData=0x53ce678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2d82cf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2d82cf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader", cAlternateFileName="")) returned 1 [0081.140] wcscmp (_String1="Reader", _String2=".") returned 1 [0081.140] wcscmp (_String1="Reader", _String2="..") returned 1 [0081.140] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6c) returned 0x5467620 [0081.140] wcscpy (in: _Dest=0x5467620, _Source="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC") returned="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC" [0081.140] wcscat (in: _Dest=0x5467620, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\") returned="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\" [0081.140] wcscat (in: _Dest=0x5467620, _Source="Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader" [0081.140] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5467620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b38 [0081.141] FindNextFileW (in: hFindFile=0x389ef80, lpFindFileData=0x53ce678 | out: lpFindFileData=0x53ce678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3632d245, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x40f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe.htm", cAlternateFileName="")) returned 1 [0081.141] wcscmp (_String1="ReadMe.htm", _String2=".") returned 1 [0081.141] wcscmp (_String1="ReadMe.htm", _String2="..") returned 1 [0081.141] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x74) returned 0x38d24a0 [0081.141] wcscpy (in: _Dest=0x38d24a0, _Source="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC") returned="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC" [0081.141] wcscat (in: _Dest=0x38d24a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\") returned="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\" [0081.141] wcscat (in: _Dest=0x38d24a0, _Source="ReadMe.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\ReadMe.htm") returned="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\ReadMe.htm" [0081.141] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d24a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b3c [0081.141] FindNextFileW (in: hFindFile=0x389ef80, lpFindFileData=0x53ce678 | out: lpFindFileData=0x53ce678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x389535d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389535d8, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resource", cAlternateFileName="")) returned 1 [0081.141] wcscmp (_String1="Resource", _String2=".") returned 1 [0081.141] wcscmp (_String1="Resource", _String2="..") returned 1 [0081.141] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x38aa4c8 [0081.141] wcscpy (in: _Dest=0x38aa4c8, _Source="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC") returned="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC" [0081.142] wcscat (in: _Dest=0x38aa4c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\") returned="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\" [0081.142] wcscat (in: _Dest=0x38aa4c8, _Source="Resource" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource") returned="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource" [0081.142] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38aa4c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b40 [0081.142] FindNextFileW (in: hFindFile=0x389ef80, lpFindFileData=0x53ce678 | out: lpFindFileData=0x53ce678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cd6ac1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cd6ac1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cd6ac1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup Files", cAlternateFileName="SETUPF~1")) returned 1 [0081.142] wcscmp (_String1="Setup Files", _String2=".") returned 1 [0081.142] wcscmp (_String1="Setup Files", _String2="..") returned 1 [0081.142] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x76) returned 0x38d1720 [0081.142] wcscpy (in: _Dest=0x38d1720, _Source="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC") returned="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC" [0081.142] wcscat (in: _Dest=0x38d1720, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\") returned="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\" [0081.142] wcscat (in: _Dest=0x38d1720, _Source="Setup Files" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files") returned="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files" [0081.143] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38d1720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b44 [0081.143] FindNextFileW (in: hFindFile=0x389ef80, lpFindFileData=0x53ce678 | out: lpFindFileData=0x53ce678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cd6ac1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cd6ac1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cd6ac1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup Files", cAlternateFileName="SETUPF~1")) returned 0 [0081.143] FindClose (in: hFindFile=0x389ef80 | out: hFindFile=0x389ef80) returned 1 [0081.143] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ce678) returned 1 [0081.143] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5468630) returned 1 [0081.143] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541ad38) returned 1 Thread: id = 317 os_tid = 0x14c8 [0071.980] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x38b5d68 [0071.980] wcscpy (in: _Dest=0x38b5d68, _Source="C:\\Program Files (x86)\\Common Files\\Adobe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe") returned="C:\\Program Files (x86)\\Common Files\\Adobe" [0071.980] wcscat (in: _Dest=0x38b5d68, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\" [0071.980] wcscat (in: _Dest=0x38b5d68, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\*" [0071.981] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53ce8e0 [0071.981] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\*", lpFindFileData=0x53ce8e0 | out: lpFindFileData=0x53ce8e0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xbb39c720, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3420de7a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445600 [0077.318] wcscmp (_String1=".", _String2=".") returned 0 [0077.318] FindNextFileW (in: hFindFile=0x5445600, lpFindFileData=0x53ce8e0 | out: lpFindFileData=0x53ce8e0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xbb39c720, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3420de7a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.318] wcscmp (_String1="..", _String2=".") returned 1 [0077.322] wcscmp (_String1="..", _String2="..") returned 0 [0077.322] FindNextFileW (in: hFindFile=0x5445600, lpFindFileData=0x53ce8e0 | out: lpFindFileData=0x53ce8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33bf1c6c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33bf1c6c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33bf1c6c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0077.322] wcscmp (_String1="Acrobat", _String2=".") returned 1 [0077.322] wcscmp (_String1="Acrobat", _String2="..") returned 1 [0077.322] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x396e4c0 [0077.322] wcscpy (in: _Dest=0x396e4c0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe") returned="C:\\Program Files (x86)\\Common Files\\Adobe" [0077.322] wcscat (in: _Dest=0x396e4c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\" [0077.322] wcscat (in: _Dest=0x396e4c0, _Source="Acrobat" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat" [0080.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x396e4c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1230 [0080.933] FindNextFileW (in: hFindFile=0x5445600, lpFindFileData=0x53ce8e0 | out: lpFindFileData=0x53ce8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33e07dd6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33e07dd6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33e07dd6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 1 [0080.933] wcscmp (_String1="ARM", _String2=".") returned 1 [0080.933] wcscmp (_String1="ARM", _String2="..") returned 1 [0080.933] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x6e96250 [0080.933] wcscpy (in: _Dest=0x6e96250, _Source="C:\\Program Files (x86)\\Common Files\\Adobe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe") returned="C:\\Program Files (x86)\\Common Files\\Adobe" [0080.933] wcscat (in: _Dest=0x6e96250, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\" [0080.933] wcscat (in: _Dest=0x6e96250, _Source="ARM" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM" [0080.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x6e96250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18cc [0080.934] FindNextFileW (in: hFindFile=0x5445600, lpFindFileData=0x53ce8e0 | out: lpFindFileData=0x53ce8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3420de7a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3420de7a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3420de7a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HelpCfg", cAlternateFileName="")) returned 1 [0080.934] wcscmp (_String1="HelpCfg", _String2=".") returned 1 [0080.934] wcscmp (_String1="HelpCfg", _String2="..") returned 1 [0080.934] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x5ba6fc8 [0080.934] wcscpy (in: _Dest=0x5ba6fc8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe") returned="C:\\Program Files (x86)\\Common Files\\Adobe" [0080.934] wcscat (in: _Dest=0x5ba6fc8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\" [0080.934] wcscat (in: _Dest=0x5ba6fc8, _Source="HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0080.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba6fc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d0 [0080.935] FindNextFileW (in: hFindFile=0x5445600, lpFindFileData=0x53ce8e0 | out: lpFindFileData=0x53ce8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ea075c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ea075c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader", cAlternateFileName="")) returned 1 [0080.935] wcscmp (_String1="Reader", _String2=".") returned 1 [0080.935] wcscmp (_String1="Reader", _String2="..") returned 1 [0080.935] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x5ba7818 [0080.935] wcscpy (in: _Dest=0x5ba7818, _Source="C:\\Program Files (x86)\\Common Files\\Adobe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe") returned="C:\\Program Files (x86)\\Common Files\\Adobe" [0080.935] wcscat (in: _Dest=0x5ba7818, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\" [0080.935] wcscat (in: _Dest=0x5ba7818, _Source="Reader" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader" [0080.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba7818, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d4 [0080.936] FindNextFileW (in: hFindFile=0x5445600, lpFindFileData=0x53ce8e0 | out: lpFindFileData=0x53ce8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ea075c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ea075c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader", cAlternateFileName="")) returned 0 [0080.936] FindClose (in: hFindFile=0x5445600 | out: hFindFile=0x5445600) returned 1 [0080.936] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ce8e0) returned 1 [0080.936] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b5d68) returned 1 [0080.936] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x543d3f8) returned 1 Thread: id = 318 os_tid = 0x14cc [0071.981] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x38b5dc8 [0071.981] wcscpy (in: _Dest=0x38b5dc8, _Source="C:\\Program Files (x86)\\Common Files\\Java" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java") returned="C:\\Program Files (x86)\\Common Files\\Java" [0071.981] wcscat (in: _Dest=0x38b5dc8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\") returned="C:\\Program Files (x86)\\Common Files\\Java\\" [0071.981] wcscat (in: _Dest=0x38b5dc8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\*") returned="C:\\Program Files (x86)\\Common Files\\Java\\*" [0071.981] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53ceb48 [0071.981] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\*", lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb2fbfbb9, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb2fe5e18, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb2fe5e18, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ee40 [0076.222] wcscmp (_String1=".", _String2=".") returned 0 [0076.222] FindNextFileW (in: hFindFile=0x389ee40, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb2fbfbb9, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb2fe5e18, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb2fe5e18, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.222] wcscmp (_String1="..", _String2=".") returned 1 [0076.222] wcscmp (_String1="..", _String2="..") returned 0 [0076.222] FindNextFileW (in: hFindFile=0x389ee40, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xb2fe5e18, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xbb68653c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb300c058, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 1 [0076.222] wcscmp (_String1="Java Update", _String2=".") returned 1 [0076.222] wcscmp (_String1="Java Update", _String2="..") returned 1 [0076.222] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6a) returned 0x54969e0 [0076.222] wcscpy (in: _Dest=0x54969e0, _Source="C:\\Program Files (x86)\\Common Files\\Java" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java") returned="C:\\Program Files (x86)\\Common Files\\Java" [0076.222] wcscat (in: _Dest=0x54969e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\") returned="C:\\Program Files (x86)\\Common Files\\Java\\" [0076.222] wcscat (in: _Dest=0x54969e0, _Source="Java Update" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update" [0081.076] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54969e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a5c [0081.076] FindNextFileW (in: hFindFile=0x389ee40, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xb2fe5e18, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xbb68653c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb300c058, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 0 [0081.076] FindClose (in: hFindFile=0x389ee40 | out: hFindFile=0x389ee40) returned 1 [0081.077] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ceb48) returned 1 [0081.077] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b5dc8) returned 1 [0081.077] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x543d6f8) returned 1 Thread: id = 319 os_tid = 0x14d0 [0071.983] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x542bad8 [0071.983] wcscpy (in: _Dest=0x542bad8, _Source="C:\\Program Files (x86)\\Common Files\\Services" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Services") returned="C:\\Program Files (x86)\\Common Files\\Services" [0071.983] wcscat (in: _Dest=0x542bad8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Services\\") returned="C:\\Program Files (x86)\\Common Files\\Services\\" [0071.983] wcscat (in: _Dest=0x542bad8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Services\\*") returned="C:\\Program Files (x86)\\Common Files\\Services\\*" [0071.983] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d05c0 [0071.983] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Services\\*", lpFindFileData=0x53d05c0 | out: lpFindFileData=0x53d05c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb9ebb45, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a6c1993, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445880 [0077.204] wcscmp (_String1=".", _String2=".") returned 0 [0077.204] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53d05c0 | out: lpFindFileData=0x53d05c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb9ebb45, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a6c1993, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.204] wcscmp (_String1="..", _String2=".") returned 1 [0077.204] wcscmp (_String1="..", _String2="..") returned 0 [0077.204] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53d05c0 | out: lpFindFileData=0x53d05c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dfbb8d0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6dfbb8d0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6dfbb8d0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0077.204] wcscmp (_String1="verisign.bmp", _String2=".") returned 1 [0077.204] wcscmp (_String1="verisign.bmp", _String2="..") returned 1 [0077.204] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x74) returned 0x38d08a0 [0077.204] wcscpy (in: _Dest=0x38d08a0, _Source="C:\\Program Files (x86)\\Common Files\\Services" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Services") returned="C:\\Program Files (x86)\\Common Files\\Services" [0077.204] wcscat (in: _Dest=0x38d08a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Services\\") returned="C:\\Program Files (x86)\\Common Files\\Services\\" [0077.204] wcscat (in: _Dest=0x38d08a0, _Source="verisign.bmp" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Services\\verisign.bmp") returned="C:\\Program Files (x86)\\Common Files\\Services\\verisign.bmp" [0080.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d08a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1210 [0080.968] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53d05c0 | out: lpFindFileData=0x53d05c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dfbb8d0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6dfbb8d0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6dfbb8d0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0080.968] FindClose (in: hFindFile=0x5445880 | out: hFindFile=0x5445880) returned 1 [0080.968] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d05c0) returned 1 [0080.968] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542bad8) returned 1 [0080.968] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541b0e0) returned 1 Thread: id = 320 os_tid = 0x14d4 [0071.984] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x54290b0 [0071.984] wcscpy (in: _Dest=0x54290b0, _Source="C:\\Program Files (x86)\\Google\\Chrome" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome") returned="C:\\Program Files (x86)\\Google\\Chrome" [0071.984] wcscat (in: _Dest=0x54290b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\" [0071.984] wcscat (in: _Dest=0x54290b0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\*") returned="C:\\Program Files (x86)\\Google\\Chrome\\*" [0071.984] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d0828 [0071.984] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\*", lpFindFileData=0x53d0828 | out: lpFindFileData=0x53d0828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe07d7559, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4cfb9d0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4cfb9d0, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f280 [0075.045] wcscmp (_String1=".", _String2=".") returned 0 [0075.045] FindNextFileW (in: hFindFile=0x389f280, lpFindFileData=0x53d0828 | out: lpFindFileData=0x53d0828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe07d7559, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4cfb9d0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4cfb9d0, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.045] wcscmp (_String1="..", _String2=".") returned 1 [0075.045] wcscmp (_String1="..", _String2="..") returned 0 [0075.045] FindNextFileW (in: hFindFile=0x389f280, lpFindFileData=0x53d0828 | out: lpFindFileData=0x53d0828*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xe4b5803b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbbac738, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe4bca716, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Application", cAlternateFileName="APPLIC~1")) returned 1 [0075.045] wcscmp (_String1="Application", _String2=".") returned 1 [0075.045] wcscmp (_String1="Application", _String2="..") returned 1 [0075.045] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x396d730 [0075.045] wcscpy (in: _Dest=0x396d730, _Source="C:\\Program Files (x86)\\Google\\Chrome" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome") returned="C:\\Program Files (x86)\\Google\\Chrome" [0075.045] wcscat (in: _Dest=0x396d730, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\" [0075.045] wcscat (in: _Dest=0x396d730, _Source="Application" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application" [0081.145] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x396d730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc44 [0081.145] FindNextFileW (in: hFindFile=0x389f280, lpFindFileData=0x53d0828 | out: lpFindFileData=0x53d0828*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xe4b5803b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbbac738, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe4bca716, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Application", cAlternateFileName="APPLIC~1")) returned 0 [0081.145] FindClose (in: hFindFile=0x389f280 | out: hFindFile=0x389f280) returned 1 [0081.145] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d0828) returned 1 [0081.145] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54290b0) returned 1 [0081.145] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54283a0) returned 1 Thread: id = 321 os_tid = 0x14d8 [0071.985] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x542b730 [0071.985] wcscpy (in: _Dest=0x542b730, _Source="C:\\Program Files (x86)\\Google\\CrashReports" | out: _Dest="C:\\Program Files (x86)\\Google\\CrashReports") returned="C:\\Program Files (x86)\\Google\\CrashReports" [0071.985] wcscat (in: _Dest=0x542b730, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\CrashReports\\") returned="C:\\Program Files (x86)\\Google\\CrashReports\\" [0071.985] wcscat (in: _Dest=0x542b730, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\CrashReports\\*") returned="C:\\Program Files (x86)\\Google\\CrashReports\\*" [0071.985] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d11c8 [0071.985] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\CrashReports\\*", lpFindFileData=0x53d11c8 | out: lpFindFileData=0x53d11c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc5e5a66, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbf7b2f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcc5e5a66, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445480 [0077.213] wcscmp (_String1=".", _String2=".") returned 0 [0077.213] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x53d11c8 | out: lpFindFileData=0x53d11c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc5e5a66, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbf7b2f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcc5e5a66, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.213] wcscmp (_String1="..", _String2=".") returned 1 [0077.214] wcscmp (_String1="..", _String2="..") returned 0 [0077.214] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x53d11c8 | out: lpFindFileData=0x53d11c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc5e5a66, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbf7b2f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcc5e5a66, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0077.214] FindClose (in: hFindFile=0x5445480 | out: hFindFile=0x5445480) returned 1 [0077.214] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d11c8) returned 1 [0077.214] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542b730) returned 1 [0077.214] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x543d7b8) returned 1 Thread: id = 322 os_tid = 0x14dc [0071.985] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x5428fa8 [0071.985] wcscpy (in: _Dest=0x5428fa8, _Source="C:\\Program Files (x86)\\Google\\Update2" | out: _Dest="C:\\Program Files (x86)\\Google\\Update2") returned="C:\\Program Files (x86)\\Google\\Update2" [0071.985] wcscat (in: _Dest=0x5428fa8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Update2\\") returned="C:\\Program Files (x86)\\Google\\Update2\\" [0071.985] wcscat (in: _Dest=0x5428fa8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\Update2\\*") returned="C:\\Program Files (x86)\\Google\\Update2\\*" [0071.985] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d1430 [0071.985] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Update2\\*", lpFindFileData=0x53d1430 | out: lpFindFileData=0x53d1430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc631f07, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbfd0b02, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcda0384e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ee00 [0076.220] wcscmp (_String1=".", _String2=".") returned 0 [0076.220] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53d1430 | out: lpFindFileData=0x53d1430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc631f07, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbfd0b02, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcda0384e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.220] wcscmp (_String1="..", _String2=".") returned 1 [0076.220] wcscmp (_String1="..", _String2="..") returned 0 [0076.220] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53d1430 | out: lpFindFileData=0x53d1430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc631f07, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc7d58e1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc7d58e1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.3.33.5", cAlternateFileName="1333~1.5")) returned 1 [0076.220] wcscmp (_String1="1.3.33.5", _String2=".") returned 1 [0076.220] wcscmp (_String1="1.3.33.5", _String2="..") returned 1 [0076.221] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x541a9f8 [0076.221] wcscpy (in: _Dest=0x541a9f8, _Source="C:\\Program Files (x86)\\Google\\Update2" | out: _Dest="C:\\Program Files (x86)\\Google\\Update2") returned="C:\\Program Files (x86)\\Google\\Update2" [0076.221] wcscat (in: _Dest=0x541a9f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Update2\\") returned="C:\\Program Files (x86)\\Google\\Update2\\" [0076.221] wcscat (in: _Dest=0x541a9f8, _Source="1.3.33.5" | out: _Dest="C:\\Program Files (x86)\\Google\\Update2\\1.3.33.5") returned="C:\\Program Files (x86)\\Google\\Update2\\1.3.33.5" [0081.077] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x541a9f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1110 [0081.078] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53d1430 | out: lpFindFileData=0x53d1430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcda0384e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcda0384e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xdfd42df1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Download", cAlternateFileName="")) returned 1 [0081.078] wcscmp (_String1="Download", _String2=".") returned 1 [0081.078] wcscmp (_String1="Download", _String2="..") returned 1 [0081.078] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x6e96320 [0081.078] wcscpy (in: _Dest=0x6e96320, _Source="C:\\Program Files (x86)\\Google\\Update2" | out: _Dest="C:\\Program Files (x86)\\Google\\Update2") returned="C:\\Program Files (x86)\\Google\\Update2" [0081.078] wcscat (in: _Dest=0x6e96320, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Update2\\") returned="C:\\Program Files (x86)\\Google\\Update2\\" [0081.078] wcscat (in: _Dest=0x6e96320, _Source="Download" | out: _Dest="C:\\Program Files (x86)\\Google\\Update2\\Download") returned="C:\\Program Files (x86)\\Google\\Update2\\Download" [0081.078] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x6e96320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a60 [0081.079] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53d1430 | out: lpFindFileData=0x53d1430*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc7af69e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc7af69e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc500c5f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x25650, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdate.exe", cAlternateFileName="GOOGLE~1.EXE")) returned 1 [0081.079] wcscmp (_String1="GoogleUpdate.exe", _String2=".") returned 1 [0081.079] wcscmp (_String1="GoogleUpdate.exe", _String2="..") returned 1 [0081.079] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53d1430 | out: lpFindFileData=0x53d1430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcda0384e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe0122b4c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe0122b4c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Install", cAlternateFileName="")) returned 1 [0081.079] wcscmp (_String1="Install", _String2=".") returned 1 [0081.079] wcscmp (_String1="Install", _String2="..") returned 1 [0081.079] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x6e96800 [0081.079] wcscpy (in: _Dest=0x6e96800, _Source="C:\\Program Files (x86)\\Google\\Update2" | out: _Dest="C:\\Program Files (x86)\\Google\\Update2") returned="C:\\Program Files (x86)\\Google\\Update2" [0081.079] wcscat (in: _Dest=0x6e96800, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Update2\\") returned="C:\\Program Files (x86)\\Google\\Update2\\" [0081.079] wcscat (in: _Dest=0x6e96800, _Source="Install" | out: _Dest="C:\\Program Files (x86)\\Google\\Update2\\Install") returned="C:\\Program Files (x86)\\Google\\Update2\\Install" [0081.079] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x6e96800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a64 [0081.080] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53d1430 | out: lpFindFileData=0x53d1430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcda0384e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe0122b4c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe0122b4c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Install", cAlternateFileName="")) returned 0 [0081.080] FindClose (in: hFindFile=0x389ee00 | out: hFindFile=0x389ee00) returned 1 [0081.080] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d1430) returned 1 [0081.080] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5428fa8) returned 1 [0081.080] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54287c0) returned 1 Thread: id = 323 os_tid = 0x14e0 [0071.987] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x38b5b88 [0071.987] wcscpy (in: _Dest=0x38b5b88, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft" [0071.987] wcscat (in: _Dest=0x38b5b88, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\" [0071.987] wcscat (in: _Dest=0x38b5b88, _Source="*" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\*") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\*" [0071.987] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d1698 [0071.987] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\*", lpFindFileData=0x53d1698 | out: lpFindFileData=0x53d1698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79effb3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79effb3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389eec0 [0075.443] wcscmp (_String1=".", _String2=".") returned 0 [0075.443] FindNextFileW (in: hFindFile=0x389eec0, lpFindFileData=0x53d1698 | out: lpFindFileData=0x53d1698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79effb3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79effb3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.443] wcscmp (_String1="..", _String2=".") returned 1 [0075.443] wcscmp (_String1="..", _String2="..") returned 0 [0075.443] FindNextFileW (in: hFindFile=0x389eec0, lpFindFileData=0x53d1698 | out: lpFindFileData=0x53d1698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 1 [0075.443] wcscmp (_String1="Windows Workflow Foundation", _String2=".") returned 1 [0075.443] wcscmp (_String1="Windows Workflow Foundation", _String2="..") returned 1 [0075.443] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8a) returned 0x38a7bb8 [0075.443] wcscpy (in: _Dest=0x38a7bb8, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft" [0075.443] wcscat (in: _Dest=0x38a7bb8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\" [0075.443] wcscat (in: _Dest=0x38a7bb8, _Source="Windows Workflow Foundation" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation" [0075.754] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a7bb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x910 [0075.755] FindNextFileW (in: hFindFile=0x389eec0, lpFindFileData=0x53d1698 | out: lpFindFileData=0x53d1698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0 [0075.755] FindClose (in: hFindFile=0x389eec0 | out: hFindFile=0x389eec0) returned 1 [0075.755] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d1698) returned 1 [0075.755] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b5b88) returned 1 [0075.755] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x543d458) returned 1 Thread: id = 324 os_tid = 0x14e4 [0071.987] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x38b6068 [0071.987] wcscpy (in: _Dest=0x38b6068, _Source="C:\\Program Files (x86)\\Windows Mail\\en-US" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\en-US") returned="C:\\Program Files (x86)\\Windows Mail\\en-US" [0071.987] wcscat (in: _Dest=0x38b6068, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\en-US\\") returned="C:\\Program Files (x86)\\Windows Mail\\en-US\\" [0071.987] wcscat (in: _Dest=0x38b6068, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\en-US\\*") returned="C:\\Program Files (x86)\\Windows Mail\\en-US\\*" [0071.987] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d1900 [0071.987] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Mail\\en-US\\*", lpFindFileData=0x53d1900 | out: lpFindFileData=0x53d1900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc4b24d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54453c0 [0077.209] wcscmp (_String1=".", _String2=".") returned 0 [0077.209] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x53d1900 | out: lpFindFileData=0x53d1900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc4b24d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.209] wcscmp (_String1="..", _String2=".") returned 1 [0077.209] wcscmp (_String1="..", _String2="..") returned 0 [0077.209] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x53d1900 | out: lpFindFileData=0x53d1900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40aa916a, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x79d60fab, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x76938d00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x7a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoeres.dll.mui", cAlternateFileName="")) returned 1 [0077.209] wcscmp (_String1="msoeres.dll.mui", _String2=".") returned 1 [0077.209] wcscmp (_String1="msoeres.dll.mui", _String2="..") returned 1 [0077.209] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x53d1900 | out: lpFindFileData=0x53d1900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40ce8172, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x79d60fab, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75626000, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 1 [0077.209] wcscmp (_String1="WinMail.exe.mui", _String2=".") returned 1 [0077.209] wcscmp (_String1="WinMail.exe.mui", _String2="..") returned 1 [0077.209] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x53d1900 | out: lpFindFileData=0x53d1900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40ce8172, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x79d60fab, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75626000, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 0 [0077.209] FindClose (in: hFindFile=0x54453c0 | out: hFindFile=0x54453c0) returned 1 [0077.209] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d1900) returned 1 [0077.209] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b6068) returned 1 [0077.209] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x543d818) returned 1 Thread: id = 325 os_tid = 0x14e8 [0071.988] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 0x80 [0077.103] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf", dwFileAttributes=0x20) Thread: id = 326 os_tid = 0x14ec [0071.989] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 0x80 [0081.281] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", dwFileAttributes=0x20) Thread: id = 327 os_tid = 0x14f0 [0072.185] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatecspstore.xml")) returned 0x20 [0077.208] SetFileAttributesW (lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml", dwFileAttributes=0x20) returned 1 [0081.558] CreateFileW (lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatecspstore.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1cf0 [0081.558] GetFileSizeEx (in: hFile=0x1cf0, lpFileSize=0xf0ffcec | out: lpFileSize=0xf0ffcec*=26) returned 1 [0081.558] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 328 os_tid = 0x14f4 [0072.188] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml")) returned 0x20 [0076.224] SetFileAttributesW (lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", dwFileAttributes=0x20) returned 1 [0076.225] CreateFileW (lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1114 [0076.225] GetFileSizeEx (in: hFile=0x1114, lpFileSize=0xf17f790 | out: lpFileSize=0xf17f790*=1444) returned 1 [0076.225] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x5a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.225] ReadFile (in: hFile=0x1114, lpBuffer=0xf17f714, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf17f710, lpOverlapped=0x0 | out: lpBuffer=0xf17f714*, lpNumberOfBytesRead=0xf17f710*=0x4, lpOverlapped=0x0) returned 1 [0076.226] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.226] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c30 [0076.226] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559b90 [0076.226] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559938 [0076.226] NtQuerySystemTime (in: CurrentTime=0xf17f6f0 | out: CurrentTime=0xf17f6f0*=132260136333866489) returned 0x0 [0076.226] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0x35f4f9ee [0076.226] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0xb9ff62f8 [0076.226] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0x7bfa5616 [0076.226] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0xf8348c6a [0076.226] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0xe11f963f [0076.226] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0x47a6bb72 [0076.227] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0x620a3f56 [0076.227] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0x90d527f1 [0076.227] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0xc16a6d0f [0076.227] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0x69073505 [0076.227] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0xa7307321 [0076.227] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0x8bcc2afb [0076.227] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0x3648d298 [0076.227] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0x5b19acaa [0076.227] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0xfc5e2638 [0076.227] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0xc8b64b40 [0076.227] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0x61c6190d [0076.227] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0x24f0f5a0 [0076.227] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0x5515b644 [0076.227] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0x56231fc [0076.227] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0x323c6bb [0076.227] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0x959a7d00 [0076.227] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0x7c52a1d7 [0076.227] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0x5871f67a [0076.227] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0xf463f40f [0076.227] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0xa80315fa [0076.227] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0xa23d6444 [0076.227] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0x4d3083fa [0076.227] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0x63c97dc3 [0076.227] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0xd4d331bb [0076.227] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0x31fa0de9 [0076.227] RtlRandom (in: Seed=0xf17f6fc | out: Seed=0xf17f6fc) returned 0x4611ea27 [0076.237] ReadFile (in: hFile=0x1114, lpBuffer=0x54a4fe8, nNumberOfBytesToRead=0x5a4, lpNumberOfBytesRead=0xf17f6ec, lpOverlapped=0x0 | out: lpBuffer=0x54a4fe8*, lpNumberOfBytesRead=0xf17f6ec*=0x5a4, lpOverlapped=0x0) returned 1 [0076.237] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.237] WriteFile (in: hFile=0x1114, lpBuffer=0x54f2018*, nNumberOfBytesToWrite=0x5a4, lpNumberOfBytesWritten=0xf17f6e8, lpOverlapped=0x0 | out: lpBuffer=0x54f2018*, lpNumberOfBytesWritten=0xf17f6e8*=0x5a4, lpOverlapped=0x0) returned 1 [0076.239] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c08 [0076.239] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c30 [0076.239] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559c30) returned 1 [0076.239] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f2018) returned 1 [0076.239] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a4fe8) returned 1 [0076.239] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.239] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a60b8) returned 1 [0076.239] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x73) returned 0x38d0da0 [0076.239] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.239] WriteFile (in: hFile=0x1114, lpBuffer=0x54a2b30*, nNumberOfBytesToWrite=0x157, lpNumberOfBytesWritten=0xf17f750, lpOverlapped=0x0 | out: lpBuffer=0x54a2b30*, lpNumberOfBytesWritten=0xf17f750*=0x157, lpOverlapped=0x0) returned 1 [0076.241] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a2b30) returned 1 [0076.241] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38d1020) returned 1 [0076.241] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a50) returned 1 [0076.241] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38d0da0) returned 1 [0076.241] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559c08) returned 1 [0076.241] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559b90) returned 1 [0076.241] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559cd0) returned 1 [0076.241] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559c58) returned 1 [0076.241] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf4) returned 0x54a4100 [0076.241] wcscpy (in: _Dest=0x54a4100, _Source="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" | out: _Dest="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml") returned="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" [0076.241] wcscat (in: _Dest=0x54a4100, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.mailto[knoocknoo@cock.li].a0a70") returned="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.mailto[knoocknoo@cock.li].a0a70" [0076.241] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.mailto[knoocknoo@cock.li].a0a70", NtPathName=0xf17f708, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.241] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0x54a2b30 [0076.246] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a2b30) returned 1 [0076.246] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549a130) returned 1 [0076.246] NtQueryInformationFile (in: FileHandle=0x1114, IoStatusBlock=0xf17f714, FileInformation=0xf17f6ec, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xf17f714, FileInformation=0xf17f6ec) returned 0x0 [0076.246] NtSetInformationFile (FileHandle=0x1114, IoStatusBlock=0xf17f714, FileInformation=0xf17f6ec, Length=0x28, FileInformationClass=0x4) returned 0x0 [0076.247] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a4100) returned 1 [0076.247] FlushFileBuffers (hFile=0x1114) returned 1 [0076.248] CloseHandle (hObject=0x1114) returned 1 [0076.248] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5496800 [0076.248] wcscpy (in: _Dest=0x5496800, _Source="C:\\ProgramData\\USOPrivate\\UpdateStore\\" | out: _Dest="C:\\ProgramData\\USOPrivate\\UpdateStore\\") returned="C:\\ProgramData\\USOPrivate\\UpdateStore\\" [0076.248] wcscat (in: _Dest=0x5496800, _Source="A0A70-Readme.txt" | out: _Dest="C:\\ProgramData\\USOPrivate\\UpdateStore\\A0A70-Readme.txt") returned="C:\\ProgramData\\USOPrivate\\UpdateStore\\A0A70-Readme.txt" [0076.248] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\A0A70-Readme.txt" (normalized: "c:\\programdata\\usoprivate\\updatestore\\a0a70-readme.txt")) returned 0xffffffff [0076.248] CreateFileW (lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\A0A70-Readme.txt" (normalized: "c:\\programdata\\usoprivate\\updatestore\\a0a70-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4c [0081.165] WriteFile (in: hFile=0x1b4c, lpBuffer=0x38ab1f8*, nNumberOfBytesToWrite=0x6f4, lpNumberOfBytesWritten=0xf17f710, lpOverlapped=0x0 | out: lpBuffer=0x38ab1f8*, lpNumberOfBytesWritten=0xf17f710*=0x6f4, lpOverlapped=0x0) returned 1 [0087.154] CloseHandle (hObject=0x1b4c) returned 1 [0089.521] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496800) returned 1 [0089.521] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fe008) returned 1 Thread: id = 329 os_tid = 0x14f8 [0072.189] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x542b798 [0072.189] wcscpy (in: _Dest=0x542b798, _Source="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage" | out: _Dest="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage") returned="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage" [0072.189] wcscat (in: _Dest=0x542b798, _Source="\\" | out: _Dest="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\") returned="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\" [0072.189] wcscat (in: _Dest=0x542b798, _Source="*" | out: _Dest="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\*") returned="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\*" [0072.189] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5419c78 [0072.189] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\*", lpFindFileData=0x5419c78 | out: lpFindFileData=0x5419c78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc2d63c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xad19b2ee, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445a00 [0077.206] wcscmp (_String1=".", _String2=".") returned 0 [0077.206] FindNextFileW (in: hFindFile=0x5445a00, lpFindFileData=0x5419c78 | out: lpFindFileData=0x5419c78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc2d63c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xad19b2ee, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.206] wcscmp (_String1="..", _String2=".") returned 1 [0077.206] wcscmp (_String1="..", _String2="..") returned 0 [0077.206] FindNextFileW (in: hFindFile=0x5445a00, lpFindFileData=0x5419c78 | out: lpFindFileData=0x5419c78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad19b2ee, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad19b2ee, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x70ca10d9, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x33, dwReserved0=0x0, dwReserved1=0x0, cFileName="17dfc292991c7c46.timestamp", cAlternateFileName="17DFC2~1.TIM")) returned 1 [0077.206] wcscmp (_String1="17dfc292991c7c46.timestamp", _String2=".") returned 1 [0077.206] wcscmp (_String1="17dfc292991c7c46.timestamp", _String2="..") returned 1 [0077.206] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x90) returned 0x549f698 [0077.206] wcscpy (in: _Dest=0x549f698, _Source="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage" | out: _Dest="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage") returned="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage" [0077.206] wcscat (in: _Dest=0x549f698, _Source="\\" | out: _Dest="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\") returned="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\" [0077.206] wcscat (in: _Dest=0x549f698, _Source="17dfc292991c7c46.timestamp" | out: _Dest="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp") returned="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp" [0080.959] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549f698, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1218 [0080.959] FindNextFileW (in: hFindFile=0x5445a00, lpFindFileData=0x5419c78 | out: lpFindFileData=0x5419c78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad19b2ee, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad19b2ee, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x70ca10d9, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x33, dwReserved0=0x0, dwReserved1=0x0, cFileName="17dfc292991c7c46.timestamp", cAlternateFileName="17DFC2~1.TIM")) returned 0 [0080.959] FindClose (in: hFindFile=0x5445a00 | out: hFindFile=0x5445a00) returned 1 [0080.965] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5419c78) returned 1 [0080.965] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542b798) returned 1 [0080.965] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541ada0) returned 1 Thread: id = 330 os_tid = 0x14fc [0072.190] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x542b8d0 [0072.190] wcscpy (in: _Dest=0x542b8d0, _Source="C:\\ProgramData\\Oracle\\Java\\installcache_x64" | out: _Dest="C:\\ProgramData\\Oracle\\Java\\installcache_x64") returned="C:\\ProgramData\\Oracle\\Java\\installcache_x64" [0072.190] wcscat (in: _Dest=0x542b8d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\") returned="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\" [0072.190] wcscat (in: _Dest=0x542b8d0, _Source="*" | out: _Dest="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\*") returned="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\*" [0072.190] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5417390 [0072.190] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\*", lpFindFileData=0x5417390 | out: lpFindFileData=0x5417390*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d35a5d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8d35a5d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f040 [0077.148] wcscmp (_String1=".", _String2=".") returned 0 [0077.148] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x5417390 | out: lpFindFileData=0x5417390*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d35a5d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8d35a5d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.148] wcscmp (_String1="..", _String2=".") returned 1 [0077.148] wcscmp (_String1="..", _String2="..") returned 0 [0077.148] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x5417390 | out: lpFindFileData=0x5417390*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa33265df, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa33265df, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa315c98a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4eba475, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseimagefam8", cAlternateFileName="BASEIM~1")) returned 1 [0077.148] wcscmp (_String1="baseimagefam8", _String2=".") returned 1 [0077.148] wcscmp (_String1="baseimagefam8", _String2="..") returned 1 [0077.148] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x74) returned 0x38d0d20 [0077.148] wcscpy (in: _Dest=0x38d0d20, _Source="C:\\ProgramData\\Oracle\\Java\\installcache_x64" | out: _Dest="C:\\ProgramData\\Oracle\\Java\\installcache_x64") returned="C:\\ProgramData\\Oracle\\Java\\installcache_x64" [0077.148] wcscat (in: _Dest=0x38d0d20, _Source="\\" | out: _Dest="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\") returned="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\" [0077.148] wcscat (in: _Dest=0x38d0d20, _Source="baseimagefam8" | out: _Dest="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\baseimagefam8") returned="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\baseimagefam8" [0081.004] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d0d20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1980 [0081.004] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x5417390 | out: lpFindFileData=0x5417390*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa33265df, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa33265df, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa315c98a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4eba475, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseimagefam8", cAlternateFileName="BASEIM~1")) returned 0 [0081.004] FindClose (in: hFindFile=0x389f040 | out: hFindFile=0x389f040) returned 1 [0081.005] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5417390) returned 1 [0081.005] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542b8d0) returned 1 [0081.005] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b5768) returned 1 Thread: id = 331 os_tid = 0x1500 [0072.191] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x5428df0 [0072.191] wcscpy (in: _Dest=0x5428df0, _Source="C:\\ProgramData\\Oracle\\Java\\javapath" | out: _Dest="C:\\ProgramData\\Oracle\\Java\\javapath") returned="C:\\ProgramData\\Oracle\\Java\\javapath" [0072.191] wcscat (in: _Dest=0x5428df0, _Source="\\" | out: _Dest="C:\\ProgramData\\Oracle\\Java\\javapath\\") returned="C:\\ProgramData\\Oracle\\Java\\javapath\\" [0072.191] wcscat (in: _Dest=0x5428df0, _Source="*" | out: _Dest="C:\\ProgramData\\Oracle\\Java\\javapath\\*") returned="C:\\ProgramData\\Oracle\\Java\\javapath\\*" [0072.191] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54175f8 [0072.191] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\*", lpFindFileData=0x54175f8 | out: lpFindFileData=0x54175f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54452c0 [0089.518] wcscmp (_String1=".", _String2=".") returned 0 [0089.518] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x54175f8 | out: lpFindFileData=0x54175f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.518] wcscmp (_String1="..", _String2=".") returned 1 [0089.518] wcscmp (_String1="..", _String2="..") returned 0 [0089.518] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x54175f8 | out: lpFindFileData=0x54175f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.exe", cAlternateFileName="")) returned 1 [0089.518] wcscmp (_String1="java.exe", _String2=".") returned 1 [0089.518] wcscmp (_String1="java.exe", _String2="..") returned 1 [0089.518] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x54175f8 | out: lpFindFileData=0x54175f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaw.exe", cAlternateFileName="")) returned 1 [0089.518] wcscmp (_String1="javaw.exe", _String2=".") returned 1 [0089.518] wcscmp (_String1="javaw.exe", _String2="..") returned 1 [0089.518] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x54175f8 | out: lpFindFileData=0x54175f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 1 [0089.518] wcscmp (_String1="javaws.exe", _String2=".") returned 1 [0089.518] wcscmp (_String1="javaws.exe", _String2="..") returned 1 [0089.518] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x54175f8 | out: lpFindFileData=0x54175f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 0 [0089.518] FindClose (in: hFindFile=0x54452c0 | out: hFindFile=0x54452c0) returned 1 [0089.518] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54175f8) returned 1 [0089.518] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5428df0) returned 1 [0089.518] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b8338) returned 1 Thread: id = 332 os_tid = 0x1504 [0072.241] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x68) returned 0x5468550 [0072.241] wcscpy (in: _Dest=0x5468550, _Source="C:\\ProgramData\\Oracle\\Java\\javapath_target_474984" | out: _Dest="C:\\ProgramData\\Oracle\\Java\\javapath_target_474984") returned="C:\\ProgramData\\Oracle\\Java\\javapath_target_474984" [0072.241] wcscat (in: _Dest=0x5468550, _Source="\\" | out: _Dest="C:\\ProgramData\\Oracle\\Java\\javapath_target_474984\\") returned="C:\\ProgramData\\Oracle\\Java\\javapath_target_474984\\" [0072.241] wcscat (in: _Dest=0x5468550, _Source="*" | out: _Dest="C:\\ProgramData\\Oracle\\Java\\javapath_target_474984\\*") returned="C:\\ProgramData\\Oracle\\Java\\javapath_target_474984\\*" [0072.241] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5417ac8 [0072.241] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath_target_474984\\*", lpFindFileData=0x5417ac8 | out: lpFindFileData=0x5417ac8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x75676c8 [0087.610] wcscmp (_String1=".", _String2=".") returned 0 [0087.611] FindNextFileW (hFindFile=0x75676c8, lpFindFileData=0x5417ac8) Thread: id = 333 os_tid = 0x1508 [0072.241] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x546dd90 [0072.242] wcscpy (in: _Dest=0x546dd90, _Source="C:\\Users\\Default.migrated\\AppData" | out: _Dest="C:\\Users\\Default.migrated\\AppData") returned="C:\\Users\\Default.migrated\\AppData" [0072.242] wcscat (in: _Dest=0x546dd90, _Source="\\" | out: _Dest="C:\\Users\\Default.migrated\\AppData\\") returned="C:\\Users\\Default.migrated\\AppData\\" [0072.242] wcscat (in: _Dest=0x546dd90, _Source="*" | out: _Dest="C:\\Users\\Default.migrated\\AppData\\*") returned="C:\\Users\\Default.migrated\\AppData\\*" [0072.242] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5417d30 [0072.242] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\*", lpFindFileData=0x5417d30 | out: lpFindFileData=0x5417d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7205420a, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ecc0 [0076.054] wcscmp (_String1=".", _String2=".") returned 0 [0076.054] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5417d30 | out: lpFindFileData=0x5417d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7205420a, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.054] wcscmp (_String1="..", _String2=".") returned 1 [0076.054] wcscmp (_String1="..", _String2="..") returned 0 [0076.054] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5417d30 | out: lpFindFileData=0x5417d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0076.055] wcscmp (_String1="Local", _String2=".") returned 1 [0076.055] wcscmp (_String1="Local", _String2="..") returned 1 [0076.055] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x3900410 [0076.055] wcscpy (in: _Dest=0x3900410, _Source="C:\\Users\\Default.migrated\\AppData" | out: _Dest="C:\\Users\\Default.migrated\\AppData") returned="C:\\Users\\Default.migrated\\AppData" [0076.055] wcscat (in: _Dest=0x3900410, _Source="\\" | out: _Dest="C:\\Users\\Default.migrated\\AppData\\") returned="C:\\Users\\Default.migrated\\AppData\\" [0076.055] wcscat (in: _Dest=0x3900410, _Source="Local" | out: _Dest="C:\\Users\\Default.migrated\\AppData\\Local") returned="C:\\Users\\Default.migrated\\AppData\\Local" [0081.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3900410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1104 [0081.103] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5417d30 | out: lpFindFileData=0x5417d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0 [0081.103] FindClose (in: hFindFile=0x389ecc0 | out: hFindFile=0x389ecc0) returned 1 [0081.104] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5417d30) returned 1 [0081.104] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x546dd90) returned 1 [0081.104] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b81f8) returned 1 Thread: id = 334 os_tid = 0x150c [0072.243] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x5428e48 [0072.243] wcscpy (in: _Dest=0x5428e48, _Source="C:\\Users\\Default.migrated\\Documents" | out: _Dest="C:\\Users\\Default.migrated\\Documents") returned="C:\\Users\\Default.migrated\\Documents" [0072.243] wcscat (in: _Dest=0x5428e48, _Source="\\" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\") returned="C:\\Users\\Default.migrated\\Documents\\" [0072.243] wcscat (in: _Dest=0x5428e48, _Source="*" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\*") returned="C:\\Users\\Default.migrated\\Documents\\*" [0072.243] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b3828 [0072.243] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\*", lpFindFileData=0x53b3828 | out: lpFindFileData=0x53b3828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba1330 [0079.766] wcscmp (_String1=".", _String2=".") returned 0 [0079.766] FindNextFileW (in: hFindFile=0x5ba1330, lpFindFileData=0x53b3828 | out: lpFindFileData=0x53b3828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.766] wcscmp (_String1="..", _String2=".") returned 1 [0079.766] wcscmp (_String1="..", _String2="..") returned 0 [0079.766] FindNextFileW (in: hFindFile=0x5ba1330, lpFindFileData=0x53b3828 | out: lpFindFileData=0x53b3828*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99a3d0f, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99a3d0f, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99a3d0f, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0079.766] wcscmp (_String1="My Music", _String2=".") returned 1 [0079.766] wcscmp (_String1="My Music", _String2="..") returned 1 [0079.766] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x6e95bd0 [0079.766] wcscpy (in: _Dest=0x6e95bd0, _Source="C:\\Users\\Default.migrated\\Documents" | out: _Dest="C:\\Users\\Default.migrated\\Documents") returned="C:\\Users\\Default.migrated\\Documents" [0079.766] wcscat (in: _Dest=0x6e95bd0, _Source="\\" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\") returned="C:\\Users\\Default.migrated\\Documents\\" [0079.766] wcscat (in: _Dest=0x6e95bd0, _Source="My Music" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Music") returned="C:\\Users\\Default.migrated\\Documents\\My Music" [0080.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x6e95bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3fc [0080.527] FindNextFileW (in: hFindFile=0x5ba1330, lpFindFileData=0x53b3828 | out: lpFindFileData=0x53b3828*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0080.527] wcscmp (_String1="My Pictures", _String2=".") returned 1 [0080.527] wcscmp (_String1="My Pictures", _String2="..") returned 1 [0080.527] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x6e959c8 [0080.527] wcscpy (in: _Dest=0x6e959c8, _Source="C:\\Users\\Default.migrated\\Documents" | out: _Dest="C:\\Users\\Default.migrated\\Documents") returned="C:\\Users\\Default.migrated\\Documents" [0080.527] wcscat (in: _Dest=0x6e959c8, _Source="\\" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\") returned="C:\\Users\\Default.migrated\\Documents\\" [0080.527] wcscat (in: _Dest=0x6e959c8, _Source="My Pictures" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Pictures") returned="C:\\Users\\Default.migrated\\Documents\\My Pictures" [0080.527] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x6e959c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x408 [0080.528] FindNextFileW (in: hFindFile=0x5ba1330, lpFindFileData=0x53b3828 | out: lpFindFileData=0x53b3828*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0080.528] wcscmp (_String1="My Videos", _String2=".") returned 1 [0080.528] wcscmp (_String1="My Videos", _String2="..") returned 1 [0080.528] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x6e95a98 [0080.528] wcscpy (in: _Dest=0x6e95a98, _Source="C:\\Users\\Default.migrated\\Documents" | out: _Dest="C:\\Users\\Default.migrated\\Documents") returned="C:\\Users\\Default.migrated\\Documents" [0080.528] wcscat (in: _Dest=0x6e95a98, _Source="\\" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\") returned="C:\\Users\\Default.migrated\\Documents\\" [0080.528] wcscat (in: _Dest=0x6e95a98, _Source="My Videos" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Videos") returned="C:\\Users\\Default.migrated\\Documents\\My Videos" [0080.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x6e95a98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410 [0080.529] FindNextFileW (in: hFindFile=0x5ba1330, lpFindFileData=0x53b3828 | out: lpFindFileData=0x53b3828*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0080.529] FindClose (in: hFindFile=0x5ba1330 | out: hFindFile=0x5ba1330) returned 1 [0080.530] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b3828) returned 1 [0080.530] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5428e48) returned 1 [0080.530] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b8068) returned 1 Thread: id = 335 os_tid = 0x1510 [0072.244] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8c) returned 0x38a7a88 [0072.244] wcscpy (in: _Dest=0x38a7a88, _Source="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204") returned="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" [0072.244] wcscat (in: _Dest=0x38a7a88, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\") returned="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\" [0072.244] wcscat (in: _Dest=0x38a7a88, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\*") returned="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\*" [0072.244] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b1b48 [0072.244] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\*", lpFindFileData=0x53b1b48 | out: lpFindFileData=0x53b1b48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f400 [0075.138] wcscmp (_String1=".", _String2=".") returned 0 [0075.138] FindNextFileW (in: hFindFile=0x389f400, lpFindFileData=0x53b1b48 | out: lpFindFileData=0x53b1b48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.138] wcscmp (_String1="..", _String2=".") returned 1 [0075.138] wcscmp (_String1="..", _String2="..") returned 0 [0075.138] FindNextFileW (in: hFindFile=0x389f400, lpFindFileData=0x53b1b48 | out: lpFindFileData=0x53b1b48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041220b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="154E23D0-C644-4E6F-8CE6-5069272F999F.vsch", cAlternateFileName="154E23~1.VSC")) returned 1 [0075.138] wcscmp (_String1="154E23D0-C644-4E6F-8CE6-5069272F999F.vsch", _String2=".") returned 1 [0075.138] wcscmp (_String1="154E23D0-C644-4E6F-8CE6-5069272F999F.vsch", _String2="..") returned 1 [0075.138] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x38cf3a0 [0075.138] wcscpy (in: _Dest=0x38cf3a0, _Source="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204") returned="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" [0075.138] wcscat (in: _Dest=0x38cf3a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\") returned="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\" [0075.138] wcscat (in: _Dest=0x38cf3a0, _Source="154E23D0-C644-4E6F-8CE6-5069272F999F.vsch" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch") returned="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch" [0081.183] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38cf3a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc68 [0081.183] FindNextFileW (in: hFindFile=0x389f400, lpFindFileData=0x53b1b48 | out: lpFindFileData=0x53b1b48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041220b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch", cAlternateFileName="2F1A65~1.VSC")) returned 1 [0081.183] wcscmp (_String1="2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch", _String2=".") returned 1 [0081.183] wcscmp (_String1="2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch", _String2="..") returned 1 [0081.183] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x54bb068 [0081.183] wcscpy (in: _Dest=0x54bb068, _Source="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204") returned="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" [0081.183] wcscat (in: _Dest=0x54bb068, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\") returned="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\" [0081.183] wcscat (in: _Dest=0x54bb068, _Source="2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch") returned="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch" [0081.183] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bb068, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b94 [0081.184] FindNextFileW (in: hFindFile=0x389f400, lpFindFileData=0x53b1b48 | out: lpFindFileData=0x53b1b48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041220b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x0, dwReserved1=0x0, cFileName="3CCD5499-87A8-4B10-A215-608888DD3B55.vsch", cAlternateFileName="3CCD54~1.VSC")) returned 1 [0081.184] wcscmp (_String1="3CCD5499-87A8-4B10-A215-608888DD3B55.vsch", _String2=".") returned 1 [0081.184] wcscmp (_String1="3CCD5499-87A8-4B10-A215-608888DD3B55.vsch", _String2="..") returned 1 [0081.184] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x54bb150 [0081.184] wcscpy (in: _Dest=0x54bb150, _Source="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204") returned="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" [0081.184] wcscat (in: _Dest=0x54bb150, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\") returned="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\" [0081.184] wcscat (in: _Dest=0x54bb150, _Source="3CCD5499-87A8-4B10-A215-608888DD3B55.vsch" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch") returned="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch" [0081.184] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bb150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b98 [0081.185] FindNextFileW (in: hFindFile=0x389f400, lpFindFileData=0x53b1b48 | out: lpFindFileData=0x53b1b48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc02e0f2e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc02e0f2e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc02e0f2e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.vpol", cAlternateFileName="POLICY~1.VPO")) returned 1 [0081.185] wcscmp (_String1="Policy.vpol", _String2=".") returned 1 [0081.185] wcscmp (_String1="Policy.vpol", _String2="..") returned 1 [0081.185] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa0) returned 0x54a2640 [0081.185] wcscpy (in: _Dest=0x54a2640, _Source="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204") returned="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" [0081.185] wcscat (in: _Dest=0x54a2640, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\") returned="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\" [0081.185] wcscat (in: _Dest=0x54a2640, _Source="Policy.vpol" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol") returned="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol" [0081.185] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54a2640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b9c [0081.186] FindNextFileW (in: hFindFile=0x389f400, lpFindFileData=0x53b1b48 | out: lpFindFileData=0x53b1b48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc02e0f2e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc02e0f2e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc02e0f2e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.vpol", cAlternateFileName="POLICY~1.VPO")) returned 0 [0081.186] FindClose (in: hFindFile=0x389f400 | out: hFindFile=0x389f400) returned 1 [0081.186] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b1b48) returned 1 [0081.186] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a7a88) returned 1 [0081.186] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a9568) returned 1 Thread: id = 336 os_tid = 0x1514 [0072.245] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\05DBE9EA-EF75-43DB-8A03-27898B59D1E9" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\05dbe9ea-ef75-43db-8a03-27898b59d1e9")) returned 0x20 [0085.987] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\05DBE9EA-EF75-43DB-8A03-27898B59D1E9", dwFileAttributes=0x20) returned 0 [0087.662] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\05DBE9EA-EF75-43DB-8A03-27898B59D1E9" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\05dbe9ea-ef75-43db-8a03-27898b59d1e9"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.567] GetLastError () returned 0x5 [0089.567] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\05DBE9EA-EF75-43DB-8A03-27898B59D1E9", dwFileAttributes=0x20) returned 0 [0089.607] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fe0c8) returned 1 Thread: id = 337 os_tid = 0x1518 [0072.245] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\appxblockmap.xml")) returned 0x20 [0081.263] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0081.263] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0081.263] GetLastError () returned 0x5 [0081.263] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0081.264] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38af788) Thread: id = 338 os_tid = 0x151c [0072.246] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\appxmanifest.xml")) returned 0x20 [0082.517] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0082.542] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.566] GetLastError () returned 0x5 [0082.566] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0082.580] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38af848) returned 1 Thread: id = 339 os_tid = 0x1520 [0072.246] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x5446368 [0072.246] wcscpy (in: _Dest=0x5446368, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxMetadata" [0072.246] wcscat (in: _Dest=0x5446368, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxMetadata\\" [0072.246] wcscat (in: _Dest=0x5446368, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxMetadata\\*" [0072.246] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b2750 [0072.246] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxMetadata\\*", lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x228b384c, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa93abe68, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x228b384c, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444ec0 [0077.329] wcscmp (_String1=".", _String2=".") returned 0 [0077.329] FindNextFileW (in: hFindFile=0x5444ec0, lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x228b384c, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa93abe68, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x228b384c, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.329] wcscmp (_String1="..", _String2=".") returned 1 [0077.329] wcscmp (_String1="..", _String2="..") returned 0 [0077.329] FindNextFileW (in: hFindFile=0x5444ec0, lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x228b384c, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x228b384c, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x2bbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="CODEIN~1.CAT")) returned 1 [0077.329] wcscmp (_String1="CodeIntegrity.cat", _String2=".") returned 1 [0077.329] wcscmp (_String1="CodeIntegrity.cat", _String2="..") returned 1 [0077.329] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x389e050 [0077.329] wcscpy (in: _Dest=0x389e050, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxMetadata" [0077.329] wcscat (in: _Dest=0x389e050, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxMetadata\\" [0077.329] wcscat (in: _Dest=0x389e050, _Source="CodeIntegrity.cat" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxMetadata\\CodeIntegrity.cat") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxMetadata\\CodeIntegrity.cat" [0080.931] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x389e050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1238 [0080.931] FindNextFileW (in: hFindFile=0x5444ec0, lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x228b384c, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x228b384c, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x2bbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="CODEIN~1.CAT")) returned 0 [0080.931] FindClose (in: hFindFile=0x5444ec0 | out: hFindFile=0x5444ec0) returned 1 [0080.932] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b2750) returned 1 [0080.932] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5446368) returned 1 [0080.932] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5446a98) returned 1 Thread: id = 340 os_tid = 0x1524 [0072.247] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\appxsignature.p7x")) returned 0x20 [0082.644] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0087.661] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.661] GetLastError () returned 0x5 [0087.661] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0089.566] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38af908) returned 1 Thread: id = 341 os_tid = 0x1528 [0072.248] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa4) returned 0x388f720 [0072.248] wcscpy (in: _Dest=0x388f720, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0072.248] wcscat (in: _Dest=0x388f720, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0072.248] wcscat (in: _Dest=0x388f720, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\*") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\*" [0072.248] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b30f0 [0072.248] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\*", lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x229e4b3b, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa94b581e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2310be20, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f580 [0075.140] wcscmp (_String1=".", _String2=".") returned 0 [0075.141] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x229e4b3b, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa94b581e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2310be20, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.148] wcscmp (_String1="..", _String2=".") returned 1 [0075.148] wcscmp (_String1="..", _String2="..") returned 0 [0075.148] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x229e4b3b, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa95725d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x22a0ae1c, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="App", cAlternateFileName="")) returned 1 [0075.148] wcscmp (_String1="App", _String2=".") returned 1 [0075.148] wcscmp (_String1="App", _String2="..") returned 1 [0075.148] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa8) returned 0x54de7c0 [0075.148] wcscpy (in: _Dest=0x54de7c0, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0075.148] wcscat (in: _Dest=0x54de7c0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0075.148] wcscat (in: _Dest=0x54de7c0, _Source="App" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App" [0076.004] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54de7c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc80 [0076.004] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a0ae1c, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a0ae1c, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x0, dwReserved1=0x0, cFileName="list.scale-100.png", cAlternateFileName="LISTSC~1.PNG")) returned 1 [0076.004] wcscmp (_String1="list.scale-100.png", _String2=".") returned 1 [0076.004] wcscmp (_String1="list.scale-100.png", _String2="..") returned 1 [0076.004] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x3971b20 [0076.004] wcscpy (in: _Dest=0x3971b20, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.004] wcscat (in: _Dest=0x3971b20, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.004] wcscat (in: _Dest=0x3971b20, _Source="list.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\list.scale-100.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\list.scale-100.png" [0076.004] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3971b20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1054 [0076.005] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a0ae1c, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a0ae1c, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x0, dwReserved1=0x0, cFileName="list.scale-100_contrast-black.png", cAlternateFileName="LISTSC~2.PNG")) returned 1 [0076.005] wcscmp (_String1="list.scale-100_contrast-black.png", _String2=".") returned 1 [0076.005] wcscmp (_String1="list.scale-100_contrast-black.png", _String2="..") returned 1 [0076.005] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe4) returned 0x396ec68 [0076.005] wcscpy (in: _Dest=0x396ec68, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.005] wcscat (in: _Dest=0x396ec68, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.005] wcscat (in: _Dest=0x396ec68, _Source="list.scale-100_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\list.scale-100_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\list.scale-100_contrast-black.png" [0076.005] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396ec68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1058 [0076.006] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a0ae1c, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a0ae1c, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x132, dwReserved0=0x0, dwReserved1=0x0, cFileName="list.scale-100_contrast-white.png", cAlternateFileName="LISTSC~3.PNG")) returned 1 [0076.006] wcscmp (_String1="list.scale-100_contrast-white.png", _String2=".") returned 1 [0076.006] wcscmp (_String1="list.scale-100_contrast-white.png", _String2="..") returned 1 [0076.006] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe4) returned 0x3970018 [0076.006] wcscpy (in: _Dest=0x3970018, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.006] wcscat (in: _Dest=0x3970018, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.006] wcscat (in: _Dest=0x3970018, _Source="list.scale-100_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\list.scale-100_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\list.scale-100_contrast-white.png" [0076.006] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3970018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x105c [0076.007] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22a31024, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa95a0375, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x22a572ca, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Periscope", cAlternateFileName="PERISC~1")) returned 1 [0076.007] wcscmp (_String1="Periscope", _String2=".") returned 1 [0076.007] wcscmp (_String1="Periscope", _String2="..") returned 1 [0076.007] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb4) returned 0x3904d20 [0076.007] wcscpy (in: _Dest=0x3904d20, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.007] wcscat (in: _Dest=0x3904d20, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.007] wcscat (in: _Dest=0x3904d20, _Source="Periscope" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope" [0076.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3904d20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1060 [0076.008] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a572ca, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a572ca, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x181, dwReserved0=0x0, dwReserved1=0x0, cFileName="search.scale-100.png", cAlternateFileName="SEARCH~1.PNG")) returned 1 [0076.008] wcscmp (_String1="search.scale-100.png", _String2=".") returned 1 [0076.008] wcscmp (_String1="search.scale-100.png", _String2="..") returned 1 [0076.008] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xca) returned 0x3973b98 [0076.008] wcscpy (in: _Dest=0x3973b98, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.008] wcscat (in: _Dest=0x3973b98, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.008] wcscat (in: _Dest=0x3973b98, _Source="search.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\search.scale-100.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\search.scale-100.png" [0076.008] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3973b98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1064 [0076.009] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a572ca, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a572ca, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x181, dwReserved0=0x0, dwReserved1=0x0, cFileName="search.scale-100_contrast-black.png", cAlternateFileName="SEARCH~2.PNG")) returned 1 [0076.009] wcscmp (_String1="search.scale-100_contrast-black.png", _String2=".") returned 1 [0076.009] wcscmp (_String1="search.scale-100_contrast-black.png", _String2="..") returned 1 [0076.009] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x396fa78 [0076.009] wcscpy (in: _Dest=0x396fa78, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.009] wcscat (in: _Dest=0x396fa78, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.009] wcscat (in: _Dest=0x396fa78, _Source="search.scale-100_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\search.scale-100_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\search.scale-100_contrast-black.png" [0076.009] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396fa78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1068 [0076.010] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a7d4f7, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a7d4f7, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x195, dwReserved0=0x0, dwReserved1=0x0, cFileName="search.scale-100_contrast-white.png", cAlternateFileName="SEARCH~3.PNG")) returned 1 [0076.010] wcscmp (_String1="search.scale-100_contrast-white.png", _String2=".") returned 1 [0076.010] wcscmp (_String1="search.scale-100_contrast-white.png", _String2="..") returned 1 [0076.010] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x396ef38 [0076.010] wcscpy (in: _Dest=0x396ef38, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.010] wcscat (in: _Dest=0x396ef38, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.010] wcscat (in: _Dest=0x396ef38, _Source="search.scale-100_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\search.scale-100_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\search.scale-100_contrast-white.png" [0076.010] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396ef38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x106c [0076.011] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a7d4f7, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a7d4f7, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x703, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.scale-100.png", cAlternateFileName="STOREL~1.PNG")) returned 1 [0076.011] wcscmp (_String1="StoreLogo.scale-100.png", _String2=".") returned 1 [0076.011] wcscmp (_String1="StoreLogo.scale-100.png", _String2="..") returned 1 [0076.011] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x3973760 [0076.011] wcscpy (in: _Dest=0x3973760, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.011] wcscat (in: _Dest=0x3973760, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.011] wcscat (in: _Dest=0x3973760, _Source="StoreLogo.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\StoreLogo.scale-100.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\StoreLogo.scale-100.png" [0076.011] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3973760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1070 [0076.011] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a7d4f7, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a7d4f7, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x890, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.scale-140.png", cAlternateFileName="STOREL~2.PNG")) returned 1 [0076.011] wcscmp (_String1="StoreLogo.scale-140.png", _String2=".") returned 1 [0076.011] wcscmp (_String1="StoreLogo.scale-140.png", _String2="..") returned 1 [0076.011] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x3973c70 [0076.012] wcscpy (in: _Dest=0x3973c70, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.012] wcscat (in: _Dest=0x3973c70, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.012] wcscat (in: _Dest=0x3973c70, _Source="StoreLogo.scale-140.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\StoreLogo.scale-140.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\StoreLogo.scale-140.png" [0076.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3973c70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1074 [0076.012] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a7d4f7, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a7d4f7, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x9f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.scale-180.png", cAlternateFileName="STOREL~3.PNG")) returned 1 [0076.012] wcscmp (_String1="StoreLogo.scale-180.png", _String2=".") returned 1 [0076.012] wcscmp (_String1="StoreLogo.scale-180.png", _String2="..") returned 1 [0076.012] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x3973838 [0076.012] wcscpy (in: _Dest=0x3973838, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.012] wcscat (in: _Dest=0x3973838, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.012] wcscat (in: _Dest=0x3973838, _Source="StoreLogo.scale-180.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\StoreLogo.scale-180.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\StoreLogo.scale-180.png" [0076.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3973838, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1078 [0076.013] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a7d4f7, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a7d4f7, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x2bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.scale-100.png", cAlternateFileName="TWITTE~1.PNG")) returned 1 [0076.013] wcscmp (_String1="TwitterAppList.scale-100.png", _String2=".") returned 1 [0076.013] wcscmp (_String1="TwitterAppList.scale-100.png", _String2="..") returned 1 [0076.013] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x54f1b70 [0076.013] wcscpy (in: _Dest=0x54f1b70, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.013] wcscat (in: _Dest=0x54f1b70, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.013] wcscat (in: _Dest=0x54f1b70, _Source="TwitterAppList.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-100.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-100.png" [0076.013] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f1b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x107c [0076.014] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a7d4f7, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a7d4f7, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x2bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.scale-100_contrast-black.png", cAlternateFileName="TWITTE~2.PNG")) returned 1 [0076.014] wcscmp (_String1="TwitterAppList.scale-100_contrast-black.png", _String2=".") returned 1 [0076.014] wcscmp (_String1="TwitterAppList.scale-100_contrast-black.png", _String2="..") returned 1 [0076.014] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf8) returned 0x54a3d00 [0076.014] wcscpy (in: _Dest=0x54a3d00, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.014] wcscat (in: _Dest=0x54a3d00, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.014] wcscat (in: _Dest=0x54a3d00, _Source="TwitterAppList.scale-100_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-100_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-100_contrast-black.png" [0076.015] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54a3d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1080 [0076.015] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a7d4f7, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a7d4f7, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.scale-100_contrast-white.png", cAlternateFileName="TWITTE~3.PNG")) returned 1 [0076.015] wcscmp (_String1="TwitterAppList.scale-100_contrast-white.png", _String2=".") returned 1 [0076.015] wcscmp (_String1="TwitterAppList.scale-100_contrast-white.png", _String2="..") returned 1 [0076.015] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf8) returned 0x54a3500 [0076.015] wcscpy (in: _Dest=0x54a3500, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.015] wcscat (in: _Dest=0x54a3500, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.015] wcscat (in: _Dest=0x54a3500, _Source="TwitterAppList.scale-100_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-100_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-100_contrast-white.png" [0076.016] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54a3500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1084 [0076.016] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a7d4f7, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a7d4f7, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x33a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.scale-125.png", cAlternateFileName="TWITTE~4.PNG")) returned 1 [0076.016] wcscmp (_String1="TwitterAppList.scale-125.png", _String2=".") returned 1 [0076.016] wcscmp (_String1="TwitterAppList.scale-125.png", _String2="..") returned 1 [0076.016] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x54f0950 [0076.016] wcscpy (in: _Dest=0x54f0950, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.016] wcscat (in: _Dest=0x54f0950, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.016] wcscat (in: _Dest=0x54f0950, _Source="TwitterAppList.scale-125.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-125.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-125.png" [0076.016] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f0950, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1088 [0076.017] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a7d4f7, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a7d4f7, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x33a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.scale-125_contrast-black.png", cAlternateFileName="TW6165~1.PNG")) returned 1 [0076.017] wcscmp (_String1="TwitterAppList.scale-125_contrast-black.png", _String2=".") returned 1 [0076.017] wcscmp (_String1="TwitterAppList.scale-125_contrast-black.png", _String2="..") returned 1 [0076.017] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf8) returned 0x54a3e00 [0076.018] wcscpy (in: _Dest=0x54a3e00, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.018] wcscat (in: _Dest=0x54a3e00, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.018] wcscat (in: _Dest=0x54a3e00, _Source="TwitterAppList.scale-125_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-125_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-125_contrast-black.png" [0076.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54a3e00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x108c [0076.018] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a7d4f7, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a7d4f7, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x35c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.scale-125_contrast-white.png", cAlternateFileName="TWBB5A~1.PNG")) returned 1 [0076.018] wcscmp (_String1="TwitterAppList.scale-125_contrast-white.png", _String2=".") returned 1 [0076.019] wcscmp (_String1="TwitterAppList.scale-125_contrast-white.png", _String2="..") returned 1 [0076.019] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf8) returned 0x54a4400 [0076.019] wcscpy (in: _Dest=0x54a4400, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.019] wcscat (in: _Dest=0x54a4400, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.019] wcscat (in: _Dest=0x54a4400, _Source="TwitterAppList.scale-125_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-125_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-125_contrast-white.png" [0076.019] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54a4400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1090 [0076.019] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a7d4f7, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a7d4f7, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x3f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.scale-150.png", cAlternateFileName="TW1D56~1.PNG")) returned 1 [0076.019] wcscmp (_String1="TwitterAppList.scale-150.png", _String2=".") returned 1 [0076.019] wcscmp (_String1="TwitterAppList.scale-150.png", _String2="..") returned 1 [0076.019] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x54f1348 [0076.019] wcscpy (in: _Dest=0x54f1348, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.020] wcscat (in: _Dest=0x54f1348, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.020] wcscat (in: _Dest=0x54f1348, _Source="TwitterAppList.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-150.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-150.png" [0076.020] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f1348, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1094 [0076.020] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a7d4f7, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a7d4f7, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x3f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.scale-150_contrast-black.png", cAlternateFileName="TW999F~1.PNG")) returned 1 [0076.020] wcscmp (_String1="TwitterAppList.scale-150_contrast-black.png", _String2=".") returned 1 [0076.020] wcscmp (_String1="TwitterAppList.scale-150_contrast-black.png", _String2="..") returned 1 [0076.020] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf8) returned 0x54a3000 [0076.020] wcscpy (in: _Dest=0x54a3000, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.020] wcscat (in: _Dest=0x54a3000, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.020] wcscat (in: _Dest=0x54a3000, _Source="TwitterAppList.scale-150_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-150_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-150_contrast-black.png" [0076.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54a3000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1098 [0076.021] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a7d4f7, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a7d4f7, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x40a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.scale-150_contrast-white.png", cAlternateFileName="TW8867~1.PNG")) returned 1 [0076.021] wcscmp (_String1="TwitterAppList.scale-150_contrast-white.png", _String2=".") returned 1 [0076.021] wcscmp (_String1="TwitterAppList.scale-150_contrast-white.png", _String2="..") returned 1 [0076.021] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf8) returned 0x54a3f00 [0076.021] wcscpy (in: _Dest=0x54a3f00, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.021] wcscat (in: _Dest=0x54a3f00, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.021] wcscat (in: _Dest=0x54a3f00, _Source="TwitterAppList.scale-150_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-150_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-150_contrast-white.png" [0076.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54a3f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x109c [0076.022] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a7d4f7, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a7d4f7, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x57d, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.scale-200.png", cAlternateFileName="TW1BCF~1.PNG")) returned 1 [0076.022] wcscmp (_String1="TwitterAppList.scale-200.png", _String2=".") returned 1 [0076.022] wcscmp (_String1="TwitterAppList.scale-200.png", _String2="..") returned 1 [0076.022] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x54f1430 [0076.022] wcscpy (in: _Dest=0x54f1430, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.022] wcscat (in: _Dest=0x54f1430, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.022] wcscat (in: _Dest=0x54f1430, _Source="TwitterAppList.scale-200.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-200.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-200.png" [0076.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f1430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10a0 [0076.023] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a7d4f7, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a7d4f7, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x57d, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.scale-200_contrast-black.png", cAlternateFileName="TW9F6F~1.PNG")) returned 1 [0076.023] wcscmp (_String1="TwitterAppList.scale-200_contrast-black.png", _String2=".") returned 1 [0076.023] wcscmp (_String1="TwitterAppList.scale-200_contrast-black.png", _String2="..") returned 1 [0076.023] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf8) returned 0x54a4000 [0076.023] wcscpy (in: _Dest=0x54a4000, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.023] wcscat (in: _Dest=0x54a4000, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.023] wcscat (in: _Dest=0x54a4000, _Source="TwitterAppList.scale-200_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-200_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-200_contrast-black.png" [0076.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54a4000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10a4 [0076.024] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a7d4f7, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a7d4f7, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x54d, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.scale-200_contrast-white.png", cAlternateFileName="TW8297~1.PNG")) returned 1 [0076.024] wcscmp (_String1="TwitterAppList.scale-200_contrast-white.png", _String2=".") returned 1 [0076.024] wcscmp (_String1="TwitterAppList.scale-200_contrast-white.png", _String2="..") returned 1 [0076.024] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf8) returned 0x54a3200 [0076.024] wcscpy (in: _Dest=0x54a3200, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.024] wcscat (in: _Dest=0x54a3200, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.024] wcscat (in: _Dest=0x54a3200, _Source="TwitterAppList.scale-200_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-200_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-200_contrast-white.png" [0076.024] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54a3200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10a8 [0076.025] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a7d4f7, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a7d4f7, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0xd30, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.scale-400.png", cAlternateFileName="TW799D~1.PNG")) returned 1 [0076.025] wcscmp (_String1="TwitterAppList.scale-400.png", _String2=".") returned 1 [0076.025] wcscmp (_String1="TwitterAppList.scale-400.png", _String2="..") returned 1 [0076.025] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x54f0c08 [0076.025] wcscpy (in: _Dest=0x54f0c08, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.025] wcscat (in: _Dest=0x54f0c08, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.025] wcscat (in: _Dest=0x54f0c08, _Source="TwitterAppList.scale-400.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-400.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-400.png" [0076.025] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f0c08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10ac [0076.026] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22aa3768, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22aa3768, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0xd30, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.scale-400_contrast-black.png", cAlternateFileName="TW91F4~1.PNG")) returned 1 [0076.026] wcscmp (_String1="TwitterAppList.scale-400_contrast-black.png", _String2=".") returned 1 [0076.026] wcscmp (_String1="TwitterAppList.scale-400_contrast-black.png", _String2="..") returned 1 [0076.026] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf8) returned 0x54a4500 [0076.026] wcscpy (in: _Dest=0x54a4500, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.026] wcscat (in: _Dest=0x54a4500, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.026] wcscat (in: _Dest=0x54a4500, _Source="TwitterAppList.scale-400_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-400_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-400_contrast-black.png" [0076.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54a4500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10b0 [0076.027] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22aa3768, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22aa3768, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0xad2, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.scale-400_contrast-white.png", cAlternateFileName="TW1B2E~1.PNG")) returned 1 [0076.030] wcscmp (_String1="TwitterAppList.scale-400_contrast-white.png", _String2=".") returned 1 [0076.030] wcscmp (_String1="TwitterAppList.scale-400_contrast-white.png", _String2="..") returned 1 [0076.030] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf8) returned 0x54a4b00 [0076.030] wcscpy (in: _Dest=0x54a4b00, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.030] wcscat (in: _Dest=0x54a4b00, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.030] wcscat (in: _Dest=0x54a4b00, _Source="TwitterAppList.scale-400_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-400_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-400_contrast-white.png" [0076.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54a4b00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10b4 [0076.031] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22aa3768, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22aa3768, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.targetsize-16.png", cAlternateFileName="TW791B~1.PNG")) returned 1 [0076.031] wcscmp (_String1="TwitterAppList.targetsize-16.png", _String2=".") returned 1 [0076.031] wcscmp (_String1="TwitterAppList.targetsize-16.png", _String2="..") returned 1 [0076.031] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x3970108 [0076.031] wcscpy (in: _Dest=0x3970108, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.031] wcscat (in: _Dest=0x3970108, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.031] wcscat (in: _Dest=0x3970108, _Source="TwitterAppList.targetsize-16.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16.png" [0076.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3970108, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10b8 [0076.032] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22aa3768, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22aa3768, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.targetsize-16_altform-unplated.png", cAlternateFileName="TWF7AA~1.PNG")) returned 1 [0076.032] wcscmp (_String1="TwitterAppList.targetsize-16_altform-unplated.png", _String2=".") returned 1 [0076.032] wcscmp (_String1="TwitterAppList.targetsize-16_altform-unplated.png", _String2="..") returned 1 [0076.032] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x104) returned 0x3979ed8 [0076.032] wcscpy (in: _Dest=0x3979ed8, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.032] wcscat (in: _Dest=0x3979ed8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.032] wcscat (in: _Dest=0x3979ed8, _Source="TwitterAppList.targetsize-16_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16_altform-unplated.png" [0076.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3979ed8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10bc [0076.033] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22aa3768, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22aa3768, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.targetsize-16_contrast-black.png", cAlternateFileName="TW65FE~1.PNG")) returned 1 [0076.033] wcscmp (_String1="TwitterAppList.targetsize-16_contrast-black.png", _String2=".") returned 1 [0076.033] wcscmp (_String1="TwitterAppList.targetsize-16_contrast-black.png", _String2="..") returned 1 [0076.033] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100) returned 0x549ab80 [0076.033] wcscpy (in: _Dest=0x549ab80, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.033] wcscat (in: _Dest=0x549ab80, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.033] wcscat (in: _Dest=0x549ab80, _Source="TwitterAppList.targetsize-16_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16_contrast-black.png" [0076.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549ab80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c0 [0076.034] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22aa3768, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22aa3768, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x17e, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.targetsize-16_contrast-white.png", cAlternateFileName="TWBC08~1.PNG")) returned 1 [0076.034] wcscmp (_String1="TwitterAppList.targetsize-16_contrast-white.png", _String2=".") returned 1 [0076.034] wcscmp (_String1="TwitterAppList.targetsize-16_contrast-white.png", _String2="..") returned 1 [0076.034] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100) returned 0x549a760 [0076.034] wcscpy (in: _Dest=0x549a760, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.034] wcscat (in: _Dest=0x549a760, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.034] wcscat (in: _Dest=0x549a760, _Source="TwitterAppList.targetsize-16_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16_contrast-white.png" [0076.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549a760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c4 [0076.035] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22aa3768, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22aa3768, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.targetsize-20.png", cAlternateFileName="TW2E8D~1.PNG")) returned 1 [0076.035] wcscmp (_String1="TwitterAppList.targetsize-20.png", _String2=".") returned 1 [0076.035] wcscmp (_String1="TwitterAppList.targetsize-20.png", _String2="..") returned 1 [0076.035] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x396f028 [0076.035] wcscpy (in: _Dest=0x396f028, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.035] wcscat (in: _Dest=0x396f028, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.035] wcscat (in: _Dest=0x396f028, _Source="TwitterAppList.targetsize-20.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20.png" [0076.035] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396f028, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c8 [0076.036] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22aa3768, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22aa3768, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.targetsize-20_altform-unplated.png", cAlternateFileName="TW559B~1.PNG")) returned 1 [0076.036] wcscmp (_String1="TwitterAppList.targetsize-20_altform-unplated.png", _String2=".") returned 1 [0076.036] wcscmp (_String1="TwitterAppList.targetsize-20_altform-unplated.png", _String2="..") returned 1 [0076.036] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x104) returned 0x549b4b0 [0076.036] wcscpy (in: _Dest=0x549b4b0, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.036] wcscat (in: _Dest=0x549b4b0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.036] wcscat (in: _Dest=0x549b4b0, _Source="TwitterAppList.targetsize-20_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20_altform-unplated.png" [0076.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549b4b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10cc [0076.037] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22aa3768, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22aa3768, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.targetsize-20_contrast-black.png", cAlternateFileName="TW064E~1.PNG")) returned 1 [0076.037] wcscmp (_String1="TwitterAppList.targetsize-20_contrast-black.png", _String2=".") returned 1 [0076.037] wcscmp (_String1="TwitterAppList.targetsize-20_contrast-black.png", _String2="..") returned 1 [0076.037] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100) returned 0x549ad90 [0076.037] wcscpy (in: _Dest=0x549ad90, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.037] wcscat (in: _Dest=0x549ad90, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.037] wcscat (in: _Dest=0x549ad90, _Source="TwitterAppList.targetsize-20_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20_contrast-black.png" [0076.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549ad90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10d0 [0076.038] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22aa3768, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22aa3768, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.targetsize-20_contrast-white.png", cAlternateFileName="TWAB1C~1.PNG")) returned 1 [0076.038] wcscmp (_String1="TwitterAppList.targetsize-20_contrast-white.png", _String2=".") returned 1 [0076.038] wcscmp (_String1="TwitterAppList.targetsize-20_contrast-white.png", _String2="..") returned 1 [0076.038] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100) returned 0x5499e18 [0076.038] wcscpy (in: _Dest=0x5499e18, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.038] wcscat (in: _Dest=0x5499e18, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.038] wcscat (in: _Dest=0x5499e18, _Source="TwitterAppList.targetsize-20_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20_contrast-white.png" [0076.038] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5499e18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10d4 [0076.039] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22ac99c3, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22ac99c3, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x1dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.targetsize-24.png", cAlternateFileName="TW3CF4~1.PNG")) returned 1 [0076.039] wcscmp (_String1="TwitterAppList.targetsize-24.png", _String2=".") returned 1 [0076.039] wcscmp (_String1="TwitterAppList.targetsize-24.png", _String2="..") returned 1 [0076.039] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x39702e8 [0076.039] wcscpy (in: _Dest=0x39702e8, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.039] wcscat (in: _Dest=0x39702e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.039] wcscat (in: _Dest=0x39702e8, _Source="TwitterAppList.targetsize-24.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24.png" [0076.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x39702e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10d8 [0076.040] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22ac99c3, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22ac99c3, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.targetsize-24_altform-unplated.png", cAlternateFileName="TW837F~1.PNG")) returned 1 [0076.040] wcscmp (_String1="TwitterAppList.targetsize-24_altform-unplated.png", _String2=".") returned 1 [0076.040] wcscmp (_String1="TwitterAppList.targetsize-24_altform-unplated.png", _String2="..") returned 1 [0076.040] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x104) returned 0x549b5c0 [0076.040] wcscpy (in: _Dest=0x549b5c0, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.040] wcscat (in: _Dest=0x549b5c0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.040] wcscat (in: _Dest=0x549b5c0, _Source="TwitterAppList.targetsize-24_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24_altform-unplated.png" [0076.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549b5c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10dc [0076.041] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22ac99c3, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22ac99c3, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x1dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.targetsize-24_contrast-black.png", cAlternateFileName="TWD56E~1.PNG")) returned 1 [0076.041] wcscmp (_String1="TwitterAppList.targetsize-24_contrast-black.png", _String2=".") returned 1 [0076.041] wcscmp (_String1="TwitterAppList.targetsize-24_contrast-black.png", _String2="..") returned 1 [0076.041] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100) returned 0x54998f0 [0076.041] wcscpy (in: _Dest=0x54998f0, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.041] wcscat (in: _Dest=0x54998f0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.041] wcscat (in: _Dest=0x54998f0, _Source="TwitterAppList.targetsize-24_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24_contrast-black.png" [0076.041] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54998f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10e0 [0076.042] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22ac99c3, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22ac99c3, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x215, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.targetsize-24_contrast-white.png", cAlternateFileName="TW4751~1.PNG")) returned 1 [0076.042] wcscmp (_String1="TwitterAppList.targetsize-24_contrast-white.png", _String2=".") returned 1 [0076.042] wcscmp (_String1="TwitterAppList.targetsize-24_contrast-white.png", _String2="..") returned 1 [0076.042] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100) returned 0x549a340 [0076.042] wcscpy (in: _Dest=0x549a340, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.042] wcscat (in: _Dest=0x549a340, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.042] wcscat (in: _Dest=0x549a340, _Source="TwitterAppList.targetsize-24_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24_contrast-white.png" [0076.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549a340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10e4 [0076.042] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22ac99c3, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22ac99c3, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x1d77, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.targetsize-256.png", cAlternateFileName="TW751A~1.PNG")) returned 1 [0076.042] wcscmp (_String1="TwitterAppList.targetsize-256.png", _String2=".") returned 1 [0076.043] wcscmp (_String1="TwitterAppList.targetsize-256.png", _String2="..") returned 1 [0076.043] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe4) returned 0x396f208 [0076.043] wcscpy (in: _Dest=0x396f208, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.043] wcscat (in: _Dest=0x396f208, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.043] wcscat (in: _Dest=0x396f208, _Source="TwitterAppList.targetsize-256.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256.png" [0076.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396f208, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10e8 [0076.043] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22ac99c3, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22ac99c3, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x2694, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.targetsize-256_altform-unplated.png", cAlternateFileName="TW99B8~1.PNG")) returned 1 [0076.043] wcscmp (_String1="TwitterAppList.targetsize-256_altform-unplated.png", _String2=".") returned 1 [0076.043] wcscmp (_String1="TwitterAppList.targetsize-256_altform-unplated.png", _String2="..") returned 1 [0076.043] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x549b6d0 [0076.043] wcscpy (in: _Dest=0x549b6d0, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.043] wcscat (in: _Dest=0x549b6d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.044] wcscat (in: _Dest=0x549b6d0, _Source="TwitterAppList.targetsize-256_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256_altform-unplated.png" [0076.044] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549b6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10ec [0076.044] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22ac99c3, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22ac99c3, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x1d77, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.targetsize-256_contrast-black.png", cAlternateFileName="TW5A0B~1.PNG")) returned 1 [0076.044] wcscmp (_String1="TwitterAppList.targetsize-256_contrast-black.png", _String2=".") returned 1 [0076.044] wcscmp (_String1="TwitterAppList.targetsize-256_contrast-black.png", _String2="..") returned 1 [0076.044] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x102) returned 0x549b7e0 [0076.044] wcscpy (in: _Dest=0x549b7e0, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.044] wcscat (in: _Dest=0x549b7e0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.044] wcscat (in: _Dest=0x549b7e0, _Source="TwitterAppList.targetsize-256_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256_contrast-black.png" [0076.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549b7e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10f0 [0076.045] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22ac99c3, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22ac99c3, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x159b, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.targetsize-256_contrast-white.png", cAlternateFileName="TWC7FB~1.PNG")) returned 1 [0076.045] wcscmp (_String1="TwitterAppList.targetsize-256_contrast-white.png", _String2=".") returned 1 [0076.045] wcscmp (_String1="TwitterAppList.targetsize-256_contrast-white.png", _String2="..") returned 1 [0076.045] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x102) returned 0x549b8f0 [0076.045] wcscpy (in: _Dest=0x549b8f0, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.045] wcscat (in: _Dest=0x549b8f0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.045] wcscat (in: _Dest=0x549b8f0, _Source="TwitterAppList.targetsize-256_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256_contrast-white.png" [0076.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549b8f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10f4 [0076.046] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22ac99c3, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22ac99c3, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x25a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.targetsize-30.png", cAlternateFileName="TW7C7D~1.PNG")) returned 1 [0076.046] wcscmp (_String1="TwitterAppList.targetsize-30.png", _String2=".") returned 1 [0076.046] wcscmp (_String1="TwitterAppList.targetsize-30.png", _String2="..") returned 1 [0076.046] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x39701f8 [0076.046] wcscpy (in: _Dest=0x39701f8, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.046] wcscat (in: _Dest=0x39701f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.046] wcscat (in: _Dest=0x39701f8, _Source="TwitterAppList.targetsize-30.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30.png" [0076.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x39701f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10f8 [0076.047] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22ac99c3, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22ac99c3, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x3be, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.targetsize-30_altform-unplated.png", cAlternateFileName="TW1FC8~1.PNG")) returned 1 [0076.047] wcscmp (_String1="TwitterAppList.targetsize-30_altform-unplated.png", _String2=".") returned 1 [0076.047] wcscmp (_String1="TwitterAppList.targetsize-30_altform-unplated.png", _String2="..") returned 1 [0076.047] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x104) returned 0x549ba00 [0076.047] wcscpy (in: _Dest=0x549ba00, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.047] wcscat (in: _Dest=0x549ba00, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.047] wcscat (in: _Dest=0x549ba00, _Source="TwitterAppList.targetsize-30_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30_altform-unplated.png" [0076.047] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549ba00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10fc [0076.048] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22ac99c3, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22ac99c3, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x25a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.targetsize-30_contrast-black.png", cAlternateFileName="TW7A72~1.PNG")) returned 1 [0076.048] wcscmp (_String1="TwitterAppList.targetsize-30_contrast-black.png", _String2=".") returned 1 [0076.048] wcscmp (_String1="TwitterAppList.targetsize-30_contrast-black.png", _String2="..") returned 1 [0076.048] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100) returned 0x549a868 [0076.048] wcscpy (in: _Dest=0x549a868, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0076.048] wcscat (in: _Dest=0x549a868, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0076.048] wcscat (in: _Dest=0x549a868, _Source="TwitterAppList.targetsize-30_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30_contrast-black.png" [0076.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549a868, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x152c [0081.187] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22ac99c3, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22ac99c3, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x287, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.targetsize-30_contrast-white.png", cAlternateFileName="TWA24D~1.PNG")) returned 1 [0081.187] wcscmp (_String1="TwitterAppList.targetsize-30_contrast-white.png", _String2=".") returned 1 [0081.187] wcscmp (_String1="TwitterAppList.targetsize-30_contrast-white.png", _String2="..") returned 1 [0081.187] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100) returned 0x7581be0 [0081.187] wcscpy (in: _Dest=0x7581be0, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0081.187] wcscat (in: _Dest=0x7581be0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0081.187] wcscat (in: _Dest=0x7581be0, _Source="TwitterAppList.targetsize-30_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30_contrast-white.png" [0081.187] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7581be0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc74 [0081.187] FindNextFileW (in: hFindFile=0x389f580, lpFindFileData=0x53b30f0 | out: lpFindFileData=0x53b30f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22ac99c3, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22ac99c3, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x296, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwitterAppList.targetsize-32.png", cAlternateFileName="TW42B1~1.PNG")) returned 1 [0081.188] wcscmp (_String1="TwitterAppList.targetsize-32.png", _String2=".") returned 1 [0081.188] wcscmp (_String1="TwitterAppList.targetsize-32.png", _String2="..") returned 1 [0081.188] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0xe338338 [0091.755] wcscpy (in: _Dest=0xe338338, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets" [0091.755] wcscat (in: _Dest=0xe338338, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\" [0091.755] wcscat (in: _Dest=0xe338338, _Source="TwitterAppList.targetsize-32.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-32.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-32.png" Thread: id = 342 os_tid = 0x152c [0072.248] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9c) returned 0x38ac058 [0072.248] wcscpy (in: _Dest=0x38ac058, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js" [0072.248] wcscat (in: _Dest=0x38ac058, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\" [0072.248] wcscat (in: _Dest=0x38ac058, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\*") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\*" [0072.248] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5462728 [0072.248] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\*", lpFindFileData=0x5462728 | out: lpFindFileData=0x5462728*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2310be20, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa967b88f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2313207f, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54453c0 [0082.545] wcscmp (_String1=".", _String2=".") returned 0 [0082.545] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x5462728 | out: lpFindFileData=0x5462728*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2310be20, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa967b88f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2313207f, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.545] wcscmp (_String1="..", _String2=".") returned 1 [0082.545] wcscmp (_String1="..", _String2="..") returned 0 [0082.545] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x5462728 | out: lpFindFileData=0x5462728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2310be20, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x2310be20, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x1c45, dwReserved0=0x0, dwReserved1=0x0, cFileName="Attributions.html", cAlternateFileName="ATTRIB~1.HTM")) returned 1 [0082.545] wcscmp (_String1="Attributions.html", _String2=".") returned 1 [0082.545] wcscmp (_String1="Attributions.html", _String2="..") returned 1 [0082.545] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x53fa708 [0082.545] wcscpy (in: _Dest=0x53fa708, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js" [0082.545] wcscat (in: _Dest=0x53fa708, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\" [0082.545] wcscat (in: _Dest=0x53fa708, _Source="Attributions.html" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\Attributions.html") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\Attributions.html" [0082.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53fa708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ed4 [0082.546] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x5462728 | out: lpFindFileData=0x5462728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2310be20, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x2310be20, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x2065c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hometimeline.json", cAlternateFileName="HOMETI~1.JSO")) returned 1 [0082.546] wcscmp (_String1="Hometimeline.json", _String2=".") returned 1 [0082.546] wcscmp (_String1="Hometimeline.json", _String2="..") returned 1 [0082.546] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x53f9f38 [0082.546] wcscpy (in: _Dest=0x53f9f38, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js" [0082.546] wcscat (in: _Dest=0x53f9f38, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\" [0082.546] wcscat (in: _Dest=0x53f9f38, _Source="Hometimeline.json" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\Hometimeline.json") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\Hometimeline.json" [0082.546] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53f9f38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ed8 [0082.547] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x5462728 | out: lpFindFileData=0x5462728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2310be20, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x2310be20, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x1595b, dwReserved0=0x0, dwReserved1=0x0, cFileName="TrendsAvailable.json", cAlternateFileName="TRENDS~1.JSO")) returned 1 [0082.547] wcscmp (_String1="TrendsAvailable.json", _String2=".") returned 1 [0082.547] wcscmp (_String1="TrendsAvailable.json", _String2="..") returned 1 [0082.547] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x55fe3d8 [0082.547] wcscpy (in: _Dest=0x55fe3d8, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js" [0082.547] wcscat (in: _Dest=0x55fe3d8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\" [0082.547] wcscat (in: _Dest=0x55fe3d8, _Source="TrendsAvailable.json" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\TrendsAvailable.json") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\TrendsAvailable.json" [0082.547] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55fe3d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1edc [0082.547] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x5462728 | out: lpFindFileData=0x5462728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2310be20, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x2310be20, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x1595b, dwReserved0=0x0, dwReserved1=0x0, cFileName="TrendsAvailable.json", cAlternateFileName="TRENDS~1.JSO")) returned 0 [0082.547] FindClose (in: hFindFile=0x54453c0 | out: hFindFile=0x54453c0) returned 1 [0082.548] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5462728) returned 1 [0082.548] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ac058) returned 1 [0082.548] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5426228) returned 1 Thread: id = 343 os_tid = 0x1530 [0072.249] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x546e1d0 [0072.249] wcscpy (in: _Dest=0x546e1d0, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\microsoft.system.package.metadata" [0072.249] wcscat (in: _Dest=0x546e1d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\microsoft.system.package.metadata\\" [0072.249] wcscat (in: _Dest=0x546e1d0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\microsoft.system.package.metadata\\*" [0072.249] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5462990 [0072.249] FindFirstFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\microsoft.system.package.metadata\\*", lpFindFileData=0x5462990) Thread: id = 344 os_tid = 0x1534 [0072.252] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\resources.pri" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\resources.pri")) returned 0x20 [0082.622] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\resources.pri", dwFileAttributes=0x20) returned 0 [0082.631] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\resources.pri" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\resources.pri"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.643] GetLastError () returned 0x5 [0082.643] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\resources.pri", dwFileAttributes=0x20) returned 0 [0087.660] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5446fa0) returned 1 Thread: id = 345 os_tid = 0x1538 [0072.253] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Twitter.Background.winmd" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\twitter.background.winmd")) returned 0x20 [0082.599] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Twitter.Background.winmd", dwFileAttributes=0x20) returned 0 [0082.620] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Twitter.Background.winmd" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\twitter.background.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.630] GetLastError () returned 0x5 [0082.630] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Twitter.Background.winmd", dwFileAttributes=0x20) returned 0 [0082.643] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b4a28) returned 1 Thread: id = 346 os_tid = 0x153c [0072.254] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Twitter.Windows.xr.xml" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\twitter.windows.xr.xml")) returned 0x20 [0082.582] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Twitter.Windows.xr.xml", dwFileAttributes=0x20) returned 0 [0082.591] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Twitter.Windows.xr.xml" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\twitter.windows.xr.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.608] GetLastError () returned 0x5 [0082.608] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Twitter.Windows.xr.xml", dwFileAttributes=0x20) returned 0 [0082.630] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ff5a0) returned 1 Thread: id = 347 os_tid = 0x1540 [0072.256] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\VoiceCommands.xml" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\voicecommands.xml")) returned 0x20 [0082.567] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\VoiceCommands.xml", dwFileAttributes=0x20) returned 0 [0082.581] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\VoiceCommands.xml" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\voicecommands.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.591] GetLastError () returned 0x5 [0082.591] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\VoiceCommands.xml", dwFileAttributes=0x20) returned 0 [0082.607] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ff668) returned 1 Thread: id = 348 os_tid = 0x1544 [0072.256] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0082.589] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0082.602] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.402] GetLastError () returned 0x5 [0087.402] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0087.402] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ff7e8) Thread: id = 349 os_tid = 0x1548 [0072.257] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0082.606] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0087.470] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.470] GetLastError () returned 0x5 [0087.470] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0087.470] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38aae40) Thread: id = 350 os_tid = 0x154c [0072.258] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x53e8d78 [0072.258] wcscpy (in: _Dest=0x53e8d78, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0072.258] wcscat (in: _Dest=0x53e8d78, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0072.258] wcscat (in: _Dest=0x53e8d78, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*" [0072.258] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542f8e0 [0072.258] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96dfefce, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9785683, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x96dfefce, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445900 [0081.259] wcscmp (_String1=".", _String2=".") returned 0 [0081.259] FindNextFileW (in: hFindFile=0x5445900, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96dfefce, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9785683, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x96dfefce, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.260] wcscmp (_String1="..", _String2=".") returned 1 [0081.260] wcscmp (_String1="..", _String2="..") returned 0 [0081.260] FindNextFileW (in: hFindFile=0x5445900, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dfefce, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x96dfefce, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x96dfefce, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2a8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1 [0081.260] wcscmp (_String1="CodeIntegrity.cat", _String2=".") returned 1 [0081.260] wcscmp (_String1="CodeIntegrity.cat", _String2="..") returned 1 [0081.260] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54bc0b8 [0081.260] wcscpy (in: _Dest=0x54bc0b8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0081.260] wcscat (in: _Dest=0x54bc0b8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0081.260] wcscat (in: _Dest=0x54bc0b8, _Source="CodeIntegrity.cat" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" [0081.260] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bc0b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c0c [0081.260] FindNextFileW (in: hFindFile=0x5445900, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dfefce, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x96dfefce, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x96dfefce, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2a8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 0 [0081.260] FindClose (in: hFindFile=0x5445900 | out: hFindFile=0x5445900) returned 1 [0081.261] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542f8e0) returned 1 [0081.261] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e8d78) returned 1 [0081.261] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38aaf10) Thread: id = 351 os_tid = 0x1550 [0072.259] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0087.154] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0087.401] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.402] GetLastError () returned 0x5 [0087.402] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0087.402] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38aafd8) Thread: id = 352 os_tid = 0x1554 [0072.261] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb4) returned 0x54618e8 [0072.261] wcscpy (in: _Dest=0x54618e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" [0072.261] wcscat (in: _Dest=0x54618e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\" [0072.261] wcscat (in: _Dest=0x54618e8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\*" [0072.261] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f31e8 [0072.265] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96dfefce, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa97d9a35, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9764f8c5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f600 [0074.729] wcscmp (_String1=".", _String2=".") returned 0 [0074.729] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96dfefce, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa97d9a35, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9764f8c5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.729] wcscmp (_String1="..", _String2=".") returned 1 [0074.729] wcscmp (_String1="..", _String2="..") returned 0 [0074.729] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dfefce, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x96e25227, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x96e25227, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x7046, dwReserved0=0x0, dwReserved1=0x0, cFileName="3mf.ico", cAlternateFileName="")) returned 1 [0074.729] wcscmp (_String1="3mf.ico", _String2=".") returned 1 [0074.729] wcscmp (_String1="3mf.ico", _String2="..") returned 1 [0074.729] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e25227, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x96e25227, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x96e25227, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2628, dwReserved0=0x0, dwReserved1=0x0, cFileName="CameraIcon_contrast-black.png", cAlternateFileName="")) returned 1 [0074.729] wcscmp (_String1="CameraIcon_contrast-black.png", _String2=".") returned 1 [0074.729] wcscmp (_String1="CameraIcon_contrast-black.png", _String2="..") returned 1 [0074.729] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x393d690 [0074.729] wcscpy (in: _Dest=0x393d690, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" [0074.729] wcscat (in: _Dest=0x393d690, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.729] wcscat (in: _Dest=0x393d690, _Source="CameraIcon_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CameraIcon_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CameraIcon_contrast-black.png" [0074.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x393d690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x47c [0074.730] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e25227, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x96e25227, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x96e25227, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2608, dwReserved0=0x0, dwReserved1=0x0, cFileName="CameraIcon_contrast-white.png", cAlternateFileName="")) returned 1 [0074.730] wcscmp (_String1="CameraIcon_contrast-white.png", _String2=".") returned 1 [0074.730] wcscmp (_String1="CameraIcon_contrast-white.png", _String2="..") returned 1 [0074.730] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x393d880 [0074.730] wcscpy (in: _Dest=0x393d880, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" [0074.730] wcscat (in: _Dest=0x393d880, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.730] wcscat (in: _Dest=0x393d880, _Source="CameraIcon_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CameraIcon_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CameraIcon_contrast-white.png" [0074.730] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x393d880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x380 [0074.731] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96e25227, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a3eee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970877d7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Catalog", cAlternateFileName="")) returned 1 [0074.731] wcscmp (_String1="Catalog", _String2=".") returned 1 [0074.731] wcscmp (_String1="Catalog", _String2="..") returned 1 [0074.731] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x53fa898 [0074.731] wcscpy (in: _Dest=0x53fa898, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" [0074.731] wcscat (in: _Dest=0x53fa898, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.731] wcscat (in: _Dest=0x53fa898, _Source="Catalog" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog" [0074.731] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53fa898, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa68 [0074.732] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a4daf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970ada35, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Contrast", cAlternateFileName="")) returned 1 [0074.732] wcscmp (_String1="Contrast", _String2=".") returned 1 [0074.732] wcscmp (_String1="Contrast", _String2="..") returned 1 [0074.732] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x53f8c00 [0074.732] wcscpy (in: _Dest=0x53f8c00, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" [0074.732] wcscat (in: _Dest=0x53f8c00, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.732] wcscat (in: _Dest=0x53f8c00, _Source="Contrast" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Contrast") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Contrast" [0074.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53f8c00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb0c [0074.733] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a7570, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970ada35, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-black", cAlternateFileName="CONTRA~1")) returned 1 [0074.733] wcscmp (_String1="contrast-black", _String2=".") returned 1 [0074.733] wcscmp (_String1="contrast-black", _String2="..") returned 1 [0074.733] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x38feb60 [0074.733] wcscpy (in: _Dest=0x38feb60, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" [0074.733] wcscat (in: _Dest=0x38feb60, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.733] wcscat (in: _Dest=0x38feb60, _Source="contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black" [0074.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38feb60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb10 [0074.733] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a7e68, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970ada35, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0074.733] wcscmp (_String1="contrast-white", _String2=".") returned 1 [0074.734] wcscmp (_String1="contrast-white", _String2="..") returned 1 [0074.734] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x38fede8 [0074.734] wcscpy (in: _Dest=0x38fede8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" [0074.734] wcscat (in: _Dest=0x38fede8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.734] wcscat (in: _Dest=0x38fede8, _Source="contrast-white" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white" [0074.734] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38fede8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb14 [0074.734] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x970d3c8f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x970d3c8f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1455, dwReserved0=0x0, dwReserved1=0x0, cFileName="CubeTile_contrast-black.png", cAlternateFileName="")) returned 1 [0074.734] wcscmp (_String1="CubeTile_contrast-black.png", _String2=".") returned 1 [0074.734] wcscmp (_String1="CubeTile_contrast-black.png", _String2="..") returned 1 [0074.734] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x38b05b8 [0074.734] wcscpy (in: _Dest=0x38b05b8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" [0074.734] wcscat (in: _Dest=0x38b05b8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.735] wcscat (in: _Dest=0x38b05b8, _Source="CubeTile_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CubeTile_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CubeTile_contrast-black.png" [0074.735] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b05b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb18 [0074.735] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x970d3c8f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x970d3c8f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x970d3c8f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x139e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CubeTile_contrast-white.png", cAlternateFileName="")) returned 1 [0074.735] wcscmp (_String1="CubeTile_contrast-white.png", _String2=".") returned 1 [0074.735] wcscmp (_String1="CubeTile_contrast-white.png", _String2="..") returned 1 [0074.735] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x38b06a8 [0074.735] wcscpy (in: _Dest=0x38b06a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" [0074.735] wcscat (in: _Dest=0x38b06a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.735] wcscat (in: _Dest=0x38b06a8, _Source="CubeTile_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CubeTile_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CubeTile_contrast-white.png" [0074.735] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b06a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb1c [0074.736] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x970d3c8f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x970d3c8f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x970d3c8f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xcbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="DarkBlue.png", cAlternateFileName="")) returned 1 [0074.736] wcscmp (_String1="DarkBlue.png", _String2=".") returned 1 [0074.736] wcscmp (_String1="DarkBlue.png", _String2="..") returned 1 [0074.736] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xca) returned 0x38feec0 [0074.736] wcscpy (in: _Dest=0x38feec0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" [0074.736] wcscat (in: _Dest=0x38feec0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.736] wcscat (in: _Dest=0x38feec0, _Source="DarkBlue.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\DarkBlue.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\DarkBlue.png" [0074.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38feec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb20 [0074.737] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x970d3c8f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x970d3c8f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x970d3c8f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3012, dwReserved0=0x0, dwReserved1=0x0, cFileName="DashboardDefaultThumbnail.png", cAlternateFileName="")) returned 1 [0074.737] wcscmp (_String1="DashboardDefaultThumbnail.png", _String2=".") returned 1 [0074.737] wcscmp (_String1="DashboardDefaultThumbnail.png", _String2="..") returned 1 [0074.737] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x393da70 [0074.737] wcscpy (in: _Dest=0x393da70, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" [0074.737] wcscat (in: _Dest=0x393da70, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.737] wcscat (in: _Dest=0x393da70, _Source="DashboardDefaultThumbnail.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\DashboardDefaultThumbnail.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\DashboardDefaultThumbnail.png" [0074.737] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x393da70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb24 [0074.738] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970d3c8f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9987cd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x972809b4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EmbossBitmaps", cAlternateFileName="EMBOSS~1")) returned 1 [0074.738] wcscmp (_String1="EmbossBitmaps", _String2=".") returned 1 [0074.738] wcscmp (_String1="EmbossBitmaps", _String2="..") returned 1 [0074.738] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x38ff220 [0074.738] wcscpy (in: _Dest=0x38ff220, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" [0074.738] wcscat (in: _Dest=0x38ff220, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.738] wcscat (in: _Dest=0x38ff220, _Source="EmbossBitmaps" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps" [0074.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38ff220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb28 [0074.739] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x972809b4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x972809b4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x972809b4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xe5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="HelpIcon_contrast-black.png", cAlternateFileName="")) returned 1 [0074.739] wcscmp (_String1="HelpIcon_contrast-black.png", _String2=".") returned 1 [0074.739] wcscmp (_String1="HelpIcon_contrast-black.png", _String2="..") returned 1 [0074.739] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x38b0888 [0074.739] wcscpy (in: _Dest=0x38b0888, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" [0074.739] wcscat (in: _Dest=0x38b0888, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.739] wcscat (in: _Dest=0x38b0888, _Source="HelpIcon_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HelpIcon_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HelpIcon_contrast-black.png" [0074.739] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b0888, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb2c [0074.740] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x972809b4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x972809b4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x972809b4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xea1, dwReserved0=0x0, dwReserved1=0x0, cFileName="HelpIcon_contrast-white.png", cAlternateFileName="")) returned 1 [0074.740] wcscmp (_String1="HelpIcon_contrast-white.png", _String2=".") returned 1 [0074.740] wcscmp (_String1="HelpIcon_contrast-white.png", _String2="..") returned 1 [0074.740] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x38b0798 [0074.740] wcscpy (in: _Dest=0x38b0798, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" [0074.740] wcscat (in: _Dest=0x38b0798, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.740] wcscat (in: _Dest=0x38b0798, _Source="HelpIcon_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HelpIcon_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HelpIcon_contrast-white.png" [0074.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb30 [0074.740] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x972809b4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa998957e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x972da738, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HeroHelp", cAlternateFileName="")) returned 1 [0074.740] wcscmp (_String1="HeroHelp", _String2=".") returned 1 [0074.740] wcscmp (_String1="HeroHelp", _String2="..") returned 1 [0074.740] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x53f8b30 [0074.741] wcscpy (in: _Dest=0x53f8b30, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" [0074.741] wcscat (in: _Dest=0x53f8b30, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.741] wcscat (in: _Dest=0x53f8b30, _Source="HeroHelp" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HeroHelp") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HeroHelp" [0074.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53f8b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb34 [0074.741] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973009bb, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x97326c19, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x97326c19, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xcbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="LightBlue.png", cAlternateFileName="")) returned 1 [0074.741] wcscmp (_String1="LightBlue.png", _String2=".") returned 1 [0074.741] wcscmp (_String1="LightBlue.png", _String2="..") returned 1 [0074.741] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x38ff4a8 [0074.742] wcscpy (in: _Dest=0x38ff4a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" [0074.742] wcscat (in: _Dest=0x38ff4a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.742] wcscat (in: _Dest=0x38ff4a8, _Source="LightBlue.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LightBlue.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LightBlue.png" [0074.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38ff4a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb38 [0074.742] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97326c19, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x97326c19, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x97326c19, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xd6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoadIconRTL_contrast-black.png", cAlternateFileName="")) returned 1 [0074.742] wcscmp (_String1="LoadIconRTL_contrast-black.png", _String2=".") returned 1 [0074.742] wcscmp (_String1="LoadIconRTL_contrast-black.png", _String2="..") returned 1 [0074.742] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xee) returned 0x393e138 [0074.742] wcscpy (in: _Dest=0x393e138, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" [0074.742] wcscat (in: _Dest=0x393e138, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.742] wcscat (in: _Dest=0x393e138, _Source="LoadIconRTL_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIconRTL_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIconRTL_contrast-black.png" [0074.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x393e138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb3c [0074.743] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97326c19, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x97326c19, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x97326c19, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xd72, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoadIconRTL_contrast-white.png", cAlternateFileName="")) returned 1 [0074.743] wcscmp (_String1="LoadIconRTL_contrast-white.png", _String2=".") returned 1 [0074.743] wcscmp (_String1="LoadIconRTL_contrast-white.png", _String2="..") returned 1 [0074.743] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xee) returned 0x393edd0 [0074.743] wcscpy (in: _Dest=0x393edd0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" [0074.743] wcscat (in: _Dest=0x393edd0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.743] wcscat (in: _Dest=0x393edd0, _Source="LoadIconRTL_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIconRTL_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIconRTL_contrast-white.png" [0074.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x393edd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb40 [0074.744] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97326c19, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x97326c19, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x97326c19, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xd84, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoadIcon_contrast-black.png", cAlternateFileName="")) returned 1 [0074.744] wcscmp (_String1="LoadIcon_contrast-black.png", _String2=".") returned 1 [0074.744] wcscmp (_String1="LoadIcon_contrast-black.png", _String2="..") returned 1 [0074.744] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x396fb68 [0074.744] wcscpy (in: _Dest=0x396fb68, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" [0074.744] wcscat (in: _Dest=0x396fb68, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.744] wcscat (in: _Dest=0x396fb68, _Source="LoadIcon_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIcon_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIcon_contrast-black.png" [0074.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396fb68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb44 [0074.745] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97326c19, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x97326c19, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x97326c19, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoadIcon_contrast-white.png", cAlternateFileName="")) returned 1 [0074.745] wcscmp (_String1="LoadIcon_contrast-white.png", _String2=".") returned 1 [0074.745] wcscmp (_String1="LoadIcon_contrast-white.png", _String2="..") returned 1 [0074.745] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x396f7a8 [0074.745] wcscpy (in: _Dest=0x396f7a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" [0074.745] wcscat (in: _Dest=0x396f7a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.745] wcscat (in: _Dest=0x396f7a8, _Source="LoadIcon_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIcon_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIcon_contrast-white.png" [0074.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396f7a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb48 [0074.746] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97326c19, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa998a0eb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x974a57e1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifestAssets", cAlternateFileName="MANIFE~1")) returned 1 [0074.746] wcscmp (_String1="manifestAssets", _String2=".") returned 1 [0074.746] wcscmp (_String1="manifestAssets", _String2="..") returned 1 [0074.746] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x38ff2f8 [0074.746] wcscpy (in: _Dest=0x38ff2f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" [0074.746] wcscat (in: _Dest=0x38ff2f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.746] wcscat (in: _Dest=0x38ff2f8, _Source="manifestAssets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" [0074.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38ff2f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb4c [0074.747] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x974a57e1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x974a57e1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x974a57e1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xcbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="MediumBlue.png", cAlternateFileName="")) returned 1 [0074.747] wcscmp (_String1="MediumBlue.png", _String2=".") returned 1 [0074.747] wcscmp (_String1="MediumBlue.png", _String2="..") returned 1 [0074.747] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x38ff3d0 [0074.747] wcscpy (in: _Dest=0x38ff3d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" [0074.747] wcscat (in: _Dest=0x38ff3d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.747] wcscat (in: _Dest=0x38ff3d0, _Source="MediumBlue.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\MediumBlue.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\MediumBlue.png" [0074.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38ff3d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb50 [0074.747] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x974a57e1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9aa16f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x975664ea, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0074.748] wcscmp (_String1="Office", _String2=".") returned 1 [0074.748] wcscmp (_String1="Office", _String2="..") returned 1 [0074.748] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53fae10 [0074.748] wcscpy (in: _Dest=0x53fae10, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" [0074.748] wcscat (in: _Dest=0x53fae10, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.748] wcscat (in: _Dest=0x53fae10, _Source="Office" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office" [0074.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53fae10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb54 [0074.748] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x975664ea, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9aa22bd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9758c747, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0074.748] wcscmp (_String1="Resources", _String2=".") returned 1 [0074.748] wcscmp (_String1="Resources", _String2="..") returned 1 [0074.748] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x3970870 [0074.752] wcscpy (in: _Dest=0x3970870, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" [0074.752] wcscat (in: _Dest=0x3970870, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.752] wcscat (in: _Dest=0x3970870, _Source="Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Resources" [0074.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3970870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb58 [0074.753] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x975d8bfa, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x975d8bfa, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x975d8bfa, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xd09, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScanIcon_contrast-black.png", cAlternateFileName="")) returned 1 [0074.753] wcscmp (_String1="ScanIcon_contrast-black.png", _String2=".") returned 1 [0074.753] wcscmp (_String1="ScanIcon_contrast-black.png", _String2="..") returned 1 [0074.753] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x396fc58 [0074.753] wcscpy (in: _Dest=0x396fc58, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" [0074.753] wcscat (in: _Dest=0x396fc58, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.753] wcscat (in: _Dest=0x396fc58, _Source="ScanIcon_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\ScanIcon_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\ScanIcon_contrast-black.png" [0074.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396fc58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb5c [0074.754] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x975d8bfa, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x975d8bfa, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x975d8bfa, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xd13, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScanIcon_contrast-white.png", cAlternateFileName="")) returned 1 [0074.754] wcscmp (_String1="ScanIcon_contrast-white.png", _String2=".") returned 1 [0074.754] wcscmp (_String1="ScanIcon_contrast-white.png", _String2="..") returned 1 [0074.754] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x396e998 [0074.754] wcscpy (in: _Dest=0x396e998, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" [0074.754] wcscat (in: _Dest=0x396e998, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.754] wcscat (in: _Dest=0x396e998, _Source="ScanIcon_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\ScanIcon_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\ScanIcon_contrast-white.png" [0074.754] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396e998, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb60 [0074.754] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x975d8bfa, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9b12d9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9764f8c5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TextureBitmaps", cAlternateFileName="TEXTUR~1")) returned 1 [0074.754] wcscmp (_String1="TextureBitmaps", _String2=".") returned 1 [0074.755] wcscmp (_String1="TextureBitmaps", _String2="..") returned 1 [0074.755] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x38ff148 [0074.755] wcscpy (in: _Dest=0x38ff148, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" [0074.755] wcscat (in: _Dest=0x38ff148, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.755] wcscat (in: _Dest=0x38ff148, _Source="TextureBitmaps" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps" [0074.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38ff148, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb64 [0074.755] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9764f8c5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9b67c1d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x976e822e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow", cAlternateFileName="")) returned 1 [0074.755] wcscmp (_String1="Workflow", _String2=".") returned 1 [0074.755] wcscmp (_String1="Workflow", _String2="..") returned 1 [0074.755] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x3971cc0 [0074.755] wcscpy (in: _Dest=0x3971cc0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets" [0074.756] wcscat (in: _Dest=0x3971cc0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.756] wcscat (in: _Dest=0x3971cc0, _Source="Workflow" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow" [0074.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3971cc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb68 [0074.756] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9764f8c5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9b67c1d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x976e822e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow", cAlternateFileName="")) returned 0 [0074.756] FindClose (in: hFindFile=0x389f600 | out: hFindFile=0x389f600) returned 1 [0074.757] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f31e8) returned 1 [0074.757] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54618e8) returned 1 [0074.757] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5446b50) returned 1 Thread: id = 353 os_tid = 0x1558 [0072.266] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb4) returned 0x54619a8 [0072.266] wcscpy (in: _Dest=0x54619a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Common" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Common") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Common" [0072.266] wcscat (in: _Dest=0x54619a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Common\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Common\\" [0072.266] wcscat (in: _Dest=0x54619a8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Common\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Common\\*" [0072.266] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f5ad0 [0072.266] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Common\\*", lpFindFileData=0x53f5ad0 | out: lpFindFileData=0x53f5ad0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9853e192, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9bd24bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9853e192, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445740 [0082.533] wcscmp (_String1=".", _String2=".") returned 0 [0082.533] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x53f5ad0 | out: lpFindFileData=0x53f5ad0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9853e192, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9bd24bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9853e192, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.533] wcscmp (_String1="..", _String2=".") returned 1 [0082.533] wcscmp (_String1="..", _String2="..") returned 0 [0082.533] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x53f5ad0 | out: lpFindFileData=0x53f5ad0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9853e192, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9853e192, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9853e192, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe.txt", cAlternateFileName="")) returned 1 [0082.533] wcscmp (_String1="ReadMe.txt", _String2=".") returned 1 [0082.534] wcscmp (_String1="ReadMe.txt", _String2="..") returned 1 [0082.534] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x55fdfc8 [0082.534] wcscpy (in: _Dest=0x55fdfc8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Common" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Common") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Common" [0082.534] wcscat (in: _Dest=0x55fdfc8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Common\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Common\\" [0082.534] wcscat (in: _Dest=0x55fdfc8, _Source="ReadMe.txt" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Common\\ReadMe.txt") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Common\\ReadMe.txt" [0082.534] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55fdfc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ec0 [0082.535] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x53f5ad0 | out: lpFindFileData=0x53f5ad0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9853e192, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9853e192, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9853e192, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe.txt", cAlternateFileName="")) returned 0 [0082.535] FindClose (in: hFindFile=0x5445740 | out: hFindFile=0x5445740) returned 1 [0082.535] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f5ad0) returned 1 [0082.535] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54619a8) returned 1 [0082.535] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445b80) returned 1 Thread: id = 354 os_tid = 0x155c [0072.267] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xea) returned 0x54505a8 [0072.267] wcscpy (in: _Dest=0x54505a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0072.267] wcscat (in: _Dest=0x54505a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0072.267] wcscat (in: _Dest=0x54505a8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0072.267] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f5d38 [0072.267] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x53f5d38 | out: lpFindFileData=0x53f5d38*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb3cc2682, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb3cc2682, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb3cc2682, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445100 [0077.729] wcscmp (_String1=".", _String2=".") returned 0 [0077.729] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53f5d38 | out: lpFindFileData=0x53f5d38*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb3cc2682, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb3cc2682, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb3cc2682, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.729] wcscmp (_String1="..", _String2=".") returned 1 [0077.729] wcscmp (_String1="..", _String2="..") returned 0 [0077.729] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53f5d38 | out: lpFindFileData=0x53f5d38*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb3cc2682, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb3cc2682, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb3cc2682, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0077.729] FindClose (in: hFindFile=0x5445100 | out: hFindFile=0x5445100) returned 1 [0077.730] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f5d38) returned 1 [0077.730] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54505a8) returned 1 [0077.730] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ab0a8) returned 1 Thread: id = 355 os_tid = 0x1560 [0072.267] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\resources.pri")) returned 0x20 [0082.577] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0082.589] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.601] GetLastError () returned 0x5 [0082.602] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0087.154] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b66e0) Thread: id = 356 os_tid = 0x1564 [0072.268] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0082.606] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0082.626] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.639] GetLastError () returned 0x5 [0082.639] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0082.639] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b6ab8) returned 1 Thread: id = 357 os_tid = 0x1568 [0072.271] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0082.591] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0082.605] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.626] GetLastError () returned 0x5 [0082.626] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0082.638] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b6b88) returned 1 Thread: id = 358 os_tid = 0x156c [0072.272] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0086.000] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0086.000] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.000] GetLastError () returned 0x5 [0086.000] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0086.000] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389cb38) returned 1 Thread: id = 359 os_tid = 0x1570 [0072.299] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb2) returned 0x54610a8 [0072.299] wcscpy (in: _Dest=0x54610a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css" [0072.300] wcscat (in: _Dest=0x54610a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\" [0072.300] wcscat (in: _Dest=0x54610a8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\*" [0072.300] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f5fa0 [0072.300] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\*", lpFindFileData=0x53f5fa0 | out: lpFindFileData=0x53f5fa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfcf205, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa9f2be01, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfcf205, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f80 [0077.726] wcscmp (_String1=".", _String2=".") returned 0 [0077.726] FindNextFileW (in: hFindFile=0x5444f80, lpFindFileData=0x53f5fa0 | out: lpFindFileData=0x53f5fa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfcf205, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa9f2be01, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfcf205, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.726] wcscmp (_String1="..", _String2=".") returned 1 [0077.726] wcscmp (_String1="..", _String2="..") returned 0 [0077.726] FindNextFileW (in: hFindFile=0x5444f80, lpFindFileData=0x53f5fa0 | out: lpFindFileData=0x53f5fa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfcf205, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xcdfcf205, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xcdfcf205, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xe, dwReserved0=0x0, dwReserved1=0x0, cFileName="default.css", cAlternateFileName="")) returned 1 [0077.726] wcscmp (_String1="default.css", _String2=".") returned 1 [0077.726] wcscmp (_String1="default.css", _String2="..") returned 1 [0077.726] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x55fd878 [0077.726] wcscpy (in: _Dest=0x55fd878, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css" [0077.726] wcscat (in: _Dest=0x55fd878, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\" [0077.726] wcscat (in: _Dest=0x55fd878, _Source="default.css" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\default.css") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\default.css" [0080.925] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55fd878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1280 [0080.926] FindNextFileW (in: hFindFile=0x5444f80, lpFindFileData=0x53f5fa0 | out: lpFindFileData=0x53f5fa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfcf205, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xcdfcf205, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xcdfcf205, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xe, dwReserved0=0x0, dwReserved1=0x0, cFileName="default.css", cAlternateFileName="")) returned 0 [0080.926] FindClose (in: hFindFile=0x5444f80 | out: hFindFile=0x5444f80) returned 1 [0080.926] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f5fa0) returned 1 [0080.926] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54610a8) returned 1 [0080.926] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5446c08) returned 1 Thread: id = 360 os_tid = 0x1574 [0072.300] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\default.html" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\default.html")) returned 0x20 [0082.627] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\default.html", dwFileAttributes=0x20) returned 0 [0082.639] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\default.html" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\default.html"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.639] GetLastError () returned 0x5 [0082.639] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\default.html", dwFileAttributes=0x20) returned 0 [0082.639] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b6c58) returned 1 Thread: id = 361 os_tid = 0x1578 [0072.302] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb8) returned 0x5461168 [0072.302] wcscpy (in: _Dest=0x5461168, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images" [0072.302] wcscat (in: _Dest=0x5461168, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\" [0072.302] wcscat (in: _Dest=0x5461168, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\*" [0072.302] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f6208 [0072.302] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\*", lpFindFileData=0x53f6208 | out: lpFindFileData=0x53f6208*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfcf205, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa9f2cc20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdff5463, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54458c0 [0081.254] wcscmp (_String1=".", _String2=".") returned 0 [0081.254] FindNextFileW (in: hFindFile=0x54458c0, lpFindFileData=0x53f6208 | out: lpFindFileData=0x53f6208*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfcf205, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa9f2cc20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdff5463, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.254] wcscmp (_String1="..", _String2=".") returned 1 [0081.254] wcscmp (_String1="..", _String2="..") returned 0 [0081.254] FindNextFileW (in: hFindFile=0x54458c0, lpFindFileData=0x53f6208 | out: lpFindFileData=0x53f6208*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfcf205, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xcdfcf205, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xcdfcf205, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConnectorAppList.scale-100.png", cAlternateFileName="")) returned 1 [0081.254] wcscmp (_String1="AppConnectorAppList.scale-100.png", _String2=".") returned 1 [0081.254] wcscmp (_String1="AppConnectorAppList.scale-100.png", _String2="..") returned 1 [0081.254] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf8) returned 0x5ba2bf8 [0081.254] wcscpy (in: _Dest=0x5ba2bf8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images" [0081.254] wcscat (in: _Dest=0x5ba2bf8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\" [0081.254] wcscat (in: _Dest=0x5ba2bf8, _Source="AppConnectorAppList.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.scale-100.png" [0081.254] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba2bf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bf4 [0081.255] FindNextFileW (in: hFindFile=0x54458c0, lpFindFileData=0x53f6208 | out: lpFindFileData=0x53f6208*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfcf205, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xcdfcf205, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xcdfcf205, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConnectorAppList.targetsize-16.png", cAlternateFileName="")) returned 1 [0081.255] wcscmp (_String1="AppConnectorAppList.targetsize-16.png", _String2=".") returned 1 [0081.255] wcscmp (_String1="AppConnectorAppList.targetsize-16.png", _String2="..") returned 1 [0081.255] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100) returned 0x75815b0 [0081.255] wcscpy (in: _Dest=0x75815b0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images" [0081.255] wcscat (in: _Dest=0x75815b0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\" [0081.255] wcscat (in: _Dest=0x75815b0, _Source="AppConnectorAppList.targetsize-16.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-16.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-16.png" [0081.255] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x75815b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bf8 [0081.255] FindNextFileW (in: hFindFile=0x54458c0, lpFindFileData=0x53f6208 | out: lpFindFileData=0x53f6208*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfcf205, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xcdfcf205, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xcdfcf205, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConnectorAppList.targetsize-20.png", cAlternateFileName="")) returned 1 [0081.255] wcscmp (_String1="AppConnectorAppList.targetsize-20.png", _String2=".") returned 1 [0081.256] wcscmp (_String1="AppConnectorAppList.targetsize-20.png", _String2="..") returned 1 [0081.256] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100) returned 0x75817c0 [0081.256] wcscpy (in: _Dest=0x75817c0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images" [0081.256] wcscat (in: _Dest=0x75817c0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\" [0081.256] wcscat (in: _Dest=0x75817c0, _Source="AppConnectorAppList.targetsize-20.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-20.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-20.png" [0081.256] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x75817c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bfc [0081.256] FindNextFileW (in: hFindFile=0x54458c0, lpFindFileData=0x53f6208 | out: lpFindFileData=0x53f6208*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfcf205, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xcdfcf205, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xcdfcf205, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConnectorAppList.targetsize-24.png", cAlternateFileName="")) returned 1 [0081.256] wcscmp (_String1="AppConnectorAppList.targetsize-24.png", _String2=".") returned 1 [0081.256] wcscmp (_String1="AppConnectorAppList.targetsize-24.png", _String2="..") returned 1 [0081.256] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100) returned 0x7582a50 [0081.256] wcscpy (in: _Dest=0x7582a50, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images" [0081.256] wcscat (in: _Dest=0x7582a50, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\" [0081.256] wcscat (in: _Dest=0x7582a50, _Source="AppConnectorAppList.targetsize-24.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-24.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-24.png" [0081.256] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7582a50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c04 [0081.257] FindNextFileW (in: hFindFile=0x54458c0, lpFindFileData=0x53f6208 | out: lpFindFileData=0x53f6208*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfcf205, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xcdfcf205, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xcdfcf205, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConnectorAppList.targetsize-256.png", cAlternateFileName="")) returned 1 [0081.257] wcscmp (_String1="AppConnectorAppList.targetsize-256.png", _String2=".") returned 1 [0081.257] wcscmp (_String1="AppConnectorAppList.targetsize-256.png", _String2="..") returned 1 [0081.257] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x102) Thread: id = 362 os_tid = 0x157c [0072.302] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x54464d8 [0072.302] wcscpy (in: _Dest=0x54464d8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js" [0072.302] wcscat (in: _Dest=0x54464d8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\" [0072.302] wcscat (in: _Dest=0x54464d8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\*" [0072.302] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f6470 [0072.302] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\*", lpFindFileData=0x53f6470 | out: lpFindFileData=0x53f6470*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdff5463, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa9f2d5d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdff5463, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445740 [0082.537] wcscmp (_String1=".", _String2=".") returned 0 [0082.537] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x53f6470 | out: lpFindFileData=0x53f6470*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdff5463, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa9f2d5d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdff5463, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.537] wcscmp (_String1="..", _String2=".") returned 1 [0082.537] wcscmp (_String1="..", _String2="..") returned 0 [0082.537] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x53f6470 | out: lpFindFileData=0x53f6470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdff5463, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xcdff5463, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xcdff5463, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x233, dwReserved0=0x0, dwReserved1=0x0, cFileName="default.js", cAlternateFileName="")) returned 1 [0082.537] wcscmp (_String1="default.js", _String2=".") returned 1 [0082.537] wcscmp (_String1="default.js", _String2="..") returned 1 [0082.537] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x55fe308 [0082.537] wcscpy (in: _Dest=0x55fe308, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js" [0082.537] wcscat (in: _Dest=0x55fe308, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\" [0082.537] wcscat (in: _Dest=0x55fe308, _Source="default.js" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\default.js") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\default.js" [0082.537] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55fe308, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ecc [0082.538] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x53f6470 | out: lpFindFileData=0x53f6470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdff5463, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xcdff5463, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xcdff5463, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x233, dwReserved0=0x0, dwReserved1=0x0, cFileName="default.js", cAlternateFileName="")) returned 0 [0082.538] FindClose (in: hFindFile=0x5445740 | out: hFindFile=0x5445740) returned 1 [0082.538] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f6470) returned 1 [0082.538] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54464d8) returned 1 [0082.538] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445c38) returned 1 Thread: id = 363 os_tid = 0x1580 [0072.303] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xee) returned 0x54506a0 [0072.303] wcscpy (in: _Dest=0x54506a0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0072.303] wcscat (in: _Dest=0x54506a0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0072.303] wcscat (in: _Dest=0x54506a0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0072.303] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f66d8 [0072.303] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x53f66d8 | out: lpFindFileData=0x53f66d8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5e205736, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x10032a71, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x10032a71, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ed40 [0086.001] wcscmp (_String1=".", _String2=".") returned 0 [0086.001] FindNextFileW (in: hFindFile=0x389ed40, lpFindFileData=0x53f66d8 | out: lpFindFileData=0x53f66d8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5e205736, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x10032a71, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x10032a71, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.001] wcscmp (_String1="..", _String2=".") returned 1 [0086.001] wcscmp (_String1="..", _String2="..") returned 0 [0086.001] FindNextFileW (in: hFindFile=0x389ed40, lpFindFileData=0x53f66d8 | out: lpFindFileData=0x53f66d8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x10032a71, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x10032a71, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x10032a71, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 1 [0086.001] wcscmp (_String1="Autogen", _String2=".") returned 1 [0086.001] wcscmp (_String1="Autogen", _String2="..") returned 1 [0086.001] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfa) returned 0x54999f8 [0086.002] wcscpy (in: _Dest=0x54999f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0086.002] wcscat (in: _Dest=0x54999f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0086.002] wcscat (in: _Dest=0x54999f8, _Source="Autogen" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen" [0088.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54999f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ec8 [0088.685] FindNextFileW (in: hFindFile=0x389ed40, lpFindFileData=0x53f66d8 | out: lpFindFileData=0x53f66d8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x10032a71, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x10032a71, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x10032a71, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0088.685] FindClose (in: hFindFile=0x389ed40 | out: hFindFile=0x389ed40) returned 1 [0088.685] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f66d8) returned 1 [0088.685] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54506a0) returned 1 [0088.685] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5450e60) returned 1 Thread: id = 364 os_tid = 0x1584 [0072.304] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\resources.pri")) returned 0x20 [0082.640] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0082.640] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.640] GetLastError () returned 0x5 [0082.640] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0082.640] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5470510) returned 1 Thread: id = 365 os_tid = 0x1588 [0072.305] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x542b938 [0072.305] wcscpy (in: _Dest=0x542b938, _Source="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033" | out: _Dest="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033") returned="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033" [0072.305] wcscat (in: _Dest=0x542b938, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033\\") returned="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033\\" [0072.305] wcscat (in: _Dest=0x542b938, _Source="*" | out: _Dest="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033\\*") returned="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033\\*" [0072.305] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f4528 [0072.305] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033\\*", lpFindFileData=0x53f4528 | out: lpFindFileData=0x53f4528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54457c0 [0077.181] wcscmp (_String1=".", _String2=".") returned 0 [0077.181] FindNextFileW (in: hFindFile=0x54457c0, lpFindFileData=0x53f4528 | out: lpFindFileData=0x53f4528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.181] wcscmp (_String1="..", _String2=".") returned 1 [0077.181] wcscmp (_String1="..", _String2="..") returned 0 [0077.181] FindNextFileW (in: hFindFile=0x54457c0, lpFindFileData=0x53f4528 | out: lpFindFileData=0x53f4528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0077.181] FindClose (in: hFindFile=0x54457c0 | out: hFindFile=0x54457c0) returned 1 [0077.182] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f4528) returned 1 [0077.182] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542b938) returned 1 [0077.182] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541ae08) returned 1 Thread: id = 366 os_tid = 0x158c [0072.307] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x542b9a0 [0072.307] wcscpy (in: _Dest=0x542b9a0, _Source="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070" | out: _Dest="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070") returned="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070" [0072.307] wcscat (in: _Dest=0x542b9a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070\\") returned="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070\\" [0072.307] wcscat (in: _Dest=0x542b9a0, _Source="*" | out: _Dest="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070\\*") returned="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070\\*" [0072.307] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f6940 [0072.307] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070\\*", lpFindFileData=0x53f6940 | out: lpFindFileData=0x53f6940*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445880 [0081.216] wcscmp (_String1=".", _String2=".") returned 0 [0081.216] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53f6940 | out: lpFindFileData=0x53f6940*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.216] wcscmp (_String1="..", _String2=".") returned 1 [0081.216] wcscmp (_String1="..", _String2="..") returned 0 [0081.216] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x53f6940 | out: lpFindFileData=0x53f6940*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0081.216] FindClose (in: hFindFile=0x5445880 | out: hFindFile=0x5445880) returned 1 [0081.216] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f6940) returned 1 [0081.216] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542b9a0) returned 1 [0081.216] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542b590) returned 1 Thread: id = 367 os_tid = 0x1590 [0072.308] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a59b0 [0072.308] wcscpy (in: _Dest=0x38a59b0, _Source="C:\\ProgramData\\Adobe\\ARM\\S" | out: _Dest="C:\\ProgramData\\Adobe\\ARM\\S") returned="C:\\ProgramData\\Adobe\\ARM\\S" [0072.308] wcscat (in: _Dest=0x38a59b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\ARM\\S\\") returned="C:\\ProgramData\\Adobe\\ARM\\S\\" [0072.308] wcscat (in: _Dest=0x38a59b0, _Source="*" | out: _Dest="C:\\ProgramData\\Adobe\\ARM\\S\\*") returned="C:\\ProgramData\\Adobe\\ARM\\S\\*" [0072.308] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f6ba8 [0072.308] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\S\\*", lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ec80 [0077.124] wcscmp (_String1=".", _String2=".") returned 0 [0077.128] FindNextFileW (in: hFindFile=0x389ec80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.128] wcscmp (_String1="..", _String2=".") returned 1 [0077.128] wcscmp (_String1="..", _String2="..") returned 0 [0077.129] FindNextFileW (in: hFindFile=0x389ec80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0077.129] FindClose (in: hFindFile=0x389ec80 | out: hFindFile=0x389ec80) returned 1 [0077.129] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f6ba8) returned 1 [0077.129] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a59b0) returned 1 [0077.129] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445900) returned 1 Thread: id = 368 os_tid = 0x1594 [0072.312] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x53f7d60 [0072.312] wcscpy (in: _Dest=0x53f7d60, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe" [0072.312] wcscat (in: _Dest=0x53f7d60, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\" [0072.312] wcscat (in: _Dest=0x53f7d60, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\*" [0072.312] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f4790 [0072.312] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x53f4790 | out: lpFindFileData=0x53f4790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac06201d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbed30aaa, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbed30aaa, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba11f0 [0079.161] wcscmp (_String1=".", _String2=".") returned 0 [0079.161] FindNextFileW (in: hFindFile=0x5ba11f0, lpFindFileData=0x53f4790 | out: lpFindFileData=0x53f4790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac06201d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbed30aaa, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbed30aaa, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.162] wcscmp (_String1="..", _String2=".") returned 1 [0079.162] wcscmp (_String1="..", _String2="..") returned 0 [0079.162] FindNextFileW (in: hFindFile=0x5ba11f0, lpFindFileData=0x53f4790 | out: lpFindFileData=0x53f4790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac278116, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac278116, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac278116, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0079.162] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0079.162] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0079.162] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x39704c8 [0079.162] wcscpy (in: _Dest=0x39704c8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe" [0079.162] wcscat (in: _Dest=0x39704c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\" [0079.162] wcscat (in: _Dest=0x39704c8, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" [0080.556] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x39704c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140c [0080.556] FindNextFileW (in: hFindFile=0x5ba11f0, lpFindFileData=0x53f4790 | out: lpFindFileData=0x53f4790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac08827b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabb9e6bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac08827b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0080.556] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0080.556] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0080.556] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x54ba928 [0080.556] wcscpy (in: _Dest=0x54ba928, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe" [0080.556] wcscat (in: _Dest=0x54ba928, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\" [0080.557] wcscat (in: _Dest=0x54ba928, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0080.557] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54ba928, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1590 [0080.557] FindNextFileW (in: hFindFile=0x5ba11f0, lpFindFileData=0x53f4790 | out: lpFindFileData=0x53f4790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac278116, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac278116, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac278116, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x299d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0080.557] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0080.557] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0080.557] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe4) returned 0x54b9558 [0080.557] wcscpy (in: _Dest=0x54b9558, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe" [0080.557] wcscat (in: _Dest=0x54b9558, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\" [0080.557] wcscat (in: _Dest=0x54b9558, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" [0080.557] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54b9558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1594 [0080.558] FindNextFileW (in: hFindFile=0x5ba11f0, lpFindFileData=0x53f4790 | out: lpFindFileData=0x53f4790*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbed30aaa, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbed30aaa, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbed30aaa, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0080.558] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0080.558] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0080.558] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x104) returned 0x7412890 [0080.558] wcscpy (in: _Dest=0x7412890, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe" [0080.558] wcscat (in: _Dest=0x7412890, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\" [0080.558] wcscat (in: _Dest=0x7412890, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" [0080.558] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7412890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1598 [0080.559] FindNextFileW (in: hFindFile=0x5ba11f0, lpFindFileData=0x53f4790 | out: lpFindFileData=0x53f4790*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbed30aaa, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbed30aaa, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbed30aaa, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0080.559] FindClose (in: hFindFile=0x5ba11f0 | out: hFindFile=0x5ba11f0) returned 1 [0080.560] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f4790) returned 1 [0080.560] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f7d60) returned 1 [0080.560] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388c5d8) returned 1 Thread: id = 369 os_tid = 0x1598 [0072.314] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x53fa640 [0072.314] wcscpy (in: _Dest=0x53fa640, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe" [0072.314] wcscat (in: _Dest=0x53fa640, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\" [0072.314] wcscat (in: _Dest=0x53fa640, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\*" [0072.314] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f49f8 [0072.314] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x53f49f8 | out: lpFindFileData=0x53f49f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac29e374, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbed30aaa, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbed30aaa, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ec40 [0075.169] wcscmp (_String1=".", _String2=".") returned 0 [0075.169] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x53f49f8 | out: lpFindFileData=0x53f49f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac29e374, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbed30aaa, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbed30aaa, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.169] wcscmp (_String1="..", _String2=".") returned 1 [0075.169] wcscmp (_String1="..", _String2="..") returned 0 [0075.169] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x53f49f8 | out: lpFindFileData=0x53f49f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac310a85, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac4da6c7, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac4da6c7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x6bc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="3DViewer.dll", cAlternateFileName="")) returned 1 [0075.169] wcscmp (_String1="3DViewer.dll", _String2=".") returned 1 [0075.169] wcscmp (_String1="3DViewer.dll", _String2="..") returned 1 [0075.170] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x53f49f8 | out: lpFindFileData=0x53f49f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac500925, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac526b7e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac526b7e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="3DViewer.exe", cAlternateFileName="")) returned 1 [0075.170] wcscmp (_String1="3DViewer.exe", _String2=".") returned 1 [0075.170] wcscmp (_String1="3DViewer.exe", _String2="..") returned 1 [0075.170] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x53f49f8 | out: lpFindFileData=0x53f49f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac526b7e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac526b7e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac526b7e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="3DViewer.ResourceResolver.exe", cAlternateFileName="")) returned 1 [0075.170] wcscmp (_String1="3DViewer.ResourceResolver.exe", _String2=".") returned 1 [0075.170] wcscmp (_String1="3DViewer.ResourceResolver.exe", _String2="..") returned 1 [0075.170] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x53f49f8 | out: lpFindFileData=0x53f49f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac29e374, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac2c45ce, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac2c45ce, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x6fa1, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0075.170] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0075.170] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0075.170] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x3934488 [0075.170] wcscpy (in: _Dest=0x3934488, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe" [0075.170] wcscat (in: _Dest=0x3934488, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\" [0075.170] wcscat (in: _Dest=0x3934488, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" [0075.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3934488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc88 [0075.971] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x53f49f8 | out: lpFindFileData=0x53f49f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac29e374, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac29e374, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac29e374, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2a17, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0075.971] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0075.971] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0075.972] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x3935528 [0075.972] wcscpy (in: _Dest=0x3935528, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe" [0075.972] wcscat (in: _Dest=0x3935528, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\" [0075.972] wcscat (in: _Dest=0x3935528, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" [0075.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3935528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd8 [0075.972] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x53f49f8 | out: lpFindFileData=0x53f49f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac2ea82c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabba0d3c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac2ea82c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0075.972] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0075.972] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0075.972] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x39735b0 [0075.972] wcscpy (in: _Dest=0x39735b0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe" [0075.973] wcscat (in: _Dest=0x39735b0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\" [0075.973] wcscat (in: _Dest=0x39735b0, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0075.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x39735b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfdc [0075.973] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x53f49f8 | out: lpFindFileData=0x53f49f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2ea82c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac2ea82c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac2ea82c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x29c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0075.973] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0075.973] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0075.973] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x54f18b8 [0075.973] wcscpy (in: _Dest=0x54f18b8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe" [0075.973] wcscat (in: _Dest=0x54f18b8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\" [0075.973] wcscat (in: _Dest=0x54f18b8, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" [0075.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f18b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe0 [0075.974] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x53f49f8 | out: lpFindFileData=0x53f49f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac526b7e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabba158a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac59928e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0075.974] wcscmp (_String1="Assets", _String2=".") returned 1 [0075.974] wcscmp (_String1="Assets", _String2="..") returned 1 [0075.974] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x3970a10 [0075.974] wcscpy (in: _Dest=0x3970a10, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe" [0075.974] wcscat (in: _Dest=0x3970a10, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\" [0075.974] wcscat (in: _Dest=0x3970a10, _Source="Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets" [0075.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3970a10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe4 [0075.975] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x53f49f8 | out: lpFindFileData=0x53f49f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac67e0b4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac6a430d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac6a430d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x24c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Beihai.Common.Diagnostics.dll", cAlternateFileName="")) returned 1 [0075.975] wcscmp (_String1="Beihai.Common.Diagnostics.dll", _String2=".") returned 1 [0075.975] wcscmp (_String1="Beihai.Common.Diagnostics.dll", _String2="..") returned 1 [0075.975] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x53f49f8 | out: lpFindFileData=0x53f49f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac6a430d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac6a430d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac6a430d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Beihai_Common_Diagnostics.winmd", cAlternateFileName="")) returned 1 [0075.975] wcscmp (_String1="Beihai_Common_Diagnostics.winmd", _String2=".") returned 1 [0075.975] wcscmp (_String1="Beihai_Common_Diagnostics.winmd", _String2="..") returned 1 [0075.975] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf6) returned 0x54a4700 [0075.976] wcscpy (in: _Dest=0x54a4700, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe" [0075.976] wcscat (in: _Dest=0x54a4700, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\" [0075.976] wcscat (in: _Dest=0x54a4700, _Source="Beihai_Common_Diagnostics.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Beihai_Common_Diagnostics.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Beihai_Common_Diagnostics.winmd" [0075.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54a4700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe8 [0075.976] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x53f49f8 | out: lpFindFileData=0x53f49f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac6a430d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac6ca56b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac6ca56b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xff58, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClrCompression.dll", cAlternateFileName="")) returned 1 [0075.976] wcscmp (_String1="ClrCompression.dll", _String2=".") returned 1 [0075.976] wcscmp (_String1="ClrCompression.dll", _String2="..") returned 1 [0075.976] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x53f49f8 | out: lpFindFileData=0x53f49f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac6ca56b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac7af38c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac7af38c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x597000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EngineWinRT.dll", cAlternateFileName="")) returned 1 [0075.976] wcscmp (_String1="EngineWinRT.dll", _String2=".") returned 1 [0075.976] wcscmp (_String1="EngineWinRT.dll", _String2="..") returned 1 [0075.976] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x53f49f8 | out: lpFindFileData=0x53f49f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac7af38c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac7d55e5, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac7d55e5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lift.Engine.winmd", cAlternateFileName="")) returned 1 [0075.976] wcscmp (_String1="Lift.Engine.winmd", _String2=".") returned 1 [0075.977] wcscmp (_String1="Lift.Engine.winmd", _String2="..") returned 1 [0075.977] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x54f0698 [0075.977] wcscpy (in: _Dest=0x54f0698, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe" [0075.977] wcscat (in: _Dest=0x54f0698, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\" [0075.977] wcscat (in: _Dest=0x54f0698, _Source="Lift.Engine.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Lift.Engine.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Lift.Engine.winmd" [0075.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f0698, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfec [0075.977] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x53f49f8 | out: lpFindFileData=0x53f49f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac7d55e5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac7d55e5, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac7d55e5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lift.Transcoding.winmd", cAlternateFileName="")) returned 1 [0075.977] wcscmp (_String1="Lift.Transcoding.winmd", _String2=".") returned 1 [0075.977] wcscmp (_String1="Lift.Transcoding.winmd", _String2="..") returned 1 [0075.977] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe4) returned 0x396f988 [0075.978] wcscpy (in: _Dest=0x396f988, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe" [0075.978] wcscat (in: _Dest=0x396f988, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\" [0075.978] wcscat (in: _Dest=0x396f988, _Source="Lift.Transcoding.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Lift.Transcoding.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Lift.Transcoding.winmd" [0075.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396f988, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xff0 [0075.978] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x53f49f8 | out: lpFindFileData=0x53f49f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbed30aaa, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xabbf4c99, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbed30aaa, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0075.978] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0075.978] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0075.978] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfa) returned 0x550b470 [0075.979] wcscpy (in: _Dest=0x550b470, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe" [0075.979] wcscat (in: _Dest=0x550b470, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\" [0075.979] wcscat (in: _Dest=0x550b470, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0075.979] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x550b470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xff4 [0075.979] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x53f49f8 | out: lpFindFileData=0x53f49f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac7d55e5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaca37b9a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xaca37b9a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x65be00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PluginManagerWinRt.dll", cAlternateFileName="")) returned 1 [0075.979] wcscmp (_String1="PluginManagerWinRt.dll", _String2=".") returned 1 [0075.979] wcscmp (_String1="PluginManagerWinRt.dll", _String2="..") returned 1 [0075.979] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x53f49f8 | out: lpFindFileData=0x53f49f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaca37b9a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacb9b066, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xacb9b066, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x6a2f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0075.979] wcscmp (_String1="resources.pri", _String2=".") returned 1 [0075.979] wcscmp (_String1="resources.pri", _String2="..") returned 1 [0075.980] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x3935288 [0075.980] wcscpy (in: _Dest=0x3935288, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe" [0075.980] wcscat (in: _Dest=0x3935288, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\" [0075.980] wcscat (in: _Dest=0x3935288, _Source="resources.pri" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\resources.pri") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\resources.pri" [0075.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3935288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xff8 [0075.980] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x53f49f8 | out: lpFindFileData=0x53f49f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac310a85, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabba02f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac310a85, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 1 [0075.980] wcscmp (_String1="_Resources", _String2=".") returned 1 [0075.980] wcscmp (_String1="_Resources", _String2="..") returned 1 [0075.980] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x3973688 [0075.980] wcscpy (in: _Dest=0x3973688, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe" [0075.980] wcscat (in: _Dest=0x3973688, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\" [0075.980] wcscat (in: _Dest=0x3973688, _Source="_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources" [0075.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3973688, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xffc [0075.981] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x53f49f8 | out: lpFindFileData=0x53f49f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac310a85, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabba02f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac310a85, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 0 [0075.981] FindClose (in: hFindFile=0x389ec40 | out: hFindFile=0x389ec40) returned 1 [0075.981] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f49f8) returned 1 [0075.981] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fa640) returned 1 [0075.982] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5461b28) returned 1 Thread: id = 370 os_tid = 0x159c [0072.315] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0086.001] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0087.659] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.347] GetLastError () returned 0x5 [0089.347] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0089.347] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ba758) returned 1 Thread: id = 371 os_tid = 0x15a0 [0072.316] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0086.000] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0087.659] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.341] GetLastError () returned 0x5 [0089.342] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0089.342] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53bb178) returned 1 Thread: id = 372 os_tid = 0x15a4 [0072.317] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x53bb838 [0072.317] wcscpy (in: _Dest=0x53bb838, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0072.317] wcscat (in: _Dest=0x53bb838, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0072.317] wcscat (in: _Dest=0x53bb838, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*" [0072.317] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f4c60 [0072.317] FindFirstFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x53f4c60) Thread: id = 373 os_tid = 0x15a8 [0072.318] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0085.999] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0087.659] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.341] GetLastError () returned 0x5 [0089.341] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0089.341] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53bba80) returned 1 Thread: id = 374 os_tid = 0x15ac [0072.319] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\logo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\logo.png")) returned 0x20 [0082.609] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x20) returned 0 [0082.626] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\logo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\logo.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.658] GetLastError () returned 0x5 [0087.658] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x20) returned 0 [0089.339] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b6868) returned 1 Thread: id = 375 os_tid = 0x15b0 [0072.323] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xde) returned 0x546eda0 [0072.324] wcscpy (in: _Dest=0x546eda0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising" [0072.324] wcscat (in: _Dest=0x546eda0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\" [0072.324] wcscat (in: _Dest=0x546eda0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\*" [0072.324] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f2f80 [0072.324] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\*", lpFindFileData=0x53f2f80 | out: lpFindFileData=0x53f2f80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ccfdd0, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9cba947, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33cf6025, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445100 [0077.731] wcscmp (_String1=".", _String2=".") returned 0 [0077.731] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53f2f80 | out: lpFindFileData=0x53f2f80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ccfdd0, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9cba947, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33cf6025, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.731] wcscmp (_String1="..", _String2=".") returned 1 [0077.731] wcscmp (_String1="..", _String2="..") returned 0 [0077.731] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53f2f80 | out: lpFindFileData=0x53f2f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33ccfdd0, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33ccfdd0, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33ccfdd0, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x6e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootstrap.html", cAlternateFileName="")) returned 1 [0077.731] wcscmp (_String1="bootstrap.html", _String2=".") returned 1 [0077.731] wcscmp (_String1="bootstrap.html", _String2="..") returned 1 [0077.731] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf8) returned 0x54a4100 [0077.731] wcscpy (in: _Dest=0x54a4100, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising" [0077.731] wcscat (in: _Dest=0x54a4100, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\" [0077.731] wcscat (in: _Dest=0x54a4100, _Source="bootstrap.html" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html" [0080.918] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54a4100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12bc [0080.918] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53f2f80 | out: lpFindFileData=0x53f2f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33cf6025, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33cf6025, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33cf6025, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x50cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootstrap.js", cAlternateFileName="")) returned 1 [0080.918] wcscmp (_String1="bootstrap.js", _String2=".") returned 1 [0080.918] wcscmp (_String1="bootstrap.js", _String2="..") returned 1 [0080.918] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf4) returned 0x5ba29f8 [0080.918] wcscpy (in: _Dest=0x5ba29f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising" [0080.918] wcscat (in: _Dest=0x5ba29f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\" [0080.918] wcscat (in: _Dest=0x5ba29f8, _Source="bootstrap.js" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.js") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.js" [0080.918] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba29f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18bc [0080.919] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53f2f80 | out: lpFindFileData=0x53f2f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33cf6025, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33d27ae5, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33d27ae5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x78bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ormma.js", cAlternateFileName="")) returned 1 [0080.919] wcscmp (_String1="ormma.js", _String2=".") returned 1 [0080.919] wcscmp (_String1="ormma.js", _String2="..") returned 1 [0080.919] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x72865b0 [0080.919] wcscpy (in: _Dest=0x72865b0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising" [0080.919] wcscat (in: _Dest=0x72865b0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\" [0080.919] wcscat (in: _Dest=0x72865b0, _Source="ormma.js" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\ormma.js") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\ormma.js" [0080.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x72865b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c0 [0080.920] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x53f2f80 | out: lpFindFileData=0x53f2f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33cf6025, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33d27ae5, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33d27ae5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x78bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ormma.js", cAlternateFileName="")) returned 0 [0080.920] FindClose (in: hFindFile=0x5445100 | out: hFindFile=0x5445100) returned 1 [0080.920] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f2f80) returned 1 [0080.920] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x546eda0) returned 1 [0084.179] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53bbb60) returned 1 Thread: id = 376 os_tid = 0x15b4 [0072.324] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.advertising.winmd")) returned 0x20 [0082.631] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising.winmd", dwFileAttributes=0x20) returned 0 [0087.659] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.advertising.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.340] GetLastError () returned 0x5 [0089.340] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising.winmd", dwFileAttributes=0x20) returned 0 [0089.340] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53bbc48) returned 1 Thread: id = 377 os_tid = 0x15b8 [0072.325] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf6) returned 0x38c9fd0 [0072.325] wcscpy (in: _Dest=0x38c9fd0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0072.325] wcscat (in: _Dest=0x38c9fd0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0072.325] wcscat (in: _Dest=0x38c9fd0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0072.325] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f3450 [0072.325] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x53f3450 | out: lpFindFileData=0x53f3450*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb4a05954, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb4a05954, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xdfcbee3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e800 [0086.002] wcscmp (_String1=".", _String2=".") returned 0 [0086.002] FindNextFileW (in: hFindFile=0x389e800, lpFindFileData=0x53f3450 | out: lpFindFileData=0x53f3450*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb4a05954, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb4a05954, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xdfcbee3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.002] wcscmp (_String1="..", _String2=".") returned 1 [0086.002] wcscmp (_String1="..", _String2="..") returned 0 [0086.002] FindNextFileW (in: hFindFile=0x389e800, lpFindFileData=0x53f3450 | out: lpFindFileData=0x53f3450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdfcbee3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xdfcbee3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdfcbee3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 1 [0086.002] wcscmp (_String1="Autogen", _String2=".") returned 1 [0086.002] wcscmp (_String1="Autogen", _String2="..") returned 1 [0086.002] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x102) returned 0x743a690 [0086.002] wcscpy (in: _Dest=0x743a690, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0086.002] wcscat (in: _Dest=0x743a690, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0086.002] wcscat (in: _Dest=0x743a690, _Source="Autogen" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen" [0088.678] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x743a690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1eb8 [0088.678] FindNextFileW (in: hFindFile=0x389e800, lpFindFileData=0x53f3450 | out: lpFindFileData=0x53f3450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdfcbee3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xdfcbee3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdfcbee3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0088.678] FindClose (in: hFindFile=0x389e800 | out: hFindFile=0x389e800) returned 1 [0088.678] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f3450) returned 1 [0088.678] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38c9fd0) Thread: id = 378 os_tid = 0x15bc [0072.326] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\resources.pri")) returned 0x20 [0087.155] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0089.338] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.338] GetLastError () returned 0x5 [0089.338] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0089.338] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ba5a8) returned 1 Thread: id = 379 os_tid = 0x15c0 [0072.327] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x53fa708 [0072.327] wcscpy (in: _Dest=0x53fa708, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" [0072.327] wcscat (in: _Dest=0x53fa708, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\" [0072.327] wcscat (in: _Dest=0x53fa708, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\*" [0072.327] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f4ec8 [0072.327] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62a7e361, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc3123ced, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc3123ced, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ed00 [0075.179] wcscmp (_String1=".", _String2=".") returned 0 [0075.179] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62a7e361, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc3123ced, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc3123ced, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.179] wcscmp (_String1="..", _String2=".") returned 1 [0075.179] wcscmp (_String1="..", _String2="..") returned 0 [0075.179] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62aa45be, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x62aa45be, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x62aa45be, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2557a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0075.179] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0075.179] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0075.179] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x54f1600 [0075.179] wcscpy (in: _Dest=0x54f1600, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" [0075.179] wcscat (in: _Dest=0x54f1600, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\" [0075.179] wcscat (in: _Dest=0x54f1600, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" [0075.950] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f1600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc8c [0075.951] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a7e361, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x62a7e361, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x62a7e361, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x11c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0075.951] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0075.951] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0075.951] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x54f16e8 [0075.951] wcscpy (in: _Dest=0x54f16e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" [0075.951] wcscat (in: _Dest=0x54f16e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\" [0075.951] wcscat (in: _Dest=0x54f16e8, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" [0075.951] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f16e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8c [0075.952] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62aca818, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc4070c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62aca818, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0075.952] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0075.952] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0075.952] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x39348e8 [0075.952] wcscpy (in: _Dest=0x39348e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" [0075.952] wcscat (in: _Dest=0x39348e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\" [0075.952] wcscat (in: _Dest=0x39348e8, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0075.952] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x39348e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf90 [0075.953] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62aa45be, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x62aa45be, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x62aa45be, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2997, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0075.953] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0075.953] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0075.953] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x54f17d0 [0075.953] wcscpy (in: _Dest=0x54f17d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" [0075.953] wcscat (in: _Dest=0x54f17d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\" [0075.953] wcscat (in: _Dest=0x54f17d0, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" [0075.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f17d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf94 [0075.954] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62aca818, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x62b893df, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x62b893df, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x249ed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="clienttelemetry.dll", cAlternateFileName="")) returned 1 [0075.954] wcscmp (_String1="clienttelemetry.dll", _String2=".") returned 1 [0075.954] wcscmp (_String1="clienttelemetry.dll", _String2="..") returned 1 [0075.954] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62b893df, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x62baf63d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x62baf63d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1c8e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="FilesystemMetadata.xml", cAlternateFileName="")) returned 1 [0075.954] wcscmp (_String1="FilesystemMetadata.xml", _String2=".") returned 1 [0075.954] wcscmp (_String1="FilesystemMetadata.xml", _String2="..") returned 1 [0075.954] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe6) returned 0x396ee48 [0075.954] wcscpy (in: _Dest=0x396ee48, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" [0075.954] wcscat (in: _Dest=0x396ee48, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\" [0075.954] wcscat (in: _Dest=0x396ee48, _Source="FilesystemMetadata.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\FilesystemMetadata.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\FilesystemMetadata.xml" [0075.954] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396ee48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf98 [0075.955] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62baf63d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x62baf63d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x62baf63d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x21, dwReserved0=0x0, dwReserved1=0x0, cFileName="FilesystemMetadata.xml.md", cAlternateFileName="")) returned 1 [0075.955] wcscmp (_String1="FilesystemMetadata.xml.md", _String2=".") returned 1 [0075.955] wcscmp (_String1="FilesystemMetadata.xml.md", _String2="..") returned 1 [0075.955] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x393e8f8 [0075.955] wcscpy (in: _Dest=0x393e8f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" [0075.955] wcscat (in: _Dest=0x393e8f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\" [0075.955] wcscat (in: _Dest=0x393e8f8, _Source="FilesystemMetadata.xml.md" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\FilesystemMetadata.xml.md") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\FilesystemMetadata.xml.md" [0075.955] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x393e8f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf9c [0075.956] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62baf63d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc41746, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62c6e205, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0075.956] wcscmp (_String1="images", _String2=".") returned 1 [0075.956] wcscmp (_String1="images", _String2="..") returned 1 [0075.956] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x3971980 [0075.956] wcscpy (in: _Dest=0x3971980, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" [0075.956] wcscat (in: _Dest=0x3971980, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\" [0075.956] wcscat (in: _Dest=0x3971980, _Source="images" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images" [0075.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3971980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa0 [0075.957] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62c6e205, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc423fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62c6e205, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="loc", cAlternateFileName="")) returned 1 [0075.957] wcscmp (_String1="loc", _String2=".") returned 1 [0075.957] wcscmp (_String1="loc", _String2="..") returned 1 [0075.957] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x3974f50 [0075.957] wcscpy (in: _Dest=0x3974f50, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" [0075.957] wcscat (in: _Dest=0x3974f50, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\" [0075.957] wcscat (in: _Dest=0x3974f50, _Source="loc" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\loc") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\loc" [0075.957] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3974f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa4 [0075.958] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc3123ced, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc3123ced, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc3123ced, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0075.958] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0075.958] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0075.958] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x550baa0 [0075.958] wcscpy (in: _Dest=0x550baa0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" [0075.958] wcscat (in: _Dest=0x550baa0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\" [0075.958] wcscat (in: _Dest=0x550baa0, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0075.958] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x550baa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa8 [0075.959] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c9445e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x63254d7a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x63254d7a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3f0cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso20imm.dll", cAlternateFileName="")) returned 1 [0075.959] wcscmp (_String1="mso20imm.dll", _String2=".") returned 1 [0075.959] wcscmp (_String1="mso20imm.dll", _String2="..") returned 1 [0075.959] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63254d7a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x63508a92, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x63508a92, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x5a32c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso30imm.dll", cAlternateFileName="")) returned 1 [0075.959] wcscmp (_String1="mso30imm.dll", _String2=".") returned 1 [0075.959] wcscmp (_String1="mso30imm.dll", _String2="..") returned 1 [0075.959] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6357cfac, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x63688022, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x63688022, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2180c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="office.odf", cAlternateFileName="")) returned 1 [0075.959] wcscmp (_String1="office.odf", _String2=".") returned 1 [0075.959] wcscmp (_String1="office.odf", _String2="..") returned 1 [0075.959] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x39739e8 [0075.959] wcscpy (in: _Dest=0x39739e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" [0075.959] wcscat (in: _Dest=0x39739e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\" [0075.959] wcscat (in: _Dest=0x39739e8, _Source="office.odf" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\office.odf") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\office.odf" [0075.959] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x39739e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfac [0075.960] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x636ae280, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc4357d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x63720995, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office16", cAlternateFileName="")) returned 1 [0075.960] wcscmp (_String1="Office16", _String2=".") returned 1 [0075.960] wcscmp (_String1="Office16", _String2="..") returned 1 [0075.960] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xca) returned 0x3974180 [0075.960] wcscpy (in: _Dest=0x3974180, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" [0075.960] wcscat (in: _Dest=0x3974180, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\" [0075.960] wcscat (in: _Dest=0x3974180, _Source="Office16" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Office16") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Office16" [0075.960] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3974180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfb0 [0075.961] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x638057b6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x638057b6, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x638057b6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x659, dwReserved0=0x0, dwReserved1=0x0, cFileName="Officehub_Base_PriConfig.xml", cAlternateFileName="")) returned 1 [0075.961] wcscmp (_String1="Officehub_Base_PriConfig.xml", _String2=".") returned 1 [0075.961] wcscmp (_String1="Officehub_Base_PriConfig.xml", _String2="..") returned 1 [0075.961] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x54a4d00 [0075.961] wcscpy (in: _Dest=0x54a4d00, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" [0075.961] wcscat (in: _Dest=0x54a4d00, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\" [0075.961] wcscat (in: _Dest=0x54a4d00, _Source="Officehub_Base_PriConfig.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Officehub_Base_PriConfig.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Officehub_Base_PriConfig.xml" [0075.961] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54a4d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfb4 [0075.962] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x638057b6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x638c4379, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x638c4379, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x189ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="officeimm.odf", cAlternateFileName="")) returned 1 [0075.962] wcscmp (_String1="officeimm.odf", _String2=".") returned 1 [0075.962] wcscmp (_String1="officeimm.odf", _String2="..") returned 1 [0075.962] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd4) returned 0x39349c8 [0075.962] wcscpy (in: _Dest=0x39349c8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" [0075.962] wcscat (in: _Dest=0x39349c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\" [0075.962] wcscat (in: _Dest=0x39349c8, _Source="officeimm.odf" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\officeimm.odf") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\officeimm.odf" [0075.962] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x39349c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfb8 [0075.963] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x638c4379, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x638c4379, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x638c4379, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xb76, dwReserved0=0x0, dwReserved1=0x0, cFileName="Offihub_Base_PriInfo.pri.xml", cAlternateFileName="")) returned 1 [0075.963] wcscmp (_String1="Offihub_Base_PriInfo.pri.xml", _String2=".") returned 1 [0075.963] wcscmp (_String1="Offihub_Base_PriInfo.pri.xml", _String2="..") returned 1 [0075.963] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x54a3400 [0075.963] wcscpy (in: _Dest=0x54a3400, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" [0075.963] wcscat (in: _Dest=0x54a3400, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\" [0075.963] wcscat (in: _Dest=0x54a3400, _Source="Offihub_Base_PriInfo.pri.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Offihub_Base_PriInfo.pri.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Offihub_Base_PriInfo.pri.xml" [0075.963] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54a3400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfbc [0075.964] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x638c4379, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x63936aaf, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x63936aaf, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x356000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Registry.dat", cAlternateFileName="")) returned 1 [0075.964] wcscmp (_String1="Registry.dat", _String2=".") returned 1 [0075.964] wcscmp (_String1="Registry.dat", _String2="..") returned 1 [0075.964] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x3934aa8 [0075.964] wcscpy (in: _Dest=0x3934aa8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" [0075.964] wcscat (in: _Dest=0x3934aa8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\" [0075.964] wcscat (in: _Dest=0x3934aa8, _Source="Registry.dat" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Registry.dat") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Registry.dat" [0075.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3934aa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc0 [0075.965] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63936aaf, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x63936aaf, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x63936aaf, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x7f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0075.965] wcscmp (_String1="resources.pri", _String2=".") returned 1 [0075.965] wcscmp (_String1="resources.pri", _String2="..") returned 1 [0075.965] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd4) returned 0x3934b88 [0075.965] wcscpy (in: _Dest=0x3934b88, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" [0075.965] wcscat (in: _Dest=0x3934b88, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\" [0075.965] wcscat (in: _Dest=0x3934b88, _Source="resources.pri" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\resources.pri") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\resources.pri" [0075.965] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3934b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc4 [0075.966] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63936aaf, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x6395ccec, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x6395ccec, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xdd80, dwReserved0=0x0, dwReserved1=0x0, cFileName="StreamMap.xml", cAlternateFileName="")) returned 1 [0075.966] wcscmp (_String1="StreamMap.xml", _String2=".") returned 1 [0075.966] wcscmp (_String1="StreamMap.xml", _String2="..") returned 1 [0075.966] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd4) returned 0x3934c68 [0075.966] wcscpy (in: _Dest=0x3934c68, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" [0075.966] wcscat (in: _Dest=0x3934c68, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\" [0075.966] wcscat (in: _Dest=0x3934c68, _Source="StreamMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\StreamMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\StreamMap.xml" [0075.966] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3934c68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc8 [0075.966] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6395ccec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc44b63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6395ccec, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="strings", cAlternateFileName="")) returned 1 [0075.966] wcscmp (_String1="strings", _String2=".") returned 1 [0075.967] wcscmp (_String1="strings", _String2="..") returned 1 [0075.967] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x3971a50 [0075.967] wcscpy (in: _Dest=0x3971a50, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" [0075.967] wcscat (in: _Dest=0x3971a50, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\" [0075.967] wcscat (in: _Dest=0x3971a50, _Source="strings" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\strings") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\strings" [0075.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3971a50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfcc [0075.967] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6395ccec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc45469, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x662a39a5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VFS", cAlternateFileName="")) returned 1 [0075.967] wcscmp (_String1="VFS", _String2=".") returned 1 [0075.967] wcscmp (_String1="VFS", _String2="..") returned 1 [0075.968] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x3976148 [0075.968] wcscpy (in: _Dest=0x3976148, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" [0075.968] wcscat (in: _Dest=0x3976148, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\" [0075.968] wcscat (in: _Dest=0x3976148, _Source="VFS" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS" [0075.968] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3976148, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd0 [0075.968] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x663d4c5d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabd372f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6644736d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XMLOffKeys", cAlternateFileName="XMLOFF~1")) returned 1 [0075.968] wcscmp (_String1="XMLOffKeys", _String2=".") returned 1 [0075.968] wcscmp (_String1="XMLOffKeys", _String2="..") returned 1 [0075.968] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x39734d8 [0075.969] wcscpy (in: _Dest=0x39734d8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe" [0075.969] wcscat (in: _Dest=0x39734d8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\" [0075.969] wcscat (in: _Dest=0x39734d8, _Source="XMLOffKeys" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys" [0075.969] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x39734d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd4 [0075.969] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x663d4c5d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabd372f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6644736d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XMLOffKeys", cAlternateFileName="XMLOFF~1")) returned 0 [0075.969] FindClose (in: hFindFile=0x389ed00 | out: hFindFile=0x389ed00) returned 1 [0075.970] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f4ec8) returned 1 [0075.970] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fa708) returned 1 [0075.970] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5461468) returned 1 Thread: id = 380 os_tid = 0x15c4 [0072.327] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x53f87f0 [0072.327] wcscpy (in: _Dest=0x53f87f0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe" [0072.327] wcscat (in: _Dest=0x53f87f0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\" [0072.327] wcscat (in: _Dest=0x53f87f0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\*" [0072.327] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f5130 [0072.327] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x53f5130 | out: lpFindFileData=0x53f5130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628da999, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc3123ced, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc3123ced, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba1170 [0079.158] wcscmp (_String1=".", _String2=".") returned 0 [0079.158] FindNextFileW (in: hFindFile=0x5ba1170, lpFindFileData=0x53f5130 | out: lpFindFileData=0x53f5130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628da999, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc3123ced, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc3123ced, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.158] wcscmp (_String1="..", _String2=".") returned 1 [0079.158] wcscmp (_String1="..", _String2="..") returned 0 [0079.158] FindNextFileW (in: hFindFile=0x5ba1170, lpFindFileData=0x53f5130 | out: lpFindFileData=0x53f5130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a0bc4b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x62a0bc4b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x62a0bc4b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0079.158] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0079.158] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0079.158] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe4) returned 0x396f3e8 [0079.158] wcscpy (in: _Dest=0x396f3e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe" [0079.158] wcscat (in: _Dest=0x396f3e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\" [0079.158] wcscat (in: _Dest=0x396f3e8, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" [0080.563] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396f3e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1408 [0080.564] FindNextFileW (in: hFindFile=0x5ba1170, lpFindFileData=0x53f5130 | out: lpFindFileData=0x53f5130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628da999, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabdaf1a7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628da999, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0080.564] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0080.564] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0080.564] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x54bb320 [0080.564] wcscpy (in: _Dest=0x54bb320, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe" [0080.564] wcscat (in: _Dest=0x54bb320, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\" [0080.564] wcscat (in: _Dest=0x54bb320, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0080.564] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54bb320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x159c [0080.565] FindNextFileW (in: hFindFile=0x5ba1170, lpFindFileData=0x53f5130 | out: lpFindFileData=0x53f5130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a31eae, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x62a31eae, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x62a31eae, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2970, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0080.565] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0080.565] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0080.565] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe6) returned 0x54b9288 [0080.565] wcscpy (in: _Dest=0x54b9288, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe" [0080.565] wcscat (in: _Dest=0x54b9288, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\" [0080.565] wcscat (in: _Dest=0x54b9288, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" [0080.565] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54b9288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15a0 [0080.566] FindNextFileW (in: hFindFile=0x5ba1170, lpFindFileData=0x53f5130 | out: lpFindFileData=0x53f5130*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc3123ced, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc3123ced, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc3123ced, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0080.566] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0080.566] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0080.566] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x74129a8 [0080.566] wcscpy (in: _Dest=0x74129a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe" [0080.566] wcscat (in: _Dest=0x74129a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\" [0080.566] wcscat (in: _Dest=0x74129a8, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" [0080.566] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x74129a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15a4 [0080.567] FindNextFileW (in: hFindFile=0x5ba1170, lpFindFileData=0x53f5130 | out: lpFindFileData=0x53f5130*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc3123ced, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc3123ced, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc3123ced, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0080.567] FindClose (in: hFindFile=0x5ba1170 | out: hFindFile=0x5ba1170) returned 1 [0080.568] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f5130) returned 1 [0080.568] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f87f0) returned 1 [0080.568] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53bbe38) returned 1 Thread: id = 381 os_tid = 0x15c8 [0072.328] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x54504b0 [0072.328] wcscpy (in: _Dest=0x54504b0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe" [0072.328] wcscat (in: _Dest=0x54504b0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0072.328] wcscat (in: _Dest=0x54504b0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\*" [0072.328] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f36b8 [0072.328] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\*", lpFindFileData=0x53f36b8 | out: lpFindFileData=0x53f36b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x390dfd83, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc96ea5b4, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc96ea5b4, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f380 [0074.760] wcscmp (_String1=".", _String2=".") returned 0 [0074.760] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x53f36b8 | out: lpFindFileData=0x53f36b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x390dfd83, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc96ea5b4, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc96ea5b4, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.760] wcscmp (_String1="..", _String2=".") returned 1 [0074.760] wcscmp (_String1="..", _String2="..") returned 0 [0074.760] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x53f36b8 | out: lpFindFileData=0x53f36b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x391eadfd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x391eadfd, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x391eadfd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x69d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0074.760] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0074.761] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0074.761] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x38af0b8 [0074.761] wcscpy (in: _Dest=0x38af0b8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe" [0074.761] wcscat (in: _Dest=0x38af0b8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0074.761] wcscat (in: _Dest=0x38af0b8, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml" [0074.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38af0b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb6c [0074.761] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x53f36b8 | out: lpFindFileData=0x53f36b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x390dfd83, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x390dfd83, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x390dfd83, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0074.761] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0074.761] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0074.761] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x38af1d0 [0074.761] wcscpy (in: _Dest=0x38af1d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe" [0074.761] wcscat (in: _Dest=0x38af1d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0074.762] wcscat (in: _Dest=0x38af1d0, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml" [0074.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38af1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb70 [0074.762] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x53f36b8 | out: lpFindFileData=0x53f36b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x391eadfd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x391eadfd, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x391eadfd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x295a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0074.762] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0074.762] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0074.762] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x110) returned 0x38af2e8 [0074.762] wcscpy (in: _Dest=0x38af2e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe" [0074.762] wcscat (in: _Dest=0x38af2e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0074.762] wcscat (in: _Dest=0x38af2e8, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x" [0074.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38af2e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb74 [0074.763] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x53f36b8 | out: lpFindFileData=0x53f36b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x391eadfd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabe0794e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3925d50d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0074.763] wcscmp (_String1="Assets", _String2=".") returned 1 [0074.763] wcscmp (_String1="Assets", _String2="..") returned 1 [0074.763] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfa) returned 0x38af400 [0074.763] wcscpy (in: _Dest=0x38af400, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe" [0074.763] wcscat (in: _Dest=0x38af400, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0074.763] wcscat (in: _Dest=0x38af400, _Source="Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0074.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38af400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb78 [0074.764] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x53f36b8 | out: lpFindFileData=0x53f36b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc96ea5b4, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc96ea5b4, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc96ea5b4, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0074.764] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0074.764] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0074.764] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x130) returned 0x38af508 [0074.764] wcscpy (in: _Dest=0x38af508, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe" [0074.764] wcscat (in: _Dest=0x38af508, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0074.764] wcscat (in: _Dest=0x38af508, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata" [0074.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38af508, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb7c [0074.765] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x53f36b8 | out: lpFindFileData=0x53f36b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3925d50d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3925d50d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3925d50d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x538, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0074.765] wcscmp (_String1="resources.pri", _String2=".") returned 1 [0074.765] wcscmp (_String1="resources.pri", _String2="..") returned 1 [0074.765] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x108) returned 0x38af640 [0074.765] wcscpy (in: _Dest=0x38af640, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe" [0074.765] wcscat (in: _Dest=0x38af640, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0074.765] wcscat (in: _Dest=0x38af640, _Source="resources.pri" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri" [0074.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38af640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb80 [0074.766] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x53f36b8 | out: lpFindFileData=0x53f36b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3925d50d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3925d50d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3925d50d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x538, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 0 [0074.766] FindClose (in: hFindFile=0x389f380 | out: hFindFile=0x389f380) returned 1 [0074.766] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f36b8) returned 1 [0074.766] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54504b0) returned 1 [0074.766] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54501c8) returned 1 Thread: id = 382 os_tid = 0x15cc [0072.330] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd4) returned 0x53fcda0 [0072.330] wcscpy (in: _Dest=0x53fcda0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe" [0072.331] wcscat (in: _Dest=0x53fcda0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\" [0072.331] wcscat (in: _Dest=0x53fcda0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\*" [0072.331] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f5398 [0072.331] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x53f5398 | out: lpFindFileData=0x53f5398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33798b5a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc96c435e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc96c435e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba1670 [0079.133] wcscmp (_String1=".", _String2=".") returned 0 [0079.133] FindNextFileW (in: hFindFile=0x5ba1670, lpFindFileData=0x53f5398 | out: lpFindFileData=0x53f5398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33798b5a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc96c435e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc96c435e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.133] wcscmp (_String1="..", _String2=".") returned 1 [0079.133] wcscmp (_String1="..", _String2="..") returned 0 [0079.133] FindNextFileW (in: hFindFile=0x5ba1670, lpFindFileData=0x53f5398 | out: lpFindFileData=0x53f5398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3387d97b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3387d97b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3387d97b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0079.133] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0079.133] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0079.133] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x54a4900 [0079.133] wcscpy (in: _Dest=0x54a4900, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe" [0079.133] wcscat (in: _Dest=0x54a4900, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\" [0079.133] wcscat (in: _Dest=0x54a4900, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" [0080.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54a4900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c4 [0080.767] FindNextFileW (in: hFindFile=0x5ba1670, lpFindFileData=0x53f5398 | out: lpFindFileData=0x53f5398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33798b5a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabec308c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33798b5a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0080.767] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0080.767] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0080.767] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xea) returned 0x7285df0 [0080.767] wcscpy (in: _Dest=0x7285df0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe" [0080.767] wcscat (in: _Dest=0x7285df0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\" [0080.767] wcscat (in: _Dest=0x7285df0, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0080.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7285df0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b8 [0080.768] FindNextFileW (in: hFindFile=0x5ba1670, lpFindFileData=0x53f5398 | out: lpFindFileData=0x53f5398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3387d97b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3387d97b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3387d97b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x295a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0080.768] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0080.768] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0080.768] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf4) returned 0x5ba22f8 [0080.768] wcscpy (in: _Dest=0x5ba22f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe" [0080.768] wcscat (in: _Dest=0x5ba22f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\" [0080.768] wcscat (in: _Dest=0x5ba22f8, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" [0080.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba22f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16bc [0080.769] FindNextFileW (in: hFindFile=0x5ba1670, lpFindFileData=0x53f5398 | out: lpFindFileData=0x53f5398*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc96c435e, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc96c435e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc96c435e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0080.769] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0080.769] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0080.769] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x114) returned 0x54bcf30 [0080.769] wcscpy (in: _Dest=0x54bcf30, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe" [0080.769] wcscat (in: _Dest=0x54bcf30, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\" [0080.769] wcscat (in: _Dest=0x54bcf30, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" [0080.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54bcf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c0 [0080.770] FindNextFileW (in: hFindFile=0x5ba1670, lpFindFileData=0x53f5398 | out: lpFindFileData=0x53f5398*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc96c435e, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc96c435e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc96c435e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0080.770] FindClose (in: hFindFile=0x5ba1670 | out: hFindFile=0x5ba1670) returned 1 [0080.771] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f5398) returned 1 [0080.771] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fcda0) returned 1 [0080.771] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b9e10) returned 1 Thread: id = 383 os_tid = 0x15d0 [0072.331] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x5428ea0 [0072.331] wcscpy (in: _Dest=0x5428ea0, _Source="C:\\Program Files\\Java\\jre1.8.0_144" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144") returned="C:\\Program Files\\Java\\jre1.8.0_144" [0072.331] wcscat (in: _Dest=0x5428ea0, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\" [0072.331] wcscat (in: _Dest=0x5428ea0, _Source="*" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\*") returned="C:\\Program Files\\Java\\jre1.8.0_144\\*" [0072.331] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f5600 [0072.331] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\*", lpFindFileData=0x53f5600 | out: lpFindFileData=0x53f5600*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389eb40 [0075.179] wcscmp (_String1=".", _String2=".") returned 0 [0075.179] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x53f5600 | out: lpFindFileData=0x53f5600*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.179] wcscmp (_String1="..", _String2=".") returned 1 [0075.180] wcscmp (_String1="..", _String2="..") returned 0 [0075.180] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x53f5600 | out: lpFindFileData=0x53f5600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bin", cAlternateFileName="")) returned 1 [0075.180] wcscmp (_String1="bin", _String2=".") returned 1 [0075.180] wcscmp (_String1="bin", _String2="..") returned 1 [0075.180] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x38ffde0 [0075.180] wcscpy (in: _Dest=0x38ffde0, _Source="C:\\Program Files\\Java\\jre1.8.0_144" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144") returned="C:\\Program Files\\Java\\jre1.8.0_144" [0075.180] wcscat (in: _Dest=0x38ffde0, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\" [0075.180] wcscat (in: _Dest=0x38ffde0, _Source="bin" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\bin") returned="C:\\Program Files\\Java\\jre1.8.0_144\\bin" [0075.941] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38ffde0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcac [0075.941] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x53f5600 | out: lpFindFileData=0x53f5600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcac, dwReserved0=0x0, dwReserved1=0x0, cFileName="COPYRIGHT", cAlternateFileName="COPYRI~1")) returned 1 [0075.941] wcscmp (_String1="COPYRIGHT", _String2=".") returned 1 [0075.941] wcscmp (_String1="COPYRIGHT", _String2="..") returned 1 [0075.941] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x541b148 [0075.941] wcscpy (in: _Dest=0x541b148, _Source="C:\\Program Files\\Java\\jre1.8.0_144" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144") returned="C:\\Program Files\\Java\\jre1.8.0_144" [0075.941] wcscat (in: _Dest=0x541b148, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\" [0075.941] wcscat (in: _Dest=0x541b148, _Source="COPYRIGHT" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" [0075.942] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x541b148, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf6c [0075.942] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x53f5600 | out: lpFindFileData=0x53f5600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe1f09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lib", cAlternateFileName="")) returned 1 [0075.942] wcscmp (_String1="lib", _String2=".") returned 1 [0075.942] wcscmp (_String1="lib", _String2="..") returned 1 [0075.942] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x39003b8 [0075.942] wcscpy (in: _Dest=0x39003b8, _Source="C:\\Program Files\\Java\\jre1.8.0_144" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144") returned="C:\\Program Files\\Java\\jre1.8.0_144" [0075.942] wcscat (in: _Dest=0x39003b8, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\" [0075.942] wcscat (in: _Dest=0x39003b8, _Source="lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0075.943] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x39003b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf70 [0075.943] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x53f5600 | out: lpFindFileData=0x53f5600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0075.943] wcscmp (_String1="LICENSE", _String2=".") returned 1 [0075.943] wcscmp (_String1="LICENSE", _String2="..") returned 1 [0075.943] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x5498168 [0075.943] wcscpy (in: _Dest=0x5498168, _Source="C:\\Program Files\\Java\\jre1.8.0_144" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144") returned="C:\\Program Files\\Java\\jre1.8.0_144" [0075.943] wcscat (in: _Dest=0x5498168, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\" [0075.943] wcscat (in: _Dest=0x5498168, _Source="LICENSE" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" [0075.943] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5498168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf74 [0075.944] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x53f5600 | out: lpFindFileData=0x53f5600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="README.txt", cAlternateFileName="")) returned 1 [0075.944] wcscmp (_String1="README.txt", _String2=".") returned 1 [0075.944] wcscmp (_String1="README.txt", _String2="..") returned 1 [0075.944] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x541b010 [0075.944] wcscpy (in: _Dest=0x541b010, _Source="C:\\Program Files\\Java\\jre1.8.0_144" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144") returned="C:\\Program Files\\Java\\jre1.8.0_144" [0075.944] wcscat (in: _Dest=0x541b010, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\" [0075.944] wcscat (in: _Dest=0x541b010, _Source="README.txt" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" [0075.944] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x541b010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf78 [0075.945] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x53f5600 | out: lpFindFileData=0x53f5600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x210, dwReserved0=0x0, dwReserved1=0x0, cFileName="release", cAlternateFileName="")) returned 1 [0075.945] wcscmp (_String1="release", _String2=".") returned 1 [0075.945] wcscmp (_String1="release", _String2="..") returned 1 [0075.945] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x54981c8 [0075.945] wcscpy (in: _Dest=0x54981c8, _Source="C:\\Program Files\\Java\\jre1.8.0_144" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144") returned="C:\\Program Files\\Java\\jre1.8.0_144" [0075.945] wcscat (in: _Dest=0x54981c8, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\" [0075.945] wcscat (in: _Dest=0x54981c8, _Source="release" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned="C:\\Program Files\\Java\\jre1.8.0_144\\release" [0075.945] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54981c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf7c [0075.946] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x53f5600 | out: lpFindFileData=0x53f5600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf9bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="THIRDPARTYLICENSEREADME-JAVAFX.txt", cAlternateFileName="THIRDP~1.TXT")) returned 1 [0075.946] wcscmp (_String1="THIRDPARTYLICENSEREADME-JAVAFX.txt", _String2=".") returned 1 [0075.946] wcscmp (_String1="THIRDPARTYLICENSEREADME-JAVAFX.txt", _String2="..") returned 1 [0075.946] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8c) returned 0x38a7498 [0075.946] wcscpy (in: _Dest=0x38a7498, _Source="C:\\Program Files\\Java\\jre1.8.0_144" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144") returned="C:\\Program Files\\Java\\jre1.8.0_144" [0075.946] wcscat (in: _Dest=0x38a7498, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\" [0075.946] wcscat (in: _Dest=0x38a7498, _Source="THIRDPARTYLICENSEREADME-JAVAFX.txt" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" [0075.946] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38a7498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf80 [0075.947] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x53f5600 | out: lpFindFileData=0x53f5600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2371c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THIRDPARTYLICENSEREADME.txt", cAlternateFileName="THIRDP~2.TXT")) returned 1 [0075.947] wcscmp (_String1="THIRDPARTYLICENSEREADME.txt", _String2=".") returned 1 [0075.947] wcscmp (_String1="THIRDPARTYLICENSEREADME.txt", _String2="..") returned 1 [0075.947] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7e) returned 0x3978298 [0075.947] wcscpy (in: _Dest=0x3978298, _Source="C:\\Program Files\\Java\\jre1.8.0_144" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144") returned="C:\\Program Files\\Java\\jre1.8.0_144" [0075.947] wcscat (in: _Dest=0x3978298, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\" [0075.947] wcscat (in: _Dest=0x3978298, _Source="THIRDPARTYLICENSEREADME.txt" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" [0075.947] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3978298, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf84 [0075.948] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x53f5600 | out: lpFindFileData=0x53f5600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome.html", cAlternateFileName="WELCOM~1.HTM")) returned 1 [0075.948] wcscmp (_String1="Welcome.html", _String2=".") returned 1 [0075.948] wcscmp (_String1="Welcome.html", _String2="..") returned 1 [0075.948] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x541aa60 [0075.948] wcscpy (in: _Dest=0x541aa60, _Source="C:\\Program Files\\Java\\jre1.8.0_144" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144") returned="C:\\Program Files\\Java\\jre1.8.0_144" [0075.948] wcscat (in: _Dest=0x541aa60, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\" [0075.948] wcscat (in: _Dest=0x541aa60, _Source="Welcome.html" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" [0075.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x541aa60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf88 [0075.949] FindNextFileW (in: hFindFile=0x389eb40, lpFindFileData=0x53f5600 | out: lpFindFileData=0x53f5600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome.html", cAlternateFileName="WELCOM~1.HTM")) returned 0 [0075.949] FindClose (in: hFindFile=0x389eb40 | out: hFindFile=0x389eb40) returned 1 [0075.949] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f5600) returned 1 [0075.949] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5428ea0) returned 1 [0075.949] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5466140) returned 1 Thread: id = 384 os_tid = 0x15d4 [0072.332] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x5468d30 [0072.332] wcscpy (in: _Dest=0x5468d30, _Source="C:\\Program Files\\Microsoft Office 15\\ClientX64" | out: _Dest="C:\\Program Files\\Microsoft Office 15\\ClientX64") returned="C:\\Program Files\\Microsoft Office 15\\ClientX64" [0072.332] wcscat (in: _Dest=0x5468d30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office 15\\ClientX64\\") returned="C:\\Program Files\\Microsoft Office 15\\ClientX64\\" [0072.332] wcscat (in: _Dest=0x5468d30, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office 15\\ClientX64\\*") returned="C:\\Program Files\\Microsoft Office 15\\ClientX64\\*" [0072.332] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f5868 [0072.332] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office 15\\ClientX64\\*", lpFindFileData=0x53f5868 | out: lpFindFileData=0x53f5868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e68d8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82e8efda, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f040 [0074.767] wcscmp (_String1=".", _String2=".") returned 0 [0074.767] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x53f5868 | out: lpFindFileData=0x53f5868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e68d8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82e8efda, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.767] wcscmp (_String1="..", _String2=".") returned 1 [0074.767] wcscmp (_String1="..", _String2="..") returned 0 [0074.767] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x53f5868 | out: lpFindFileData=0x53f5868*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e68d8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x10ae80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IntegratedOffice.exe", cAlternateFileName="INTEGR~1.EXE")) returned 1 [0074.767] wcscmp (_String1="IntegratedOffice.exe", _String2=".") returned 1 [0074.767] wcscmp (_String1="IntegratedOffice.exe", _String2="..") returned 1 [0074.767] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x53f5868 | out: lpFindFileData=0x53f5868*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82e8efda, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e8efda, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x10ae80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeClickToRun.exe", cAlternateFileName="OFFICE~1.EXE")) returned 1 [0074.767] wcscmp (_String1="OfficeClickToRun.exe", _String2=".") returned 1 [0074.767] wcscmp (_String1="OfficeClickToRun.exe", _String2="..") returned 1 [0074.767] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x53f5868 | out: lpFindFileData=0x53f5868*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82e8efda, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e8efda, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x10ae80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeClickToRun.exe", cAlternateFileName="OFFICE~1.EXE")) returned 0 [0074.767] FindClose (in: hFindFile=0x389f040 | out: hFindFile=0x389f040) returned 1 [0074.768] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f5868) returned 1 [0074.768] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5468d30) returned 1 [0074.768] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542bb40) returned 1 Thread: id = 385 os_tid = 0x15d8 [0072.334] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3c) returned 0x38a5e30 [0072.334] wcscpy (in: _Dest=0x38a5e30, _Source="C:\\Program Files\\rempl\\Logs" | out: _Dest="C:\\Program Files\\rempl\\Logs") returned="C:\\Program Files\\rempl\\Logs" [0072.334] wcscat (in: _Dest=0x38a5e30, _Source="\\" | out: _Dest="C:\\Program Files\\rempl\\Logs\\") returned="C:\\Program Files\\rempl\\Logs\\" [0072.334] wcscat (in: _Dest=0x38a5e30, _Source="*" | out: _Dest="C:\\Program Files\\rempl\\Logs\\*") returned="C:\\Program Files\\rempl\\Logs\\*" [0072.334] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f3920 [0072.334] FindFirstFileW (in: lpFileName="C:\\Program Files\\rempl\\Logs\\*", lpFindFileData=0x53f3920 | out: lpFindFileData=0x53f3920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8390c831, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x86e9cd10, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x86e9cd10, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f40 [0081.551] wcscmp (_String1=".", _String2=".") returned 0 [0081.551] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x53f3920 | out: lpFindFileData=0x53f3920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8390c831, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x86e9cd10, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x86e9cd10, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.551] wcscmp (_String1="..", _String2=".") returned 1 [0081.551] wcscmp (_String1="..", _String2="..") returned 0 [0081.551] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x53f3920 | out: lpFindFileData=0x53f3920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8390c831, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x86e9cd10, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x87d22907, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remediation.001.etl", cAlternateFileName="REMEDI~3.ETL")) returned 1 [0081.551] wcscmp (_String1="Remediation.001.etl", _String2=".") returned 1 [0081.551] wcscmp (_String1="Remediation.001.etl", _String2="..") returned 1 [0081.551] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x541ac00 [0081.552] wcscpy (in: _Dest=0x541ac00, _Source="C:\\Program Files\\rempl\\Logs" | out: _Dest="C:\\Program Files\\rempl\\Logs") returned="C:\\Program Files\\rempl\\Logs" [0081.552] wcscat (in: _Dest=0x541ac00, _Source="\\" | out: _Dest="C:\\Program Files\\rempl\\Logs\\") returned="C:\\Program Files\\rempl\\Logs\\" [0081.552] wcscat (in: _Dest=0x541ac00, _Source="Remediation.001.etl" | out: _Dest="C:\\Program Files\\rempl\\Logs\\Remediation.001.etl") returned="C:\\Program Files\\rempl\\Logs\\Remediation.001.etl" [0081.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x541ac00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cf4 [0081.552] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x53f3920 | out: lpFindFileData=0x53f3920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8390c831, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x79e31fb0, ftLastAccessTime.dwHighDateTime=0x1d327b1, ftLastWriteTime.dwLowDateTime=0x79eac3d2, ftLastWriteTime.dwHighDateTime=0x1d327b1, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remediation.002.etl", cAlternateFileName="REMEDI~2.ETL")) returned 1 [0081.552] wcscmp (_String1="Remediation.002.etl", _String2=".") returned 1 [0081.552] wcscmp (_String1="Remediation.002.etl", _String2="..") returned 1 [0081.552] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x541ab98 [0081.552] wcscpy (in: _Dest=0x541ab98, _Source="C:\\Program Files\\rempl\\Logs" | out: _Dest="C:\\Program Files\\rempl\\Logs") returned="C:\\Program Files\\rempl\\Logs" [0081.552] wcscat (in: _Dest=0x541ab98, _Source="\\" | out: _Dest="C:\\Program Files\\rempl\\Logs\\") returned="C:\\Program Files\\rempl\\Logs\\" [0081.552] wcscat (in: _Dest=0x541ab98, _Source="Remediation.002.etl" | out: _Dest="C:\\Program Files\\rempl\\Logs\\Remediation.002.etl") returned="C:\\Program Files\\rempl\\Logs\\Remediation.002.etl" [0081.553] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x541ab98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cf8 [0081.553] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x53f3920 | out: lpFindFileData=0x53f3920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8390c831, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x8390c831, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0x39b54322, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remediation.003.etl", cAlternateFileName="REMEDI~1.ETL")) returned 1 [0081.553] wcscmp (_String1="Remediation.003.etl", _String2=".") returned 1 [0081.553] wcscmp (_String1="Remediation.003.etl", _String2="..") returned 1 [0081.553] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x541ad38 [0081.553] wcscpy (in: _Dest=0x541ad38, _Source="C:\\Program Files\\rempl\\Logs" | out: _Dest="C:\\Program Files\\rempl\\Logs") returned="C:\\Program Files\\rempl\\Logs" [0081.553] wcscat (in: _Dest=0x541ad38, _Source="\\" | out: _Dest="C:\\Program Files\\rempl\\Logs\\") returned="C:\\Program Files\\rempl\\Logs\\" [0081.553] wcscat (in: _Dest=0x541ad38, _Source="Remediation.003.etl" | out: _Dest="C:\\Program Files\\rempl\\Logs\\Remediation.003.etl") returned="C:\\Program Files\\rempl\\Logs\\Remediation.003.etl" [0081.553] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x541ad38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cfc [0081.554] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x53f3920 | out: lpFindFileData=0x53f3920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8390c831, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x8390c831, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0x39b54322, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remediation.003.etl", cAlternateFileName="REMEDI~1.ETL")) returned 0 [0081.554] FindClose (in: hFindFile=0x5444f40 | out: hFindFile=0x5444f40) returned 1 [0081.555] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f3920) returned 1 [0081.555] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5e30) returned 1 [0081.555] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445700) returned 1 Thread: id = 386 os_tid = 0x15dc [0072.335] GetFileAttributesW (lpFileName="C:\\Program Files\\rempl\\rempl.xml" (normalized: "c:\\program files\\rempl\\rempl.xml")) returned 0x20 [0078.330] SetFileAttributesW (lpFileName="C:\\Program Files\\rempl\\rempl.xml", dwFileAttributes=0x20) returned 1 [0087.606] CreateFileW (lpFileName="C:\\Program Files\\rempl\\rempl.xml" (normalized: "c:\\program files\\rempl\\rempl.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3c0 [0089.615] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x10e7fe68 | out: lpFileSize=0x10e7fe68*=3884) returned 1 [0089.615] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xf28, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.625] ReadFile (in: hFile=0x3c0, lpBuffer=0x10e7fdec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x10e7fde8, lpOverlapped=0x0 | out: lpBuffer=0x10e7fdec*, lpNumberOfBytesRead=0x10e7fde8*=0x4, lpOverlapped=0x0) returned 1 [0089.627] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.627] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080a60 [0089.627] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080998 [0089.627] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080718 [0089.627] NtQuerySystemTime (in: CurrentTime=0x10e7fdc8 | out: CurrentTime=0x10e7fdc8*=132260136467900100) returned 0x0 [0089.627] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0xf25e56f3 [0089.627] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0x176d2621 [0089.627] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0x2938e82a [0089.627] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0x613f4aa9 [0089.627] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0xb6aa0811 [0089.627] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0x5140e62d [0089.627] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0x1171be07 [0089.627] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0x9e3c79cf [0089.627] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0x1c89b8e7 [0089.627] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0xb97d8079 [0089.627] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0x4ed8f6a9 [0089.627] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0x3e28b65b [0089.627] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0xb1607557 [0089.627] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0x9bc7b6d [0089.627] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0xba6ab76d [0089.627] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0xa41f957a [0089.627] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0xaa61ab99 [0089.627] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0xe7cd12f6 [0089.627] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0x5c274cf6 [0089.627] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0x7fc540fc [0089.628] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0xf685c04 [0089.628] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0x965b6bbd [0089.628] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0x3894bbf7 [0089.628] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0xf87a92a4 [0089.628] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0x244427db [0089.628] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0x4d95a0d4 [0089.628] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0x635345b7 [0089.628] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0xdadb3060 [0089.628] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0xcb2f566a [0089.628] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0xfb702597 [0089.628] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0xb6383d0 [0089.628] RtlRandom (in: Seed=0x10e7fdd4 | out: Seed=0x10e7fdd4) returned 0x7deb7a2c [0091.468] ReadFile (in: hFile=0x3c0, lpBuffer=0x7305c60, nNumberOfBytesToRead=0xf2c, lpNumberOfBytesRead=0x10e7fdc4, lpOverlapped=0x0 | out: lpBuffer=0x7305c60*, lpNumberOfBytesRead=0x10e7fdc4*=0xf2c, lpOverlapped=0x0) returned 1 [0091.468] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.468] WriteFile (hFile=0x3c0, lpBuffer=0x7312468, nNumberOfBytesToWrite=0xf2c, lpNumberOfBytesWritten=0x10e7fdc0, lpOverlapped=0x0) Thread: id = 387 os_tid = 0x15e0 [0072.337] GetFileAttributesW (lpFileName="C:\\Program Files\\rempl\\Unlock.xml" (normalized: "c:\\program files\\rempl\\unlock.xml")) returned 0x20 [0077.155] SetFileAttributesW (lpFileName="C:\\Program Files\\rempl\\Unlock.xml", dwFileAttributes=0x20) returned 1 [0087.506] CreateFileW (lpFileName="C:\\Program Files\\rempl\\Unlock.xml" (normalized: "c:\\program files\\rempl\\unlock.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1b4c [0089.614] GetFileSizeEx (in: hFile=0x1b4c, lpFileSize=0x10eff840 | out: lpFileSize=0x10eff840*=1541) returned 1 [0089.614] SetFilePointerEx (in: hFile=0x1b4c, liDistanceToMove=0x601, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.614] ReadFile (in: hFile=0x1b4c, lpBuffer=0x10eff7c4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x10eff7c0, lpOverlapped=0x0 | out: lpBuffer=0x10eff7c4*, lpNumberOfBytesRead=0x10eff7c0*=0x4, lpOverlapped=0x0) returned 1 [0089.615] SetFilePointerEx (in: hFile=0x1b4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.616] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080a60 [0089.616] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080970 [0089.616] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080718 [0089.616] NtQuerySystemTime (in: CurrentTime=0x10eff7a0 | out: CurrentTime=0x10eff7a0*=132260136467743967) returned 0x0 [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0x78a1e193 [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0xb315ca74 [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0x7a58c15e [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0xd10ae267 [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0xfd1cd647 [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0x42ee06e1 [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0xf03f4b45 [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0x445ebbf8 [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0xafd33db1 [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0x3af55534 [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0x5c0c1ed [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0x9d89b390 [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0xc92f547e [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0x9fdbb24 [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0x438106e6 [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0xaa5ccdf2 [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0x651bb89 [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0x58ee0a2c [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0x8348486d [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0xa6ec6f28 [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0xfd9e67d2 [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0x9dc56f9e [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0x1b95b2cf [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0x6aca6eab [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0x5af59a5 [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0x13ec1a44 [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0x586304ba [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0xcc7716ff [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0xda9919de [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0xa960be97 [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0x2ea6ec4c [0089.616] RtlRandom (in: Seed=0x10eff7ac | out: Seed=0x10eff7ac) returned 0xbc7ba289 [0091.470] ReadFile (in: hFile=0x1b4c, lpBuffer=0x731ec70, nNumberOfBytesToRead=0x605, lpNumberOfBytesRead=0x10eff79c, lpOverlapped=0x0 | out: lpBuffer=0x731ec70*, lpNumberOfBytesRead=0x10eff79c*=0x605, lpOverlapped=0x0) returned 1 [0091.470] SetFilePointerEx (in: hFile=0x1b4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.470] WriteFile (hFile=0x1b4c, lpBuffer=0xe2cab28, nNumberOfBytesToWrite=0x605, lpNumberOfBytesWritten=0x10eff798, lpOverlapped=0x0) Thread: id = 388 os_tid = 0x15e4 [0072.337] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 0x20 [0076.843] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0076.854] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1188 [0076.858] GetFileSizeEx (in: hFile=0x1188, lpFileSize=0x10f7fe94 | out: lpFileSize=0x10f7fe94*=69632) returned 1 [0076.858] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.858] ReadFile (in: hFile=0x1188, lpBuffer=0x10f7fe18, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x10f7fe14, lpOverlapped=0x0 | out: lpBuffer=0x10f7fe18*, lpNumberOfBytesRead=0x10f7fe14*=0x4, lpOverlapped=0x0) returned 1 [0076.860] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.860] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5210 [0076.860] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a52b0 [0076.860] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ea0 [0076.860] NtQuerySystemTime (in: CurrentTime=0x10f7fdf4 | out: CurrentTime=0x10f7fdf4*=132260136340116633) returned 0x0 [0076.860] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0xbc8d1f0c [0076.860] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0x32c869a9 [0076.860] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0x21b4f00 [0076.860] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0x4951cf65 [0076.860] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0x8d1d69dd [0076.860] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0x553e6a32 [0076.860] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0x57eb011f [0076.860] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0x1562e118 [0076.860] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0x8346655d [0076.860] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0xe814baf9 [0076.860] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0xa771031b [0076.860] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0x4ad8f5b [0076.860] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0x4fd475c0 [0076.860] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0x9225ec54 [0076.860] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0x6020d111 [0076.860] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0xfca4703b [0076.860] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0x2c316d5e [0076.860] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0x4292bf78 [0076.860] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0x292f6f3a [0076.860] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0x510db8c3 [0076.860] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0x3af1ba00 [0076.860] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0x76a72e8 [0076.860] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0x58e253a3 [0076.860] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0xca41aa79 [0076.861] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0xc2c933c3 [0076.861] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0xf158e0a4 [0076.861] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0xf293834a [0076.861] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0xd2be106b [0076.861] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0x433f0f9f [0076.861] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0xd3158bc [0076.861] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0x477c4621 [0076.861] RtlRandom (in: Seed=0x10f7fe00 | out: Seed=0x10f7fe00) returned 0x79f7a791 [0076.870] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.870] ReadFile (in: hFile=0x1188, lpBuffer=0x547d7c0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x10f7fdd4, lpOverlapped=0x0 | out: lpBuffer=0x547d7c0*, lpNumberOfBytesRead=0x10f7fdd4*=0xc800, lpOverlapped=0x0) returned 1 [0076.871] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.871] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0076.871] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0076.871] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4f68 [0076.871] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4f68) returned 1 [0076.872] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5489fc8 [0076.873] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5210 [0076.873] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4e78 [0076.873] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e78) returned 1 [0076.873] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.873] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0076.873] WriteFile (in: hFile=0x1188, lpBuffer=0x5489fc8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x10f7fdd4, lpOverlapped=0x0 | out: lpBuffer=0x5489fc8*, lpNumberOfBytesWritten=0x10f7fdd4*=0xc800, lpOverlapped=0x0) returned 1 [0076.877] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5489fc8) returned 1 [0076.877] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x547d7c0) returned 1 [0076.877] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x73) returned 0x38d09a0 [0076.877] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.877] WriteFile (in: hFile=0x1188, lpBuffer=0x54a2b30*, nNumberOfBytesToWrite=0x157, lpNumberOfBytesWritten=0x10f7fe54, lpOverlapped=0x0 | out: lpBuffer=0x54a2b30*, lpNumberOfBytesWritten=0x10f7fe54*=0x157, lpOverlapped=0x0) returned 1 [0076.889] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a2b30) returned 1 [0076.889] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38d0d20) returned 1 [0076.889] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e78) returned 1 [0076.889] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38d09a0) returned 1 [0076.889] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5210) returned 1 [0076.889] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a52b0) returned 1 [0076.889] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e00) returned 1 [0076.889] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e50) returned 1 [0076.889] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb8) returned 0x3905620 [0076.889] wcscpy (in: _Dest=0x3905620, _Source="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" [0076.889] wcscat (in: _Dest=0x3905620, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70" [0076.889] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x10f7fe0c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.889] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x3973fd0 Thread: id = 389 os_tid = 0x15e8 [0072.338] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 0x20 [0076.820] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx", dwFileAttributes=0x20) returned 1 [0076.831] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1184 [0076.839] GetFileSizeEx (in: hFile=0x1184, lpFileSize=0x10fff9e8 | out: lpFileSize=0x10fff9e8*=69632) returned 1 [0076.839] SetFilePointerEx (in: hFile=0x1184, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.839] ReadFile (in: hFile=0x1184, lpBuffer=0x10fff96c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x10fff968, lpOverlapped=0x0 | out: lpBuffer=0x10fff96c*, lpNumberOfBytesRead=0x10fff968*=0x4, lpOverlapped=0x0) returned 1 [0076.843] SetFilePointerEx (in: hFile=0x1184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.843] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5198 [0076.843] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5170 [0076.843] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ea0 [0076.843] NtQuerySystemTime (in: CurrentTime=0x10fff948 | out: CurrentTime=0x10fff948*=132260136339960407) returned 0x0 [0076.843] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0xa2367f76 [0076.843] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0xbe269047 [0076.843] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0xba5ef414 [0076.843] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0x95704d70 [0076.844] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0x16432d85 [0076.844] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0x8c34bc9c [0076.844] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0x3e599a83 [0076.844] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0x6ea96f15 [0076.844] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0xe810053 [0076.844] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0x62620138 [0076.844] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0xa5e1dec9 [0076.844] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0x7b0c18eb [0076.844] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0xc8c0c6f4 [0076.844] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0x367151c3 [0076.844] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0xf4f2878f [0076.844] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0x4f8a89dd [0076.844] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0xed5b2975 [0076.844] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0x85f030d3 [0076.844] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0xfa2e2300 [0076.844] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0x3ffcf9b6 [0076.844] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0x52ab7ca4 [0076.844] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0xfb70c9ad [0076.844] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0xd41d18dd [0076.844] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0x9b94f485 [0076.844] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0x2fb86ef6 [0076.844] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0x1b8158d3 [0076.844] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0x3581cfa6 [0076.844] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0xc0f04f0f [0076.844] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0x14aef166 [0076.844] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0xde9914ee [0076.844] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0xc55c04de [0076.844] RtlRandom (in: Seed=0x10fff954 | out: Seed=0x10fff954) returned 0xf4792842 [0076.854] SetFilePointerEx (in: hFile=0x1184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.854] ReadFile (in: hFile=0x1184, lpBuffer=0x55f00d0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x10fff928, lpOverlapped=0x0 | out: lpBuffer=0x55f00d0*, lpNumberOfBytesRead=0x10fff928*=0xc800, lpOverlapped=0x0) returned 1 [0076.855] SetFilePointerEx (in: hFile=0x1184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.855] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0076.855] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0076.855] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4f68 [0076.855] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4f68) returned 1 [0076.856] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5470fb8 [0076.857] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5198 [0076.857] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5210 [0076.857] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5210) returned 1 [0076.857] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.857] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0076.857] WriteFile (in: hFile=0x1184, lpBuffer=0x5470fb8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x10fff928, lpOverlapped=0x0 | out: lpBuffer=0x5470fb8*, lpNumberOfBytesWritten=0x10fff928*=0xc800, lpOverlapped=0x0) returned 1 [0081.205] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5470fb8) returned 1 [0091.759] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55f00d0) returned 1 [0091.759] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x61) returned 0x5468b70 [0091.759] SetFilePointerEx (in: hFile=0x1184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.759] WriteFile (hFile=0x1184, lpBuffer=0xe538028, nNumberOfBytesToWrite=0x145, lpNumberOfBytesWritten=0x10fff9a8, lpOverlapped=0x0) Thread: id = 390 os_tid = 0x15ec [0072.338] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 0x20 [0076.801] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0076.811] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1180 [0076.819] GetFileSizeEx (in: hFile=0x1180, lpFileSize=0x1107fb30 | out: lpFileSize=0x1107fb30*=69632) returned 1 [0076.819] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.819] ReadFile (in: hFile=0x1180, lpBuffer=0x1107fab4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1107fab0, lpOverlapped=0x0 | out: lpBuffer=0x1107fab4*, lpNumberOfBytesRead=0x1107fab0*=0x4, lpOverlapped=0x0) returned 1 [0076.820] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.820] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5198 [0076.820] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5170 [0076.820] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ea0 [0076.820] NtQuerySystemTime (in: CurrentTime=0x1107fa90 | out: CurrentTime=0x1107fa90*=132260136339823682) returned 0x0 [0076.820] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0x555510e4 [0076.820] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0x2332cdeb [0076.820] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0xd74c8bff [0076.820] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0x459bc392 [0076.820] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0x33e60f52 [0076.820] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0x2949a923 [0076.820] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0x99332e24 [0076.820] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0x10bd1656 [0076.820] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0x88cb63bf [0076.821] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0xe6c5392c [0076.821] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0x3840dc03 [0076.821] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0x20fbbd47 [0076.821] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0xa676b2a8 [0076.821] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0xb33b7737 [0076.821] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0xf6182239 [0076.821] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0x58d3ea91 [0076.821] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0x46603736 [0076.821] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0x12e9dd77 [0076.821] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0x562db080 [0076.821] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0x86e30697 [0076.821] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0x84cab8f3 [0076.821] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0x9857b5b9 [0076.821] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0xb5f0d88a [0076.821] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0xf4fb9f0b [0076.821] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0x2a10dbaf [0076.821] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0xa66de487 [0076.821] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0xca812b59 [0076.821] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0x3f73605c [0076.821] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0xde4aecf4 [0076.821] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0xcc91f9d8 [0076.821] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0xd5584914 [0076.821] RtlRandom (in: Seed=0x1107fa9c | out: Seed=0x1107fa9c) returned 0x94a15688 [0076.831] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.831] ReadFile (in: hFile=0x1180, lpBuffer=0x55f00d0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1107fa70, lpOverlapped=0x0 | out: lpBuffer=0x55f00d0*, lpNumberOfBytesRead=0x1107fa70*=0xc800, lpOverlapped=0x0) returned 1 [0076.832] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.832] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0076.832] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0076.832] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4f68 [0076.832] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4f68) returned 1 [0076.833] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5470fb8 [0076.837] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5198 [0076.837] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5210 [0076.838] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5210) returned 1 [0076.838] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.838] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0076.838] WriteFile (in: hFile=0x1180, lpBuffer=0x5470fb8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1107fa70, lpOverlapped=0x0 | out: lpBuffer=0x5470fb8*, lpNumberOfBytesWritten=0x1107fa70*=0xc800, lpOverlapped=0x0) returned 1 [0076.840] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5470fb8) returned 1 [0076.840] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55f00d0) returned 1 [0076.840] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6b) returned 0x5496b48 [0076.840] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.840] WriteFile (in: hFile=0x1180, lpBuffer=0x54a2b30*, nNumberOfBytesToWrite=0x14f, lpNumberOfBytesWritten=0x1107faf0, lpOverlapped=0x0 | out: lpBuffer=0x54a2b30*, lpNumberOfBytesWritten=0x1107faf0*=0x14f, lpOverlapped=0x0) returned 1 [0076.842] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a2b30) returned 1 [0076.842] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496d28) returned 1 [0076.842] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e78) returned 1 [0076.842] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496b48) returned 1 [0076.842] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5198) returned 1 [0076.842] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5170) returned 1 [0076.842] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5260) returned 1 [0076.842] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a51e8) returned 1 [0076.842] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x54479b0 [0076.842] wcscpy (in: _Dest=0x54479b0, _Source="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" [0076.842] wcscat (in: _Dest=0x54479b0, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70" [0076.842] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1107faa8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.842] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x39724e0 Thread: id = 391 os_tid = 0x15f0 [0072.339] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 0x20 [0076.570] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx", dwFileAttributes=0x20) returned 1 [0076.570] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1170 [0076.570] GetFileSizeEx (in: hFile=0x1170, lpFileSize=0x110ffe58 | out: lpFileSize=0x110ffe58*=69632) returned 1 [0076.570] SetFilePointerEx (in: hFile=0x1170, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.570] ReadFile (in: hFile=0x1170, lpBuffer=0x110ffddc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x110ffdd8, lpOverlapped=0x0 | out: lpBuffer=0x110ffddc*, lpNumberOfBytesRead=0x110ffdd8*=0x4, lpOverlapped=0x0) returned 1 [0076.801] SetFilePointerEx (in: hFile=0x1170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.801] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5198 [0076.801] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5120 [0076.801] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ea0 [0076.801] NtQuerySystemTime (in: CurrentTime=0x110ffdb8 | out: CurrentTime=0x110ffdb8*=132260136339648056) returned 0x0 [0076.801] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0x950c418 [0076.801] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0x824b3ca [0076.801] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0x26a57c86 [0076.802] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0x4aee6929 [0076.802] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0xca0306a9 [0076.802] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0x3a68b819 [0076.802] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0x4f13b9f0 [0076.802] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0xc5744616 [0076.802] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0x80f15f67 [0076.802] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0xdd243de6 [0076.802] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0x50fd3ab7 [0076.802] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0x749da1f0 [0076.802] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0xdd0c7b4f [0076.802] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0xa37cc185 [0076.802] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0x3fd36151 [0076.802] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0x4e1a601c [0076.802] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0x6f5c9f9f [0076.802] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0x9e630445 [0076.802] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0xb1a46683 [0076.802] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0x49cb0032 [0076.802] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0x7b22b08c [0076.802] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0x80f357d7 [0076.802] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0xf7006341 [0076.802] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0xa93f35cf [0076.802] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0x4bb41eb7 [0076.802] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0xfe62194a [0076.802] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0x60d9748a [0076.802] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0xb49abfdf [0076.802] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0xfd1c2d5 [0076.802] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0xd7297b01 [0076.802] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0x34368691 [0076.802] RtlRandom (in: Seed=0x110ffdc4 | out: Seed=0x110ffdc4) returned 0x2d1ce0ab [0076.811] SetFilePointerEx (in: hFile=0x1170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.811] ReadFile (in: hFile=0x1170, lpBuffer=0x555a070, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x110ffd98, lpOverlapped=0x0 | out: lpBuffer=0x555a070*, lpNumberOfBytesRead=0x110ffd98*=0xc800, lpOverlapped=0x0) returned 1 [0076.812] SetFilePointerEx (in: hFile=0x1170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.812] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0076.812] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0076.812] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4f68 [0076.812] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4f68) returned 1 [0076.813] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x55d70c0 [0076.817] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5148 [0076.817] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5170 [0076.817] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5170) returned 1 [0076.817] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.817] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0076.817] WriteFile (in: hFile=0x1170, lpBuffer=0x55d70c0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x110ffd98, lpOverlapped=0x0 | out: lpBuffer=0x55d70c0*, lpNumberOfBytesWritten=0x110ffd98*=0xc800, lpOverlapped=0x0) returned 1 [0081.206] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55d70c0) returned 1 [0091.760] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x555a070) returned 1 [0091.760] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6d) returned 0x766d4d8 [0091.760] SetFilePointerEx (in: hFile=0x1170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.760] WriteFile (hFile=0x1170, lpBuffer=0x388aff8, nNumberOfBytesToWrite=0x151, lpNumberOfBytesWritten=0x110ffe18, lpOverlapped=0x0) Thread: id = 392 os_tid = 0x15f4 [0072.339] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 0x20 [0076.568] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0076.569] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x116c [0076.569] GetFileSizeEx (in: hFile=0x116c, lpFileSize=0x1117fe44 | out: lpFileSize=0x1117fe44*=69632) returned 1 [0076.569] SetFilePointerEx (in: hFile=0x116c, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.569] ReadFile (in: hFile=0x116c, lpBuffer=0x1117fdc8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1117fdc4, lpOverlapped=0x0 | out: lpBuffer=0x1117fdc8*, lpNumberOfBytesRead=0x1117fdc4*=0x4, lpOverlapped=0x0) returned 1 [0076.618] SetFilePointerEx (in: hFile=0x116c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.618] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559fc8 [0076.618] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f78 [0076.618] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559de8 [0076.618] NtQuerySystemTime (in: CurrentTime=0x1117fda4 | out: CurrentTime=0x1117fda4*=132260136337773014) returned 0x0 [0076.618] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0xd9832e6d [0076.618] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0x5012dd5f [0076.618] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0xa489f43 [0076.618] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0xe4a03b1f [0076.618] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0x1d462636 [0076.619] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0x68c743ca [0076.619] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0xf3fc0aaa [0076.619] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0xe3c2a40e [0076.619] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0x2cf1b03 [0076.619] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0x52251c94 [0076.619] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0x31937a86 [0076.619] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0x84612d78 [0076.619] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0x2991d5e4 [0076.619] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0x4a55ac04 [0076.619] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0xce5f35c8 [0076.619] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0x48c39a17 [0076.619] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0x5c9a8c57 [0076.619] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0x9cce8fe8 [0076.619] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0xcfecea63 [0076.619] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0x2760ee85 [0076.619] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0x14843aef [0076.619] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0x9a7949a7 [0076.619] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0x3c7ee9a3 [0076.619] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0xda0b563f [0076.619] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0x5bbd3537 [0076.619] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0xd11a452e [0076.619] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0xac238e34 [0076.619] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0xa80b950a [0076.619] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0x683ed401 [0076.619] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0x7ecdd0b8 [0076.619] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0x3062aec7 [0076.619] RtlRandom (in: Seed=0x1117fdb0 | out: Seed=0x1117fdb0) returned 0xea78e62f [0076.629] SetFilePointerEx (in: hFile=0x116c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.629] ReadFile (in: hFile=0x116c, lpBuffer=0x5598898, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1117fd84, lpOverlapped=0x0 | out: lpBuffer=0x5598898*, lpNumberOfBytesRead=0x1117fd84*=0xc800, lpOverlapped=0x0) returned 1 [0076.703] SetFilePointerEx (in: hFile=0x116c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.703] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0076.703] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0076.703] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f28 [0076.703] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559f28) returned 1 [0076.704] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x55d70c0 [0076.708] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f28 [0076.708] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a50f8 [0076.708] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a50f8) returned 1 [0076.708] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.708] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0076.708] WriteFile (in: hFile=0x116c, lpBuffer=0x55d70c0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1117fd84, lpOverlapped=0x0 | out: lpBuffer=0x55d70c0*, lpNumberOfBytesWritten=0x1117fd84*=0xc800, lpOverlapped=0x0) returned 1 [0076.734] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55d70c0) returned 1 [0076.734] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5598898) returned 1 [0076.734] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x61) returned 0x396d6c0 [0076.734] SetFilePointerEx (in: hFile=0x116c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.734] WriteFile (in: hFile=0x116c, lpBuffer=0x54a2dd8*, nNumberOfBytesToWrite=0x145, lpNumberOfBytesWritten=0x1117fe04, lpOverlapped=0x0 | out: lpBuffer=0x54a2dd8*, lpNumberOfBytesWritten=0x1117fe04*=0x145, lpOverlapped=0x0) returned 1 [0076.771] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a2dd8) returned 1 [0076.771] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396d810) returned 1 [0076.771] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4fe0) returned 1 [0076.771] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396d6c0) returned 1 [0076.771] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559f28) returned 1 [0076.771] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559f78) returned 1 [0076.771] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559d98) returned 1 [0076.771] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559dc0) returned 1 [0076.771] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa6) returned 0x54df4d0 [0076.771] wcscpy (in: _Dest=0x54df4d0, _Source="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" [0076.772] wcscat (in: _Dest=0x54df4d0, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70" [0076.772] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1117fdbc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.772] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x39754c8 Thread: id = 393 os_tid = 0x15f8 [0072.340] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 0x20 [0076.567] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0076.567] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1168 [0076.567] GetFileSizeEx (in: hFile=0x1168, lpFileSize=0x111ffc8c | out: lpFileSize=0x111ffc8c*=69632) returned 1 [0076.567] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.567] ReadFile (in: hFile=0x1168, lpBuffer=0x111ffc10, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x111ffc0c, lpOverlapped=0x0 | out: lpBuffer=0x111ffc10*, lpNumberOfBytesRead=0x111ffc0c*=0x4, lpOverlapped=0x0) returned 1 [0076.629] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.629] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559de8 [0076.629] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559fc8 [0076.629] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559e60 [0076.629] NtQuerySystemTime (in: CurrentTime=0x111ffbec | out: CurrentTime=0x111ffbec*=132260136337929262) returned 0x0 [0076.629] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0xbad2a26f [0076.629] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0x81d8a326 [0076.629] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0x6d0f77be [0076.629] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0x4c48af6 [0076.629] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0xe81a8c5 [0076.629] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0x4f30ba28 [0076.629] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0xd3570cea [0076.629] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0x4324a9f8 [0076.629] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0xe230d932 [0076.629] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0x6882a703 [0076.629] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0x8a383a45 [0076.629] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0xb7b2106d [0076.629] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0xaac11d41 [0076.629] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0x30a413d2 [0076.629] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0xfeadbf4f [0076.630] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0xa6d24681 [0076.630] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0xf3c2f4f [0076.630] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0x4cdfe89a [0076.630] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0xa3a0740d [0076.630] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0x5c3cf86b [0076.630] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0x1e92fd00 [0076.630] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0xb0d9307d [0076.630] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0x848223d6 [0076.630] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0xb1943990 [0076.630] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0x80b0974b [0076.630] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0xf5f64ae6 [0076.630] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0x5f3975d3 [0076.630] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0xe454a1e8 [0076.630] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0xacaa3551 [0076.630] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0xec5a3fbf [0076.630] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0x822dec7f [0076.630] RtlRandom (in: Seed=0x111ffbf8 | out: Seed=0x111ffbf8) returned 0x1d80b822 [0076.640] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.640] ReadFile (in: hFile=0x1168, lpBuffer=0x55a50a0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x111ffbcc, lpOverlapped=0x0 | out: lpBuffer=0x55a50a0*, lpNumberOfBytesRead=0x111ffbcc*=0xc800, lpOverlapped=0x0) returned 1 [0076.726] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.726] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0076.726] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0076.726] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4f68 [0076.726] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4f68) returned 1 [0076.727] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x547d7c0 [0076.727] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5148 [0076.727] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5170 [0076.727] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5170) returned 1 [0076.727] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.727] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0076.727] WriteFile (in: hFile=0x1168, lpBuffer=0x547d7c0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x111ffbcc, lpOverlapped=0x0 | out: lpBuffer=0x547d7c0*, lpNumberOfBytesWritten=0x111ffbcc*=0xc800, lpOverlapped=0x0) returned 1 [0076.765] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x547d7c0) returned 1 [0076.767] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55a50a0) returned 1 [0076.769] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4f) returned 0x5428ea0 [0076.769] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.769] WriteFile (in: hFile=0x1168, lpBuffer=0x54a2b30*, nNumberOfBytesToWrite=0x133, lpNumberOfBytesWritten=0x111ffc4c, lpOverlapped=0x0 | out: lpBuffer=0x54a2b30*, lpNumberOfBytesWritten=0x111ffc4c*=0x133, lpOverlapped=0x0) returned 1 [0076.782] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a2b30) returned 1 [0076.782] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5428ef8) returned 1 [0076.782] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e78) returned 1 [0076.783] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5428ea0) returned 1 [0076.783] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5148) returned 1 [0076.783] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559fc8) returned 1 [0076.783] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559e10) returned 1 [0076.783] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559e38) returned 1 [0076.783] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x94) returned 0x54264a8 [0076.783] wcscpy (in: _Dest=0x54264a8, _Source="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" [0076.783] wcscat (in: _Dest=0x54264a8, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.mailto[knoocknoo@cock.li].a0a70" [0076.783] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x111ffc04, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.783] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xaa) returned 0x54478f8 Thread: id = 394 os_tid = 0x15fc [0072.341] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 0x20 [0076.566] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0076.566] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1164 [0076.566] GetFileSizeEx (in: hFile=0x1164, lpFileSize=0x1127f930 | out: lpFileSize=0x1127f930*=69632) returned 1 [0076.566] SetFilePointerEx (in: hFile=0x1164, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.566] ReadFile (in: hFile=0x1164, lpBuffer=0x1127f8b4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1127f8b0, lpOverlapped=0x0 | out: lpBuffer=0x1127f8b4*, lpNumberOfBytesRead=0x1127f8b0*=0x4, lpOverlapped=0x0) returned 1 [0076.647] SetFilePointerEx (in: hFile=0x1164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.647] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559e60 [0076.647] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559e88 [0076.648] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f00 [0076.648] NtQuerySystemTime (in: CurrentTime=0x1127f890 | out: CurrentTime=0x1127f890*=132260136338113442) returned 0x0 [0076.648] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0x331c4f5b [0076.648] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0x67b01be3 [0076.648] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0x15f25424 [0076.648] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0xef01ad09 [0076.648] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0x673d8081 [0076.648] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0x5cb32457 [0076.648] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0x7d1c955a [0076.648] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0xc5abf12c [0076.648] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0xe04384b3 [0076.648] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0x9b6526d3 [0076.648] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0xc264475c [0076.648] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0x761fcb56 [0076.648] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0xc0940453 [0076.648] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0xf4dba657 [0076.648] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0x62a1daf8 [0076.648] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0x569fc9e1 [0076.648] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0x410b3020 [0076.648] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0x14ff324f [0076.648] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0x965a3389 [0076.648] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0x4eb1aaa5 [0076.648] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0x13848f62 [0076.648] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0xe8d962df [0076.648] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0xff15f142 [0076.648] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0xfcd972b8 [0076.648] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0x352cf57 [0076.648] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0xdb9cf1aa [0076.648] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0x35a7f43d [0076.648] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0xd30ec923 [0076.648] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0x4d75868d [0076.648] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0x4b60fa89 [0076.648] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0x2239ee17 [0076.649] RtlRandom (in: Seed=0x1127f89c | out: Seed=0x1127f89c) returned 0x5affd48c [0076.690] SetFilePointerEx (in: hFile=0x1164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.691] ReadFile (in: hFile=0x1164, lpBuffer=0x55be0b0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1127f870, lpOverlapped=0x0 | out: lpBuffer=0x55be0b0*, lpNumberOfBytesRead=0x1127f870*=0xc800, lpOverlapped=0x0) returned 1 [0076.731] SetFilePointerEx (in: hFile=0x1164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.731] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0076.731] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0076.731] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4f68 [0076.732] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4f68) returned 1 [0076.732] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5470fb8 [0076.733] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5170 [0076.733] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5198 [0076.733] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5198) returned 1 [0076.733] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.733] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0076.733] WriteFile (in: hFile=0x1164, lpBuffer=0x5470fb8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1127f870, lpOverlapped=0x0 | out: lpBuffer=0x5470fb8*, lpNumberOfBytesWritten=0x1127f870*=0xc800, lpOverlapped=0x0) returned 1 [0076.778] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5470fb8) returned 1 [0076.779] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55be0b0) returned 1 [0076.779] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5b) returned 0x54b1af8 [0076.779] SetFilePointerEx (in: hFile=0x1164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.779] WriteFile (in: hFile=0x1164, lpBuffer=0x54a2c70*, nNumberOfBytesToWrite=0x13f, lpNumberOfBytesWritten=0x1127f8f0, lpOverlapped=0x0 | out: lpBuffer=0x54a2c70*, lpNumberOfBytesWritten=0x1127f8f0*=0x13f, lpOverlapped=0x0) returned 1 [0076.798] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a2c70) returned 1 [0076.798] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b1c98) returned 1 [0076.798] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4ea0) returned 1 [0076.798] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b1af8) returned 1 [0076.798] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5170) returned 1 [0076.798] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559e88) returned 1 [0076.798] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559eb0) returned 1 [0076.798] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ed8) returned 1 [0076.798] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa0) returned 0x54a1f08 [0076.798] wcscpy (in: _Dest=0x54a1f08, _Source="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" [0076.798] wcscat (in: _Dest=0x54a1f08, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70" [0076.798] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1127f8a8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.798] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb6) returned 0x3905560 Thread: id = 395 os_tid = 0x1600 [0072.341] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 0x20 [0076.564] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0076.564] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1160 [0076.565] GetFileSizeEx (in: hFile=0x1160, lpFileSize=0x112ff7fc | out: lpFileSize=0x112ff7fc*=69632) returned 1 [0076.565] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.565] ReadFile (in: hFile=0x1160, lpBuffer=0x112ff780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x112ff77c, lpOverlapped=0x0 | out: lpBuffer=0x112ff780*, lpNumberOfBytesRead=0x112ff77c*=0x4, lpOverlapped=0x0) returned 1 [0076.607] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.607] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559fc8 [0076.607] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f50 [0076.607] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559de8 [0076.607] NtQuerySystemTime (in: CurrentTime=0x112ff75c | out: CurrentTime=0x112ff75c*=132260136337616515) returned 0x0 [0076.607] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0xaa0d8496 [0076.607] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0xbe3b29a4 [0076.607] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0x6c835b8e [0076.607] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0x8305d4b4 [0076.607] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0xc533f299 [0076.607] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0x77002b3a [0076.607] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0x1cebe2d3 [0076.607] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0x4bdfc386 [0076.607] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0xb3b37b51 [0076.607] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0x635a14ea [0076.607] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0xc1bb0225 [0076.607] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0xec5cc21 [0076.607] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0x7045d2a9 [0076.607] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0x928f86c9 [0076.607] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0xd3b0239e [0076.607] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0x6434b69c [0076.607] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0xdffc363 [0076.607] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0xefc521c0 [0076.607] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0x1268cd58 [0076.607] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0xbcda673d [0076.608] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0x2f984396 [0076.608] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0x6f4973d6 [0076.608] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0x1afaef7d [0076.608] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0x150dce58 [0076.608] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0x6ed714ec [0076.608] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0x9bac6d7c [0076.608] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0x7ad4990e [0076.608] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0x327f6eae [0076.608] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0x13e3c5c4 [0076.608] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0x20d54623 [0076.608] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0xc2d957d4 [0076.608] RtlRandom (in: Seed=0x112ff768 | out: Seed=0x112ff768) returned 0xc58f39bf [0076.618] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.618] ReadFile (in: hFile=0x1160, lpBuffer=0x558c090, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x112ff73c, lpOverlapped=0x0 | out: lpBuffer=0x558c090*, lpNumberOfBytesRead=0x112ff73c*=0xc800, lpOverlapped=0x0) returned 1 [0076.717] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.717] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0076.718] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0076.718] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4f68 [0076.718] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4f68) returned 1 [0076.718] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x55f00d0 [0076.722] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5120 [0076.722] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5148 [0076.722] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5148) returned 1 [0076.722] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.722] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0076.722] WriteFile (in: hFile=0x1160, lpBuffer=0x55f00d0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x112ff73c, lpOverlapped=0x0 | out: lpBuffer=0x55f00d0*, lpNumberOfBytesWritten=0x112ff73c*=0xc800, lpOverlapped=0x0) returned 1 [0076.736] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55f00d0) returned 1 [0076.757] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x558c090) returned 1 [0076.762] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5d) returned 0x542b2b8 [0076.762] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.762] WriteFile (in: hFile=0x1160, lpBuffer=0x54b27f8*, nNumberOfBytesToWrite=0x141, lpNumberOfBytesWritten=0x112ff7bc, lpOverlapped=0x0 | out: lpBuffer=0x54b27f8*, lpNumberOfBytesWritten=0x112ff7bc*=0x141, lpOverlapped=0x0) returned 1 [0076.781] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b27f8) returned 1 [0076.781] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b19c0) returned 1 [0076.781] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a52b0) returned 1 [0076.782] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542b2b8) returned 1 [0076.782] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5120) returned 1 [0076.782] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559f50) returned 1 [0076.782] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x555a018) returned 1 [0076.782] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x555a040) returned 1 [0076.782] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa2) returned 0x54dea80 [0076.782] wcscpy (in: _Dest=0x54dea80, _Source="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" [0076.782] wcscat (in: _Dest=0x54dea80, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70" [0076.782] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x112ff774, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.782] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb8) returned 0x39054a0 Thread: id = 396 os_tid = 0x1604 [0072.342] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 0x20 [0076.973] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0076.974] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x11a8 [0076.975] GetFileSizeEx (in: hFile=0x11a8, lpFileSize=0x1137fb3c | out: lpFileSize=0x1137fb3c*=69632) returned 1 [0076.975] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.975] ReadFile (in: hFile=0x11a8, lpBuffer=0x1137fac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1137fabc, lpOverlapped=0x0 | out: lpBuffer=0x1137fac0*, lpNumberOfBytesRead=0x1137fabc*=0x4, lpOverlapped=0x0) returned 1 [0076.976] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.976] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5210 [0076.976] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a52b0 [0076.976] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ea0 [0076.976] NtQuerySystemTime (in: CurrentTime=0x1137fa9c | out: CurrentTime=0x1137fa9c*=132260136341366639) returned 0x0 [0076.976] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0x6e732e4 [0076.976] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0x2f207319 [0076.976] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0xd2a830cd [0076.976] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0xd2cb804f [0076.976] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0x3d4bdb69 [0076.976] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0x7bd3ab06 [0076.976] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0x5686717e [0076.976] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0x4d725873 [0076.976] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0x214c0b28 [0076.976] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0xad9637c0 [0076.976] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0xf4d349bb [0076.976] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0x678df11a [0076.976] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0x3b45b1d1 [0076.976] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0xad91862c [0076.976] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0x25e12de6 [0076.976] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0x6e245747 [0076.976] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0x6c4d6e79 [0076.976] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0xfa9bdd5c [0076.976] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0x3a5c93a4 [0076.977] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0xca827e87 [0076.977] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0x5cdca0fa [0076.977] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0xea38bfa2 [0076.977] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0xb480c839 [0076.977] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0xf51c05fc [0076.977] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0xe0d2cbef [0076.977] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0xb8b84bb1 [0076.977] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0x471b28d0 [0076.977] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0x3109f9f9 [0076.977] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0xd0f7829e [0076.977] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0x9237e973 [0076.977] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0x93fcac4 [0076.977] RtlRandom (in: Seed=0x1137faa8 | out: Seed=0x1137faa8) returned 0xbf77f60e [0076.986] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.986] ReadFile (in: hFile=0x11a8, lpBuffer=0x547d7c0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1137fa7c, lpOverlapped=0x0 | out: lpBuffer=0x547d7c0*, lpNumberOfBytesRead=0x1137fa7c*=0xc800, lpOverlapped=0x0) returned 1 [0076.987] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.987] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0076.987] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0076.987] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4f68 [0076.987] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4f68) returned 1 [0076.988] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5489fc8 [0076.989] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5210 [0076.989] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4e78 [0076.989] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e78) returned 1 [0076.989] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.989] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0076.989] WriteFile (in: hFile=0x11a8, lpBuffer=0x5489fc8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1137fa7c, lpOverlapped=0x0 | out: lpBuffer=0x5489fc8*, lpNumberOfBytesWritten=0x1137fa7c*=0xc800, lpOverlapped=0x0) returned 1 [0076.991] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5489fc8) returned 1 [0076.991] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x547d7c0) returned 1 [0076.991] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x71) returned 0x38d09a0 [0076.992] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.992] WriteFile (in: hFile=0x11a8, lpBuffer=0x54a2b30*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x1137fafc, lpOverlapped=0x0 | out: lpBuffer=0x54a2b30*, lpNumberOfBytesWritten=0x1137fafc*=0x155, lpOverlapped=0x0) returned 1 [0076.994] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a2b30) returned 1 [0076.994] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38d0d20) returned 1 [0076.994] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e78) returned 1 [0076.994] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38d09a0) returned 1 [0076.994] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5210) returned 1 [0076.994] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a52b0) returned 1 [0076.994] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e00) returned 1 [0076.994] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e50) returned 1 [0076.994] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb6) returned 0x3906520 [0076.994] wcscpy (in: _Dest=0x3906520, _Source="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" [0076.994] wcscat (in: _Dest=0x3906520, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70" [0076.994] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1137fab4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.994] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x3974768 Thread: id = 397 os_tid = 0x1608 [0072.342] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 0x20 [0076.563] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0076.563] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x115c [0076.563] GetFileSizeEx (in: hFile=0x115c, lpFileSize=0x113ffde0 | out: lpFileSize=0x113ffde0*=69632) returned 1 [0076.563] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.563] ReadFile (in: hFile=0x115c, lpBuffer=0x113ffd64, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x113ffd60, lpOverlapped=0x0 | out: lpBuffer=0x113ffd64*, lpNumberOfBytesRead=0x113ffd60*=0x4, lpOverlapped=0x0) returned 1 [0076.572] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.572] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0076.572] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559960 [0076.572] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55599d8 [0076.572] NtQuerySystemTime (in: CurrentTime=0x113ffd40 | out: CurrentTime=0x113ffd40*=132260136337304492) returned 0x0 [0076.572] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0x1bee2308 [0076.572] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0x76cb63ae [0076.572] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0xa7f13674 [0076.572] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0x5a8f320c [0076.572] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0x230ba2ed [0076.572] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0x7e55aae5 [0076.572] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0x49061c52 [0076.572] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0x81021afd [0076.572] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0xe0bd3cc1 [0076.572] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0x9413e26a [0076.572] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0xaa817771 [0076.572] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0x52f9d60a [0076.572] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0xcdbcb1e1 [0076.572] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0x6d6c42ec [0076.572] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0xd6d2eb75 [0076.572] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0x2f63b371 [0076.572] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0x741330ad [0076.572] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0xa5ad3e2e [0076.572] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0x9b1e0593 [0076.572] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0x6bc7d994 [0076.572] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0xe51c4a5d [0076.572] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0x181536 [0076.572] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0xdc7ea29b [0076.572] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0x4ebf74ba [0076.572] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0xf231e9d1 [0076.572] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0x5f92f7b5 [0076.572] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0x4fa08a5b [0076.572] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0x8dc2538 [0076.572] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0x953e6fd2 [0076.573] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0x5953c478 [0076.573] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0x9248e1bc [0076.573] RtlRandom (in: Seed=0x113ffd4c | out: Seed=0x113ffd4c) returned 0x8a2c832f [0076.582] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.582] ReadFile (in: hFile=0x115c, lpBuffer=0x5489fc8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x113ffd20, lpOverlapped=0x0 | out: lpBuffer=0x5489fc8*, lpNumberOfBytesRead=0x113ffd20*=0xc800, lpOverlapped=0x0) returned 1 [0076.641] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.641] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0076.641] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0076.641] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559e88 [0076.641] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559e88) returned 1 [0076.642] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x55b18a8 [0076.646] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559de8 [0076.646] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559e60 [0076.646] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559e60) returned 1 [0076.646] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.646] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0076.646] WriteFile (in: hFile=0x115c, lpBuffer=0x55b18a8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x113ffd20, lpOverlapped=0x0 | out: lpBuffer=0x55b18a8*, lpNumberOfBytesWritten=0x113ffd20*=0xc800, lpOverlapped=0x0) returned 1 [0076.729] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55b18a8) returned 1 [0076.729] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5489fc8) returned 1 [0076.729] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5d) returned 0x542ba70 [0076.729] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.729] WriteFile (in: hFile=0x115c, lpBuffer=0x54a2c88*, nNumberOfBytesToWrite=0x141, lpNumberOfBytesWritten=0x113ffda0, lpOverlapped=0x0 | out: lpBuffer=0x54a2c88*, lpNumberOfBytesWritten=0x113ffda0*=0x141, lpOverlapped=0x0) returned 1 [0076.778] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a2c88) returned 1 [0076.778] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542b250) returned 1 [0076.778] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4fb8) returned 1 [0076.778] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542ba70) returned 1 [0076.778] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559de8) returned 1 [0076.778] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559960) returned 1 [0076.778] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a00) returned 1 [0076.778] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a28) returned 1 [0076.778] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa2) returned 0x54df580 [0076.778] wcscpy (in: _Dest=0x54df580, _Source="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" [0076.778] wcscat (in: _Dest=0x54df580, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70" [0076.778] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x113ffd58, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.778] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb8) returned 0x39053e0 Thread: id = 398 os_tid = 0x160c [0072.342] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 0x20 [0076.561] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx", dwFileAttributes=0x20) returned 1 [0076.562] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1158 [0076.562] GetFileSizeEx (in: hFile=0x1158, lpFileSize=0x1147fc58 | out: lpFileSize=0x1147fc58*=69632) returned 1 [0076.562] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.562] ReadFile (in: hFile=0x1158, lpBuffer=0x1147fbdc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1147fbd8, lpOverlapped=0x0 | out: lpBuffer=0x1147fbdc*, lpNumberOfBytesRead=0x1147fbd8*=0x4, lpOverlapped=0x0) returned 1 [0076.582] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.582] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0076.582] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55599d8 [0076.582] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559b18 [0076.583] NtQuerySystemTime (in: CurrentTime=0x1147fbb8 | out: CurrentTime=0x1147fbb8*=132260136337460380) returned 0x0 [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0xaf471936 [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0x7541e207 [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0x880ced17 [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0xfe92c7da [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0xb71926c6 [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0xcc0af46c [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0x7d34aedb [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0x23a14005 [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0xe25f2bfc [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0xf2356903 [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0x9c7c30c [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0x80785c68 [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0x4e2adf7f [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0xb5bcd4 [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0x3d25b716 [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0xc0ed150b [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0xee6f7991 [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0xf43743bf [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0x7c980dfe [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0x489497de [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0x772cab12 [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0x106f2ada [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0x24293e4a [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0x4cdd2834 [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0xff3aeb76 [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0x7fc56ff1 [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0x36a613d3 [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0x8eba3cba [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0x9e0a98b2 [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0x2a1dc1e8 [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0x53dbd455 [0076.583] RtlRandom (in: Seed=0x1147fbc4 | out: Seed=0x1147fbc4) returned 0x7468efc9 [0076.593] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.593] ReadFile (in: hFile=0x1158, lpBuffer=0x5566878, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1147fb98, lpOverlapped=0x0 | out: lpBuffer=0x5566878*, lpNumberOfBytesRead=0x1147fb98*=0xc800, lpOverlapped=0x0) returned 1 [0076.695] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.695] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0076.695] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0076.695] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f00 [0076.695] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559f00) returned 1 [0076.696] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x55ca8b8 [0076.701] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f00 [0076.701] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f28 [0076.701] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559f28) returned 1 [0076.701] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.701] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0076.701] WriteFile (in: hFile=0x1158, lpBuffer=0x55ca8b8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1147fb98, lpOverlapped=0x0 | out: lpBuffer=0x55ca8b8*, lpNumberOfBytesWritten=0x1147fb98*=0xc800, lpOverlapped=0x0) returned 1 [0081.201] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55ca8b8) returned 1 [0091.757] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5566878) returned 1 [0091.757] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4d) returned 0x757ef48 [0091.757] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.757] WriteFile (hFile=0x1158, lpBuffer=0x758b118, nNumberOfBytesToWrite=0x131, lpNumberOfBytesWritten=0x1147fc18, lpOverlapped=0x0) Thread: id = 399 os_tid = 0x1610 [0072.343] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 0x20 [0076.560] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", dwFileAttributes=0x20) returned 1 [0076.560] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1154 [0076.560] GetFileSizeEx (in: hFile=0x1154, lpFileSize=0x114ffef4 | out: lpFileSize=0x114ffef4*=69632) returned 1 [0076.560] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.560] ReadFile (in: hFile=0x1154, lpBuffer=0x114ffe78, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x114ffe74, lpOverlapped=0x0 | out: lpBuffer=0x114ffe78*, lpNumberOfBytesRead=0x114ffe74*=0x4, lpOverlapped=0x0) returned 1 [0076.593] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.594] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0076.594] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559b18 [0076.594] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559de8 [0076.594] NtQuerySystemTime (in: CurrentTime=0x114ffe54 | out: CurrentTime=0x114ffe54*=132260136337460380) returned 0x0 [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0x82487eed [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0xe22ee8f5 [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0xecfd36ac [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0x545f53e [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0x6136c5ac [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0xae80c140 [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0xa2f2c259 [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0xdccea2b2 [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0x85c1ad68 [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0xc0e571c4 [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0x2c941f7a [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0xe7eeb4f5 [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0x18c48915 [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0xb7d4c390 [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0xb043abf8 [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0x11370dbf [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0xe2769955 [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0x6d8f964b [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0xcd21ef3b [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0xc314b40e [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0x2c5c9607 [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0xe8afc0b6 [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0xbce1a17b [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0x9ebd01cb [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0x450c34a8 [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0x1935d66d [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0xcb3486b2 [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0x717dbb63 [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0x31c82103 [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0xeabdbd95 [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0x42a1c72a [0076.594] RtlRandom (in: Seed=0x114ffe60 | out: Seed=0x114ffe60) returned 0x2332d4b3 [0076.603] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.604] ReadFile (in: hFile=0x1154, lpBuffer=0x5573080, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x114ffe34, lpOverlapped=0x0 | out: lpBuffer=0x5573080*, lpNumberOfBytesRead=0x114ffe34*=0xc800, lpOverlapped=0x0) returned 1 [0076.710] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.710] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0076.710] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0076.710] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4f68 [0076.710] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4f68) returned 1 [0076.711] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x55e38c8 [0076.715] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a50f8 [0076.715] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5120 [0076.715] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5120) returned 1 [0076.715] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.715] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0076.715] WriteFile (in: hFile=0x1154, lpBuffer=0x55e38c8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x114ffe34, lpOverlapped=0x0 | out: lpBuffer=0x55e38c8*, lpNumberOfBytesWritten=0x114ffe34*=0xc800, lpOverlapped=0x0) returned 1 [0081.206] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55e38c8) returned 1 [0091.759] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5573080) returned 1 [0091.759] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa1) returned 0x388e960 [0091.759] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.759] WriteFile (hFile=0x1154, lpBuffer=0x74b55f8, nNumberOfBytesToWrite=0x185, lpNumberOfBytesWritten=0x114ffeb4, lpOverlapped=0x0) Thread: id = 400 os_tid = 0x1614 [0072.344] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 0x20 [0076.508] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0076.509] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1150 [0076.509] GetFileSizeEx (in: hFile=0x1150, lpFileSize=0x1157fc34 | out: lpFileSize=0x1157fc34*=69632) returned 1 [0076.509] SetFilePointerEx (in: hFile=0x1150, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.509] ReadFile (in: hFile=0x1150, lpBuffer=0x1157fbb8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1157fbb4, lpOverlapped=0x0 | out: lpBuffer=0x1157fbb8*, lpNumberOfBytesRead=0x1157fbb4*=0x4, lpOverlapped=0x0) returned 1 [0076.549] SetFilePointerEx (in: hFile=0x1150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.549] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0076.550] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559938 [0076.550] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559960 [0076.550] NtQuerySystemTime (in: CurrentTime=0x1157fb94 | out: CurrentTime=0x1157fb94*=132260136337147666) returned 0x0 [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0xaa5a2624 [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0xfd55e7b2 [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0xb00f3773 [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0xc916f1e6 [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0x7934af78 [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0x122345be [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0x57f271a6 [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0xb82fd325 [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0x10b01001 [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0x7f1be9f7 [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0xbbb4e4fd [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0x665a456 [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0x6a12e2f3 [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0x2a994156 [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0xa29feecc [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0xc253db02 [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0xf92f2584 [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0xec08f6a4 [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0x657f191b [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0xfaf89e31 [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0x50c890b7 [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0x8a433fe [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0xcea62a58 [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0x4a0057e2 [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0xb7f15979 [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0xf9810229 [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0xebc5f6e2 [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0xd5ecb6ac [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0x9e9377f2 [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0xaa96008d [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0x2c6257bf [0076.550] RtlRandom (in: Seed=0x1157fba0 | out: Seed=0x1157fba0) returned 0xc6640522 [0076.559] SetFilePointerEx (in: hFile=0x1150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.559] ReadFile (in: hFile=0x1150, lpBuffer=0x547d7c0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1157fb74, lpOverlapped=0x0 | out: lpBuffer=0x547d7c0*, lpNumberOfBytesRead=0x1157fb74*=0xc800, lpOverlapped=0x0) returned 1 [0076.604] SetFilePointerEx (in: hFile=0x1150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.604] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5b60 [0076.604] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5496b48 [0076.604] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0076.604] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559910) returned 1 [0076.605] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x557f888 [0076.606] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0076.606] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x555a018 [0076.606] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x555a018) returned 1 [0076.606] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496b48) returned 1 [0076.606] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5b60) returned 1 [0076.606] WriteFile (in: hFile=0x1150, lpBuffer=0x557f888*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1157fb74, lpOverlapped=0x0 | out: lpBuffer=0x557f888*, lpNumberOfBytesWritten=0x1157fb74*=0xc800, lpOverlapped=0x0) returned 1 [0076.724] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x557f888) returned 1 [0076.724] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x547d7c0) returned 1 [0076.724] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x69) returned 0x5497250 [0076.724] SetFilePointerEx (in: hFile=0x1150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.724] WriteFile (in: hFile=0x1150, lpBuffer=0x54a2b30*, nNumberOfBytesToWrite=0x14d, lpNumberOfBytesWritten=0x1157fbf4, lpOverlapped=0x0 | out: lpBuffer=0x54a2b30*, lpNumberOfBytesWritten=0x1157fbf4*=0x14d, lpOverlapped=0x0) returned 1 [0076.764] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a2b30) returned 1 [0076.764] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496e90) returned 1 [0076.764] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e00) returned 1 [0076.764] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497250) returned 1 [0076.764] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559910) returned 1 [0076.764] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559938) returned 1 [0076.764] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559988) returned 1 [0076.764] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55599b0) returned 1 [0076.764] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xae) returned 0x5447788 [0076.764] wcscpy (in: _Dest=0x5447788, _Source="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" [0076.764] wcscat (in: _Dest=0x5447788, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70" [0076.764] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1157fbac, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.764] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x3972410 Thread: id = 401 os_tid = 0x1618 [0072.346] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 0x20 [0076.950] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0076.950] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x11a0 [0076.953] GetFileSizeEx (in: hFile=0x11a0, lpFileSize=0x115ff8e0 | out: lpFileSize=0x115ff8e0*=69632) returned 1 [0076.953] SetFilePointerEx (in: hFile=0x11a0, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.953] ReadFile (in: hFile=0x11a0, lpBuffer=0x115ff864, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x115ff860, lpOverlapped=0x0 | out: lpBuffer=0x115ff864*, lpNumberOfBytesRead=0x115ff860*=0x4, lpOverlapped=0x0) returned 1 [0076.956] SetFilePointerEx (in: hFile=0x11a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.956] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5210 [0076.956] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a52b0 [0076.956] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ea0 [0076.956] NtQuerySystemTime (in: CurrentTime=0x115ff840 | out: CurrentTime=0x115ff840*=132260136341210174) returned 0x0 [0076.956] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0xeeacda09 [0076.957] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0xd44d0597 [0076.957] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0x973bcacd [0076.957] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0xb1062afd [0076.957] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0xb92e6823 [0076.957] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0x87ba1010 [0076.957] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0x93304ada [0076.957] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0x8437a401 [0076.957] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0xffc21e76 [0076.957] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0x62d2b262 [0076.957] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0x2474969 [0076.957] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0xad8abef4 [0076.957] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0x1697adb1 [0076.957] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0xd8a15345 [0076.957] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0x2877d99b [0076.957] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0x318e8c55 [0076.957] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0x922d2d7 [0076.957] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0x585a7678 [0076.957] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0xb1bf31b6 [0076.957] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0xf892b614 [0076.957] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0x3ab6cbc6 [0076.957] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0xc22c9708 [0076.957] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0x3057fa33 [0076.957] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0x97ad7c8 [0076.957] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0xd78a3a09 [0076.957] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0xa088a178 [0076.957] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0xde3f3e28 [0076.957] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0x10f0743d [0076.957] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0x4db33500 [0076.957] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0xb3049b39 [0076.957] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0xbed1fe3d [0076.957] RtlRandom (in: Seed=0x115ff84c | out: Seed=0x115ff84c) returned 0x4bcbd381 [0076.966] SetFilePointerEx (in: hFile=0x11a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.966] ReadFile (in: hFile=0x11a0, lpBuffer=0x547d7c0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x115ff820, lpOverlapped=0x0 | out: lpBuffer=0x547d7c0*, lpNumberOfBytesRead=0x115ff820*=0xc800, lpOverlapped=0x0) returned 1 [0076.967] SetFilePointerEx (in: hFile=0x11a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.967] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0076.967] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0076.967] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4f68 [0076.967] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4f68) returned 1 [0076.968] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5489fc8 [0076.969] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5210 [0076.969] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4e78 [0076.969] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e78) returned 1 [0076.969] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.969] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0076.969] WriteFile (in: hFile=0x11a0, lpBuffer=0x5489fc8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x115ff820, lpOverlapped=0x0 | out: lpBuffer=0x5489fc8*, lpNumberOfBytesWritten=0x115ff820*=0xc800, lpOverlapped=0x0) returned 1 [0076.971] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5489fc8) returned 1 [0076.971] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x547d7c0) returned 1 [0076.971] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8d) returned 0x549ef78 [0076.971] SetFilePointerEx (in: hFile=0x11a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.971] WriteFile (in: hFile=0x11a0, lpBuffer=0x54a2b30*, nNumberOfBytesToWrite=0x171, lpNumberOfBytesWritten=0x115ff8a0, lpOverlapped=0x0 | out: lpBuffer=0x54a2b30*, lpNumberOfBytesWritten=0x115ff8a0*=0x171, lpOverlapped=0x0) returned 1 [0076.972] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a2b30) returned 1 [0076.973] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549f1d8) returned 1 [0076.973] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e78) returned 1 [0076.973] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549ef78) returned 1 [0076.973] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5210) returned 1 [0076.973] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a52b0) returned 1 [0076.973] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e00) returned 1 [0076.973] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e50) returned 1 [0076.973] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x3935368 [0076.973] wcscpy (in: _Dest=0x3935368, _Source="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" [0076.973] wcscat (in: _Dest=0x3935368, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70" [0076.973] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x115ff858, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.973] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x396f4d8 Thread: id = 402 os_tid = 0x161c [0072.347] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 0x20 [0076.507] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx", dwFileAttributes=0x20) returned 1 [0076.507] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x114c [0076.507] GetFileSizeEx (in: hFile=0x114c, lpFileSize=0x1167fab4 | out: lpFileSize=0x1167fab4*=1052672) returned 1 [0076.507] SetFilePointerEx (in: hFile=0x114c, liDistanceToMove=0x100ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.507] ReadFile (in: hFile=0x114c, lpBuffer=0x1167fa38, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1167fa34, lpOverlapped=0x0 | out: lpBuffer=0x1167fa38*, lpNumberOfBytesRead=0x1167fa34*=0x4, lpOverlapped=0x0) returned 1 [0076.524] SetFilePointerEx (in: hFile=0x114c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.524] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559938 [0076.524] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a50 [0076.524] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0076.524] NtQuerySystemTime (in: CurrentTime=0x1167fa14 | out: CurrentTime=0x1167fa14*=132260136336835293) returned 0x0 [0076.524] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0x75d7345e [0076.524] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0x6c2323dc [0076.524] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0x9d50b257 [0076.524] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0x69570bae [0076.525] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0x9cf107b8 [0076.525] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0x3dd9dda0 [0076.525] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0x3d7bf166 [0076.525] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0x4e12f19a [0076.525] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0x1d5ab5f6 [0076.525] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0x3af2bf87 [0076.525] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0xa95ad66 [0076.525] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0xe5bd48b6 [0076.525] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0x36e1c3e4 [0076.525] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0xb904024b [0076.525] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0xd92a5238 [0076.525] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0xe7d61ebb [0076.525] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0x8aa85eb2 [0076.525] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0x9fb2c9fb [0076.525] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0x5a8f4a3e [0076.525] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0x45c0f7a [0076.525] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0xf4fdc5fc [0076.525] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0x7aae2a47 [0076.525] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0x2b7dcc29 [0076.525] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0x632d8cd7 [0076.525] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0x66556d19 [0076.525] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0xb99527c8 [0076.525] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0x5458f80a [0076.525] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0x62bfd7af [0076.525] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0x807e2c57 [0076.525] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0x729721fd [0076.525] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0x838f4986 [0076.525] RtlRandom (in: Seed=0x1167fa20 | out: Seed=0x1167fa20) returned 0x6bf0bd4 [0076.535] SetFilePointerEx (in: hFile=0x114c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.535] ReadFile (in: hFile=0x114c, lpBuffer=0x555a070, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1167f9cc, lpOverlapped=0x0 | out: lpBuffer=0x555a070*, lpNumberOfBytesRead=0x1167f9cc*=0xc800, lpOverlapped=0x0) returned 1 [0076.542] SetFilePointerEx (in: hFile=0x114c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.542] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0076.542] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497610 [0076.542] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0076.542] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0076.543] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5470fb8 [0076.544] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0076.544] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559b40 [0076.544] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559b40) returned 1 [0076.544] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497610) returned 1 [0076.544] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0076.544] WriteFile (in: hFile=0x114c, lpBuffer=0x5470fb8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1167f9cc, lpOverlapped=0x0 | out: lpBuffer=0x5470fb8*, lpNumberOfBytesWritten=0x1167f9cc*=0xc800, lpOverlapped=0x0) returned 1 [0076.691] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5470fb8) returned 1 [0076.691] SetFilePointerEx (in: hFile=0x114c, liDistanceToMove=0x89800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.691] ReadFile (in: hFile=0x114c, lpBuffer=0x555a070, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1167f9cc, lpOverlapped=0x0 | out: lpBuffer=0x555a070*, lpNumberOfBytesRead=0x1167f9cc*=0xc800, lpOverlapped=0x0) returned 1 [0076.692] SetFilePointerEx (in: hFile=0x114c, liDistanceToMove=0x89800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.692] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5890 [0076.692] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5496e90 [0076.693] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559e60 [0076.693] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559e60) returned 1 [0076.693] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5470fb8 [0076.694] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559e60 [0076.694] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f00 [0076.694] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559f00) returned 1 [0076.694] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496e90) returned 1 [0076.694] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5890) returned 1 [0076.694] WriteFile (in: hFile=0x114c, lpBuffer=0x5470fb8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1167f9cc, lpOverlapped=0x0 | out: lpBuffer=0x5470fb8*, lpNumberOfBytesWritten=0x1167f9cc*=0xc800, lpOverlapped=0x0) returned 1 [0076.730] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5470fb8) returned 1 [0076.730] SetFilePointerEx (in: hFile=0x114c, liDistanceToMove=0xf4800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.730] ReadFile (in: hFile=0x114c, lpBuffer=0x555a070, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1167f9cc, lpOverlapped=0x0 | out: lpBuffer=0x555a070*, lpNumberOfBytesRead=0x1167f9cc*=0xc800, lpOverlapped=0x0) returned 1 [0076.772] SetFilePointerEx (in: hFile=0x114c, liDistanceToMove=0xf4800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.772] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0076.772] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5496a58 [0076.772] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4e00 [0076.772] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e00) returned 1 [0076.773] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x55d70c0 [0076.776] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4e00 [0076.776] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5058 [0076.777] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5058) returned 1 [0076.777] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496a58) returned 1 [0076.777] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0076.777] WriteFile (in: hFile=0x114c, lpBuffer=0x55d70c0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1167f9cc, lpOverlapped=0x0 | out: lpBuffer=0x55d70c0*, lpNumberOfBytesWritten=0x1167f9cc*=0xc800, lpOverlapped=0x0) returned 1 [0076.783] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55d70c0) returned 1 [0076.795] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x54b1c30 [0076.795] SetFilePointerEx (in: hFile=0x114c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.795] WriteFile (in: hFile=0x114c, lpBuffer=0x54a2db8*, nNumberOfBytesToWrite=0x183, lpNumberOfBytesWritten=0x1167fa74, lpOverlapped=0x0 | out: lpBuffer=0x54a2db8*, lpNumberOfBytesWritten=0x1167fa74*=0x183, lpOverlapped=0x0) returned 1 [0076.799] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a2db8) returned 1 [0076.799] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b1ea0) returned 1 [0076.799] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e50) returned 1 [0076.799] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b1fd8) returned 1 [0076.799] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b1c30) returned 1 [0076.799] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a50) returned 1 [0076.799] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ac8) returned 1 [0076.799] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559af0) returned 1 [0076.799] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa4) returned 0x54de920 [0076.799] wcscpy (in: _Dest=0x54de920, _Source="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" [0076.800] wcscat (in: _Dest=0x54de920, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.mailto[knoocknoo@cock.li].a0a70" [0076.800] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1167fa2c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.800] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x39751a8 Thread: id = 403 os_tid = 0x1620 [0072.347] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 0x20 [0076.494] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0076.506] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1148 [0076.506] GetFileSizeEx (in: hFile=0x1148, lpFileSize=0x116fff10 | out: lpFileSize=0x116fff10*=69632) returned 1 [0076.506] SetFilePointerEx (in: hFile=0x1148, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.506] ReadFile (in: hFile=0x1148, lpBuffer=0x116ffe94, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x116ffe90, lpOverlapped=0x0 | out: lpBuffer=0x116ffe94*, lpNumberOfBytesRead=0x116ffe90*=0x4, lpOverlapped=0x0) returned 1 [0076.510] SetFilePointerEx (in: hFile=0x1148, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.510] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559938 [0076.510] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559960 [0076.510] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55599d8 [0076.511] NtQuerySystemTime (in: CurrentTime=0x116ffe70 | out: CurrentTime=0x116ffe70*=132260136336679004) returned 0x0 [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0x452f9356 [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0x8304f1cd [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0xe29af340 [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0x6d18679a [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0x162233d8 [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0x9dd5673a [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0x355926b3 [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0x2546bf38 [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0x8152704a [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0x202173c8 [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0x10f420d2 [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0x40253a8d [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0xee8b3f54 [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0x8c510d18 [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0x19f39b78 [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0x41463fd0 [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0x71e21952 [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0x8c2185fc [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0xfb5b745 [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0x1a319d02 [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0xcdc4ddbc [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0xe7e826c3 [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0x2aa59d87 [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0xa048c72b [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0xb5c6df51 [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0x81d00d47 [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0x5c7c92e2 [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0x6b138da3 [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0x982c74be [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0xe807626f [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0x9178281f [0076.511] RtlRandom (in: Seed=0x116ffe7c | out: Seed=0x116ffe7c) returned 0xf19c5cd3 [0076.520] SetFilePointerEx (in: hFile=0x1148, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.521] ReadFile (in: hFile=0x1148, lpBuffer=0x547d7c0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x116ffe50, lpOverlapped=0x0 | out: lpBuffer=0x547d7c0*, lpNumberOfBytesRead=0x116ffe50*=0xc800, lpOverlapped=0x0) returned 1 [0076.536] SetFilePointerEx (in: hFile=0x1148, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.536] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0076.536] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0076.537] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0076.537] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0076.537] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5566878 [0076.539] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559938 [0076.539] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0076.539] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0076.539] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.539] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0076.539] WriteFile (in: hFile=0x1148, lpBuffer=0x5566878*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x116ffe50, lpOverlapped=0x0 | out: lpBuffer=0x5566878*, lpNumberOfBytesWritten=0x116ffe50*=0xc800, lpOverlapped=0x0) returned 1 [0076.545] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5566878) returned 1 [0076.545] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x547d7c0) returned 1 [0076.545] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6b) returned 0x5496b48 [0076.545] SetFilePointerEx (in: hFile=0x1148, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.545] WriteFile (in: hFile=0x1148, lpBuffer=0x54a2c88*, nNumberOfBytesToWrite=0x14f, lpNumberOfBytesWritten=0x116ffed0, lpOverlapped=0x0 | out: lpBuffer=0x54a2c88*, lpNumberOfBytesWritten=0x116ffed0*=0x14f, lpOverlapped=0x0) returned 1 [0076.548] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a2c88) returned 1 [0076.548] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54972c8) returned 1 [0076.548] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559b40) returned 1 [0076.548] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496b48) returned 1 [0076.548] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559938) returned 1 [0076.549] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559960) returned 1 [0076.549] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a00) returned 1 [0076.549] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a28) returned 1 [0076.549] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x54476d0 [0076.549] wcscpy (in: _Dest=0x54476d0, _Source="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" [0076.549] wcscat (in: _Dest=0x54476d0, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70" [0076.549] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x116ffe88, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.549] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x39720d0 Thread: id = 404 os_tid = 0x1624 [0072.350] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 0x20 [0076.479] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx", dwFileAttributes=0x20) returned 1 [0076.479] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1144 [0076.489] GetFileSizeEx (in: hFile=0x1144, lpFileSize=0x1177fcf4 | out: lpFileSize=0x1177fcf4*=69632) returned 1 [0076.489] SetFilePointerEx (in: hFile=0x1144, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.489] ReadFile (in: hFile=0x1144, lpBuffer=0x1177fc78, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1177fc74, lpOverlapped=0x0 | out: lpBuffer=0x1177fc78*, lpNumberOfBytesRead=0x1177fc74*=0x4, lpOverlapped=0x0) returned 1 [0076.494] SetFilePointerEx (in: hFile=0x1144, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.494] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559938 [0076.494] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0076.494] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559960 [0076.495] NtQuerySystemTime (in: CurrentTime=0x1177fc54 | out: CurrentTime=0x1177fc54*=132260136336522840) returned 0x0 [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0x8e47702a [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0xd2bc6bf [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0xdb98b464 [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0x636dad1f [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0xa3c212db [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0x9b1ac9e0 [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0x9982afb9 [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0xf00bdb1 [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0xee25b0b5 [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0x7a5c3f80 [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0xf6d48948 [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0x80bf2fa0 [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0x7e6ab6f0 [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0xa71fe7d3 [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0xfd9907b4 [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0x4b30aaf5 [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0xaa4fefc6 [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0x9d1a14ea [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0xb156a80a [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0x602b8fae [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0x791fa317 [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0xcc7b5ea0 [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0xca6a170b [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0x48f2143a [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0x1e65edb5 [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0x20cddbcd [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0xd13287bc [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0x92f1129c [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0x14ec97b6 [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0xb5f25c48 [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0x12b5013d [0076.495] RtlRandom (in: Seed=0x1177fc60 | out: Seed=0x1177fc60) returned 0x4af4ee48 [0076.505] SetFilePointerEx (in: hFile=0x1144, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.505] ReadFile (in: hFile=0x1144, lpBuffer=0x5470fb8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1177fc34, lpOverlapped=0x0 | out: lpBuffer=0x5470fb8*, lpNumberOfBytesRead=0x1177fc34*=0xc800, lpOverlapped=0x0) returned 1 [0076.521] SetFilePointerEx (in: hFile=0x1144, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.521] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5890 [0076.521] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x54970e8 [0076.521] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559938 [0076.521] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559938) returned 1 [0076.522] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5489fc8 [0076.523] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55599d8 [0076.523] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559ac8 [0076.523] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ac8) returned 1 [0076.523] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54970e8) returned 1 [0076.523] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5890) returned 1 [0076.523] WriteFile (in: hFile=0x1144, lpBuffer=0x5489fc8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1177fc34, lpOverlapped=0x0 | out: lpBuffer=0x5489fc8*, lpNumberOfBytesWritten=0x1177fc34*=0xc800, lpOverlapped=0x0) returned 1 [0076.540] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5489fc8) returned 1 [0076.540] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5470fb8) returned 1 [0076.540] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6b) returned 0x54970e8 [0076.540] SetFilePointerEx (in: hFile=0x1144, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.540] WriteFile (in: hFile=0x1144, lpBuffer=0x54a2b30*, nNumberOfBytesToWrite=0x14f, lpNumberOfBytesWritten=0x1177fcb4, lpOverlapped=0x0 | out: lpBuffer=0x54a2b30*, lpNumberOfBytesWritten=0x1177fcb4*=0x14f, lpOverlapped=0x0) returned 1 [0076.547] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a2b30) returned 1 [0076.547] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.547] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559b18) returned 1 [0076.547] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54970e8) returned 1 [0076.547] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55599d8) returned 1 [0076.547] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559910) returned 1 [0076.547] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559988) returned 1 [0076.547] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55599b0) returned 1 [0076.547] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x54471c8 [0076.547] wcscpy (in: _Dest=0x54471c8, _Source="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" [0076.548] wcscat (in: _Dest=0x54471c8, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.mailto[knoocknoo@cock.li].a0a70" [0076.548] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1177fc6c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.548] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x39721a0 Thread: id = 405 os_tid = 0x1628 [0072.351] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 0x20 [0076.459] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0076.471] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1140 [0076.475] GetFileSizeEx (in: hFile=0x1140, lpFileSize=0x117ff8d4 | out: lpFileSize=0x117ff8d4*=69632) returned 1 [0076.475] SetFilePointerEx (in: hFile=0x1140, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.475] ReadFile (in: hFile=0x1140, lpBuffer=0x117ff858, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x117ff854, lpOverlapped=0x0 | out: lpBuffer=0x117ff858*, lpNumberOfBytesRead=0x117ff854*=0x4, lpOverlapped=0x0) returned 1 [0076.479] SetFilePointerEx (in: hFile=0x1140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.479] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559d70 [0076.479] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559898 [0076.479] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559938 [0076.479] NtQuerySystemTime (in: CurrentTime=0x117ff834 | out: CurrentTime=0x117ff834*=132260136336366564) returned 0x0 [0076.479] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0x2b6d8462 [0076.479] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0x90f03933 [0076.479] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0xca86b5dd [0076.479] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0xc58676c0 [0076.480] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0xdbb3d93d [0076.480] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0xe6919f3f [0076.480] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0x6f887d42 [0076.480] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0x21442683 [0076.480] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0x18fd9b4a [0076.480] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0xa75bcf1a [0076.480] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0x1326372d [0076.480] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0xf2520cc5 [0076.480] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0xa9df1888 [0076.480] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0xfdd22258 [0076.480] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0x38fb5223 [0076.480] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0x45ad7c94 [0076.480] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0xc89a7bb6 [0076.480] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0x53c3b081 [0076.480] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0x344bc193 [0076.480] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0xd21536d4 [0076.480] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0x9637612d [0076.480] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0x8fe1a43f [0076.480] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0x2b773ca [0076.480] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0x90e2b98b [0076.480] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0xff576de3 [0076.480] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0x98d6fb36 [0076.480] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0xe697fe53 [0076.480] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0x21cf04c8 [0076.480] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0x23f7e709 [0076.480] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0xb23bb39d [0076.480] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0xef6b8d1a [0076.480] RtlRandom (in: Seed=0x117ff840 | out: Seed=0x117ff840) returned 0xad097cdd [0076.489] SetFilePointerEx (in: hFile=0x1140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.489] ReadFile (in: hFile=0x1140, lpBuffer=0x5540858, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x117ff814, lpOverlapped=0x0 | out: lpBuffer=0x5540858*, lpNumberOfBytesRead=0x117ff814*=0xc800, lpOverlapped=0x0) returned 1 [0076.490] SetFilePointerEx (in: hFile=0x1140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.490] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0076.490] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0076.490] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55599b0 [0076.490] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55599b0) returned 1 [0076.491] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x554d060 [0076.491] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559d70 [0076.492] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0076.492] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559910) returned 1 [0076.492] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.492] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0076.492] WriteFile (in: hFile=0x1140, lpBuffer=0x554d060*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x117ff814, lpOverlapped=0x0 | out: lpBuffer=0x554d060*, lpNumberOfBytesWritten=0x117ff814*=0xc800, lpOverlapped=0x0) returned 1 [0081.201] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x554d060) returned 1 [0091.757] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5540858) returned 1 [0091.757] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x69) returned 0x766d370 [0091.757] SetFilePointerEx (in: hFile=0x1140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.758] WriteFile (hFile=0x1140, lpBuffer=0xe537d78, nNumberOfBytesToWrite=0x14d, lpNumberOfBytesWritten=0x117ff894, lpOverlapped=0x0) Thread: id = 406 os_tid = 0x162c [0072.351] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 0x20 [0076.443] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx", dwFileAttributes=0x20) returned 1 [0076.443] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x113c [0076.453] GetFileSizeEx (in: hFile=0x113c, lpFileSize=0x1187fd98 | out: lpFileSize=0x1187fd98*=69632) returned 1 [0076.453] SetFilePointerEx (in: hFile=0x113c, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.454] ReadFile (in: hFile=0x113c, lpBuffer=0x1187fd1c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1187fd18, lpOverlapped=0x0 | out: lpBuffer=0x1187fd1c*, lpNumberOfBytesRead=0x1187fd18*=0x4, lpOverlapped=0x0) returned 1 [0076.459] SetFilePointerEx (in: hFile=0x113c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.459] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559d70 [0076.459] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559898 [0076.460] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559938 [0076.460] NtQuerySystemTime (in: CurrentTime=0x1187fcf8 | out: CurrentTime=0x1187fcf8*=132260136336210468) returned 0x0 [0076.460] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0xf243d22b [0076.460] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0x93a22d94 [0076.460] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0xa564820c [0076.460] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0x23882788 [0076.460] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0x8d1e2b45 [0076.460] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0x80d1eecc [0076.460] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0xfb984c51 [0076.460] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0xbc198a13 [0076.460] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0x65fa71a4 [0076.460] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0x2d7ca601 [0076.460] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0xaee7be38 [0076.460] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0x631689e4 [0076.460] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0x892a4cb0 [0076.460] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0x11993276 [0076.460] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0xce9cdad1 [0076.460] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0xbf2feb6b [0076.460] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0x92e6dc8a [0076.460] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0x74a03257 [0076.460] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0x3b6b469c [0076.460] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0xa38b5de5 [0076.460] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0xcccf6972 [0076.460] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0xf5181adf [0076.460] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0x66df7875 [0076.460] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0xe570f79c [0076.460] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0xe2762494 [0076.460] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0x78025317 [0076.460] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0xc03fc40e [0076.460] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0x35e1abfc [0076.460] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0x8ab9065e [0076.461] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0xcbbf6a88 [0076.461] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0x7a0323c8 [0076.461] RtlRandom (in: Seed=0x1187fd04 | out: Seed=0x1187fd04) returned 0xe668d00a [0076.470] SetFilePointerEx (in: hFile=0x113c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.470] ReadFile (in: hFile=0x113c, lpBuffer=0x5540858, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1187fcd8, lpOverlapped=0x0 | out: lpBuffer=0x5540858*, lpNumberOfBytesRead=0x1187fcd8*=0xc800, lpOverlapped=0x0) returned 1 [0076.471] SetFilePointerEx (in: hFile=0x113c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.471] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0076.471] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0076.472] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55599b0 [0076.472] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55599b0) returned 1 [0076.472] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x554d060 [0076.474] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559d70 [0076.474] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0076.474] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559910) returned 1 [0076.474] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.474] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0076.474] WriteFile (in: hFile=0x113c, lpBuffer=0x554d060*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1187fcd8, lpOverlapped=0x0 | out: lpBuffer=0x554d060*, lpNumberOfBytesWritten=0x1187fcd8*=0xc800, lpOverlapped=0x0) returned 1 [0076.475] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x554d060) returned 1 [0076.475] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5540858) returned 1 [0076.475] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x69) returned 0x5496b48 [0076.476] SetFilePointerEx (in: hFile=0x113c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.476] WriteFile (in: hFile=0x113c, lpBuffer=0x54a2b30*, nNumberOfBytesToWrite=0x14d, lpNumberOfBytesWritten=0x1187fd58, lpOverlapped=0x0 | out: lpBuffer=0x54a2b30*, lpNumberOfBytesWritten=0x1187fd58*=0x14d, lpOverlapped=0x0) returned 1 [0076.477] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a2b30) returned 1 [0076.477] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497250) returned 1 [0076.477] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a50) returned 1 [0076.477] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496b48) returned 1 [0076.477] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559d70) returned 1 [0076.478] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559898) returned 1 [0076.478] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55598c0) returned 1 [0076.478] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55598e8) returned 1 [0076.478] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xae) returned 0x5447618 [0076.478] wcscpy (in: _Dest=0x5447618, _Source="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" [0076.478] wcscat (in: _Dest=0x5447618, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.mailto[knoocknoo@cock.li].a0a70" [0076.478] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1187fd10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0076.478] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x3971e60 Thread: id = 407 os_tid = 0x1630 [0072.351] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 0x20 [0076.438] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0076.439] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1138 [0076.442] GetFileSizeEx (in: hFile=0x1138, lpFileSize=0x118ffd54 | out: lpFileSize=0x118ffd54*=69632) returned 1 [0076.442] SetFilePointerEx (in: hFile=0x1138, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.442] ReadFile (in: hFile=0x1138, lpBuffer=0x118ffcd8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x118ffcd4, lpOverlapped=0x0 | out: lpBuffer=0x118ffcd8*, lpNumberOfBytesRead=0x118ffcd4*=0x4, lpOverlapped=0x0) returned 1 [0076.443] SetFilePointerEx (in: hFile=0x1138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.443] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c30 [0076.444] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c80 [0076.444] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559938 [0076.444] NtQuerySystemTime (in: CurrentTime=0x118ffcb4 | out: CurrentTime=0x118ffcb4*=132260136336053799) returned 0x0 [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0x2af39587 [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0x74550826 [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0x6212f071 [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0x915666d7 [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0xe722bfbf [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0xd8f9783d [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0xd5831ff7 [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0xd7949c70 [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0xdd4318d4 [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0x2d7804f9 [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0xfc181547 [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0x18225cd4 [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0x6a2fe6ab [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0x36c65658 [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0x1a765dcc [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0x25d9d31e [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0xd1f78c8 [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0x47c16ed0 [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0xcbe8a7f3 [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0xeed3d11a [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0xf56bf96 [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0xd6d488f0 [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0x13ab9d3d [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0x94f374a0 [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0xcb6da6fc [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0x59316083 [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0x5e52c15c [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0x8bde485f [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0x8697bdce [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0xf1e11607 [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0x9391afbb [0076.444] RtlRandom (in: Seed=0x118ffcc0 | out: Seed=0x118ffcc0) returned 0xbe03a1f6 [0076.453] SetFilePointerEx (in: hFile=0x1138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.453] ReadFile (in: hFile=0x1138, lpBuffer=0x54fe820, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x118ffc94, lpOverlapped=0x0 | out: lpBuffer=0x54fe820*, lpNumberOfBytesRead=0x118ffc94*=0xc800, lpOverlapped=0x0) returned 1 [0076.454] SetFilePointerEx (in: hFile=0x1138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.454] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0076.454] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497598 [0076.455] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55599b0 [0076.455] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55599b0) returned 1 [0076.456] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5534050 [0076.456] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559c30 [0076.456] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559d70 [0076.456] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559d70) returned 1 [0076.456] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497598) returned 1 [0076.456] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0076.456] WriteFile (in: hFile=0x1138, lpBuffer=0x5534050*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x118ffc94, lpOverlapped=0x0 | out: lpBuffer=0x5534050*, lpNumberOfBytesWritten=0x118ffc94*=0xc800, lpOverlapped=0x0) returned 1 [0081.198] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5534050) returned 1 [0091.757] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54fe820) returned 1 [0091.757] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x67) returned 0x5468b00 [0091.757] SetFilePointerEx (in: hFile=0x1138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.757] WriteFile (hFile=0x1138, lpBuffer=0xe538ae8, nNumberOfBytesToWrite=0x14b, lpNumberOfBytesWritten=0x118ffd14, lpOverlapped=0x0) Thread: id = 408 os_tid = 0x1634 [0072.352] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 0x20 [0079.122] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx", dwFileAttributes=0x20) returned 1 [0082.881] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) Thread: id = 409 os_tid = 0x1638 [0072.353] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x5444c00 [0072.353] wcscpy (in: _Dest=0x5444c00, _Source="C:\\Windows10Upgrade\\2052" | out: _Dest="C:\\Windows10Upgrade\\2052") returned="C:\\Windows10Upgrade\\2052" [0072.353] wcscat (in: _Dest=0x5444c00, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\2052\\") returned="C:\\Windows10Upgrade\\2052\\" [0072.353] wcscat (in: _Dest=0x5444c00, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\2052\\*") returned="C:\\Windows10Upgrade\\2052\\*" [0072.353] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f42c0 [0072.353] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\2052\\*", lpFindFileData=0x53f42c0 | out: lpFindFileData=0x53f42c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea35483d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea355be9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54452c0 [0077.325] wcscmp (_String1=".", _String2=".") returned 0 [0077.325] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x53f42c0 | out: lpFindFileData=0x53f42c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea35483d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea355be9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.325] wcscmp (_String1="..", _String2=".") returned 1 [0077.325] wcscmp (_String1="..", _String2="..") returned 0 [0077.325] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x53f42c0 | out: lpFindFileData=0x53f42c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea355be9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x1cec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWINTL20.DLL", cAlternateFileName="")) returned 1 [0077.326] wcscmp (_String1="DWINTL20.DLL", _String2=".") returned 1 [0077.326] wcscmp (_String1="DWINTL20.DLL", _String2="..") returned 1 [0077.326] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x53f42c0 | out: lpFindFileData=0x53f42c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea355be9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x1cec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWINTL20.DLL", cAlternateFileName="")) returned 0 [0077.326] FindClose (in: hFindFile=0x54452c0 | out: hFindFile=0x54452c0) returned 1 [0077.326] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f42c0) returned 1 [0077.326] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444c00) returned 1 [0077.326] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444ec0) returned 1 Thread: id = 410 os_tid = 0x163c [0072.354] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Configuration.ini" (normalized: "c:\\windows10upgrade\\configuration.ini")) returned 0x20 [0077.325] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Configuration.ini", dwFileAttributes=0x20) returned 1 [0081.566] CreateFileW (lpFileName="C:\\Windows10Upgrade\\Configuration.ini" (normalized: "c:\\windows10upgrade\\configuration.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d08 [0081.567] GetFileSizeEx (in: hFile=0x1d08, lpFileSize=0x11a7fb0c | out: lpFileSize=0x11a7fb0c*=212) returned 1 [0081.567] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 411 os_tid = 0x1640 [0072.355] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x5444cc0 [0072.355] wcscpy (in: _Dest=0x5444cc0, _Source="C:\\Windows10Upgrade\\dll1" | out: _Dest="C:\\Windows10Upgrade\\dll1") returned="C:\\Windows10Upgrade\\dll1" [0072.355] wcscat (in: _Dest=0x5444cc0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\dll1\\") returned="C:\\Windows10Upgrade\\dll1\\" [0072.355] wcscat (in: _Dest=0x5444cc0, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\dll1\\*") returned="C:\\Windows10Upgrade\\dll1\\*" [0072.355] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f3b88 [0072.355] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\dll1\\*", lpFindFileData=0x53f3b88 | out: lpFindFileData=0x53f3b88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3757e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37926f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0081.562] wcscmp (_String1=".", _String2=".") returned 0 [0081.562] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53f3b88 | out: lpFindFileData=0x53f3b88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3757e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37926f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.562] wcscmp (_String1="..", _String2=".") returned 1 [0081.562] wcscmp (_String1="..", _String2="..") returned 0 [0081.562] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53f3b88 | out: lpFindFileData=0x53f3b88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea376b75, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea376b75, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x204c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="cosqueryxp.dll", cAlternateFileName="COSQUE~1.DLL")) returned 1 [0081.562] wcscmp (_String1="cosqueryxp.dll", _String2=".") returned 1 [0081.562] wcscmp (_String1="cosqueryxp.dll", _String2="..") returned 1 [0081.562] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53f3b88 | out: lpFindFileData=0x53f3b88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea377ed3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x3b0c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="wdscore.dll", cAlternateFileName="")) returned 1 [0081.562] wcscmp (_String1="wdscore.dll", _String2=".") returned 1 [0081.562] wcscmp (_String1="wdscore.dll", _String2="..") returned 1 [0081.562] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53f3b88 | out: lpFindFileData=0x53f3b88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37926f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37926f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xe9ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 1 [0081.562] wcscmp (_String1="webservices.dll", _String2=".") returned 1 [0081.562] wcscmp (_String1="webservices.dll", _String2="..") returned 1 [0081.562] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53f3b88 | out: lpFindFileData=0x53f3b88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37926f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37926f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xe9ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 0 [0081.562] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0081.562] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f3b88) returned 1 [0081.562] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444cc0) returned 1 [0081.562] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54451c0) returned 1 Thread: id = 412 os_tid = 0x1644 [0072.357] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x5445200 [0072.357] wcscpy (in: _Dest=0x5445200, _Source="C:\\Windows10Upgrade\\dll2" | out: _Dest="C:\\Windows10Upgrade\\dll2") returned="C:\\Windows10Upgrade\\dll2" [0072.357] wcscat (in: _Dest=0x5445200, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\dll2\\") returned="C:\\Windows10Upgrade\\dll2\\" [0072.357] wcscat (in: _Dest=0x5445200, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\dll2\\*") returned="C:\\Windows10Upgrade\\dll2\\*" [0072.357] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f3df0 [0072.357] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\dll2\\*", lpFindFileData=0x53f3df0 | out: lpFindFileData=0x53f3df0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea37cd05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37cd05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37e09b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444b00 [0081.564] wcscmp (_String1=".", _String2=".") returned 0 [0081.565] FindNextFileW (in: hFindFile=0x5444b00, lpFindFileData=0x53f3df0 | out: lpFindFileData=0x53f3df0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea37cd05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37cd05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37e09b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.565] wcscmp (_String1="..", _String2=".") returned 1 [0081.565] wcscmp (_String1="..", _String2="..") returned 0 [0081.565] FindNextFileW (in: hFindFile=0x5444b00, lpFindFileData=0x53f3df0 | out: lpFindFileData=0x53f3df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37e09b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37e09b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xb8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 1 [0081.565] wcscmp (_String1="webservices.dll", _String2=".") returned 1 [0081.565] wcscmp (_String1="webservices.dll", _String2="..") returned 1 [0081.565] FindNextFileW (in: hFindFile=0x5444b00, lpFindFileData=0x53f3df0 | out: lpFindFileData=0x53f3df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37e09b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37e09b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xb8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 0 [0081.565] FindClose (in: hFindFile=0x5444b00 | out: hFindFile=0x5444b00) returned 1 [0081.565] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f3df0) returned 1 [0081.566] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445200) returned 1 [0081.566] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445040) returned 1 Thread: id = 413 os_tid = 0x1648 [0072.358] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5ec0 [0072.358] wcscpy (in: _Dest=0x38a5ec0, _Source="C:\\Windows10Upgrade\\resources" | out: _Dest="C:\\Windows10Upgrade\\resources") returned="C:\\Windows10Upgrade\\resources" [0072.358] wcscat (in: _Dest=0x38a5ec0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\") returned="C:\\Windows10Upgrade\\resources\\" [0072.358] wcscat (in: _Dest=0x38a5ec0, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\resources\\*") returned="C:\\Windows10Upgrade\\resources\\*" [0072.358] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f4058 [0072.358] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\*", lpFindFileData=0x53f4058 | out: lpFindFileData=0x53f4058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b3c1b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b3c1b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba1230 [0079.162] wcscmp (_String1=".", _String2=".") returned 0 [0079.162] FindNextFileW (in: hFindFile=0x5ba1230, lpFindFileData=0x53f4058 | out: lpFindFileData=0x53f4058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b3c1b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b3c1b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.162] wcscmp (_String1="..", _String2=".") returned 1 [0079.162] wcscmp (_String1="..", _String2="..") returned 0 [0079.162] FindNextFileW (in: hFindFile=0x5ba1230, lpFindFileData=0x53f4058 | out: lpFindFileData=0x53f4058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a5195, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3a5195, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="amd64", cAlternateFileName="")) returned 1 [0079.162] wcscmp (_String1="amd64", _String2=".") returned 1 [0079.162] wcscmp (_String1="amd64", _String2="..") returned 1 [0079.162] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x5bc7448 [0079.162] wcscpy (in: _Dest=0x5bc7448, _Source="C:\\Windows10Upgrade\\resources" | out: _Dest="C:\\Windows10Upgrade\\resources") returned="C:\\Windows10Upgrade\\resources" [0079.163] wcscat (in: _Dest=0x5bc7448, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\") returned="C:\\Windows10Upgrade\\resources\\" [0079.163] wcscat (in: _Dest=0x5bc7448, _Source="amd64" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64") returned="C:\\Windows10Upgrade\\resources\\amd64" [0080.551] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5bc7448, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf28 [0080.551] FindNextFileW (in: hFindFile=0x5ba1230, lpFindFileData=0x53f4058 | out: lpFindFileData=0x53f4058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a78b4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a78b4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xc981b, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwcompatShared.txt", cAlternateFileName="HWCOMP~1.TXT")) returned 1 [0080.551] wcscmp (_String1="hwcompatShared.txt", _String2=".") returned 1 [0080.552] wcscmp (_String1="hwcompatShared.txt", _String2="..") returned 1 [0080.552] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x5ba7038 [0080.552] wcscpy (in: _Dest=0x5ba7038, _Source="C:\\Windows10Upgrade\\resources" | out: _Dest="C:\\Windows10Upgrade\\resources") returned="C:\\Windows10Upgrade\\resources" [0080.552] wcscat (in: _Dest=0x5ba7038, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\") returned="C:\\Windows10Upgrade\\resources\\" [0080.552] wcscat (in: _Dest=0x5ba7038, _Source="hwcompatShared.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt") returned="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" [0080.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba7038, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xed4 [0080.552] FindNextFileW (in: hFindFile=0x5ba1230, lpFindFileData=0x53f4058 | out: lpFindFileData=0x53f4058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3a9fd3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b1515, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b1515, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="i386", cAlternateFileName="")) returned 1 [0080.552] wcscmp (_String1="i386", _String2=".") returned 1 [0080.552] wcscmp (_String1="i386", _String2="..") returned 1 [0080.552] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x46) returned 0x397ddb8 [0080.552] wcscpy (in: _Dest=0x397ddb8, _Source="C:\\Windows10Upgrade\\resources" | out: _Dest="C:\\Windows10Upgrade\\resources") returned="C:\\Windows10Upgrade\\resources" [0080.552] wcscat (in: _Dest=0x397ddb8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\") returned="C:\\Windows10Upgrade\\resources\\" [0080.553] wcscat (in: _Dest=0x397ddb8, _Source="i386" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386") returned="C:\\Windows10Upgrade\\resources\\i386" [0080.553] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x397ddb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f8 [0080.553] FindNextFileW (in: hFindFile=0x5ba1230, lpFindFileData=0x53f4058 | out: lpFindFileData=0x53f4058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea63c947, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ux", cAlternateFileName="")) returned 1 [0080.553] wcscmp (_String1="ux", _String2=".") returned 1 [0080.553] wcscmp (_String1="ux", _String2="..") returned 1 [0080.553] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x42) returned 0x397df98 [0080.553] wcscpy (in: _Dest=0x397df98, _Source="C:\\Windows10Upgrade\\resources" | out: _Dest="C:\\Windows10Upgrade\\resources") returned="C:\\Windows10Upgrade\\resources" [0080.554] wcscat (in: _Dest=0x397df98, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\") returned="C:\\Windows10Upgrade\\resources\\" [0080.554] wcscat (in: _Dest=0x397df98, _Source="ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0080.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x397df98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1420 [0080.554] FindNextFileW (in: hFindFile=0x5ba1230, lpFindFileData=0x53f4058 | out: lpFindFileData=0x53f4058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea63c947, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ux", cAlternateFileName="")) returned 0 [0080.554] FindClose (in: hFindFile=0x5ba1230 | out: hFindFile=0x5ba1230) returned 1 [0080.555] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f4058) returned 1 [0080.555] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5ec0) returned 1 [0080.555] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537bef0) returned 1 Thread: id = 414 os_tid = 0x164c [0072.359] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\upgrader_default.log" (normalized: "c:\\windows10upgrade\\upgrader_default.log")) returned 0x20 [0081.559] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\upgrader_default.log", dwFileAttributes=0x20) returned 1 [0081.559] CreateFileW (lpFileName="C:\\Windows10Upgrade\\upgrader_default.log" (normalized: "c:\\windows10upgrade\\upgrader_default.log"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d00 [0081.559] GetFileSizeEx (in: hFile=0x1d00, lpFileSize=0x11c7febc | out: lpFileSize=0x11c7febc*=250186) returned 1 [0081.559] SetFilePointerEx (in: hFile=0x1d00, liDistanceToMove=0x3d146, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.559] ReadFile (in: hFile=0x1d00, lpBuffer=0x11c7fe40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x11c7fe3c, lpOverlapped=0x0 | out: lpBuffer=0x11c7fe40*, lpNumberOfBytesRead=0x11c7fe3c*=0x4, lpOverlapped=0x0) returned 1 [0081.561] SetFilePointerEx (in: hFile=0x1d00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.561] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 415 os_tid = 0x1650 [0072.359] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\upgrader_win10.log" (normalized: "c:\\windows10upgrade\\upgrader_win10.log")) returned 0x20 [0077.325] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\upgrader_win10.log", dwFileAttributes=0x20) returned 1 [0081.563] CreateFileW (lpFileName="C:\\Windows10Upgrade\\upgrader_win10.log" (normalized: "c:\\windows10upgrade\\upgrader_win10.log"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d04 [0081.563] GetFileSizeEx (in: hFile=0x1d04, lpFileSize=0x11cffa30 | out: lpFileSize=0x11cffa30*=20548) returned 1 [0081.563] SetFilePointerEx (in: hFile=0x1d04, liDistanceToMove=0x5040, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.563] ReadFile (in: hFile=0x1d04, lpBuffer=0x11cff9b4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x11cff9b0, lpOverlapped=0x0 | out: lpBuffer=0x11cff9b4*, lpNumberOfBytesRead=0x11cff9b0*=0x4, lpOverlapped=0x0) returned 1 [0081.565] SetFilePointerEx (in: hFile=0x1d04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.565] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 416 os_tid = 0x1654 [0072.477] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 0x80 [0089.287] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf", dwFileAttributes=0x20) Thread: id = 417 os_tid = 0x1658 [0072.479] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 0x80 [0079.162] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", dwFileAttributes=0x20) Thread: id = 418 os_tid = 0x165c [0072.479] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 0x80 [0077.330] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf", dwFileAttributes=0x20) Thread: id = 419 os_tid = 0x1660 [0072.479] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0082.518] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0082.544] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.582] GetLastError () returned 0x5 [0082.582] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0082.596] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ba170) returned 1 Thread: id = 420 os_tid = 0x1664 [0072.481] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0082.551] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0082.567] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.583] GetLastError () returned 0x5 [0082.583] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0082.597] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ba9e0) returned 1 Thread: id = 421 os_tid = 0x1668 [0072.481] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x53bb4d8 [0072.481] wcscpy (in: _Dest=0x53bb4d8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxMetadata" [0072.481] wcscat (in: _Dest=0x53bb4d8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxMetadata\\" [0072.482] wcscat (in: _Dest=0x53bb4d8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*" [0072.482] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x541a618 [0072.482] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x541a618 | out: lpFindFileData=0x541a618*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33d73fc1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9e44ee0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33d73fc1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54450c0 [0077.728] wcscmp (_String1=".", _String2=".") returned 0 [0077.728] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x541a618 | out: lpFindFileData=0x541a618*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33d73fc1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9e44ee0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33d73fc1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.728] wcscmp (_String1="..", _String2=".") returned 1 [0077.729] wcscmp (_String1="..", _String2="..") returned 0 [0077.729] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x541a618 | out: lpFindFileData=0x541a618*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33d73fc1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33d73fc1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33d73fc1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2a88, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1 [0077.729] wcscmp (_String1="CodeIntegrity.cat", _String2=".") returned 1 [0077.729] wcscmp (_String1="CodeIntegrity.cat", _String2="..") returned 1 [0077.729] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x393ebe0 [0077.729] wcscpy (in: _Dest=0x393ebe0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxMetadata" [0077.729] wcscat (in: _Dest=0x393ebe0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxMetadata\\" [0077.729] wcscat (in: _Dest=0x393ebe0, _Source="CodeIntegrity.cat" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" [0080.920] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x393ebe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1288 [0080.921] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x541a618 | out: lpFindFileData=0x541a618*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33d73fc1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33d73fc1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33d73fc1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2a88, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 0 [0080.921] FindClose (in: hFindFile=0x54450c0 | out: hFindFile=0x54450c0) returned 1 [0080.921] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541a618) returned 1 [0080.921] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53bb4d8) returned 1 [0080.921] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54060e8) returned 1 Thread: id = 422 os_tid = 0x166c [0072.482] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0082.568] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0082.583] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.621] GetLastError () returned 0x5 [0082.621] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0082.632] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54061b8) returned 1 Thread: id = 423 os_tid = 0x1670 [0072.484] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\logo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\logo.png")) returned 0x20 [0082.583] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x20) returned 0 [0082.598] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\logo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\logo.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.621] GetLastError () returned 0x5 [0082.621] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x20) returned 0 [0082.632] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b69f0) returned 1 Thread: id = 424 os_tid = 0x1674 [0072.484] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xde) returned 0x38ce9a8 [0072.484] wcscpy (in: _Dest=0x38ce9a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" [0072.484] wcscat (in: _Dest=0x38ce9a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\" [0072.484] wcscat (in: _Dest=0x38ce9a8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\*" [0072.484] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54169f0 [0072.484] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\*", lpFindFileData=0x54169f0 | out: lpFindFileData=0x54169f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f2112c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9e45833, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33f47386, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445380 [0081.261] wcscmp (_String1=".", _String2=".") returned 0 [0081.261] FindNextFileW (in: hFindFile=0x5445380, lpFindFileData=0x54169f0 | out: lpFindFileData=0x54169f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f2112c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9e45833, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33f47386, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.261] wcscmp (_String1="..", _String2=".") returned 1 [0081.261] wcscmp (_String1="..", _String2="..") returned 0 [0081.261] FindNextFileW (in: hFindFile=0x5445380, lpFindFileData=0x54169f0 | out: lpFindFileData=0x54169f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33f2112c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33f2112c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33f2112c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x6e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootstrap.html", cAlternateFileName="")) returned 1 [0081.261] wcscmp (_String1="bootstrap.html", _String2=".") returned 1 [0081.261] wcscmp (_String1="bootstrap.html", _String2="..") returned 1 [0081.261] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf8) returned 0x5ba3df8 [0081.262] wcscpy (in: _Dest=0x5ba3df8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" [0081.262] wcscat (in: _Dest=0x5ba3df8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\" [0081.262] wcscat (in: _Dest=0x5ba3df8, _Source="bootstrap.html" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html" [0081.262] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba3df8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c14 [0081.262] FindNextFileW (in: hFindFile=0x5445380, lpFindFileData=0x54169f0 | out: lpFindFileData=0x54169f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33f2112c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33f2112c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33f2112c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x50cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootstrap.js", cAlternateFileName="")) returned 1 [0081.262] wcscmp (_String1="bootstrap.js", _String2=".") returned 1 [0081.262] wcscmp (_String1="bootstrap.js", _String2="..") returned 1 [0081.262] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf4) returned 0x5ba37f8 [0081.262] wcscpy (in: _Dest=0x5ba37f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" [0081.262] wcscat (in: _Dest=0x5ba37f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\" [0081.262] wcscat (in: _Dest=0x5ba37f8, _Source="bootstrap.js" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.js") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.js" [0081.262] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba37f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c18 [0081.263] FindNextFileW (in: hFindFile=0x5445380, lpFindFileData=0x54169f0 | out: lpFindFileData=0x54169f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33f2112c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33f47386, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33f47386, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x78bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ormma.js", cAlternateFileName="")) returned 1 [0081.263] wcscmp (_String1="ormma.js", _String2=".") returned 1 [0081.263] wcscmp (_String1="ormma.js", _String2="..") returned 1 [0081.263] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) Thread: id = 425 os_tid = 0x1678 [0072.485] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.advertising.winmd")) returned 0x20 [0082.828] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd", dwFileAttributes=0x20) returned 0 [0082.828] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.advertising.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.828] GetLastError () returned 0x5 [0082.828] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd", dwFileAttributes=0x20) returned 0 [0082.828] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53feaa0) returned 1 Thread: id = 426 os_tid = 0x167c [0072.486] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf6) returned 0x53fd080 [0072.486] wcscpy (in: _Dest=0x53fd080, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0072.486] wcscat (in: _Dest=0x53fd080, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0072.486] wcscat (in: _Dest=0x53fd080, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0072.486] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5417860 [0072.486] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x5417860 | out: lpFindFileData=0x5417860*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb523798b, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb523798b, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xe0183a1, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ecc0 [0085.992] wcscmp (_String1=".", _String2=".") returned 0 [0085.992] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5417860 | out: lpFindFileData=0x5417860*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb523798b, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb523798b, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xe0183a1, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.992] wcscmp (_String1="..", _String2=".") returned 1 [0085.992] wcscmp (_String1="..", _String2="..") returned 0 [0085.992] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5417860 | out: lpFindFileData=0x5417860*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe0183a1, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xe0183a1, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe0183a1, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 1 [0085.992] wcscmp (_String1="Autogen", _String2=".") returned 1 [0085.992] wcscmp (_String1="Autogen", _String2="..") returned 1 [0085.992] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x102) returned 0x743a578 [0085.992] wcscpy (in: _Dest=0x743a578, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0085.992] wcscat (in: _Dest=0x743a578, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0085.992] wcscat (in: _Dest=0x743a578, _Source="Autogen" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen" [0088.686] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x743a578, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ef4 [0088.741] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5417860 | out: lpFindFileData=0x5417860*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe0183a1, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xe0183a1, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe0183a1, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0088.741] FindClose (in: hFindFile=0x389ecc0 | out: hFindFile=0x389ecc0) returned 1 [0088.741] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5417860) returned 1 [0088.741] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fd080) Thread: id = 427 os_tid = 0x1680 [0072.486] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\resources.pri")) returned 0x20 [0082.637] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0082.637] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.637] GetLastError () returned 0x5 [0082.637] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0082.638] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ba248) returned 1 Thread: id = 428 os_tid = 0x1684 [0072.488] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0082.559] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0082.559] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.559] GetLastError () returned 0x5 [0082.560] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0082.560] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ba908) returned 1 Thread: id = 429 os_tid = 0x1688 [0072.490] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xca) returned 0x38fe800 [0072.493] wcscpy (in: _Dest=0x38fe800, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0072.493] wcscat (in: _Dest=0x38fe800, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\" [0072.493] wcscat (in: _Dest=0x38fe800, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*" [0072.493] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5416c58 [0072.493] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x5416c58 | out: lpFindFileData=0x5416c58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96c0f12e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9730ad4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x96c0f12e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba11b0 [0079.160] wcscmp (_String1=".", _String2=".") returned 0 [0079.160] FindNextFileW (in: hFindFile=0x5ba11b0, lpFindFileData=0x5416c58 | out: lpFindFileData=0x5416c58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96c0f12e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9730ad4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x96c0f12e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.160] wcscmp (_String1="..", _String2=".") returned 1 [0079.160] wcscmp (_String1="..", _String2="..") returned 0 [0079.160] FindNextFileW (in: hFindFile=0x5ba11b0, lpFindFileData=0x5416c58 | out: lpFindFileData=0x5416c58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96c0f12e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x96c0f12e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x96c0f12e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x46bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 1 [0079.160] wcscmp (_String1="AppxBundleManifest.xml", _String2=".") returned 1 [0079.160] wcscmp (_String1="AppxBundleManifest.xml", _String2="..") returned 1 [0079.160] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf4) returned 0x5ba39f8 [0079.160] wcscpy (in: _Dest=0x5ba39f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0079.160] wcscat (in: _Dest=0x5ba39f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\" [0079.160] wcscat (in: _Dest=0x5ba39f8, _Source="AppxBundleManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" [0080.562] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba39f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1404 [0080.562] FindNextFileW (in: hFindFile=0x5ba11b0, lpFindFileData=0x5416c58 | out: lpFindFileData=0x5416c58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96c0f12e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x96c0f12e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x96c0f12e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x46bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 0 [0080.562] FindClose (in: hFindFile=0x5ba11b0 | out: hFindFile=0x5ba11b0) returned 1 [0080.562] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5416c58) returned 1 [0080.562] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38fe800) returned 1 [0080.562] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e71d0) returned 1 Thread: id = 430 os_tid = 0x168c [0072.494] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0082.286] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0082.521] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.123] GetLastError () returned 0x5 [0083.123] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.123] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b9fc0) returned 1 Thread: id = 431 os_tid = 0x1690 [0072.495] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf4) returned 0x53fd288 [0072.495] wcscpy (in: _Dest=0x53fd288, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" [0072.495] wcscat (in: _Dest=0x53fd288, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0072.495] wcscat (in: _Dest=0x53fd288, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0072.496] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5418ba0 [0072.496] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x5418ba0 | out: lpFindFileData=0x5418ba0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb3c9c41d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa973141d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3c9c41d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e840 [0086.003] wcscmp (_String1=".", _String2=".") returned 0 [0086.003] FindNextFileW (in: hFindFile=0x389e840, lpFindFileData=0x5418ba0 | out: lpFindFileData=0x5418ba0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb3c9c41d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa973141d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3c9c41d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.003] wcscmp (_String1="..", _String2=".") returned 1 [0086.003] wcscmp (_String1="..", _String2="..") returned 0 [0086.003] FindNextFileW (in: hFindFile=0x389e840, lpFindFileData=0x5418ba0 | out: lpFindFileData=0x5418ba0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb3c9c41d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa973141d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3c9c41d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.003] FindClose (in: hFindFile=0x389e840 | out: hFindFile=0x389e840) returned 1 [0086.003] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5418ba0) returned 1 [0086.003] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fd288) returned 1 [0086.003] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5450988) returned 1 Thread: id = 432 os_tid = 0x1694 [0072.497] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 0x80 [0088.950] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", dwFileAttributes=0x20) Thread: id = 433 os_tid = 0x1698 [0072.498] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 0x80 [0092.854] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf", dwFileAttributes=0x20) Thread: id = 434 os_tid = 0x169c [0072.499] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 0x80 [0080.403] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", dwFileAttributes=0x20) Thread: id = 435 os_tid = 0x16a0 [0072.499] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 0x80 [0089.286] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf", dwFileAttributes=0x20) Thread: id = 436 os_tid = 0x16a4 [0072.499] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 0x80 [0079.161] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", dwFileAttributes=0x20) Thread: id = 437 os_tid = 0x16a8 [0072.500] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 0x80 [0092.853] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf", dwFileAttributes=0x20) Thread: id = 438 os_tid = 0x16ac [0072.501] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 0x80 [0080.410] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", dwFileAttributes=0x20) Thread: id = 439 os_tid = 0x16b0 [0072.502] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x34) returned 0x5444d00 [0072.502] wcscpy (in: _Dest=0x5444d00, _Source="C:\\Users\\FD1HVy\\AppData" | out: _Dest="C:\\Users\\FD1HVy\\AppData") returned="C:\\Users\\FD1HVy\\AppData" [0072.502] wcscat (in: _Dest=0x5444d00, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\") returned="C:\\Users\\FD1HVy\\AppData\\" [0072.502] wcscat (in: _Dest=0x5444d00, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\*") returned="C:\\Users\\FD1HVy\\AppData\\*" [0072.502] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5417f98 [0072.503] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\*", lpFindFileData=0x5417f98 | out: lpFindFileData=0x5417f98*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f040 [0074.907] wcscmp (_String1=".", _String2=".") returned 0 [0074.907] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x5417f98 | out: lpFindFileData=0x5417f98*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.907] wcscmp (_String1="..", _String2=".") returned 1 [0074.907] wcscmp (_String1="..", _String2="..") returned 0 [0074.907] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x5417f98 | out: lpFindFileData=0x5417f98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb6f6a4d1, ftLastAccessTime.dwHighDateTime=0x1d5d815, ftLastWriteTime.dwLowDateTime=0xb6f6a4d1, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0074.907] wcscmp (_String1="Local", _String2=".") returned 1 [0074.907] wcscmp (_String1="Local", _String2="..") returned 1 [0074.907] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3c) returned 0x38a5608 [0074.907] wcscpy (in: _Dest=0x38a5608, _Source="C:\\Users\\FD1HVy\\AppData" | out: _Dest="C:\\Users\\FD1HVy\\AppData") returned="C:\\Users\\FD1HVy\\AppData" [0074.907] wcscat (in: _Dest=0x38a5608, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\") returned="C:\\Users\\FD1HVy\\AppData\\" [0074.907] wcscat (in: _Dest=0x38a5608, _Source="Local" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local") returned="C:\\Users\\FD1HVy\\AppData\\Local" [0074.907] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a5608, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc24 [0074.908] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x5417f98 | out: lpFindFileData=0x5417f98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34f2b3d6, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb373310b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb373310b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0074.908] wcscmp (_String1="LocalLow", _String2=".") returned 1 [0074.908] wcscmp (_String1="LocalLow", _String2="..") returned 1 [0074.908] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x42) returned 0x393fce8 [0074.908] wcscpy (in: _Dest=0x393fce8, _Source="C:\\Users\\FD1HVy\\AppData" | out: _Dest="C:\\Users\\FD1HVy\\AppData") returned="C:\\Users\\FD1HVy\\AppData" [0074.908] wcscat (in: _Dest=0x393fce8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\") returned="C:\\Users\\FD1HVy\\AppData\\" [0074.908] wcscat (in: _Dest=0x393fce8, _Source="LocalLow" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\LocalLow") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow" [0074.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x393fce8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc28 [0074.908] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x5417f98 | out: lpFindFileData=0x5417f98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x39dbebb0, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39dbebb0, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0074.909] wcscmp (_String1="Roaming", _String2=".") returned 1 [0074.909] wcscmp (_String1="Roaming", _String2="..") returned 1 [0074.909] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5698 [0074.909] wcscpy (in: _Dest=0x38a5698, _Source="C:\\Users\\FD1HVy\\AppData" | out: _Dest="C:\\Users\\FD1HVy\\AppData") returned="C:\\Users\\FD1HVy\\AppData" [0074.909] wcscat (in: _Dest=0x38a5698, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\") returned="C:\\Users\\FD1HVy\\AppData\\" [0074.909] wcscat (in: _Dest=0x38a5698, _Source="Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0074.909] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a5698, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc2c [0074.909] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x5417f98 | out: lpFindFileData=0x5417f98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x39dbebb0, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39dbebb0, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0074.909] FindClose (in: hFindFile=0x389f040 | out: hFindFile=0x389f040) returned 1 [0074.909] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5417f98) returned 1 [0074.910] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444d00) returned 1 [0074.910] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e65b8) returned 1 Thread: id = 440 os_tid = 0x16b4 [0072.503] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x46) returned 0x38fb220 [0072.503] wcscpy (in: _Dest=0x38fb220, _Source="C:\\Users\\FD1HVy\\Application Data" | out: _Dest="C:\\Users\\FD1HVy\\Application Data") returned="C:\\Users\\FD1HVy\\Application Data" [0072.503] wcscat (in: _Dest=0x38fb220, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Application Data\\") returned="C:\\Users\\FD1HVy\\Application Data\\" [0072.503] wcscat (in: _Dest=0x38fb220, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Application Data\\*") returned="C:\\Users\\FD1HVy\\Application Data\\*" [0072.503] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5418200 [0072.503] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Application Data\\*", lpFindFileData=0x5418200 | out: lpFindFileData=0x5418200*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.807] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5418200) returned 1 [0074.807] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38fb220) returned 1 [0074.807] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x546d840) returned 1 Thread: id = 441 os_tid = 0x16b8 [0072.504] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x5444d40 [0072.504] wcscpy (in: _Dest=0x5444d40, _Source="C:\\Users\\FD1HVy\\Contacts" | out: _Dest="C:\\Users\\FD1HVy\\Contacts") returned="C:\\Users\\FD1HVy\\Contacts" [0072.504] wcscat (in: _Dest=0x5444d40, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Contacts\\") returned="C:\\Users\\FD1HVy\\Contacts\\" [0072.504] wcscat (in: _Dest=0x5444d40, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Contacts\\*") returned="C:\\Users\\FD1HVy\\Contacts\\*" [0072.504] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5418468 [0072.504] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts\\*", lpFindFileData=0x5418468 | out: lpFindFileData=0x5418468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389eec0 [0076.330] wcscmp (_String1=".", _String2=".") returned 0 [0076.330] FindNextFileW (in: hFindFile=0x389eec0, lpFindFileData=0x5418468 | out: lpFindFileData=0x5418468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.330] wcscmp (_String1="..", _String2=".") returned 1 [0076.331] wcscmp (_String1="..", _String2="..") returned 0 [0076.331] FindNextFileW (in: hFindFile=0x389eec0, lpFindFileData=0x5418468 | out: lpFindFileData=0x5418468*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0076.333] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0076.333] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0076.333] FindNextFileW (in: hFindFile=0x389eec0, lpFindFileData=0x5418468 | out: lpFindFileData=0x5418468*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0076.333] FindClose (in: hFindFile=0x389eec0 | out: hFindFile=0x389eec0) returned 1 [0076.334] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5418468) returned 1 [0076.334] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444d40) returned 1 [0076.334] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444c40) returned 1 Thread: id = 442 os_tid = 0x16bc [0072.505] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x34) returned 0x5444dc0 [0072.505] wcscpy (in: _Dest=0x5444dc0, _Source="C:\\Users\\FD1HVy\\Cookies" | out: _Dest="C:\\Users\\FD1HVy\\Cookies") returned="C:\\Users\\FD1HVy\\Cookies" [0072.505] wcscat (in: _Dest=0x5444dc0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Cookies\\") returned="C:\\Users\\FD1HVy\\Cookies\\" [0072.505] wcscat (in: _Dest=0x5444dc0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Cookies\\*") returned="C:\\Users\\FD1HVy\\Cookies\\*" [0072.505] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54186d0 [0072.505] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Cookies\\*", lpFindFileData=0x54186d0 | out: lpFindFileData=0x54186d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.809] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54186d0) returned 1 [0074.809] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444dc0) returned 1 [0074.809] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e6238) returned 1 Thread: id = 443 os_tid = 0x16c0 [0072.505] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x34) returned 0x5444e80 [0072.506] wcscpy (in: _Dest=0x5444e80, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0072.506] wcscat (in: _Dest=0x5444e80, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0072.506] wcscat (in: _Dest=0x5444e80, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\*") returned="C:\\Users\\FD1HVy\\Desktop\\*" [0072.506] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5418938 [0072.506] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa15a90db, ftLastAccessTime.dwHighDateTime=0x1d5e1e4, ftLastWriteTime.dwLowDateTime=0xa15a90db, ftLastWriteTime.dwHighDateTime=0x1d5e1e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389eb80 [0075.231] wcscmp (_String1=".", _String2=".") returned 0 [0075.231] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa15a90db, ftLastAccessTime.dwHighDateTime=0x1d5e1e4, ftLastWriteTime.dwLowDateTime=0xa15a90db, ftLastWriteTime.dwHighDateTime=0x1d5e1e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.231] wcscmp (_String1="..", _String2=".") returned 1 [0075.231] wcscmp (_String1="..", _String2="..") returned 0 [0075.231] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ef4d380, ftCreationTime.dwHighDateTime=0x1d5cb8e, ftLastAccessTime.dwLowDateTime=0xf9bfbd50, ftLastAccessTime.dwHighDateTime=0x1d5d2d4, ftLastWriteTime.dwLowDateTime=0xf9bfbd50, ftLastWriteTime.dwHighDateTime=0x1d5d2d4, nFileSizeHigh=0x0, nFileSizeLow=0x8fbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="-P3XyyVavLec0sKG-bX9.ots", cAlternateFileName="-P3XYY~1.OTS")) returned 1 [0075.231] wcscmp (_String1="-P3XyyVavLec0sKG-bX9.ots", _String2=".") returned -1 [0075.231] wcscmp (_String1="-P3XyyVavLec0sKG-bX9.ots", _String2="..") returned -1 [0075.231] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x396dc00 [0075.231] wcscpy (in: _Dest=0x396dc00, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0075.231] wcscat (in: _Dest=0x396dc00, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0075.231] wcscat (in: _Dest=0x396dc00, _Source="-P3XyyVavLec0sKG-bX9.ots" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\-P3XyyVavLec0sKG-bX9.ots") returned="C:\\Users\\FD1HVy\\Desktop\\-P3XyyVavLec0sKG-bX9.ots" [0075.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396dc00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcb4 [0075.901] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5f6f660, ftCreationTime.dwHighDateTime=0x1d5d451, ftLastAccessTime.dwLowDateTime=0xda64a2e0, ftLastAccessTime.dwHighDateTime=0x1d5c951, ftLastWriteTime.dwLowDateTime=0xda64a2e0, ftLastWriteTime.dwHighDateTime=0x1d5c951, nFileSizeHigh=0x0, nFileSizeLow=0x115dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="-zgrM9.mp3", cAlternateFileName="")) returned 1 [0075.901] wcscmp (_String1="-zgrM9.mp3", _String2=".") returned -1 [0075.901] wcscmp (_String1="-zgrM9.mp3", _String2="..") returned -1 [0075.901] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x46) returned 0x55328f0 [0075.902] wcscpy (in: _Dest=0x55328f0, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0075.902] wcscat (in: _Dest=0x55328f0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0075.902] wcscat (in: _Dest=0x55328f0, _Source="-zgrM9.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\-zgrM9.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\-zgrM9.mp3" [0075.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55328f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xee4 [0075.902] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35f3ad40, ftCreationTime.dwHighDateTime=0x1d5d5fa, ftLastAccessTime.dwLowDateTime=0xcf419800, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0xcf419800, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0x155e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="32670RwV1Oxd5LF5.gif", cAlternateFileName="32670R~1.GIF")) returned 1 [0075.902] wcscmp (_String1="32670RwV1Oxd5LF5.gif", _String2=".") returned 1 [0075.902] wcscmp (_String1="32670RwV1Oxd5LF5.gif", _String2="..") returned 1 [0075.902] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x38fd410 [0075.902] wcscpy (in: _Dest=0x38fd410, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0075.902] wcscat (in: _Dest=0x38fd410, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0075.903] wcscat (in: _Dest=0x38fd410, _Source="32670RwV1Oxd5LF5.gif" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\32670RwV1Oxd5LF5.gif") returned="C:\\Users\\FD1HVy\\Desktop\\32670RwV1Oxd5LF5.gif" [0075.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fd410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xee8 [0075.903] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a5f52c0, ftCreationTime.dwHighDateTime=0x1d5d057, ftLastAccessTime.dwLowDateTime=0x5b9521f0, ftLastAccessTime.dwHighDateTime=0x1d5cc5e, ftLastWriteTime.dwLowDateTime=0x5b9521f0, ftLastWriteTime.dwHighDateTime=0x1d5cc5e, nFileSizeHigh=0x0, nFileSizeLow=0x15a77, dwReserved0=0x0, dwReserved1=0x0, cFileName="39E9.mkv", cAlternateFileName="")) returned 1 [0075.903] wcscmp (_String1="39E9.mkv", _String2=".") returned 1 [0075.903] wcscmp (_String1="39E9.mkv", _String2="..") returned 1 [0075.903] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x42) returned 0x5532940 [0075.903] wcscpy (in: _Dest=0x5532940, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0075.903] wcscat (in: _Dest=0x5532940, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0075.903] wcscat (in: _Dest=0x5532940, _Source="39E9.mkv" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\39E9.mkv") returned="C:\\Users\\FD1HVy\\Desktop\\39E9.mkv" [0075.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5532940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeec [0075.904] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42047b60, ftCreationTime.dwHighDateTime=0x1d5cfc3, ftLastAccessTime.dwLowDateTime=0x729b7ec0, ftLastAccessTime.dwHighDateTime=0x1d5d1fa, ftLastWriteTime.dwLowDateTime=0x729b7ec0, ftLastWriteTime.dwHighDateTime=0x1d5d1fa, nFileSizeHigh=0x0, nFileSizeLow=0xbbcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="3hcSRx6tHB844TPE-PH.mkv", cAlternateFileName="3HCSRX~1.MKV")) returned 1 [0075.904] wcscmp (_String1="3hcSRx6tHB844TPE-PH.mkv", _String2=".") returned 1 [0075.904] wcscmp (_String1="3hcSRx6tHB844TPE-PH.mkv", _String2="..") returned 1 [0075.904] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x38fd548 [0075.904] wcscpy (in: _Dest=0x38fd548, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0075.904] wcscat (in: _Dest=0x38fd548, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0075.904] wcscat (in: _Dest=0x38fd548, _Source="3hcSRx6tHB844TPE-PH.mkv" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\3hcSRx6tHB844TPE-PH.mkv") returned="C:\\Users\\FD1HVy\\Desktop\\3hcSRx6tHB844TPE-PH.mkv" [0075.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fd548, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xef0 [0075.905] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3df5fa0, ftCreationTime.dwHighDateTime=0x1d5d412, ftLastAccessTime.dwLowDateTime=0x30618fa0, ftLastAccessTime.dwHighDateTime=0x1d5d2a3, ftLastWriteTime.dwLowDateTime=0x30618fa0, ftLastWriteTime.dwHighDateTime=0x1d5d2a3, nFileSizeHigh=0x0, nFileSizeLow=0xd484, dwReserved0=0x0, dwReserved1=0x0, cFileName="3RTQUW2BS_.jpg", cAlternateFileName="3RTQUW~1.JPG")) returned 1 [0075.905] wcscmp (_String1="3RTQUW2BS_.jpg", _String2=".") returned 1 [0075.905] wcscmp (_String1="3RTQUW2BS_.jpg", _String2="..") returned 1 [0075.905] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x39005c8 [0075.905] wcscpy (in: _Dest=0x39005c8, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0075.905] wcscat (in: _Dest=0x39005c8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0075.905] wcscat (in: _Dest=0x39005c8, _Source="3RTQUW2BS_.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\3RTQUW2BS_.jpg") returned="C:\\Users\\FD1HVy\\Desktop\\3RTQUW2BS_.jpg" [0075.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x39005c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xef4 [0075.906] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb92aeda0, ftCreationTime.dwHighDateTime=0x1d5d478, ftLastAccessTime.dwLowDateTime=0x39ffedc0, ftLastAccessTime.dwHighDateTime=0x1d5d007, ftLastWriteTime.dwLowDateTime=0x39ffedc0, ftLastWriteTime.dwHighDateTime=0x1d5d007, nFileSizeHigh=0x0, nFileSizeLow=0x95ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="6rJ4zuIO9I.wav", cAlternateFileName="6RJ4ZU~1.WAV")) returned 1 [0075.906] wcscmp (_String1="6rJ4zuIO9I.wav", _String2=".") returned 1 [0075.906] wcscmp (_String1="6rJ4zuIO9I.wav", _String2="..") returned 1 [0075.906] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x3900308 [0075.906] wcscpy (in: _Dest=0x3900308, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0075.906] wcscat (in: _Dest=0x3900308, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0075.906] wcscat (in: _Dest=0x3900308, _Source="6rJ4zuIO9I.wav" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\6rJ4zuIO9I.wav") returned="C:\\Users\\FD1HVy\\Desktop\\6rJ4zuIO9I.wav" [0075.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3900308, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xef8 [0075.907] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaefa630, ftCreationTime.dwHighDateTime=0x1d5c9de, ftLastAccessTime.dwLowDateTime=0x4dc1a3e0, ftLastAccessTime.dwHighDateTime=0x1d5ce71, ftLastWriteTime.dwLowDateTime=0x4dc1a3e0, ftLastWriteTime.dwHighDateTime=0x1d5ce71, nFileSizeHigh=0x0, nFileSizeLow=0x1f0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="9QLAhBRTqcQ.flv", cAlternateFileName="9QLAHB~1.FLV")) returned 1 [0075.907] wcscmp (_String1="9QLAhBRTqcQ.flv", _String2=".") returned 1 [0075.907] wcscmp (_String1="9QLAhBRTqcQ.flv", _String2="..") returned 1 [0075.907] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x39001a8 [0075.907] wcscpy (in: _Dest=0x39001a8, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0075.907] wcscat (in: _Dest=0x39001a8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0075.907] wcscat (in: _Dest=0x39001a8, _Source="9QLAhBRTqcQ.flv" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\9QLAhBRTqcQ.flv") returned="C:\\Users\\FD1HVy\\Desktop\\9QLAhBRTqcQ.flv" [0075.907] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x39001a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xefc [0075.908] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1b44b70, ftCreationTime.dwHighDateTime=0x1d5cc5a, ftLastAccessTime.dwLowDateTime=0x29dc0560, ftLastAccessTime.dwHighDateTime=0x1d5d65f, ftLastWriteTime.dwLowDateTime=0x29dc0560, ftLastWriteTime.dwHighDateTime=0x1d5d65f, nFileSizeHigh=0x0, nFileSizeLow=0x68b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="aqaYC.rtf", cAlternateFileName="")) returned 1 [0075.908] wcscmp (_String1="aqaYC.rtf", _String2=".") returned 1 [0075.908] wcscmp (_String1="aqaYC.rtf", _String2="..") returned 1 [0075.908] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x5532710 [0075.908] wcscpy (in: _Dest=0x5532710, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0075.908] wcscat (in: _Dest=0x5532710, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0075.908] wcscat (in: _Dest=0x5532710, _Source="aqaYC.rtf" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\aqaYC.rtf") returned="C:\\Users\\FD1HVy\\Desktop\\aqaYC.rtf" [0075.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5532710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf00 [0075.909] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0075.909] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0075.909] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0075.909] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59749f30, ftCreationTime.dwHighDateTime=0x1d5cc9b, ftLastAccessTime.dwLowDateTime=0xfc388f20, ftLastAccessTime.dwHighDateTime=0x1d5d48d, ftLastWriteTime.dwLowDateTime=0xfc388f20, ftLastWriteTime.dwHighDateTime=0x1d5d48d, nFileSizeHigh=0x0, nFileSizeLow=0x8ba5, dwReserved0=0x0, dwReserved1=0x0, cFileName="DkpjLP5M_k.ppt", cAlternateFileName="DKPJLP~1.PPT")) returned 1 [0075.909] wcscmp (_String1="DkpjLP5M_k.ppt", _String2=".") returned 1 [0075.909] wcscmp (_String1="DkpjLP5M_k.ppt", _String2="..") returned 1 [0075.909] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x3900360 [0075.909] wcscpy (in: _Dest=0x3900360, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0075.909] wcscat (in: _Dest=0x3900360, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0075.909] wcscat (in: _Dest=0x3900360, _Source="DkpjLP5M_k.ppt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\DkpjLP5M_k.ppt") returned="C:\\Users\\FD1HVy\\Desktop\\DkpjLP5M_k.ppt" [0075.909] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3900360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf04 [0075.910] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x514b8300, ftCreationTime.dwHighDateTime=0x1d5d579, ftLastAccessTime.dwLowDateTime=0x1fb78250, ftLastAccessTime.dwHighDateTime=0x1d5ca8c, ftLastWriteTime.dwLowDateTime=0x1fb78250, ftLastWriteTime.dwHighDateTime=0x1d5ca8c, nFileSizeHigh=0x0, nFileSizeLow=0xb057, dwReserved0=0x0, dwReserved1=0x0, cFileName="evwMKgOzdO2DlQHqbWE.png", cAlternateFileName="EVWMKG~1.PNG")) returned 1 [0075.910] wcscmp (_String1="evwMKgOzdO2DlQHqbWE.png", _String2=".") returned 1 [0075.910] wcscmp (_String1="evwMKgOzdO2DlQHqbWE.png", _String2="..") returned 1 [0075.910] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x542bb40 [0075.910] wcscpy (in: _Dest=0x542bb40, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0075.910] wcscat (in: _Dest=0x542bb40, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0075.910] wcscat (in: _Dest=0x542bb40, _Source="evwMKgOzdO2DlQHqbWE.png" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\evwMKgOzdO2DlQHqbWE.png") returned="C:\\Users\\FD1HVy\\Desktop\\evwMKgOzdO2DlQHqbWE.png" [0075.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x542bb40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf08 [0075.911] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa19bb3e0, ftCreationTime.dwHighDateTime=0x1d5d220, ftLastAccessTime.dwLowDateTime=0xb2fab930, ftLastAccessTime.dwHighDateTime=0x1d5caa8, ftLastWriteTime.dwLowDateTime=0xb2fab930, ftLastWriteTime.dwHighDateTime=0x1d5caa8, nFileSizeHigh=0x0, nFileSizeLow=0xab31, dwReserved0=0x0, dwReserved1=0x0, cFileName="F9cV.bmp", cAlternateFileName="")) returned 1 [0075.911] wcscmp (_String1="F9cV.bmp", _String2=".") returned 1 [0075.911] wcscmp (_String1="F9cV.bmp", _String2="..") returned 1 [0075.911] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x42) returned 0x5532760 [0075.911] wcscpy (in: _Dest=0x5532760, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0075.911] wcscat (in: _Dest=0x5532760, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0075.911] wcscat (in: _Dest=0x5532760, _Source="F9cV.bmp" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\F9cV.bmp") returned="C:\\Users\\FD1HVy\\Desktop\\F9cV.bmp" [0075.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5532760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf0c [0075.912] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad84a9a0, ftCreationTime.dwHighDateTime=0x1d5d437, ftLastAccessTime.dwLowDateTime=0x1969f510, ftLastAccessTime.dwHighDateTime=0x1d5d287, ftLastWriteTime.dwLowDateTime=0x1969f510, ftLastWriteTime.dwHighDateTime=0x1d5d287, nFileSizeHigh=0x0, nFileSizeLow=0xdf7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="g8rpcVHRizs14C.avi", cAlternateFileName="G8RPCV~1.AVI")) returned 1 [0075.912] wcscmp (_String1="g8rpcVHRizs14C.avi", _String2=".") returned 1 [0075.912] wcscmp (_String1="g8rpcVHRizs14C.avi", _String2="..") returned 1 [0075.912] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x54982e8 [0075.912] wcscpy (in: _Dest=0x54982e8, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0075.912] wcscat (in: _Dest=0x54982e8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0075.912] wcscat (in: _Dest=0x54982e8, _Source="g8rpcVHRizs14C.avi" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\g8rpcVHRizs14C.avi") returned="C:\\Users\\FD1HVy\\Desktop\\g8rpcVHRizs14C.avi" [0075.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54982e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf10 [0075.913] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a946d30, ftCreationTime.dwHighDateTime=0x1d5d7a2, ftLastAccessTime.dwLowDateTime=0x77d06300, ftLastAccessTime.dwHighDateTime=0x1d5cdc3, ftLastWriteTime.dwLowDateTime=0x77d06300, ftLastWriteTime.dwHighDateTime=0x1d5cdc3, nFileSizeHigh=0x0, nFileSizeLow=0xed03, dwReserved0=0x0, dwReserved1=0x0, cFileName="GupI.avi", cAlternateFileName="")) returned 1 [0075.913] wcscmp (_String1="GupI.avi", _String2=".") returned 1 [0075.913] wcscmp (_String1="GupI.avi", _String2="..") returned 1 [0075.913] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x42) returned 0x5532a30 [0075.913] wcscpy (in: _Dest=0x5532a30, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0075.913] wcscat (in: _Dest=0x5532a30, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0075.913] wcscat (in: _Dest=0x5532a30, _Source="GupI.avi" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\GupI.avi") returned="C:\\Users\\FD1HVy\\Desktop\\GupI.avi" [0075.913] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5532a30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf14 [0075.914] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2237a60, ftCreationTime.dwHighDateTime=0x1d5d247, ftLastAccessTime.dwLowDateTime=0x39ca1c10, ftLastAccessTime.dwHighDateTime=0x1d5caf6, ftLastWriteTime.dwLowDateTime=0x39ca1c10, ftLastWriteTime.dwHighDateTime=0x1d5caf6, nFileSizeHigh=0x0, nFileSizeLow=0x65bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="jx2O629A2-48Sx5.mkv", cAlternateFileName="JX2O62~1.MKV")) returned 1 [0075.914] wcscmp (_String1="jx2O629A2-48Sx5.mkv", _String2=".") returned 1 [0075.914] wcscmp (_String1="jx2O629A2-48Sx5.mkv", _String2="..") returned 1 [0075.914] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x5497ce8 [0075.914] wcscpy (in: _Dest=0x5497ce8, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0075.914] wcscat (in: _Dest=0x5497ce8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0075.914] wcscat (in: _Dest=0x5497ce8, _Source="jx2O629A2-48Sx5.mkv" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\jx2O629A2-48Sx5.mkv") returned="C:\\Users\\FD1HVy\\Desktop\\jx2O629A2-48Sx5.mkv" [0075.914] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5497ce8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf18 [0075.914] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce1153b0, ftCreationTime.dwHighDateTime=0x1d5c818, ftLastAccessTime.dwLowDateTime=0x271c6d20, ftLastAccessTime.dwHighDateTime=0x1d5c89e, ftLastWriteTime.dwLowDateTime=0x271c6d20, ftLastWriteTime.dwHighDateTime=0x1d5c89e, nFileSizeHigh=0x0, nFileSizeLow=0x59f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="klYTOSp2nv3qCIKv.m4a", cAlternateFileName="KLYTOS~1.M4A")) returned 1 [0075.915] wcscmp (_String1="klYTOSp2nv3qCIKv.m4a", _String2=".") returned 1 [0075.915] wcscmp (_String1="klYTOSp2nv3qCIKv.m4a", _String2="..") returned 1 [0075.915] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x542b6c8 [0075.915] wcscpy (in: _Dest=0x542b6c8, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0075.915] wcscat (in: _Dest=0x542b6c8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0075.915] wcscat (in: _Dest=0x542b6c8, _Source="klYTOSp2nv3qCIKv.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\klYTOSp2nv3qCIKv.m4a") returned="C:\\Users\\FD1HVy\\Desktop\\klYTOSp2nv3qCIKv.m4a" [0075.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x542b6c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf1c [0075.915] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cb79820, ftCreationTime.dwHighDateTime=0x1d5d1ab, ftLastAccessTime.dwLowDateTime=0x489fa630, ftLastAccessTime.dwHighDateTime=0x1d5d52b, ftLastWriteTime.dwLowDateTime=0x489fa630, ftLastWriteTime.dwHighDateTime=0x1d5d52b, nFileSizeHigh=0x0, nFileSizeLow=0x1fac, dwReserved0=0x0, dwReserved1=0x0, cFileName="L6MUi p.flv", cAlternateFileName="L6MUIP~1.FLV")) returned 1 [0075.915] wcscmp (_String1="L6MUi p.flv", _String2=".") returned 1 [0075.915] wcscmp (_String1="L6MUi p.flv", _String2="..") returned 1 [0075.916] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x55323a0 [0075.916] wcscpy (in: _Dest=0x55323a0, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0075.916] wcscat (in: _Dest=0x55323a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0075.916] wcscat (in: _Dest=0x55323a0, _Source="L6MUi p.flv" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\L6MUi p.flv") returned="C:\\Users\\FD1HVy\\Desktop\\L6MUi p.flv" [0075.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55323a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf20 [0075.916] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85418430, ftCreationTime.dwHighDateTime=0x1d5ca9c, ftLastAccessTime.dwLowDateTime=0x69722640, ftLastAccessTime.dwHighDateTime=0x1d5c9e5, ftLastWriteTime.dwLowDateTime=0x69722640, ftLastWriteTime.dwHighDateTime=0x1d5c9e5, nFileSizeHigh=0x0, nFileSizeLow=0xccc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="lBoLBknioIKFwym.jpg", cAlternateFileName="LBOLBK~1.JPG")) returned 1 [0075.916] wcscmp (_String1="lBoLBknioIKFwym.jpg", _String2=".") returned 1 [0075.916] wcscmp (_String1="lBoLBknioIKFwym.jpg", _String2="..") returned 1 [0075.917] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x5497b08 [0075.917] wcscpy (in: _Dest=0x5497b08, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0075.917] wcscat (in: _Dest=0x5497b08, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0075.917] wcscat (in: _Dest=0x5497b08, _Source="lBoLBknioIKFwym.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lBoLBknioIKFwym.jpg") returned="C:\\Users\\FD1HVy\\Desktop\\lBoLBknioIKFwym.jpg" [0075.917] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5497b08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf24 [0075.917] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3eb67570, ftCreationTime.dwHighDateTime=0x1d5ce9d, ftLastAccessTime.dwLowDateTime=0x350775a0, ftLastAccessTime.dwHighDateTime=0x1d5c85e, ftLastWriteTime.dwLowDateTime=0x350775a0, ftLastWriteTime.dwHighDateTime=0x1d5c85e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lLMKz1W", cAlternateFileName="")) returned 1 [0075.917] wcscmp (_String1="lLMKz1W", _String2=".") returned 1 [0075.917] wcscmp (_String1="lLMKz1W", _String2="..") returned 1 [0075.917] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5bf0 [0075.917] wcscpy (in: _Dest=0x38a5bf0, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0075.917] wcscat (in: _Dest=0x38a5bf0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0075.918] wcscat (in: _Dest=0x38a5bf0, _Source="lLMKz1W" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W" [0075.918] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a5bf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf28 [0075.918] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1229f250, ftCreationTime.dwHighDateTime=0x1d5c93b, ftLastAccessTime.dwLowDateTime=0xd6c60880, ftLastAccessTime.dwHighDateTime=0x1d5c8c6, ftLastWriteTime.dwLowDateTime=0xd6c60880, ftLastWriteTime.dwHighDateTime=0x1d5c8c6, nFileSizeHigh=0x0, nFileSizeLow=0x95ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOTB.wav", cAlternateFileName="")) returned 1 [0075.918] wcscmp (_String1="MOTB.wav", _String2=".") returned 1 [0075.918] wcscmp (_String1="MOTB.wav", _String2="..") returned 1 [0075.918] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x42) returned 0x55327b0 [0075.918] wcscpy (in: _Dest=0x55327b0, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0075.918] wcscat (in: _Dest=0x55327b0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0075.918] wcscat (in: _Dest=0x55327b0, _Source="MOTB.wav" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\MOTB.wav") returned="C:\\Users\\FD1HVy\\Desktop\\MOTB.wav" [0075.918] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55327b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf2c [0075.919] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5d79e70, ftCreationTime.dwHighDateTime=0x1d5d355, ftLastAccessTime.dwLowDateTime=0xac4367b0, ftLastAccessTime.dwHighDateTime=0x1d5cace, ftLastWriteTime.dwLowDateTime=0xac4367b0, ftLastWriteTime.dwHighDateTime=0x1d5cace, nFileSizeHigh=0x0, nFileSizeLow=0x5b27, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q6neBp9.mp3", cAlternateFileName="")) returned 1 [0075.919] wcscmp (_String1="Q6neBp9.mp3", _String2=".") returned 1 [0075.919] wcscmp (_String1="Q6neBp9.mp3", _String2="..") returned 1 [0075.919] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x55320d0 [0075.919] wcscpy (in: _Dest=0x55320d0, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0075.919] wcscat (in: _Dest=0x55320d0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0075.919] wcscat (in: _Dest=0x55320d0, _Source="Q6neBp9.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\Q6neBp9.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\Q6neBp9.mp3" [0075.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55320d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf30 [0075.920] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4e9cdf0, ftCreationTime.dwHighDateTime=0x1d5d157, ftLastAccessTime.dwLowDateTime=0xfc72e570, ftLastAccessTime.dwHighDateTime=0x1d5c9cb, ftLastWriteTime.dwLowDateTime=0xfc72e570, ftLastWriteTime.dwHighDateTime=0x1d5c9cb, nFileSizeHigh=0x0, nFileSizeLow=0x7de9, dwReserved0=0x0, dwReserved1=0x0, cFileName="rSTGLb40SzTKhhfO.gif", cAlternateFileName="RSTGLB~1.GIF")) returned 1 [0075.920] wcscmp (_String1="rSTGLb40SzTKhhfO.gif", _String2=".") returned 1 [0075.920] wcscmp (_String1="rSTGLb40SzTKhhfO.gif", _String2="..") returned 1 [0075.920] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x542bba8 [0075.920] wcscpy (in: _Dest=0x542bba8, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0075.920] wcscat (in: _Dest=0x542bba8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0075.920] wcscat (in: _Dest=0x542bba8, _Source="rSTGLb40SzTKhhfO.gif" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\rSTGLb40SzTKhhfO.gif") returned="C:\\Users\\FD1HVy\\Desktop\\rSTGLb40SzTKhhfO.gif" [0075.920] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x542bba8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf34 [0075.921] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39dd6d70, ftCreationTime.dwHighDateTime=0x1d5cd9d, ftLastAccessTime.dwLowDateTime=0xe4177a20, ftLastAccessTime.dwHighDateTime=0x1d5d0cb, ftLastWriteTime.dwLowDateTime=0xe4177a20, ftLastWriteTime.dwHighDateTime=0x1d5d0cb, nFileSizeHigh=0x0, nFileSizeLow=0x6bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="T6vFQ-8_OByh97WPG8n.mp4", cAlternateFileName="T6VFQ-~1.MP4")) returned 1 [0075.921] wcscmp (_String1="T6vFQ-8_OByh97WPG8n.mp4", _String2=".") returned 1 [0075.921] wcscmp (_String1="T6vFQ-8_OByh97WPG8n.mp4", _String2="..") returned 1 [0075.921] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x542be18 [0075.921] wcscpy (in: _Dest=0x542be18, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0075.921] wcscat (in: _Dest=0x542be18, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0075.921] wcscat (in: _Dest=0x542be18, _Source="T6vFQ-8_OByh97WPG8n.mp4" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\T6vFQ-8_OByh97WPG8n.mp4") returned="C:\\Users\\FD1HVy\\Desktop\\T6vFQ-8_OByh97WPG8n.mp4" [0075.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x542be18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf38 [0075.922] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf65d4d20, ftCreationTime.dwHighDateTime=0x1d5c87b, ftLastAccessTime.dwLowDateTime=0x73572c90, ftLastAccessTime.dwHighDateTime=0x1d5d2c9, ftLastWriteTime.dwLowDateTime=0x73572c90, ftLastWriteTime.dwHighDateTime=0x1d5d2c9, nFileSizeHigh=0x0, nFileSizeLow=0x9f86, dwReserved0=0x0, dwReserved1=0x0, cFileName="TvaZaKnck05q.mp3", cAlternateFileName="TVAZAK~1.MP3")) returned 1 [0075.922] wcscmp (_String1="TvaZaKnck05q.mp3", _String2=".") returned 1 [0075.922] wcscmp (_String1="TvaZaKnck05q.mp3", _String2="..") returned 1 [0075.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x5497c88 [0075.922] wcscpy (in: _Dest=0x5497c88, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0075.922] wcscat (in: _Dest=0x5497c88, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0075.922] wcscat (in: _Dest=0x5497c88, _Source="TvaZaKnck05q.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\TvaZaKnck05q.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\TvaZaKnck05q.mp3" [0075.922] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5497c88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf3c [0075.925] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x817c4720, ftCreationTime.dwHighDateTime=0x1d5d787, ftLastAccessTime.dwLowDateTime=0x4a8b95b0, ftLastAccessTime.dwHighDateTime=0x1d5c90c, ftLastWriteTime.dwLowDateTime=0x4a8b95b0, ftLastWriteTime.dwHighDateTime=0x1d5c90c, nFileSizeHigh=0x0, nFileSizeLow=0x15dac, dwReserved0=0x0, dwReserved1=0x0, cFileName="TWTBg90RE6bO.m4a", cAlternateFileName="TWTBG9~1.M4A")) returned 1 [0075.925] wcscmp (_String1="TWTBg90RE6bO.m4a", _String2=".") returned 1 [0075.925] wcscmp (_String1="TWTBg90RE6bO.m4a", _String2="..") returned 1 [0075.925] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x54978c8 [0075.925] wcscpy (in: _Dest=0x54978c8, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0075.925] wcscat (in: _Dest=0x54978c8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0075.925] wcscat (in: _Dest=0x54978c8, _Source="TWTBg90RE6bO.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\TWTBg90RE6bO.m4a") returned="C:\\Users\\FD1HVy\\Desktop\\TWTBg90RE6bO.m4a" [0075.925] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54978c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf40 [0075.926] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d5dbad0, ftCreationTime.dwHighDateTime=0x1d5cb50, ftLastAccessTime.dwLowDateTime=0x18f647d0, ftLastAccessTime.dwHighDateTime=0x1d5d60d, ftLastWriteTime.dwLowDateTime=0x18f647d0, ftLastWriteTime.dwHighDateTime=0x1d5d60d, nFileSizeHigh=0x0, nFileSizeLow=0x4a83, dwReserved0=0x0, dwReserved1=0x0, cFileName="ugpXae-w 2NSYG_.wav", cAlternateFileName="UGPXAE~1.WAV")) returned 1 [0075.926] wcscmp (_String1="ugpXae-w 2NSYG_.wav", _String2=".") returned 1 [0075.926] wcscmp (_String1="ugpXae-w 2NSYG_.wav", _String2="..") returned 1 [0075.926] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x5497d48 [0075.926] wcscpy (in: _Dest=0x5497d48, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0075.926] wcscat (in: _Dest=0x5497d48, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0075.926] wcscat (in: _Dest=0x5497d48, _Source="ugpXae-w 2NSYG_.wav" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ugpXae-w 2NSYG_.wav") returned="C:\\Users\\FD1HVy\\Desktop\\ugpXae-w 2NSYG_.wav" [0075.926] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5497d48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf44 [0075.927] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7a6c7c0, ftCreationTime.dwHighDateTime=0x1d5d302, ftLastAccessTime.dwLowDateTime=0xab704d10, ftLastAccessTime.dwHighDateTime=0x1d5d05c, ftLastWriteTime.dwLowDateTime=0xab704d10, ftLastWriteTime.dwHighDateTime=0x1d5d05c, nFileSizeHigh=0x0, nFileSizeLow=0x521f, dwReserved0=0x0, dwReserved1=0x0, cFileName="UTlC-SqWY_RcPFlrdtX9.png", cAlternateFileName="UTLC-S~1.PNG")) returned 1 [0075.927] wcscmp (_String1="UTlC-SqWY_RcPFlrdtX9.png", _String2=".") returned 1 [0075.927] wcscmp (_String1="UTlC-SqWY_RcPFlrdtX9.png", _String2="..") returned 1 [0075.927] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x396e300 [0075.927] wcscpy (in: _Dest=0x396e300, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0075.927] wcscat (in: _Dest=0x396e300, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0075.927] wcscat (in: _Dest=0x396e300, _Source="UTlC-SqWY_RcPFlrdtX9.png" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\UTlC-SqWY_RcPFlrdtX9.png") returned="C:\\Users\\FD1HVy\\Desktop\\UTlC-SqWY_RcPFlrdtX9.png" [0075.927] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396e300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf48 [0075.928] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe08e16c0, ftCreationTime.dwHighDateTime=0x1d5d625, ftLastAccessTime.dwLowDateTime=0x58926990, ftLastAccessTime.dwHighDateTime=0x1d5cfdd, ftLastWriteTime.dwLowDateTime=0x58926990, ftLastWriteTime.dwHighDateTime=0x1d5cfdd, nFileSizeHigh=0x0, nFileSizeLow=0x6f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="vdQMRI5Mhw6nRn2.mp3", cAlternateFileName="VDQMRI~1.MP3")) returned 1 [0075.928] wcscmp (_String1="vdQMRI5Mhw6nRn2.mp3", _String2=".") returned 1 [0075.928] wcscmp (_String1="vdQMRI5Mhw6nRn2.mp3", _String2="..") returned 1 [0075.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x5498288 [0075.928] wcscpy (in: _Dest=0x5498288, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0075.928] wcscat (in: _Dest=0x5498288, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0075.928] wcscat (in: _Dest=0x5498288, _Source="vdQMRI5Mhw6nRn2.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\vdQMRI5Mhw6nRn2.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\vdQMRI5Mhw6nRn2.mp3" [0075.928] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5498288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf4c [0075.928] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40cd5550, ftCreationTime.dwHighDateTime=0x1d5c8fc, ftLastAccessTime.dwLowDateTime=0x2289f8b0, ftLastAccessTime.dwHighDateTime=0x1d5ccfc, ftLastWriteTime.dwLowDateTime=0x2289f8b0, ftLastWriteTime.dwHighDateTime=0x1d5ccfc, nFileSizeHigh=0x0, nFileSizeLow=0xae16, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xfbjc ztk.ods", cAlternateFileName="XFBJCZ~1.ODS")) returned 1 [0075.929] wcscmp (_String1="Xfbjc ztk.ods", _String2=".") returned 1 [0075.929] wcscmp (_String1="Xfbjc ztk.ods", _String2="..") returned 1 [0075.929] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x3900258 [0075.929] wcscpy (in: _Dest=0x3900258, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0075.929] wcscat (in: _Dest=0x3900258, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0075.929] wcscat (in: _Dest=0x3900258, _Source="Xfbjc ztk.ods" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\Xfbjc ztk.ods") returned="C:\\Users\\FD1HVy\\Desktop\\Xfbjc ztk.ods" [0075.929] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3900258, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf50 [0075.929] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c9e5c00, ftCreationTime.dwHighDateTime=0x1d5d386, ftLastAccessTime.dwLowDateTime=0x199485f0, ftLastAccessTime.dwHighDateTime=0x1d5cd41, ftLastWriteTime.dwLowDateTime=0x199485f0, ftLastWriteTime.dwHighDateTime=0x1d5cd41, nFileSizeHigh=0x0, nFileSizeLow=0x112bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="YZDkWQoGFHYXs.gif", cAlternateFileName="YZDKWQ~1.GIF")) returned 1 [0075.930] wcscmp (_String1="YZDkWQoGFHYXs.gif", _String2=".") returned 1 [0075.930] wcscmp (_String1="YZDkWQoGFHYXs.gif", _String2="..") returned 1 [0075.930] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x5497ec8 [0075.930] wcscpy (in: _Dest=0x5497ec8, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0075.930] wcscat (in: _Dest=0x5497ec8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0075.930] wcscat (in: _Dest=0x5497ec8, _Source="YZDkWQoGFHYXs.gif" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\YZDkWQoGFHYXs.gif") returned="C:\\Users\\FD1HVy\\Desktop\\YZDkWQoGFHYXs.gif" [0075.930] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5497ec8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf54 [0075.930] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c9e5c00, ftCreationTime.dwHighDateTime=0x1d5d386, ftLastAccessTime.dwLowDateTime=0x199485f0, ftLastAccessTime.dwHighDateTime=0x1d5cd41, ftLastWriteTime.dwLowDateTime=0x199485f0, ftLastWriteTime.dwHighDateTime=0x1d5cd41, nFileSizeHigh=0x0, nFileSizeLow=0x112bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="YZDkWQoGFHYXs.gif", cAlternateFileName="YZDKWQ~1.GIF")) returned 0 [0075.930] FindClose (in: hFindFile=0x389eb80 | out: hFindFile=0x389eb80) returned 1 [0075.931] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5418938) returned 1 [0075.931] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444e80) returned 1 [0075.931] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e63c0) returned 1 Thread: id = 444 os_tid = 0x16c4 [0072.506] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x38) returned 0x5444f40 [0072.506] wcscpy (in: _Dest=0x5444f40, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0072.506] wcscat (in: _Dest=0x5444f40, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0072.506] wcscat (in: _Dest=0x5444f40, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\*") returned="C:\\Users\\FD1HVy\\Documents\\*" [0072.506] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5418e08 [0072.506] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x39b7fbfc, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39b7fbfc, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ebc0 [0075.232] wcscmp (_String1=".", _String2=".") returned 0 [0075.232] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x39b7fbfc, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39b7fbfc, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.232] wcscmp (_String1="..", _String2=".") returned 1 [0075.232] wcscmp (_String1="..", _String2="..") returned 0 [0075.232] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2bf3cfa0, ftCreationTime.dwHighDateTime=0x1d5d0be, ftLastAccessTime.dwLowDateTime=0x25884500, ftLastAccessTime.dwHighDateTime=0x1d5d3d5, ftLastWriteTime.dwLowDateTime=0x25884500, ftLastWriteTime.dwHighDateTime=0x1d5d3d5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0qZ1VEn", cAlternateFileName="")) returned 1 [0075.232] wcscmp (_String1="0qZ1VEn", _String2=".") returned 1 [0075.233] wcscmp (_String1="0qZ1VEn", _String2="..") returned 1 [0075.233] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x5442f60 [0075.233] wcscpy (in: _Dest=0x5442f60, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0075.233] wcscat (in: _Dest=0x5442f60, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0075.233] wcscat (in: _Dest=0x5442f60, _Source="0qZ1VEn" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn" [0075.875] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5442f60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcb8 [0075.876] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8eac8210, ftCreationTime.dwHighDateTime=0x1d56d02, ftLastAccessTime.dwLowDateTime=0xd9fb6f50, ftLastAccessTime.dwHighDateTime=0x1d59a76, ftLastWriteTime.dwLowDateTime=0xd9fb6f50, ftLastWriteTime.dwHighDateTime=0x1d59a76, nFileSizeHigh=0x0, nFileSizeLow=0x124cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="5d8j8.xlsx", cAlternateFileName="5D8J8~1.XLS")) returned 1 [0075.876] wcscmp (_String1="5d8j8.xlsx", _String2=".") returned 1 [0075.876] wcscmp (_String1="5d8j8.xlsx", _String2="..") returned 1 [0075.876] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x3900570 [0075.876] wcscpy (in: _Dest=0x3900570, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0075.876] wcscat (in: _Dest=0x3900570, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0075.876] wcscat (in: _Dest=0x3900570, _Source="5d8j8.xlsx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\5d8j8.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\5d8j8.xlsx" [0075.876] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3900570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe80 [0075.877] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecfdeb0, ftCreationTime.dwHighDateTime=0x1d587fc, ftLastAccessTime.dwLowDateTime=0xe22a5720, ftLastAccessTime.dwHighDateTime=0x1d5b332, ftLastWriteTime.dwLowDateTime=0xe22a5720, ftLastWriteTime.dwHighDateTime=0x1d5b332, nFileSizeHigh=0x0, nFileSizeLow=0x12bda, dwReserved0=0x0, dwReserved1=0x0, cFileName="7fYhDgrk4Oflzx.pptx", cAlternateFileName="7FYHDG~1.PPT")) returned 1 [0075.877] wcscmp (_String1="7fYhDgrk4Oflzx.pptx", _String2=".") returned 1 [0075.877] wcscmp (_String1="7fYhDgrk4Oflzx.pptx", _String2="..") returned 1 [0075.877] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x38fd340 [0075.877] wcscpy (in: _Dest=0x38fd340, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0075.877] wcscat (in: _Dest=0x38fd340, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0075.877] wcscat (in: _Dest=0x38fd340, _Source="7fYhDgrk4Oflzx.pptx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\7fYhDgrk4Oflzx.pptx") returned="C:\\Users\\FD1HVy\\Documents\\7fYhDgrk4Oflzx.pptx" [0075.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fd340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe84 [0075.878] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbd85d0, ftCreationTime.dwHighDateTime=0x1d5a3ff, ftLastAccessTime.dwLowDateTime=0xa550550, ftLastAccessTime.dwHighDateTime=0x1d58364, ftLastWriteTime.dwLowDateTime=0xa550550, ftLastWriteTime.dwHighDateTime=0x1d58364, nFileSizeHigh=0x0, nFileSizeLow=0x12fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="B7J1.docx", cAlternateFileName="B7J1~1.DOC")) returned 1 [0075.878] wcscmp (_String1="B7J1.docx", _String2=".") returned 1 [0075.878] wcscmp (_String1="B7J1.docx", _String2="..") returned 1 [0075.878] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x55328a0 [0075.878] wcscpy (in: _Dest=0x55328a0, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0075.878] wcscat (in: _Dest=0x55328a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0075.878] wcscat (in: _Dest=0x55328a0, _Source="B7J1.docx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\B7J1.docx") returned="C:\\Users\\FD1HVy\\Documents\\B7J1.docx" [0075.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55328a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe88 [0075.879] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa017010, ftCreationTime.dwHighDateTime=0x1d5cc17, ftLastAccessTime.dwLowDateTime=0x253418d0, ftLastAccessTime.dwHighDateTime=0x1d5d1d8, ftLastWriteTime.dwLowDateTime=0x253418d0, ftLastWriteTime.dwHighDateTime=0x1d5d1d8, nFileSizeHigh=0x0, nFileSizeLow=0xb643, dwReserved0=0x0, dwReserved1=0x0, cFileName="BhVG8sEYuHI e.xlsx", cAlternateFileName="BHVG8S~1.XLS")) returned 1 [0075.879] wcscmp (_String1="BhVG8sEYuHI e.xlsx", _String2=".") returned 1 [0075.879] wcscmp (_String1="BhVG8sEYuHI e.xlsx", _String2="..") returned 1 [0075.879] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x38fd3a8 [0075.879] wcscpy (in: _Dest=0x38fd3a8, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0075.879] wcscat (in: _Dest=0x38fd3a8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0075.879] wcscat (in: _Dest=0x38fd3a8, _Source="BhVG8sEYuHI e.xlsx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\BhVG8sEYuHI e.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\BhVG8sEYuHI e.xlsx" [0075.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fd3a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe8c [0075.879] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c403970, ftCreationTime.dwHighDateTime=0x1d5789b, ftLastAccessTime.dwLowDateTime=0xc0fc4820, ftLastAccessTime.dwHighDateTime=0x1d5734e, ftLastWriteTime.dwLowDateTime=0xc0fc4820, ftLastWriteTime.dwHighDateTime=0x1d5734e, nFileSizeHigh=0x0, nFileSizeLow=0x1bef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOdetRenpdxKb6QC1UrV.xlsx", cAlternateFileName="BODETR~1.XLS")) returned 1 [0075.879] wcscmp (_String1="BOdetRenpdxKb6QC1UrV.xlsx", _String2=".") returned 1 [0075.879] wcscmp (_String1="BOdetRenpdxKb6QC1UrV.xlsx", _String2="..") returned 1 [0075.879] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x68) returned 0x396e1b0 [0075.879] wcscpy (in: _Dest=0x396e1b0, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0075.880] wcscat (in: _Dest=0x396e1b0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0075.880] wcscat (in: _Dest=0x396e1b0, _Source="BOdetRenpdxKb6QC1UrV.xlsx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\BOdetRenpdxKb6QC1UrV.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\BOdetRenpdxKb6QC1UrV.xlsx" [0075.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396e1b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe90 [0075.880] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd8cc10, ftCreationTime.dwHighDateTime=0x1d5656c, ftLastAccessTime.dwLowDateTime=0x631b9940, ftLastAccessTime.dwHighDateTime=0x1d57844, ftLastWriteTime.dwLowDateTime=0x631b9940, ftLastWriteTime.dwHighDateTime=0x1d57844, nFileSizeHigh=0x0, nFileSizeLow=0x76f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BSQC9Dr4kg9Tb2.docx", cAlternateFileName="BSQC9D~1.DOC")) returned 1 [0075.880] wcscmp (_String1="BSQC9Dr4kg9Tb2.docx", _String2=".") returned 1 [0075.880] wcscmp (_String1="BSQC9Dr4kg9Tb2.docx", _String2="..") returned 1 [0075.880] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x38fd478 [0075.880] wcscpy (in: _Dest=0x38fd478, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0075.880] wcscat (in: _Dest=0x38fd478, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0075.880] wcscat (in: _Dest=0x38fd478, _Source="BSQC9Dr4kg9Tb2.docx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\BSQC9Dr4kg9Tb2.docx") returned="C:\\Users\\FD1HVy\\Documents\\BSQC9Dr4kg9Tb2.docx" [0075.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fd478, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe94 [0075.881] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9daec75b, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb", cAlternateFileName="DATABA~1.ACC")) returned 1 [0075.881] wcscmp (_String1="Database1.accdb", _String2=".") returned 1 [0075.881] wcscmp (_String1="Database1.accdb", _String2="..") returned 1 [0075.881] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x5497f88 [0075.881] wcscpy (in: _Dest=0x5497f88, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0075.881] wcscat (in: _Dest=0x5497f88, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0075.881] wcscat (in: _Dest=0x5497f88, _Source="Database1.accdb" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Database1.accdb") returned="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" [0075.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5497f88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe98 [0075.882] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0075.882] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0075.882] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0075.882] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd199f1b0, ftCreationTime.dwHighDateTime=0x1d54e68, ftLastAccessTime.dwLowDateTime=0x68d46b80, ftLastAccessTime.dwHighDateTime=0x1d5b27f, ftLastWriteTime.dwLowDateTime=0x68d46b80, ftLastWriteTime.dwHighDateTime=0x1d5b27f, nFileSizeHigh=0x0, nFileSizeLow=0x65ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="hDFe0_c9uuJxXHVlQ.xlsx", cAlternateFileName="HDFE0_~1.XLS")) returned 1 [0075.882] wcscmp (_String1="hDFe0_c9uuJxXHVlQ.xlsx", _String2=".") returned 1 [0075.882] wcscmp (_String1="hDFe0_c9uuJxXHVlQ.xlsx", _String2="..") returned 1 [0075.882] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x396e220 [0075.882] wcscpy (in: _Dest=0x396e220, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0075.882] wcscat (in: _Dest=0x396e220, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0075.882] wcscat (in: _Dest=0x396e220, _Source="hDFe0_c9uuJxXHVlQ.xlsx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\hDFe0_c9uuJxXHVlQ.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\hDFe0_c9uuJxXHVlQ.xlsx" [0075.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396e220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe9c [0075.883] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e34cf0, ftCreationTime.dwHighDateTime=0x1d5bba5, ftLastAccessTime.dwLowDateTime=0x26419760, ftLastAccessTime.dwHighDateTime=0x1d55538, ftLastWriteTime.dwLowDateTime=0x26419760, ftLastWriteTime.dwHighDateTime=0x1d55538, nFileSizeHigh=0x0, nFileSizeLow=0xa76e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LgDLYrs.docx", cAlternateFileName="LGDLYR~1.DOC")) returned 1 [0075.883] wcscmp (_String1="LgDLYrs.docx", _String2=".") returned 1 [0075.883] wcscmp (_String1="LgDLYrs.docx", _String2="..") returned 1 [0075.883] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x39002b0 [0075.883] wcscpy (in: _Dest=0x39002b0, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0075.883] wcscat (in: _Dest=0x39002b0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0075.883] wcscat (in: _Dest=0x39002b0, _Source="LgDLYrs.docx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\LgDLYrs.docx") returned="C:\\Users\\FD1HVy\\Documents\\LgDLYrs.docx" [0075.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x39002b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xea0 [0075.884] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0075.884] wcscmp (_String1="My Music", _String2=".") returned 1 [0075.884] wcscmp (_String1="My Music", _String2="..") returned 1 [0075.884] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x46) returned 0x55324e0 [0075.884] wcscpy (in: _Dest=0x55324e0, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0075.884] wcscat (in: _Dest=0x55324e0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0075.884] wcscat (in: _Dest=0x55324e0, _Source="My Music" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Music") returned="C:\\Users\\FD1HVy\\Documents\\My Music" [0075.884] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55324e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xea4 [0075.885] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0075.885] wcscmp (_String1="My Pictures", _String2=".") returned 1 [0075.885] wcscmp (_String1="My Pictures", _String2="..") returned 1 [0075.885] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x39004c0 [0075.885] wcscpy (in: _Dest=0x39004c0, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0075.885] wcscat (in: _Dest=0x39004c0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0075.885] wcscat (in: _Dest=0x39004c0, _Source="My Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Pictures") returned="C:\\Users\\FD1HVy\\Documents\\My Pictures" [0075.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x39004c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xea8 [0075.886] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0075.886] wcscmp (_String1="My Shapes", _String2=".") returned 1 [0075.886] wcscmp (_String1="My Shapes", _String2="..") returned 1 [0075.886] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x5532990 [0075.886] wcscpy (in: _Dest=0x5532990, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0075.886] wcscat (in: _Dest=0x5532990, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0075.886] wcscat (in: _Dest=0x5532990, _Source="My Shapes" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes" [0075.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5532990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeac [0075.887] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0075.887] wcscmp (_String1="My Videos", _String2=".") returned 1 [0075.887] wcscmp (_String1="My Videos", _String2="..") returned 1 [0075.887] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x55329e0 [0075.887] wcscpy (in: _Dest=0x55329e0, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0075.887] wcscat (in: _Dest=0x55329e0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0075.887] wcscat (in: _Dest=0x55329e0, _Source="My Videos" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Videos") returned="C:\\Users\\FD1HVy\\Documents\\My Videos" [0075.887] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55329e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeb0 [0075.888] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96bffa30, ftCreationTime.dwHighDateTime=0x1d585e0, ftLastAccessTime.dwLowDateTime=0x6ef89440, ftLastAccessTime.dwHighDateTime=0x1d563b6, ftLastWriteTime.dwLowDateTime=0x6ef89440, ftLastWriteTime.dwHighDateTime=0x1d563b6, nFileSizeHigh=0x0, nFileSizeLow=0xd753, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NgaH9-S28Td4CjdpZ.docx", cAlternateFileName="NGAH9-~1.DOC")) returned 1 [0075.888] wcscmp (_String1="NgaH9-S28Td4CjdpZ.docx", _String2=".") returned 1 [0075.888] wcscmp (_String1="NgaH9-S28Td4CjdpZ.docx", _String2="..") returned 1 [0075.888] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x396dce0 [0075.888] wcscpy (in: _Dest=0x396dce0, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0075.888] wcscat (in: _Dest=0x396dce0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0075.888] wcscat (in: _Dest=0x396dce0, _Source="NgaH9-S28Td4CjdpZ.docx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\NgaH9-S28Td4CjdpZ.docx") returned="C:\\Users\\FD1HVy\\Documents\\NgaH9-S28Td4CjdpZ.docx" [0075.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396dce0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeb4 [0075.889] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0075.889] wcscmp (_String1="Outlook Files", _String2=".") returned 1 [0075.889] wcscmp (_String1="Outlook Files", _String2="..") returned 1 [0075.889] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x3900200 [0075.889] wcscpy (in: _Dest=0x3900200, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0075.889] wcscat (in: _Dest=0x3900200, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0075.889] wcscat (in: _Dest=0x3900200, _Source="Outlook Files" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Outlook Files") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files" [0075.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3900200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeb8 [0075.890] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1943dc0, ftCreationTime.dwHighDateTime=0x1d5ac93, ftLastAccessTime.dwLowDateTime=0x49bc23d0, ftLastAccessTime.dwHighDateTime=0x1d589aa, ftLastWriteTime.dwLowDateTime=0x49bc23d0, ftLastWriteTime.dwHighDateTime=0x1d589aa, nFileSizeHigh=0x0, nFileSizeLow=0x1839e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="oXptnEALZNCIx7qNkkii.xlsx", cAlternateFileName="OXPTNE~1.XLS")) returned 1 [0075.890] wcscmp (_String1="oXptnEALZNCIx7qNkkii.xlsx", _String2=".") returned 1 [0075.890] wcscmp (_String1="oXptnEALZNCIx7qNkkii.xlsx", _String2="..") returned 1 [0075.890] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x68) returned 0x396dd50 [0075.890] wcscpy (in: _Dest=0x396dd50, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0075.890] wcscat (in: _Dest=0x396dd50, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0075.890] wcscat (in: _Dest=0x396dd50, _Source="oXptnEALZNCIx7qNkkii.xlsx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\oXptnEALZNCIx7qNkkii.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\oXptnEALZNCIx7qNkkii.xlsx" [0075.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396dd50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xebc [0075.890] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecec5c80, ftCreationTime.dwHighDateTime=0x1d5d1fa, ftLastAccessTime.dwLowDateTime=0x69baadf0, ftLastAccessTime.dwHighDateTime=0x1d5d7fc, ftLastWriteTime.dwLowDateTime=0x69baadf0, ftLastWriteTime.dwHighDateTime=0x1d5d7fc, nFileSizeHigh=0x0, nFileSizeLow=0x14bf2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pXaOgk9GE1upWx.csv", cAlternateFileName="PXAOGK~1.CSV")) returned 1 [0075.890] wcscmp (_String1="pXaOgk9GE1upWx.csv", _String2=".") returned 1 [0075.890] wcscmp (_String1="pXaOgk9GE1upWx.csv", _String2="..") returned 1 [0075.890] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x38fd4e0 [0075.891] wcscpy (in: _Dest=0x38fd4e0, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0075.891] wcscat (in: _Dest=0x38fd4e0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0075.891] wcscat (in: _Dest=0x38fd4e0, _Source="pXaOgk9GE1upWx.csv" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\pXaOgk9GE1upWx.csv") returned="C:\\Users\\FD1HVy\\Documents\\pXaOgk9GE1upWx.csv" [0075.891] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fd4e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xec0 [0075.891] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0384410, ftCreationTime.dwHighDateTime=0x1d560a5, ftLastAccessTime.dwLowDateTime=0x2dadfa80, ftLastAccessTime.dwHighDateTime=0x1d5a352, ftLastWriteTime.dwLowDateTime=0x2dadfa80, ftLastWriteTime.dwHighDateTime=0x1d5a352, nFileSizeHigh=0x0, nFileSizeLow=0xd9f3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Q4_PNzrN.pptx", cAlternateFileName="Q4_PNZ~1.PPT")) returned 1 [0075.891] wcscmp (_String1="Q4_PNzrN.pptx", _String2=".") returned 1 [0075.891] wcscmp (_String1="Q4_PNzrN.pptx", _String2="..") returned 1 [0075.891] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x3900518 [0075.891] wcscpy (in: _Dest=0x3900518, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0075.892] wcscat (in: _Dest=0x3900518, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0075.892] wcscat (in: _Dest=0x3900518, _Source="Q4_PNzrN.pptx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Q4_PNzrN.pptx") returned="C:\\Users\\FD1HVy\\Documents\\Q4_PNzrN.pptx" [0075.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3900518, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xec4 [0075.893] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc58676e0, ftCreationTime.dwHighDateTime=0x1d5d735, ftLastAccessTime.dwLowDateTime=0xe355d430, ftLastAccessTime.dwHighDateTime=0x1d5c9ee, ftLastWriteTime.dwLowDateTime=0xe355d430, ftLastWriteTime.dwHighDateTime=0x1d5c9ee, nFileSizeHigh=0x0, nFileSizeLow=0xa437, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="R4QR.xls", cAlternateFileName="")) returned 1 [0075.893] wcscmp (_String1="R4QR.xls", _String2=".") returned 1 [0075.893] wcscmp (_String1="R4QR.xls", _String2="..") returned 1 [0075.893] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x46) returned 0x55326c0 [0075.893] wcscpy (in: _Dest=0x55326c0, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0075.893] wcscat (in: _Dest=0x55326c0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0075.893] wcscat (in: _Dest=0x55326c0, _Source="R4QR.xls" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\R4QR.xls") returned="C:\\Users\\FD1HVy\\Documents\\R4QR.xls" [0075.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55326c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xec8 [0075.894] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a26fea0, ftCreationTime.dwHighDateTime=0x1d57533, ftLastAccessTime.dwLowDateTime=0x66287f0, ftLastAccessTime.dwHighDateTime=0x1d5b876, ftLastWriteTime.dwLowDateTime=0x66287f0, ftLastWriteTime.dwHighDateTime=0x1d5b876, nFileSizeHigh=0x0, nFileSizeLow=0xd1c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ThmgR4UeY.pptx", cAlternateFileName="THMGR4~1.PPT")) returned 1 [0075.894] wcscmp (_String1="ThmgR4UeY.pptx", _String2=".") returned 1 [0075.894] wcscmp (_String1="ThmgR4UeY.pptx", _String2="..") returned 1 [0075.894] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x54983a8 [0075.894] wcscpy (in: _Dest=0x54983a8, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0075.894] wcscat (in: _Dest=0x54983a8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0075.894] wcscat (in: _Dest=0x54983a8, _Source="ThmgR4UeY.pptx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\ThmgR4UeY.pptx") returned="C:\\Users\\FD1HVy\\Documents\\ThmgR4UeY.pptx" [0075.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54983a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xecc [0075.895] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b766ec0, ftCreationTime.dwHighDateTime=0x1d5d3b7, ftLastAccessTime.dwLowDateTime=0xb7617a90, ftLastAccessTime.dwHighDateTime=0x1d5540b, ftLastWriteTime.dwLowDateTime=0xb7617a90, ftLastWriteTime.dwHighDateTime=0x1d5540b, nFileSizeHigh=0x0, nFileSizeLow=0x84da, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="uOFkECuPU.xlsx", cAlternateFileName="UOFKEC~1.XLS")) returned 1 [0075.895] wcscmp (_String1="uOFkECuPU.xlsx", _String2=".") returned 1 [0075.895] wcscmp (_String1="uOFkECuPU.xlsx", _String2="..") returned 1 [0075.895] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x5497aa8 [0075.895] wcscpy (in: _Dest=0x5497aa8, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0075.895] wcscat (in: _Dest=0x5497aa8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0075.895] wcscat (in: _Dest=0x5497aa8, _Source="uOFkECuPU.xlsx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\uOFkECuPU.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\uOFkECuPU.xlsx" [0075.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5497aa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xed0 [0075.895] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66b14630, ftCreationTime.dwHighDateTime=0x1d5cf43, ftLastAccessTime.dwLowDateTime=0x438224d0, ftLastAccessTime.dwHighDateTime=0x1d5cb5c, ftLastWriteTime.dwLowDateTime=0x438224d0, ftLastWriteTime.dwHighDateTime=0x1d5cb5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UoJQqpc-TPlhHkjZqD", cAlternateFileName="UOJQQP~1")) returned 1 [0075.895] wcscmp (_String1="UoJQqpc-TPlhHkjZqD", _String2=".") returned 1 [0075.895] wcscmp (_String1="UoJQqpc-TPlhHkjZqD", _String2="..") returned 1 [0075.895] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x38fd5b0 [0075.896] wcscpy (in: _Dest=0x38fd5b0, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0075.896] wcscat (in: _Dest=0x38fd5b0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0075.896] wcscat (in: _Dest=0x38fd5b0, _Source="UoJQqpc-TPlhHkjZqD" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD") returned="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD" [0075.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38fd5b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xed4 [0075.896] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0c6f2a0, ftCreationTime.dwHighDateTime=0x1d5b77c, ftLastAccessTime.dwLowDateTime=0xe396f5b0, ftLastAccessTime.dwHighDateTime=0x1d5ceed, ftLastWriteTime.dwLowDateTime=0xe396f5b0, ftLastWriteTime.dwHighDateTime=0x1d5ceed, nFileSizeHigh=0x0, nFileSizeLow=0xdbe0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XIuM.docx", cAlternateFileName="XIUM~1.DOC")) returned 1 [0075.896] wcscmp (_String1="XIuM.docx", _String2=".") returned 1 [0075.896] wcscmp (_String1="XIuM.docx", _String2="..") returned 1 [0075.896] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x5532440 [0075.897] wcscpy (in: _Dest=0x5532440, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0075.897] wcscat (in: _Dest=0x5532440, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0075.897] wcscat (in: _Dest=0x5532440, _Source="XIuM.docx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\XIuM.docx") returned="C:\\Users\\FD1HVy\\Documents\\XIuM.docx" [0075.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5532440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xed8 [0075.897] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e0f440, ftCreationTime.dwHighDateTime=0x1d54dac, ftLastAccessTime.dwLowDateTime=0xc5fccc50, ftLastAccessTime.dwHighDateTime=0x1d580e6, ftLastWriteTime.dwLowDateTime=0xc5fccc50, ftLastWriteTime.dwHighDateTime=0x1d580e6, nFileSizeHigh=0x0, nFileSizeLow=0x4013, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YGcP76-KczLAPYEvPx.pptx", cAlternateFileName="YGCP76~1.PPT")) returned 1 [0075.897] wcscmp (_String1="YGcP76-KczLAPYEvPx.pptx", _String2=".") returned 1 [0075.897] wcscmp (_String1="YGcP76-KczLAPYEvPx.pptx", _String2="..") returned 1 [0075.897] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x396d7a0 [0075.897] wcscpy (in: _Dest=0x396d7a0, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0075.897] wcscat (in: _Dest=0x396d7a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0075.897] wcscat (in: _Dest=0x396d7a0, _Source="YGcP76-KczLAPYEvPx.pptx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\YGcP76-KczLAPYEvPx.pptx") returned="C:\\Users\\FD1HVy\\Documents\\YGcP76-KczLAPYEvPx.pptx" [0075.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396d7a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xedc [0075.898] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd761ef50, ftCreationTime.dwHighDateTime=0x1d54b0f, ftLastAccessTime.dwLowDateTime=0xb7845530, ftLastAccessTime.dwHighDateTime=0x1d5a918, ftLastWriteTime.dwLowDateTime=0xb7845530, ftLastWriteTime.dwHighDateTime=0x1d5a918, nFileSizeHigh=0x0, nFileSizeLow=0x145c9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Z B5wY iscDO9GFwsKpM.pptx", cAlternateFileName="ZB5WYI~1.PPT")) returned 1 [0075.898] wcscmp (_String1="Z B5wY iscDO9GFwsKpM.pptx", _String2=".") returned 1 [0075.898] wcscmp (_String1="Z B5wY iscDO9GFwsKpM.pptx", _String2="..") returned 1 [0075.898] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x68) returned 0x396e290 [0075.898] wcscpy (in: _Dest=0x396e290, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0075.898] wcscat (in: _Dest=0x396e290, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0075.898] wcscat (in: _Dest=0x396e290, _Source="Z B5wY iscDO9GFwsKpM.pptx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Z B5wY iscDO9GFwsKpM.pptx") returned="C:\\Users\\FD1HVy\\Documents\\Z B5wY iscDO9GFwsKpM.pptx" [0075.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396e290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xee0 [0075.899] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd761ef50, ftCreationTime.dwHighDateTime=0x1d54b0f, ftLastAccessTime.dwLowDateTime=0xb7845530, ftLastAccessTime.dwHighDateTime=0x1d5a918, ftLastWriteTime.dwLowDateTime=0xb7845530, ftLastWriteTime.dwHighDateTime=0x1d5a918, nFileSizeHigh=0x0, nFileSizeLow=0x145c9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Z B5wY iscDO9GFwsKpM.pptx", cAlternateFileName="ZB5WYI~1.PPT")) returned 0 [0075.899] FindClose (in: hFindFile=0x389ebc0 | out: hFindFile=0x389ebc0) returned 1 [0075.899] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5418e08) returned 1 [0075.899] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444f40) returned 1 [0075.899] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445180) returned 1 Thread: id = 445 os_tid = 0x16c8 [0072.507] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x38) returned 0x5444f80 [0072.507] wcscpy (in: _Dest=0x5444f80, _Source="C:\\Users\\FD1HVy\\Downloads" | out: _Dest="C:\\Users\\FD1HVy\\Downloads") returned="C:\\Users\\FD1HVy\\Downloads" [0072.507] wcscat (in: _Dest=0x5444f80, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Downloads\\") returned="C:\\Users\\FD1HVy\\Downloads\\" [0072.507] wcscat (in: _Dest=0x5444f80, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Downloads\\*") returned="C:\\Users\\FD1HVy\\Downloads\\*" [0072.507] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5419070 [0072.507] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\*", lpFindFileData=0x5419070 | out: lpFindFileData=0x5419070*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ec80 [0075.233] wcscmp (_String1=".", _String2=".") returned 0 [0075.233] FindNextFileW (in: hFindFile=0x389ec80, lpFindFileData=0x5419070 | out: lpFindFileData=0x5419070*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.233] wcscmp (_String1="..", _String2=".") returned 1 [0075.233] wcscmp (_String1="..", _String2="..") returned 0 [0075.234] FindNextFileW (in: hFindFile=0x389ec80, lpFindFileData=0x5419070 | out: lpFindFileData=0x5419070*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0075.234] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0075.234] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0075.234] FindNextFileW (in: hFindFile=0x389ec80, lpFindFileData=0x5419070 | out: lpFindFileData=0x5419070*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0075.234] FindClose (in: hFindFile=0x389ec80 | out: hFindFile=0x389ec80) returned 1 [0075.234] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5419070) returned 1 [0075.234] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444f80) returned 1 [0075.234] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444f00) returned 1 Thread: id = 446 os_tid = 0x16cc [0072.507] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x38) returned 0x5444fc0 [0072.508] wcscpy (in: _Dest=0x5444fc0, _Source="C:\\Users\\FD1HVy\\Favorites" | out: _Dest="C:\\Users\\FD1HVy\\Favorites") returned="C:\\Users\\FD1HVy\\Favorites" [0072.508] wcscat (in: _Dest=0x5444fc0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Favorites\\") returned="C:\\Users\\FD1HVy\\Favorites\\" [0072.508] wcscat (in: _Dest=0x5444fc0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Favorites\\*") returned="C:\\Users\\FD1HVy\\Favorites\\*" [0072.508] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54192d8 [0072.508] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\*", lpFindFileData=0x54192d8 | out: lpFindFileData=0x54192d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba12f0 [0079.763] wcscmp (_String1=".", _String2=".") returned 0 [0079.763] FindNextFileW (in: hFindFile=0x5ba12f0, lpFindFileData=0x54192d8 | out: lpFindFileData=0x54192d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.763] wcscmp (_String1="..", _String2=".") returned 1 [0079.763] wcscmp (_String1="..", _String2="..") returned 0 [0079.763] FindNextFileW (in: hFindFile=0x5ba12f0, lpFindFileData=0x54192d8 | out: lpFindFileData=0x54192d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43598c8e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43b9f870, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x43b9f870, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bing.url", cAlternateFileName="")) returned 1 [0079.763] wcscmp (_String1="Bing.url", _String2=".") returned 1 [0079.763] wcscmp (_String1="Bing.url", _String2="..") returned 1 [0079.763] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x46) returned 0x5eebf98 [0079.763] wcscpy (in: _Dest=0x5eebf98, _Source="C:\\Users\\FD1HVy\\Favorites" | out: _Dest="C:\\Users\\FD1HVy\\Favorites") returned="C:\\Users\\FD1HVy\\Favorites" [0079.763] wcscat (in: _Dest=0x5eebf98, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Favorites\\") returned="C:\\Users\\FD1HVy\\Favorites\\" [0079.763] wcscat (in: _Dest=0x5eebf98, _Source="Bing.url" | out: _Dest="C:\\Users\\FD1HVy\\Favorites\\Bing.url") returned="C:\\Users\\FD1HVy\\Favorites\\Bing.url" [0080.535] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5eebf98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcac [0080.536] FindNextFileW (in: hFindFile=0x5ba12f0, lpFindFileData=0x54192d8 | out: lpFindFileData=0x54192d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0080.536] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0080.536] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0080.536] FindNextFileW (in: hFindFile=0x5ba12f0, lpFindFileData=0x54192d8 | out: lpFindFileData=0x54192d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0080.536] wcscmp (_String1="Links", _String2=".") returned 1 [0080.536] wcscmp (_String1="Links", _String2="..") returned 1 [0080.536] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8018 [0080.536] wcscpy (in: _Dest=0x5ba8018, _Source="C:\\Users\\FD1HVy\\Favorites" | out: _Dest="C:\\Users\\FD1HVy\\Favorites") returned="C:\\Users\\FD1HVy\\Favorites" [0080.536] wcscat (in: _Dest=0x5ba8018, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Favorites\\") returned="C:\\Users\\FD1HVy\\Favorites\\" [0080.536] wcscat (in: _Dest=0x5ba8018, _Source="Links" | out: _Dest="C:\\Users\\FD1HVy\\Favorites\\Links") returned="C:\\Users\\FD1HVy\\Favorites\\Links" [0080.536] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba8018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0 [0080.537] FindNextFileW (in: hFindFile=0x5ba12f0, lpFindFileData=0x54192d8 | out: lpFindFileData=0x54192d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 0 [0080.537] FindClose (in: hFindFile=0x5ba12f0 | out: hFindFile=0x5ba12f0) returned 1 [0080.537] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54192d8) returned 1 [0080.537] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444fc0) returned 1 [0080.537] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444b40) returned 1 Thread: id = 447 os_tid = 0x16d0 [0072.508] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x30) returned 0x38cf848 [0072.508] wcscpy (in: _Dest=0x38cf848, _Source="C:\\Users\\FD1HVy\\Links" | out: _Dest="C:\\Users\\FD1HVy\\Links") returned="C:\\Users\\FD1HVy\\Links" [0072.508] wcscat (in: _Dest=0x38cf848, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Links\\") returned="C:\\Users\\FD1HVy\\Links\\" [0072.508] wcscat (in: _Dest=0x38cf848, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Links\\*") returned="C:\\Users\\FD1HVy\\Links\\*" [0072.508] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542d4c8 [0072.508] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\*", lpFindFileData=0x542d4c8 | out: lpFindFileData=0x542d4c8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba1330 [0079.763] wcscmp (_String1=".", _String2=".") returned 0 [0079.763] FindNextFileW (in: hFindFile=0x5ba1330, lpFindFileData=0x542d4c8 | out: lpFindFileData=0x542d4c8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.763] wcscmp (_String1="..", _String2=".") returned 1 [0079.763] wcscmp (_String1="..", _String2="..") returned 0 [0079.763] FindNextFileW (in: hFindFile=0x5ba1330, lpFindFileData=0x542d4c8 | out: lpFindFileData=0x542d4c8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcee4480b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0079.763] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0079.763] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0079.764] FindNextFileW (in: hFindFile=0x5ba1330, lpFindFileData=0x542d4c8 | out: lpFindFileData=0x542d4c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4428f2bb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4428f2bb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce90d59d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0079.764] wcscmp (_String1="Desktop.lnk", _String2=".") returned 1 [0079.764] wcscmp (_String1="Desktop.lnk", _String2="..") returned 1 [0079.764] FindNextFileW (in: hFindFile=0x5ba1330, lpFindFileData=0x542d4c8 | out: lpFindFileData=0x542d4c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442b54f3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x442b54f3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcec7abde, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x3ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0079.764] wcscmp (_String1="Downloads.lnk", _String2=".") returned 1 [0079.764] wcscmp (_String1="Downloads.lnk", _String2="..") returned 1 [0079.764] FindNextFileW (in: hFindFile=0x5ba1330, lpFindFileData=0x542d4c8 | out: lpFindFileData=0x542d4c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 1 [0079.764] wcscmp (_String1="OneDrive.lnk", _String2=".") returned 1 [0079.764] wcscmp (_String1="OneDrive.lnk", _String2="..") returned 1 [0079.764] FindNextFileW (in: hFindFile=0x5ba1330, lpFindFileData=0x542d4c8 | out: lpFindFileData=0x542d4c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 0 [0079.764] FindClose (in: hFindFile=0x5ba1330 | out: hFindFile=0x5ba1330) returned 1 [0079.764] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542d4c8) returned 1 [0079.764] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38cf848) returned 1 [0079.764] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e63f8) returned 1 Thread: id = 448 os_tid = 0x16d4 [0072.509] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x42) returned 0x38fb2c0 [0072.509] wcscpy (in: _Dest=0x38fb2c0, _Source="C:\\Users\\FD1HVy\\Local Settings" | out: _Dest="C:\\Users\\FD1HVy\\Local Settings") returned="C:\\Users\\FD1HVy\\Local Settings" [0072.509] wcscat (in: _Dest=0x38fb2c0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Local Settings\\") returned="C:\\Users\\FD1HVy\\Local Settings\\" [0072.509] wcscat (in: _Dest=0x38fb2c0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Local Settings\\*") returned="C:\\Users\\FD1HVy\\Local Settings\\*" [0072.509] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542d730 [0072.509] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Local Settings\\*", lpFindFileData=0x542d730 | out: lpFindFileData=0x542d730*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.810] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542d730) returned 1 [0074.810] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38fb2c0) returned 1 [0074.810] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537bf80) returned 1 Thread: id = 449 os_tid = 0x16d8 [0072.509] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x30) returned 0x38cf8f0 [0072.509] wcscpy (in: _Dest=0x38cf8f0, _Source="C:\\Users\\FD1HVy\\Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0072.510] wcscat (in: _Dest=0x38cf8f0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0072.510] wcscat (in: _Dest=0x38cf8f0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Music\\*") returned="C:\\Users\\FD1HVy\\Music\\*" [0072.510] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542de68 [0072.510] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\*", lpFindFileData=0x542de68 | out: lpFindFileData=0x542de68*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x39bf2515, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39bf2515, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ec80 [0075.238] wcscmp (_String1=".", _String2=".") returned 0 [0075.238] FindNextFileW (in: hFindFile=0x389ec80, lpFindFileData=0x542de68 | out: lpFindFileData=0x542de68*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x39bf2515, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39bf2515, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.238] wcscmp (_String1="..", _String2=".") returned 1 [0075.238] wcscmp (_String1="..", _String2="..") returned 0 [0075.239] FindNextFileW (in: hFindFile=0x389ec80, lpFindFileData=0x542de68 | out: lpFindFileData=0x542de68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7ae0d70, ftCreationTime.dwHighDateTime=0x1d5cd7a, ftLastAccessTime.dwLowDateTime=0x60568780, ftLastAccessTime.dwHighDateTime=0x1d5cc93, ftLastWriteTime.dwLowDateTime=0x60568780, ftLastWriteTime.dwHighDateTime=0x1d5cc93, nFileSizeHigh=0x0, nFileSizeLow=0xa31c, dwReserved0=0x0, dwReserved1=0x0, cFileName="38uKSkZAiozNgTxGB.wav", cAlternateFileName="38UKSK~1.WAV")) returned 1 [0075.239] wcscmp (_String1="38uKSkZAiozNgTxGB.wav", _String2=".") returned 1 [0075.239] wcscmp (_String1="38uKSkZAiozNgTxGB.wav", _String2="..") returned 1 [0075.239] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x38b6428 [0075.239] wcscpy (in: _Dest=0x38b6428, _Source="C:\\Users\\FD1HVy\\Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0075.239] wcscat (in: _Dest=0x38b6428, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0075.239] wcscat (in: _Dest=0x38b6428, _Source="38uKSkZAiozNgTxGB.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\38uKSkZAiozNgTxGB.wav") returned="C:\\Users\\FD1HVy\\Music\\38uKSkZAiozNgTxGB.wav" [0075.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b6428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcbc [0075.866] FindNextFileW (in: hFindFile=0x389ec80, lpFindFileData=0x542de68 | out: lpFindFileData=0x542de68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b059420, ftCreationTime.dwHighDateTime=0x1d5d7c6, ftLastAccessTime.dwLowDateTime=0x31ba77f0, ftLastAccessTime.dwHighDateTime=0x1d5d61c, ftLastWriteTime.dwLowDateTime=0x31ba77f0, ftLastWriteTime.dwHighDateTime=0x1d5d61c, nFileSizeHigh=0x0, nFileSizeLow=0x1402a, dwReserved0=0x0, dwReserved1=0x0, cFileName="3RPF7uizkWhEbCYZX82n.m4a", cAlternateFileName="3RPF7U~1.M4A")) returned 1 [0075.866] wcscmp (_String1="3RPF7uizkWhEbCYZX82n.m4a", _String2=".") returned 1 [0075.866] wcscmp (_String1="3RPF7uizkWhEbCYZX82n.m4a", _String2="..") returned 1 [0075.866] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x38fc918 [0075.866] wcscpy (in: _Dest=0x38fc918, _Source="C:\\Users\\FD1HVy\\Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0075.867] wcscat (in: _Dest=0x38fc918, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0075.867] wcscat (in: _Dest=0x38fc918, _Source="3RPF7uizkWhEbCYZX82n.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\3RPF7uizkWhEbCYZX82n.m4a") returned="C:\\Users\\FD1HVy\\Music\\3RPF7uizkWhEbCYZX82n.m4a" [0075.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fc918, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe5c [0075.867] FindNextFileW (in: hFindFile=0x389ec80, lpFindFileData=0x542de68 | out: lpFindFileData=0x542de68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f21f360, ftCreationTime.dwHighDateTime=0x1d5ce4d, ftLastAccessTime.dwLowDateTime=0x4f5c0820, ftLastAccessTime.dwHighDateTime=0x1d5d502, ftLastWriteTime.dwLowDateTime=0x4f5c0820, ftLastWriteTime.dwHighDateTime=0x1d5d502, nFileSizeHigh=0x0, nFileSizeLow=0xdb09, dwReserved0=0x0, dwReserved1=0x0, cFileName="8PJXMFVd1.mp3", cAlternateFileName="8PJXMF~1.MP3")) returned 1 [0075.867] wcscmp (_String1="8PJXMFVd1.mp3", _String2=".") returned 1 [0075.867] wcscmp (_String1="8PJXMFVd1.mp3", _String2="..") returned 1 [0075.867] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x5532080 [0075.867] wcscpy (in: _Dest=0x5532080, _Source="C:\\Users\\FD1HVy\\Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0075.867] wcscat (in: _Dest=0x5532080, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0075.867] wcscat (in: _Dest=0x5532080, _Source="8PJXMFVd1.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\8PJXMFVd1.mp3") returned="C:\\Users\\FD1HVy\\Music\\8PJXMFVd1.mp3" [0075.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5532080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe60 [0075.868] FindNextFileW (in: hFindFile=0x389ec80, lpFindFileData=0x542de68 | out: lpFindFileData=0x542de68*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0075.868] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0075.868] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0075.868] FindNextFileW (in: hFindFile=0x389ec80, lpFindFileData=0x542de68 | out: lpFindFileData=0x542de68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78aa650, ftCreationTime.dwHighDateTime=0x1d5c963, ftLastAccessTime.dwLowDateTime=0xada220d0, ftLastAccessTime.dwHighDateTime=0x1d5c8bf, ftLastWriteTime.dwLowDateTime=0xada220d0, ftLastWriteTime.dwHighDateTime=0x1d5c8bf, nFileSizeHigh=0x0, nFileSizeLow=0xb9d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppDpDLkO.m4a", cAlternateFileName="")) returned 1 [0075.868] wcscmp (_String1="ppDpDLkO.m4a", _String2=".") returned 1 [0075.868] wcscmp (_String1="ppDpDLkO.m4a", _String2="..") returned 1 [0075.868] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x46) returned 0x5532850 [0075.868] wcscpy (in: _Dest=0x5532850, _Source="C:\\Users\\FD1HVy\\Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0075.868] wcscat (in: _Dest=0x5532850, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0075.868] wcscat (in: _Dest=0x5532850, _Source="ppDpDLkO.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\ppDpDLkO.m4a") returned="C:\\Users\\FD1HVy\\Music\\ppDpDLkO.m4a" [0075.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5532850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe64 [0075.869] FindNextFileW (in: hFindFile=0x389ec80, lpFindFileData=0x542de68 | out: lpFindFileData=0x542de68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa757590, ftCreationTime.dwHighDateTime=0x1d5d7da, ftLastAccessTime.dwLowDateTime=0xa1244190, ftLastAccessTime.dwHighDateTime=0x1d5cf0d, ftLastWriteTime.dwLowDateTime=0xa1244190, ftLastWriteTime.dwHighDateTime=0x1d5cf0d, nFileSizeHigh=0x0, nFileSizeLow=0xd9e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="s0GdPqj8GLeJZL.m4a", cAlternateFileName="S0GDPQ~1.M4A")) returned 1 [0075.869] wcscmp (_String1="s0GdPqj8GLeJZL.m4a", _String2=".") returned 1 [0075.869] wcscmp (_String1="s0GdPqj8GLeJZL.m4a", _String2="..") returned 1 [0075.869] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x5497988 [0075.869] wcscpy (in: _Dest=0x5497988, _Source="C:\\Users\\FD1HVy\\Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0075.869] wcscat (in: _Dest=0x5497988, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0075.869] wcscat (in: _Dest=0x5497988, _Source="s0GdPqj8GLeJZL.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\s0GdPqj8GLeJZL.m4a") returned="C:\\Users\\FD1HVy\\Music\\s0GdPqj8GLeJZL.m4a" [0075.869] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5497988, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe68 [0075.870] FindNextFileW (in: hFindFile=0x389ec80, lpFindFileData=0x542de68 | out: lpFindFileData=0x542de68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde08f040, ftCreationTime.dwHighDateTime=0x1d5caa5, ftLastAccessTime.dwLowDateTime=0x32b0f4f0, ftLastAccessTime.dwHighDateTime=0x1d5cd60, ftLastWriteTime.dwLowDateTime=0x32b0f4f0, ftLastWriteTime.dwHighDateTime=0x1d5cd60, nFileSizeHigh=0x0, nFileSizeLow=0x1825, dwReserved0=0x0, dwReserved1=0x0, cFileName="scM4r.m4a", cAlternateFileName="")) returned 1 [0075.870] wcscmp (_String1="scM4r.m4a", _String2=".") returned 1 [0075.870] wcscmp (_String1="scM4r.m4a", _String2="..") returned 1 [0075.870] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5cc8 [0075.870] wcscpy (in: _Dest=0x38a5cc8, _Source="C:\\Users\\FD1HVy\\Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0075.870] wcscat (in: _Dest=0x38a5cc8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0075.870] wcscat (in: _Dest=0x38a5cc8, _Source="scM4r.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\scM4r.m4a") returned="C:\\Users\\FD1HVy\\Music\\scM4r.m4a" [0075.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38a5cc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe6c [0075.871] FindNextFileW (in: hFindFile=0x389ec80, lpFindFileData=0x542de68 | out: lpFindFileData=0x542de68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8597cf10, ftCreationTime.dwHighDateTime=0x1d5ca2f, ftLastAccessTime.dwLowDateTime=0x74238d10, ftLastAccessTime.dwHighDateTime=0x1d5cf83, ftLastWriteTime.dwLowDateTime=0x74238d10, ftLastWriteTime.dwHighDateTime=0x1d5cf83, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="siybYIA0", cAlternateFileName="")) returned 1 [0075.871] wcscmp (_String1="siybYIA0", _String2=".") returned 1 [0075.871] wcscmp (_String1="siybYIA0", _String2="..") returned 1 [0075.871] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3e) returned 0x38a5800 [0075.871] wcscpy (in: _Dest=0x38a5800, _Source="C:\\Users\\FD1HVy\\Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0075.871] wcscat (in: _Dest=0x38a5800, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0075.871] wcscat (in: _Dest=0x38a5800, _Source="siybYIA0" | out: _Dest="C:\\Users\\FD1HVy\\Music\\siybYIA0") returned="C:\\Users\\FD1HVy\\Music\\siybYIA0" [0075.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a5800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe70 [0075.872] FindNextFileW (in: hFindFile=0x389ec80, lpFindFileData=0x542de68 | out: lpFindFileData=0x542de68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d180, ftCreationTime.dwHighDateTime=0x1d5c95d, ftLastAccessTime.dwLowDateTime=0x38a368a0, ftLastAccessTime.dwHighDateTime=0x1d5c880, ftLastWriteTime.dwLowDateTime=0x38a368a0, ftLastWriteTime.dwHighDateTime=0x1d5c880, nFileSizeHigh=0x0, nFileSizeLow=0xdfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="TsHN_-DOMF Kz8I.m4a", cAlternateFileName="TSHN_-~1.M4A")) returned 1 [0075.872] wcscmp (_String1="TsHN_-DOMF Kz8I.m4a", _String2=".") returned 1 [0075.872] wcscmp (_String1="TsHN_-DOMF Kz8I.m4a", _String2="..") returned 1 [0075.872] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x5497f28 [0075.872] wcscpy (in: _Dest=0x5497f28, _Source="C:\\Users\\FD1HVy\\Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0075.872] wcscat (in: _Dest=0x5497f28, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0075.872] wcscat (in: _Dest=0x5497f28, _Source="TsHN_-DOMF Kz8I.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\TsHN_-DOMF Kz8I.m4a") returned="C:\\Users\\FD1HVy\\Music\\TsHN_-DOMF Kz8I.m4a" [0075.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5497f28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe74 [0075.872] FindNextFileW (in: hFindFile=0x389ec80, lpFindFileData=0x542de68 | out: lpFindFileData=0x542de68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1255a6c0, ftCreationTime.dwHighDateTime=0x1d5d2be, ftLastAccessTime.dwLowDateTime=0x8686fef0, ftLastAccessTime.dwHighDateTime=0x1d5c79b, ftLastWriteTime.dwLowDateTime=0x8686fef0, ftLastWriteTime.dwHighDateTime=0x1d5c79b, nFileSizeHigh=0x0, nFileSizeLow=0x14860, dwReserved0=0x0, dwReserved1=0x0, cFileName="z8IVbLeOS2MdsJM4Qm.wav", cAlternateFileName="Z8IVBL~1.WAV")) returned 1 [0075.872] wcscmp (_String1="z8IVbLeOS2MdsJM4Qm.wav", _String2=".") returned 1 [0075.872] wcscmp (_String1="z8IVbLeOS2MdsJM4Qm.wav", _String2="..") returned 1 [0075.872] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x38fc980 [0075.872] wcscpy (in: _Dest=0x38fc980, _Source="C:\\Users\\FD1HVy\\Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0075.873] wcscat (in: _Dest=0x38fc980, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0075.873] wcscat (in: _Dest=0x38fc980, _Source="z8IVbLeOS2MdsJM4Qm.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\z8IVbLeOS2MdsJM4Qm.wav") returned="C:\\Users\\FD1HVy\\Music\\z8IVbLeOS2MdsJM4Qm.wav" [0075.873] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fc980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe78 [0075.873] FindNextFileW (in: hFindFile=0x389ec80, lpFindFileData=0x542de68 | out: lpFindFileData=0x542de68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0091b20, ftCreationTime.dwHighDateTime=0x1d5d221, ftLastAccessTime.dwLowDateTime=0xabe34d0, ftLastAccessTime.dwHighDateTime=0x1d5d55d, ftLastWriteTime.dwLowDateTime=0xabe34d0, ftLastWriteTime.dwHighDateTime=0x1d5d55d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_PLqwB", cAlternateFileName="")) returned 1 [0075.873] wcscmp (_String1="_PLqwB", _String2=".") returned 1 [0075.873] wcscmp (_String1="_PLqwB", _String2="..") returned 1 [0075.873] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a5848 [0075.873] wcscpy (in: _Dest=0x38a5848, _Source="C:\\Users\\FD1HVy\\Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0075.873] wcscat (in: _Dest=0x38a5848, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0075.873] wcscat (in: _Dest=0x38a5848, _Source="_PLqwB" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB" [0075.873] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38a5848, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe7c [0075.874] FindNextFileW (in: hFindFile=0x389ec80, lpFindFileData=0x542de68 | out: lpFindFileData=0x542de68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0091b20, ftCreationTime.dwHighDateTime=0x1d5d221, ftLastAccessTime.dwLowDateTime=0xabe34d0, ftLastAccessTime.dwHighDateTime=0x1d5d55d, ftLastWriteTime.dwLowDateTime=0xabe34d0, ftLastWriteTime.dwHighDateTime=0x1d5d55d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_PLqwB", cAlternateFileName="")) returned 0 [0075.874] FindClose (in: hFindFile=0x389ec80 | out: hFindFile=0x389ec80) returned 1 [0075.874] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542de68) returned 1 [0075.874] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38cf8f0) returned 1 [0075.874] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e6078) returned 1 Thread: id = 450 os_tid = 0x16dc [0072.510] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3e) returned 0x38a5968 [0072.510] wcscpy (in: _Dest=0x38a5968, _Source="C:\\Users\\FD1HVy\\My Documents" | out: _Dest="C:\\Users\\FD1HVy\\My Documents") returned="C:\\Users\\FD1HVy\\My Documents" [0072.510] wcscat (in: _Dest=0x38a5968, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\My Documents\\") returned="C:\\Users\\FD1HVy\\My Documents\\" [0072.510] wcscat (in: _Dest=0x38a5968, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\My Documents\\*") returned="C:\\Users\\FD1HVy\\My Documents\\*" [0072.510] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542f1a8 [0072.510] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\My Documents\\*", lpFindFileData=0x542f1a8 | out: lpFindFileData=0x542f1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.811] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542f1a8) returned 1 [0074.811] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5968) returned 1 [0074.811] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5698) returned 1 Thread: id = 451 os_tid = 0x16e0 [0072.511] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x34) returned 0x54450c0 [0072.511] wcscpy (in: _Dest=0x54450c0, _Source="C:\\Users\\FD1HVy\\NetHood" | out: _Dest="C:\\Users\\FD1HVy\\NetHood") returned="C:\\Users\\FD1HVy\\NetHood" [0072.511] wcscat (in: _Dest=0x54450c0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\NetHood\\") returned="C:\\Users\\FD1HVy\\NetHood\\" [0072.511] wcscat (in: _Dest=0x54450c0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\NetHood\\*") returned="C:\\Users\\FD1HVy\\NetHood\\*" [0072.511] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54309b8 [0072.511] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\NetHood\\*", lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.812] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54309b8) returned 1 [0074.812] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54450c0) returned 1 [0074.812] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e5f98) returned 1 Thread: id = 452 os_tid = 0x16e4 [0072.511] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x5445100 [0072.511] wcscpy (in: _Dest=0x5445100, _Source="C:\\Users\\FD1HVy\\OneDrive" | out: _Dest="C:\\Users\\FD1HVy\\OneDrive") returned="C:\\Users\\FD1HVy\\OneDrive" [0072.512] wcscat (in: _Dest=0x5445100, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\OneDrive\\") returned="C:\\Users\\FD1HVy\\OneDrive\\" [0072.512] wcscat (in: _Dest=0x5445100, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\OneDrive\\*") returned="C:\\Users\\FD1HVy\\OneDrive\\*" [0072.512] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54071c8 [0072.512] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive\\*", lpFindFileData=0x54071c8 | out: lpFindFileData=0x54071c8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ecc0 [0075.240] wcscmp (_String1=".", _String2=".") returned 0 [0075.240] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x54071c8 | out: lpFindFileData=0x54071c8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.240] wcscmp (_String1="..", _String2=".") returned 1 [0075.240] wcscmp (_String1="..", _String2="..") returned 0 [0075.240] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x54071c8 | out: lpFindFileData=0x54071c8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0075.240] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0075.240] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0075.240] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x54071c8 | out: lpFindFileData=0x54071c8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0075.241] FindClose (in: hFindFile=0x389ecc0 | out: hFindFile=0x389ecc0) returned 1 [0075.241] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54071c8) returned 1 [0075.241] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445100) returned 1 [0075.241] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445240) returned 1 Thread: id = 453 os_tid = 0x16e8 [0072.512] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x5445140 [0072.512] wcscpy (in: _Dest=0x5445140, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0072.512] wcscat (in: _Dest=0x5445140, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0072.512] wcscat (in: _Dest=0x5445140, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\*") returned="C:\\Users\\FD1HVy\\Pictures\\*" [0072.512] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5407698 [0072.512] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\*", lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x39d95cc8, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39d95cc8, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ecc0 [0075.242] wcscmp (_String1=".", _String2=".") returned 0 [0075.242] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x39d95cc8, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39d95cc8, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.242] wcscmp (_String1="..", _String2=".") returned 1 [0075.242] wcscmp (_String1="..", _String2="..") returned 0 [0075.242] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67ea990, ftCreationTime.dwHighDateTime=0x1d5cc4d, ftLastAccessTime.dwLowDateTime=0x1cb58d40, ftLastAccessTime.dwHighDateTime=0x1d5cb9a, ftLastWriteTime.dwLowDateTime=0x1cb58d40, ftLastWriteTime.dwHighDateTime=0x1d5cb9a, nFileSizeHigh=0x0, nFileSizeLow=0xe996, dwReserved0=0x0, dwReserved1=0x0, cFileName="-09CD4P-xMTV.bmp", cAlternateFileName="-09CD4~1.BMP")) returned 1 [0075.242] wcscmp (_String1="-09CD4P-xMTV.bmp", _String2=".") returned -1 [0075.243] wcscmp (_String1="-09CD4P-xMTV.bmp", _String2="..") returned -1 [0075.243] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x38b6488 [0075.243] wcscpy (in: _Dest=0x38b6488, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0075.243] wcscat (in: _Dest=0x38b6488, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0075.243] wcscat (in: _Dest=0x38b6488, _Source="-09CD4P-xMTV.bmp" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\-09CD4P-xMTV.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\-09CD4P-xMTV.bmp" [0075.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b6488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc0 [0075.840] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa03351c0, ftCreationTime.dwHighDateTime=0x1d5d7e8, ftLastAccessTime.dwLowDateTime=0xee4de420, ftLastAccessTime.dwHighDateTime=0x1d5d6e3, ftLastWriteTime.dwLowDateTime=0xee4de420, ftLastWriteTime.dwHighDateTime=0x1d5d6e3, nFileSizeHigh=0x0, nFileSizeLow=0x279c, dwReserved0=0x0, dwReserved1=0x0, cFileName="0-2fU4I-yh6ST.jpg", cAlternateFileName="0-2FU4~1.JPG")) returned 1 [0075.840] wcscmp (_String1="0-2fU4I-yh6ST.jpg", _String2=".") returned 1 [0075.840] wcscmp (_String1="0-2fU4I-yh6ST.jpg", _String2="..") returned 1 [0075.840] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x543d458 [0075.840] wcscpy (in: _Dest=0x543d458, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0075.840] wcscat (in: _Dest=0x543d458, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0075.840] wcscat (in: _Dest=0x543d458, _Source="0-2fU4I-yh6ST.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\0-2fU4I-yh6ST.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\0-2fU4I-yh6ST.jpg" [0075.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x543d458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdec [0075.841] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5be831c0, ftCreationTime.dwHighDateTime=0x1d5cb9f, ftLastAccessTime.dwLowDateTime=0xb6072620, ftLastAccessTime.dwHighDateTime=0x1d5c848, ftLastWriteTime.dwLowDateTime=0xb6072620, ftLastWriteTime.dwHighDateTime=0x1d5c848, nFileSizeHigh=0x0, nFileSizeLow=0x6ed4, dwReserved0=0x0, dwReserved1=0x0, cFileName="0algdtmoqwEQsbLT.bmp", cAlternateFileName="0ALGDT~1.BMP")) returned 1 [0075.841] wcscmp (_String1="0algdtmoqwEQsbLT.bmp", _String2=".") returned 1 [0075.841] wcscmp (_String1="0algdtmoqwEQsbLT.bmp", _String2="..") returned 1 [0075.841] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x38fc6a8 [0075.841] wcscpy (in: _Dest=0x38fc6a8, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0075.841] wcscat (in: _Dest=0x38fc6a8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0075.841] wcscat (in: _Dest=0x38fc6a8, _Source="0algdtmoqwEQsbLT.bmp" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\0algdtmoqwEQsbLT.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\0algdtmoqwEQsbLT.bmp" [0075.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fc6a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdf0 [0075.842] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60feeba0, ftCreationTime.dwHighDateTime=0x1d5d319, ftLastAccessTime.dwLowDateTime=0x2ae127e0, ftLastAccessTime.dwHighDateTime=0x1d5cc70, ftLastWriteTime.dwLowDateTime=0x2ae127e0, ftLastWriteTime.dwHighDateTime=0x1d5cc70, nFileSizeHigh=0x0, nFileSizeLow=0x66c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="4V8fHb1NEKeSJc.jpg", cAlternateFileName="4V8FHB~1.JPG")) returned 1 [0075.842] wcscmp (_String1="4V8fHb1NEKeSJc.jpg", _String2=".") returned 1 [0075.842] wcscmp (_String1="4V8fHb1NEKeSJc.jpg", _String2="..") returned 1 [0075.842] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x543d518 [0075.842] wcscpy (in: _Dest=0x543d518, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0075.842] wcscat (in: _Dest=0x543d518, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0075.842] wcscat (in: _Dest=0x543d518, _Source="4V8fHb1NEKeSJc.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\4V8fHb1NEKeSJc.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\4V8fHb1NEKeSJc.jpg" [0075.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x543d518, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdf4 [0075.843] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x735c5cd0, ftCreationTime.dwHighDateTime=0x1d5ced0, ftLastAccessTime.dwLowDateTime=0x7503dd0, ftLastAccessTime.dwHighDateTime=0x1d5d4c6, ftLastWriteTime.dwLowDateTime=0x7503dd0, ftLastWriteTime.dwHighDateTime=0x1d5d4c6, nFileSizeHigh=0x0, nFileSizeLow=0x129c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AVvZEDdWpVOsZ9.jpg", cAlternateFileName="AVVZED~1.JPG")) returned 1 [0075.843] wcscmp (_String1="AVvZEDdWpVOsZ9.jpg", _String2=".") returned 1 [0075.843] wcscmp (_String1="AVvZEDdWpVOsZ9.jpg", _String2="..") returned 1 [0075.843] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x543d638 [0075.843] wcscpy (in: _Dest=0x543d638, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0075.843] wcscat (in: _Dest=0x543d638, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0075.843] wcscat (in: _Dest=0x543d638, _Source="AVvZEDdWpVOsZ9.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\AVvZEDdWpVOsZ9.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\AVvZEDdWpVOsZ9.jpg" [0075.843] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x543d638, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdf8 [0075.843] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51c9f510, ftCreationTime.dwHighDateTime=0x1d5cba5, ftLastAccessTime.dwLowDateTime=0x9463d040, ftLastAccessTime.dwHighDateTime=0x1d5d5f9, ftLastWriteTime.dwLowDateTime=0x9463d040, ftLastWriteTime.dwHighDateTime=0x1d5d5f9, nFileSizeHigh=0x0, nFileSizeLow=0x12fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="C-RSge6FoDG.png", cAlternateFileName="C-RSGE~1.PNG")) returned 1 [0075.843] wcscmp (_String1="C-RSge6FoDG.png", _String2=".") returned 1 [0075.843] wcscmp (_String1="C-RSge6FoDG.png", _String2="..") returned 1 [0075.843] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x543d578 [0075.844] wcscpy (in: _Dest=0x543d578, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0075.844] wcscat (in: _Dest=0x543d578, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0075.844] wcscat (in: _Dest=0x543d578, _Source="C-RSge6FoDG.png" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\C-RSge6FoDG.png") returned="C:\\Users\\FD1HVy\\Pictures\\C-RSge6FoDG.png" [0075.844] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x543d578, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdfc [0075.844] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0075.844] wcscmp (_String1="Camera Roll", _String2=".") returned 1 [0075.844] wcscmp (_String1="Camera Roll", _String2="..") returned 1 [0075.844] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x39000a0 [0075.844] wcscpy (in: _Dest=0x39000a0, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0075.844] wcscat (in: _Dest=0x39000a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0075.844] wcscat (in: _Dest=0x39000a0, _Source="Camera Roll" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\Camera Roll") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll" [0075.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x39000a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe00 [0075.845] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd13e3c20, ftCreationTime.dwHighDateTime=0x1d5caf6, ftLastAccessTime.dwLowDateTime=0x54aa7570, ftLastAccessTime.dwHighDateTime=0x1d5c894, ftLastWriteTime.dwLowDateTime=0x54aa7570, ftLastWriteTime.dwHighDateTime=0x1d5c894, nFileSizeHigh=0x0, nFileSizeLow=0xf1d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="dCJ2.bmp", cAlternateFileName="")) returned 1 [0075.845] wcscmp (_String1="dCJ2.bmp", _String2=".") returned 1 [0075.845] wcscmp (_String1="dCJ2.bmp", _String2="..") returned 1 [0075.846] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x5532670 [0075.846] wcscpy (in: _Dest=0x5532670, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0075.846] wcscat (in: _Dest=0x5532670, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0075.846] wcscat (in: _Dest=0x5532670, _Source="dCJ2.bmp" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\dCJ2.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\dCJ2.bmp" [0075.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5532670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe04 [0075.846] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44053085, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44053085, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0075.846] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0075.846] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0075.846] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58f651f0, ftCreationTime.dwHighDateTime=0x1d5d4b3, ftLastAccessTime.dwLowDateTime=0xafea9220, ftLastAccessTime.dwHighDateTime=0x1d5d560, ftLastWriteTime.dwLowDateTime=0xafea9220, ftLastWriteTime.dwHighDateTime=0x1d5d560, nFileSizeHigh=0x0, nFileSizeLow=0x9a11, dwReserved0=0x0, dwReserved1=0x0, cFileName="e8RP7fcF2GbKFno4wEQ.png", cAlternateFileName="E8RP7F~1.PNG")) returned 1 [0075.846] wcscmp (_String1="e8RP7fcF2GbKFno4wEQ.png", _String2=".") returned 1 [0075.846] wcscmp (_String1="e8RP7fcF2GbKFno4wEQ.png", _String2="..") returned 1 [0075.846] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x396e140 [0075.846] wcscpy (in: _Dest=0x396e140, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0075.847] wcscat (in: _Dest=0x396e140, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0075.847] wcscat (in: _Dest=0x396e140, _Source="e8RP7fcF2GbKFno4wEQ.png" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\e8RP7fcF2GbKFno4wEQ.png") returned="C:\\Users\\FD1HVy\\Pictures\\e8RP7fcF2GbKFno4wEQ.png" [0075.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396e140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe08 [0075.847] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44519880, ftCreationTime.dwHighDateTime=0x1d5d73e, ftLastAccessTime.dwLowDateTime=0x3a601ce0, ftLastAccessTime.dwHighDateTime=0x1d5d75f, ftLastWriteTime.dwLowDateTime=0x3a601ce0, ftLastWriteTime.dwHighDateTime=0x1d5d75f, nFileSizeHigh=0x0, nFileSizeLow=0x6743, dwReserved0=0x0, dwReserved1=0x0, cFileName="eZxR4UE1l.png", cAlternateFileName="EZXR4U~1.PNG")) returned 1 [0075.847] wcscmp (_String1="eZxR4UE1l.png", _String2=".") returned 1 [0075.847] wcscmp (_String1="eZxR4UE1l.png", _String2="..") returned 1 [0075.847] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x39000f8 [0075.847] wcscpy (in: _Dest=0x39000f8, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0075.847] wcscat (in: _Dest=0x39000f8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0075.847] wcscat (in: _Dest=0x39000f8, _Source="eZxR4UE1l.png" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\eZxR4UE1l.png") returned="C:\\Users\\FD1HVy\\Pictures\\eZxR4UE1l.png" [0075.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x39000f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe0c [0075.848] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fae7550, ftCreationTime.dwHighDateTime=0x1d5cf0b, ftLastAccessTime.dwLowDateTime=0xde7978d0, ftLastAccessTime.dwHighDateTime=0x1d5d25a, ftLastWriteTime.dwLowDateTime=0xde7978d0, ftLastWriteTime.dwHighDateTime=0x1d5d25a, nFileSizeHigh=0x0, nFileSizeLow=0xcf6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="f9G-epH1h mcDmhoie.gif", cAlternateFileName="F9G-EP~1.GIF")) returned 1 [0075.848] wcscmp (_String1="f9G-epH1h mcDmhoie.gif", _String2=".") returned 1 [0075.848] wcscmp (_String1="f9G-epH1h mcDmhoie.gif", _String2="..") returned 1 [0075.848] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x38fcc58 [0075.848] wcscpy (in: _Dest=0x38fcc58, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0075.848] wcscat (in: _Dest=0x38fcc58, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0075.848] wcscat (in: _Dest=0x38fcc58, _Source="f9G-epH1h mcDmhoie.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\f9G-epH1h mcDmhoie.gif") returned="C:\\Users\\FD1HVy\\Pictures\\f9G-epH1h mcDmhoie.gif" [0075.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fcc58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe10 [0075.849] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1349b0, ftCreationTime.dwHighDateTime=0x1d5ca98, ftLastAccessTime.dwLowDateTime=0x681eb160, ftLastAccessTime.dwHighDateTime=0x1d5c97b, ftLastWriteTime.dwLowDateTime=0x681eb160, ftLastWriteTime.dwHighDateTime=0x1d5c97b, nFileSizeHigh=0x0, nFileSizeLow=0xc838, dwReserved0=0x0, dwReserved1=0x0, cFileName="fLcjAxTi18dQlVO.bmp", cAlternateFileName="FLCJAX~1.BMP")) returned 1 [0075.849] wcscmp (_String1="fLcjAxTi18dQlVO.bmp", _String2=".") returned 1 [0075.849] wcscmp (_String1="fLcjAxTi18dQlVO.bmp", _String2="..") returned 1 [0075.849] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x38fd0d0 [0075.849] wcscpy (in: _Dest=0x38fd0d0, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0075.849] wcscat (in: _Dest=0x38fd0d0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0075.849] wcscat (in: _Dest=0x38fd0d0, _Source="fLcjAxTi18dQlVO.bmp" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\fLcjAxTi18dQlVO.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\fLcjAxTi18dQlVO.bmp" [0075.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fd0d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe14 [0075.850] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c71ad0, ftCreationTime.dwHighDateTime=0x1d5d791, ftLastAccessTime.dwLowDateTime=0x112726b0, ftLastAccessTime.dwHighDateTime=0x1d5d35f, ftLastWriteTime.dwLowDateTime=0x112726b0, ftLastWriteTime.dwHighDateTime=0x1d5d35f, nFileSizeHigh=0x0, nFileSizeLow=0xc68e, dwReserved0=0x0, dwReserved1=0x0, cFileName="GJoKdTfOL9ji8GXtw1b.jpg", cAlternateFileName="GJOKDT~1.JPG")) returned 1 [0075.850] wcscmp (_String1="GJoKdTfOL9ji8GXtw1b.jpg", _String2=".") returned 1 [0075.850] wcscmp (_String1="GJoKdTfOL9ji8GXtw1b.jpg", _String2="..") returned 1 [0075.850] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x396e3e0 [0075.850] wcscpy (in: _Dest=0x396e3e0, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0075.850] wcscat (in: _Dest=0x396e3e0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0075.850] wcscat (in: _Dest=0x396e3e0, _Source="GJoKdTfOL9ji8GXtw1b.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\GJoKdTfOL9ji8GXtw1b.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\GJoKdTfOL9ji8GXtw1b.jpg" [0075.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396e3e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe18 [0075.850] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510a5ba0, ftCreationTime.dwHighDateTime=0x1d5ca52, ftLastAccessTime.dwLowDateTime=0x3d8278b0, ftLastAccessTime.dwHighDateTime=0x1d5c84f, ftLastWriteTime.dwLowDateTime=0x3d8278b0, ftLastWriteTime.dwHighDateTime=0x1d5c84f, nFileSizeHigh=0x0, nFileSizeLow=0xa637, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jbc4PG hVWo7ul7-.bmp", cAlternateFileName="JBC4PG~1.BMP")) returned 1 [0075.850] wcscmp (_String1="Jbc4PG hVWo7ul7-.bmp", _String2=".") returned 1 [0075.850] wcscmp (_String1="Jbc4PG hVWo7ul7-.bmp", _String2="..") returned 1 [0075.851] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x38fc710 [0075.851] wcscpy (in: _Dest=0x38fc710, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0075.851] wcscat (in: _Dest=0x38fc710, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0075.851] wcscat (in: _Dest=0x38fc710, _Source="Jbc4PG hVWo7ul7-.bmp" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\Jbc4PG hVWo7ul7-.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\Jbc4PG hVWo7ul7-.bmp" [0075.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fc710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe1c [0075.851] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeafc9010, ftCreationTime.dwHighDateTime=0x1d5cacb, ftLastAccessTime.dwLowDateTime=0x26311860, ftLastAccessTime.dwHighDateTime=0x1d5d768, ftLastWriteTime.dwLowDateTime=0x26311860, ftLastWriteTime.dwHighDateTime=0x1d5d768, nFileSizeHigh=0x0, nFileSizeLow=0x1883f, dwReserved0=0x0, dwReserved1=0x0, cFileName="KtP2-2cxUhk6Xb8YJ7.jpg", cAlternateFileName="KTP2-2~1.JPG")) returned 1 [0075.851] wcscmp (_String1="KtP2-2cxUhk6Xb8YJ7.jpg", _String2=".") returned 1 [0075.851] wcscmp (_String1="KtP2-2cxUhk6Xb8YJ7.jpg", _String2="..") returned 1 [0075.851] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x38fd138 [0075.851] wcscpy (in: _Dest=0x38fd138, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0075.851] wcscat (in: _Dest=0x38fd138, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0075.852] wcscat (in: _Dest=0x38fd138, _Source="KtP2-2cxUhk6Xb8YJ7.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\KtP2-2cxUhk6Xb8YJ7.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\KtP2-2cxUhk6Xb8YJ7.jpg" [0075.852] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fd138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe20 [0075.852] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1859600, ftCreationTime.dwHighDateTime=0x1d5cfbe, ftLastAccessTime.dwLowDateTime=0x3ce904f0, ftLastAccessTime.dwHighDateTime=0x1d5cd8b, ftLastWriteTime.dwLowDateTime=0x3ce904f0, ftLastWriteTime.dwHighDateTime=0x1d5cd8b, nFileSizeHigh=0x0, nFileSizeLow=0x16eb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nx9GYYC2Rsjy1CN.png", cAlternateFileName="NX9GYY~1.PNG")) returned 1 [0075.852] wcscmp (_String1="nx9GYYC2Rsjy1CN.png", _String2=".") returned 1 [0075.852] wcscmp (_String1="nx9GYYC2Rsjy1CN.png", _String2="..") returned 1 [0075.852] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x38fc7e0 [0075.852] wcscpy (in: _Dest=0x38fc7e0, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0075.852] wcscat (in: _Dest=0x38fc7e0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0075.852] wcscat (in: _Dest=0x38fc7e0, _Source="nx9GYYC2Rsjy1CN.png" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\nx9GYYC2Rsjy1CN.png") returned="C:\\Users\\FD1HVy\\Pictures\\nx9GYYC2Rsjy1CN.png" [0075.852] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fc7e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe24 [0075.853] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff1e4ed0, ftCreationTime.dwHighDateTime=0x1d5d0fc, ftLastAccessTime.dwLowDateTime=0xcaf59760, ftLastAccessTime.dwHighDateTime=0x1d5d653, ftLastWriteTime.dwLowDateTime=0xcaf59760, ftLastWriteTime.dwHighDateTime=0x1d5d653, nFileSizeHigh=0x0, nFileSizeLow=0xb8e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="pdMKY_DQ4R6F.jpg", cAlternateFileName="PDMKY_~1.JPG")) returned 1 [0075.853] wcscmp (_String1="pdMKY_DQ4R6F.jpg", _String2=".") returned 1 [0075.853] wcscmp (_String1="pdMKY_DQ4R6F.jpg", _String2="..") returned 1 [0075.853] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x543d998 [0075.853] wcscpy (in: _Dest=0x543d998, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0075.853] wcscat (in: _Dest=0x543d998, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0075.853] wcscat (in: _Dest=0x543d998, _Source="pdMKY_DQ4R6F.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\pdMKY_DQ4R6F.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\pdMKY_DQ4R6F.jpg" [0075.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x543d998, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe28 [0075.854] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41a5c130, ftCreationTime.dwHighDateTime=0x1d5d192, ftLastAccessTime.dwLowDateTime=0x19462920, ftLastAccessTime.dwHighDateTime=0x1d5cb23, ftLastWriteTime.dwLowDateTime=0x19462920, ftLastWriteTime.dwHighDateTime=0x1d5cb23, nFileSizeHigh=0x0, nFileSizeLow=0x93ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="pg_Otsmww.jpg", cAlternateFileName="PG_OTS~1.JPG")) returned 1 [0075.854] wcscmp (_String1="pg_Otsmww.jpg", _String2=".") returned 1 [0075.854] wcscmp (_String1="pg_Otsmww.jpg", _String2="..") returned 1 [0075.854] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x38ff6a8 [0075.854] wcscpy (in: _Dest=0x38ff6a8, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0075.854] wcscat (in: _Dest=0x38ff6a8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0075.854] wcscat (in: _Dest=0x38ff6a8, _Source="pg_Otsmww.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\pg_Otsmww.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\pg_Otsmww.jpg" [0075.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38ff6a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe2c [0075.855] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc21f26d0, ftCreationTime.dwHighDateTime=0x1d5cb3e, ftLastAccessTime.dwLowDateTime=0x5702b4f0, ftLastAccessTime.dwHighDateTime=0x1d5cff5, ftLastWriteTime.dwLowDateTime=0x5702b4f0, ftLastWriteTime.dwHighDateTime=0x1d5cff5, nFileSizeHigh=0x0, nFileSizeLow=0x8ba3, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIFelTYGWeNcE8I.jpg", cAlternateFileName="PIFELT~1.JPG")) returned 1 [0075.855] wcscmp (_String1="PIFelTYGWeNcE8I.jpg", _String2=".") returned 1 [0075.855] wcscmp (_String1="PIFelTYGWeNcE8I.jpg", _String2="..") returned 1 [0075.855] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x38fd1a0 [0075.855] wcscpy (in: _Dest=0x38fd1a0, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0075.855] wcscat (in: _Dest=0x38fd1a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0075.855] wcscat (in: _Dest=0x38fd1a0, _Source="PIFelTYGWeNcE8I.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\PIFelTYGWeNcE8I.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\PIFelTYGWeNcE8I.jpg" [0075.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fd1a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe30 [0075.855] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaa707f0, ftCreationTime.dwHighDateTime=0x1d5d1a7, ftLastAccessTime.dwLowDateTime=0xd6c0c170, ftLastAccessTime.dwHighDateTime=0x1d5d052, ftLastWriteTime.dwLowDateTime=0xd6c0c170, ftLastWriteTime.dwHighDateTime=0x1d5d052, nFileSizeHigh=0x0, nFileSizeLow=0x1474b, dwReserved0=0x0, dwReserved1=0x0, cFileName="pz8mRn91F.jpg", cAlternateFileName="PZ8MRN~1.JPG")) returned 1 [0075.855] wcscmp (_String1="pz8mRn91F.jpg", _String2=".") returned 1 [0075.855] wcscmp (_String1="pz8mRn91F.jpg", _String2="..") returned 1 [0075.855] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x38ff700 [0075.855] wcscpy (in: _Dest=0x38ff700, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0075.855] wcscat (in: _Dest=0x38ff700, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0075.855] wcscat (in: _Dest=0x38ff700, _Source="pz8mRn91F.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\pz8mRn91F.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\pz8mRn91F.jpg" [0075.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38ff700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe34 [0075.856] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c392040, ftCreationTime.dwHighDateTime=0x1d5cdb5, ftLastAccessTime.dwLowDateTime=0x318352a0, ftLastAccessTime.dwHighDateTime=0x1d5cc69, ftLastWriteTime.dwLowDateTime=0x318352a0, ftLastWriteTime.dwHighDateTime=0x1d5cc69, nFileSizeHigh=0x0, nFileSizeLow=0x2f03, dwReserved0=0x0, dwReserved1=0x0, cFileName="rmRm5VujyX_HCC.gif", cAlternateFileName="RMRM5V~1.GIF")) returned 1 [0075.856] wcscmp (_String1="rmRm5VujyX_HCC.gif", _String2=".") returned 1 [0075.856] wcscmp (_String1="rmRm5VujyX_HCC.gif", _String2="..") returned 1 [0075.856] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x543d9f8 [0075.856] wcscpy (in: _Dest=0x543d9f8, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0075.856] wcscat (in: _Dest=0x543d9f8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0075.856] wcscat (in: _Dest=0x543d9f8, _Source="rmRm5VujyX_HCC.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\rmRm5VujyX_HCC.gif") returned="C:\\Users\\FD1HVy\\Pictures\\rmRm5VujyX_HCC.gif" [0075.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x543d9f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe38 [0075.857] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde2f1640, ftCreationTime.dwHighDateTime=0x1d5d4b3, ftLastAccessTime.dwLowDateTime=0xe64cb00, ftLastAccessTime.dwHighDateTime=0x1d5d5d3, ftLastWriteTime.dwLowDateTime=0xe64cb00, ftLastWriteTime.dwHighDateTime=0x1d5d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x172ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="rYWV6NLyHJH.gif", cAlternateFileName="RYWV6N~1.GIF")) returned 1 [0075.857] wcscmp (_String1="rYWV6NLyHJH.gif", _String2=".") returned 1 [0075.857] wcscmp (_String1="rYWV6NLyHJH.gif", _String2="..") returned 1 [0075.857] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x38b5ca8 [0075.857] wcscpy (in: _Dest=0x38b5ca8, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0075.857] wcscat (in: _Dest=0x38b5ca8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0075.857] wcscat (in: _Dest=0x38b5ca8, _Source="rYWV6NLyHJH.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\rYWV6NLyHJH.gif") returned="C:\\Users\\FD1HVy\\Pictures\\rYWV6NLyHJH.gif" [0075.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b5ca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe3c [0075.858] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0075.858] wcscmp (_String1="Saved Pictures", _String2=".") returned 1 [0075.858] wcscmp (_String1="Saved Pictures", _String2="..") returned 1 [0075.858] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x3900150 [0075.858] wcscpy (in: _Dest=0x3900150, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0075.858] wcscat (in: _Dest=0x3900150, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0075.858] wcscat (in: _Dest=0x3900150, _Source="Saved Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures" [0075.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3900150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe40 [0075.859] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69eea7f0, ftCreationTime.dwHighDateTime=0x1d5cdc4, ftLastAccessTime.dwLowDateTime=0x11397740, ftLastAccessTime.dwHighDateTime=0x1d5d01f, ftLastWriteTime.dwLowDateTime=0x11397740, ftLastWriteTime.dwHighDateTime=0x1d5d01f, nFileSizeHigh=0x0, nFileSizeLow=0xe898, dwReserved0=0x0, dwReserved1=0x0, cFileName="SelLngVXnEkSdjqcmVS.jpg", cAlternateFileName="SELLNG~1.JPG")) returned 1 [0075.859] wcscmp (_String1="SelLngVXnEkSdjqcmVS.jpg", _String2=".") returned 1 [0075.859] wcscmp (_String1="SelLngVXnEkSdjqcmVS.jpg", _String2="..") returned 1 [0075.859] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x396dc70 [0075.859] wcscpy (in: _Dest=0x396dc70, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0075.859] wcscat (in: _Dest=0x396dc70, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0075.859] wcscat (in: _Dest=0x396dc70, _Source="SelLngVXnEkSdjqcmVS.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\SelLngVXnEkSdjqcmVS.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\SelLngVXnEkSdjqcmVS.jpg" [0075.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396dc70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe44 [0075.859] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x556694b0, ftCreationTime.dwHighDateTime=0x1d5d043, ftLastAccessTime.dwLowDateTime=0xaae959e0, ftLastAccessTime.dwHighDateTime=0x1d5d52a, ftLastWriteTime.dwLowDateTime=0xaae959e0, ftLastWriteTime.dwHighDateTime=0x1d5d52a, nFileSizeHigh=0x0, nFileSizeLow=0x156d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPley3vWhB_6hs.gif", cAlternateFileName="SPLEY3~1.GIF")) returned 1 [0075.859] wcscmp (_String1="SPley3vWhB_6hs.gif", _String2=".") returned 1 [0075.859] wcscmp (_String1="SPley3vWhB_6hs.gif", _String2="..") returned 1 [0075.859] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x5497fe8 [0075.860] wcscpy (in: _Dest=0x5497fe8, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0075.860] wcscat (in: _Dest=0x5497fe8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0075.860] wcscat (in: _Dest=0x5497fe8, _Source="SPley3vWhB_6hs.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\SPley3vWhB_6hs.gif") returned="C:\\Users\\FD1HVy\\Pictures\\SPley3vWhB_6hs.gif" [0075.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5497fe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe48 [0075.860] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fa98f00, ftCreationTime.dwHighDateTime=0x1d5d814, ftLastAccessTime.dwLowDateTime=0x21640f0, ftLastAccessTime.dwHighDateTime=0x1d5d6c2, ftLastWriteTime.dwLowDateTime=0x21640f0, ftLastWriteTime.dwHighDateTime=0x1d5d6c2, nFileSizeHigh=0x0, nFileSizeLow=0xd772, dwReserved0=0x0, dwReserved1=0x0, cFileName="UPDgNAJFk_8.png", cAlternateFileName="UPDGNA~1.PNG")) returned 1 [0075.860] wcscmp (_String1="UPDgNAJFk_8.png", _String2=".") returned 1 [0075.860] wcscmp (_String1="UPDgNAJFk_8.png", _String2="..") returned 1 [0075.860] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x5498228 [0075.860] wcscpy (in: _Dest=0x5498228, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0075.860] wcscat (in: _Dest=0x5498228, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0075.860] wcscat (in: _Dest=0x5498228, _Source="UPDgNAJFk_8.png" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\UPDgNAJFk_8.png") returned="C:\\Users\\FD1HVy\\Pictures\\UPDgNAJFk_8.png" [0075.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5498228, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe4c [0075.861] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3605170, ftCreationTime.dwHighDateTime=0x1d5c861, ftLastAccessTime.dwLowDateTime=0xc24de8c0, ftLastAccessTime.dwHighDateTime=0x1d5cf40, ftLastWriteTime.dwLowDateTime=0xc24de8c0, ftLastWriteTime.dwHighDateTime=0x1d5cf40, nFileSizeHigh=0x0, nFileSizeLow=0x2f2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WYmAnlDUMTZ_Pt.gif", cAlternateFileName="WYMANL~1.GIF")) returned 1 [0075.861] wcscmp (_String1="WYmAnlDUMTZ_Pt.gif", _String2=".") returned 1 [0075.861] wcscmp (_String1="WYmAnlDUMTZ_Pt.gif", _String2="..") returned 1 [0075.861] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x5498108 [0075.861] wcscpy (in: _Dest=0x5498108, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0075.861] wcscat (in: _Dest=0x5498108, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0075.861] wcscat (in: _Dest=0x5498108, _Source="WYmAnlDUMTZ_Pt.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\WYmAnlDUMTZ_Pt.gif") returned="C:\\Users\\FD1HVy\\Pictures\\WYmAnlDUMTZ_Pt.gif" [0075.862] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5498108, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe50 [0075.862] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44c35f10, ftCreationTime.dwHighDateTime=0x1d5d62b, ftLastAccessTime.dwLowDateTime=0x405c9950, ftLastAccessTime.dwHighDateTime=0x1d5d027, ftLastWriteTime.dwLowDateTime=0x405c9950, ftLastWriteTime.dwHighDateTime=0x1d5d027, nFileSizeHigh=0x0, nFileSizeLow=0x1647, dwReserved0=0x0, dwReserved1=0x0, cFileName="zF-qkv6.jpg", cAlternateFileName="")) returned 1 [0075.862] wcscmp (_String1="zF-qkv6.jpg", _String2=".") returned 1 [0075.862] wcscmp (_String1="zF-qkv6.jpg", _String2="..") returned 1 [0075.862] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x3900468 [0075.862] wcscpy (in: _Dest=0x3900468, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0075.862] wcscat (in: _Dest=0x3900468, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0075.862] wcscat (in: _Dest=0x3900468, _Source="zF-qkv6.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\zF-qkv6.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\zF-qkv6.jpg" [0075.862] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3900468, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe54 [0075.863] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e91dd90, ftCreationTime.dwHighDateTime=0x1d5ca09, ftLastAccessTime.dwLowDateTime=0x3c384fa0, ftLastAccessTime.dwHighDateTime=0x1d5cce8, ftLastWriteTime.dwLowDateTime=0x3c384fa0, ftLastWriteTime.dwHighDateTime=0x1d5cce8, nFileSizeHigh=0x0, nFileSizeLow=0x2ade, dwReserved0=0x0, dwReserved1=0x0, cFileName="_IFws.png", cAlternateFileName="")) returned 1 [0075.863] wcscmp (_String1="_IFws.png", _String2=".") returned 1 [0075.863] wcscmp (_String1="_IFws.png", _String2="..") returned 1 [0075.863] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x46) returned 0x5532210 [0075.863] wcscpy (in: _Dest=0x5532210, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0075.863] wcscat (in: _Dest=0x5532210, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0075.863] wcscat (in: _Dest=0x5532210, _Source="_IFws.png" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\_IFws.png") returned="C:\\Users\\FD1HVy\\Pictures\\_IFws.png" [0075.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5532210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe58 [0075.864] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e91dd90, ftCreationTime.dwHighDateTime=0x1d5ca09, ftLastAccessTime.dwLowDateTime=0x3c384fa0, ftLastAccessTime.dwHighDateTime=0x1d5cce8, ftLastWriteTime.dwLowDateTime=0x3c384fa0, ftLastWriteTime.dwHighDateTime=0x1d5cce8, nFileSizeHigh=0x0, nFileSizeLow=0x2ade, dwReserved0=0x0, dwReserved1=0x0, cFileName="_IFws.png", cAlternateFileName="")) returned 0 [0075.864] FindClose (in: hFindFile=0x389ecc0 | out: hFindFile=0x389ecc0) returned 1 [0075.864] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5407698) returned 1 [0075.864] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445140) returned 1 [0075.864] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444e00) returned 1 Thread: id = 454 os_tid = 0x16ec [0072.513] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x38) returned 0x389f0c0 [0072.513] wcscpy (in: _Dest=0x389f0c0, _Source="C:\\Users\\FD1HVy\\PrintHood" | out: _Dest="C:\\Users\\FD1HVy\\PrintHood") returned="C:\\Users\\FD1HVy\\PrintHood" [0072.513] wcscat (in: _Dest=0x389f0c0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\PrintHood\\") returned="C:\\Users\\FD1HVy\\PrintHood\\" [0072.513] wcscat (in: _Dest=0x389f0c0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\PrintHood\\*") returned="C:\\Users\\FD1HVy\\PrintHood\\*" [0072.513] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b2280 [0072.513] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\PrintHood\\*", lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.813] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b2280) returned 1 [0074.813] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f0c0) returned 1 [0074.813] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444bc0) returned 1 Thread: id = 455 os_tid = 0x16f0 [0072.514] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x32) returned 0x389f100 [0072.514] wcscpy (in: _Dest=0x389f100, _Source="C:\\Users\\FD1HVy\\Recent" | out: _Dest="C:\\Users\\FD1HVy\\Recent") returned="C:\\Users\\FD1HVy\\Recent" [0072.514] wcscat (in: _Dest=0x389f100, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Recent\\") returned="C:\\Users\\FD1HVy\\Recent\\" [0072.514] wcscat (in: _Dest=0x389f100, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Recent\\*") returned="C:\\Users\\FD1HVy\\Recent\\*" [0072.514] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3904010 [0072.516] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Recent\\*", lpFindFileData=0x3904010 | out: lpFindFileData=0x3904010*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.813] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3904010) returned 1 [0074.813] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f100) returned 1 [0074.813] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e6270) returned 1 Thread: id = 456 os_tid = 0x16f4 [0072.516] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3c) returned 0x38a5b18 [0072.516] wcscpy (in: _Dest=0x38a5b18, _Source="C:\\Users\\FD1HVy\\Saved Games" | out: _Dest="C:\\Users\\FD1HVy\\Saved Games") returned="C:\\Users\\FD1HVy\\Saved Games" [0072.516] wcscat (in: _Dest=0x38a5b18, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Saved Games\\") returned="C:\\Users\\FD1HVy\\Saved Games\\" [0072.516] wcscat (in: _Dest=0x38a5b18, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Saved Games\\*") returned="C:\\Users\\FD1HVy\\Saved Games\\*" [0072.516] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3904278 [0072.516] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games\\*", lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba12f0 [0079.762] wcscmp (_String1=".", _String2=".") returned 0 [0079.762] FindNextFileW (in: hFindFile=0x5ba12f0, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.762] wcscmp (_String1="..", _String2=".") returned 1 [0079.762] wcscmp (_String1="..", _String2="..") returned 0 [0079.762] FindNextFileW (in: hFindFile=0x5ba12f0, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0079.762] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0079.762] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0079.762] FindNextFileW (in: hFindFile=0x5ba12f0, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0079.762] FindClose (in: hFindFile=0x5ba12f0 | out: hFindFile=0x5ba12f0) returned 1 [0079.762] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3904278) returned 1 [0079.762] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5b18) returned 1 [0079.762] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444c80) returned 1 Thread: id = 457 os_tid = 0x16f8 [0072.517] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x389f140 [0072.517] wcscpy (in: _Dest=0x389f140, _Source="C:\\Users\\FD1HVy\\Searches" | out: _Dest="C:\\Users\\FD1HVy\\Searches") returned="C:\\Users\\FD1HVy\\Searches" [0072.517] wcscat (in: _Dest=0x389f140, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\") returned="C:\\Users\\FD1HVy\\Searches\\" [0072.517] wcscat (in: _Dest=0x389f140, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\*") returned="C:\\Users\\FD1HVy\\Searches\\*" [0072.517] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3900650 [0072.517] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\*", lpFindFileData=0x3900650 | out: lpFindFileData=0x3900650*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ed40 [0075.244] wcscmp (_String1=".", _String2=".") returned 0 [0075.244] FindNextFileW (in: hFindFile=0x389ed40, lpFindFileData=0x3900650 | out: lpFindFileData=0x3900650*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.244] wcscmp (_String1="..", _String2=".") returned 1 [0075.244] wcscmp (_String1="..", _String2="..") returned 0 [0075.245] FindNextFileW (in: hFindFile=0x389ed40, lpFindFileData=0x3900650 | out: lpFindFileData=0x3900650*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0075.245] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0075.245] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0075.245] FindNextFileW (in: hFindFile=0x389ed40, lpFindFileData=0x3900650 | out: lpFindFileData=0x3900650*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44269063, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44269063, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44269063, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0075.245] wcscmp (_String1="Everywhere.search-ms", _String2=".") returned 1 [0075.245] wcscmp (_String1="Everywhere.search-ms", _String2="..") returned 1 [0075.245] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x38fc9e8 [0075.245] wcscpy (in: _Dest=0x38fc9e8, _Source="C:\\Users\\FD1HVy\\Searches" | out: _Dest="C:\\Users\\FD1HVy\\Searches") returned="C:\\Users\\FD1HVy\\Searches" [0075.245] wcscat (in: _Dest=0x38fc9e8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\") returned="C:\\Users\\FD1HVy\\Searches\\" [0075.245] wcscat (in: _Dest=0x38fc9e8, _Source="Everywhere.search-ms" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms") returned="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" [0075.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fc9e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc4 [0075.837] FindNextFileW (in: hFindFile=0x389ed40, lpFindFileData=0x3900650 | out: lpFindFileData=0x3900650*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44242e24, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44242e24, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44242e24, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0075.837] wcscmp (_String1="Indexed Locations.search-ms", _String2=".") returned 1 [0075.837] wcscmp (_String1="Indexed Locations.search-ms", _String2="..") returned 1 [0075.837] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6a) returned 0x5497520 [0075.837] wcscpy (in: _Dest=0x5497520, _Source="C:\\Users\\FD1HVy\\Searches" | out: _Dest="C:\\Users\\FD1HVy\\Searches") returned="C:\\Users\\FD1HVy\\Searches" [0075.837] wcscat (in: _Dest=0x5497520, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\") returned="C:\\Users\\FD1HVy\\Searches\\" [0075.837] wcscat (in: _Dest=0x5497520, _Source="Indexed Locations.search-ms" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms") returned="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" [0075.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5497520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde4 [0075.838] FindNextFileW (in: hFindFile=0x389ed40, lpFindFileData=0x3900650 | out: lpFindFileData=0x3900650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 1 [0075.838] wcscmp (_String1="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", _String2=".") returned 1 [0075.838] wcscmp (_String1="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", _String2="..") returned 1 [0075.838] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x3970940 [0075.838] wcscpy (in: _Dest=0x3970940, _Source="C:\\Users\\FD1HVy\\Searches" | out: _Dest="C:\\Users\\FD1HVy\\Searches") returned="C:\\Users\\FD1HVy\\Searches" [0075.838] wcscat (in: _Dest=0x3970940, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\") returned="C:\\Users\\FD1HVy\\Searches\\" [0075.838] wcscat (in: _Dest=0x3970940, _Source="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms") returned="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" [0075.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3970940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde8 [0075.838] FindNextFileW (in: hFindFile=0x389ed40, lpFindFileData=0x3900650 | out: lpFindFileData=0x3900650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 0 [0075.838] FindClose (in: hFindFile=0x389ed40 | out: hFindFile=0x389ed40) returned 1 [0075.838] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3900650) returned 1 [0075.839] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f140) returned 1 [0075.839] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445000) returned 1 Thread: id = 458 os_tid = 0x16fc [0072.518] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x32) returned 0x389f180 [0072.518] wcscpy (in: _Dest=0x389f180, _Source="C:\\Users\\FD1HVy\\SendTo" | out: _Dest="C:\\Users\\FD1HVy\\SendTo") returned="C:\\Users\\FD1HVy\\SendTo" [0072.518] wcscat (in: _Dest=0x389f180, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\SendTo\\") returned="C:\\Users\\FD1HVy\\SendTo\\" [0072.518] wcscat (in: _Dest=0x389f180, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\SendTo\\*") returned="C:\\Users\\FD1HVy\\SendTo\\*" [0072.518] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x39008b8 [0072.518] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\SendTo\\*", lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.814] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39008b8) returned 1 [0074.814] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f180) returned 1 [0074.814] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e6430) returned 1 Thread: id = 459 os_tid = 0x1700 [0072.518] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3a) returned 0x38a5c38 [0072.518] wcscpy (in: _Dest=0x38a5c38, _Source="C:\\Users\\FD1HVy\\Start Menu" | out: _Dest="C:\\Users\\FD1HVy\\Start Menu") returned="C:\\Users\\FD1HVy\\Start Menu" [0072.518] wcscat (in: _Dest=0x38a5c38, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Start Menu\\") returned="C:\\Users\\FD1HVy\\Start Menu\\" [0072.518] wcscat (in: _Dest=0x38a5c38, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Start Menu\\*") returned="C:\\Users\\FD1HVy\\Start Menu\\*" [0072.518] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3900b20 [0072.518] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Start Menu\\*", lpFindFileData=0x3900b20 | out: lpFindFileData=0x3900b20*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.815] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3900b20) returned 1 [0074.815] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5c38) returned 1 [0074.815] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445280) returned 1 Thread: id = 460 os_tid = 0x1704 [0072.519] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x38) returned 0x389f280 [0072.519] wcscpy (in: _Dest=0x389f280, _Source="C:\\Users\\FD1HVy\\Templates" | out: _Dest="C:\\Users\\FD1HVy\\Templates") returned="C:\\Users\\FD1HVy\\Templates" [0072.519] wcscat (in: _Dest=0x389f280, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Templates\\") returned="C:\\Users\\FD1HVy\\Templates\\" [0072.519] wcscat (in: _Dest=0x389f280, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Templates\\*") returned="C:\\Users\\FD1HVy\\Templates\\*" [0072.519] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3900d88 [0072.519] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Templates\\*", lpFindFileData=0x3900d88 | out: lpFindFileData=0x3900d88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.911] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3900d88) returned 1 [0074.911] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f280) returned 1 [0074.911] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444d80) returned 1 Thread: id = 461 os_tid = 0x1708 [0072.520] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x32) returned 0x389f300 [0072.520] wcscpy (in: _Dest=0x389f300, _Source="C:\\Users\\FD1HVy\\Videos" | out: _Dest="C:\\Users\\FD1HVy\\Videos") returned="C:\\Users\\FD1HVy\\Videos" [0072.520] wcscat (in: _Dest=0x389f300, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0072.520] wcscat (in: _Dest=0x389f300, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\*") returned="C:\\Users\\FD1HVy\\Videos\\*" [0072.520] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3900ff0 [0072.520] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\*", lpFindFileData=0x3900ff0 | out: lpFindFileData=0x3900ff0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x39d49881, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39d49881, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ee00 [0075.246] wcscmp (_String1=".", _String2=".") returned 0 [0075.246] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x3900ff0 | out: lpFindFileData=0x3900ff0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x39d49881, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39d49881, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.247] wcscmp (_String1="..", _String2=".") returned 1 [0075.247] wcscmp (_String1="..", _String2="..") returned 0 [0075.247] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x3900ff0 | out: lpFindFileData=0x3900ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c1687c0, ftCreationTime.dwHighDateTime=0x1d5d35a, ftLastAccessTime.dwLowDateTime=0x6403d4c0, ftLastAccessTime.dwHighDateTime=0x1d5cba6, ftLastWriteTime.dwLowDateTime=0x6403d4c0, ftLastWriteTime.dwHighDateTime=0x1d5cba6, nFileSizeHigh=0x0, nFileSizeLow=0x127e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="-AXGVk.mp4", cAlternateFileName="")) returned 1 [0075.247] wcscmp (_String1="-AXGVk.mp4", _String2=".") returned -1 [0075.247] wcscmp (_String1="-AXGVk.mp4", _String2="..") returned -1 [0075.247] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x5442fb0 [0075.247] wcscpy (in: _Dest=0x5442fb0, _Source="C:\\Users\\FD1HVy\\Videos" | out: _Dest="C:\\Users\\FD1HVy\\Videos") returned="C:\\Users\\FD1HVy\\Videos" [0075.247] wcscat (in: _Dest=0x5442fb0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0075.247] wcscat (in: _Dest=0x5442fb0, _Source="-AXGVk.mp4" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\-AXGVk.mp4") returned="C:\\Users\\FD1HVy\\Videos\\-AXGVk.mp4" [0075.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5442fb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc8 [0075.827] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x3900ff0 | out: lpFindFileData=0x3900ff0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43f94523, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0075.828] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0075.828] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0075.828] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x3900ff0 | out: lpFindFileData=0x3900ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3fb470, ftCreationTime.dwHighDateTime=0x1d5ce24, ftLastAccessTime.dwLowDateTime=0x5b934060, ftLastAccessTime.dwHighDateTime=0x1d5c830, ftLastWriteTime.dwLowDateTime=0x5b934060, ftLastWriteTime.dwHighDateTime=0x1d5c830, nFileSizeHigh=0x0, nFileSizeLow=0x2d43, dwReserved0=0x0, dwReserved1=0x0, cFileName="dyKrMrvMr3I6DDt1.swf", cAlternateFileName="DYKRMR~1.SWF")) returned 1 [0075.828] wcscmp (_String1="dyKrMrvMr3I6DDt1.swf", _String2=".") returned 1 [0075.828] wcscmp (_String1="dyKrMrvMr3I6DDt1.swf", _String2="..") returned 1 [0075.828] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x543d938 [0075.828] wcscpy (in: _Dest=0x543d938, _Source="C:\\Users\\FD1HVy\\Videos" | out: _Dest="C:\\Users\\FD1HVy\\Videos") returned="C:\\Users\\FD1HVy\\Videos" [0075.828] wcscat (in: _Dest=0x543d938, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0075.828] wcscat (in: _Dest=0x543d938, _Source="dyKrMrvMr3I6DDt1.swf" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\dyKrMrvMr3I6DDt1.swf") returned="C:\\Users\\FD1HVy\\Videos\\dyKrMrvMr3I6DDt1.swf" [0075.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x543d938, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc8 [0075.828] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x3900ff0 | out: lpFindFileData=0x3900ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33d4aad0, ftCreationTime.dwHighDateTime=0x1d5ce18, ftLastAccessTime.dwLowDateTime=0x37d134f0, ftLastAccessTime.dwHighDateTime=0x1d5d38b, ftLastWriteTime.dwLowDateTime=0x37d134f0, ftLastWriteTime.dwHighDateTime=0x1d5d38b, nFileSizeHigh=0x0, nFileSizeLow=0x82ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="dYrp6RPEfNrynZ9.flv", cAlternateFileName="DYRP6R~1.FLV")) returned 1 [0075.828] wcscmp (_String1="dYrp6RPEfNrynZ9.flv", _String2=".") returned 1 [0075.828] wcscmp (_String1="dYrp6RPEfNrynZ9.flv", _String2="..") returned 1 [0075.828] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x543d2d8 [0075.829] wcscpy (in: _Dest=0x543d2d8, _Source="C:\\Users\\FD1HVy\\Videos" | out: _Dest="C:\\Users\\FD1HVy\\Videos") returned="C:\\Users\\FD1HVy\\Videos" [0075.829] wcscat (in: _Dest=0x543d2d8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0075.829] wcscat (in: _Dest=0x543d2d8, _Source="dYrp6RPEfNrynZ9.flv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\dYrp6RPEfNrynZ9.flv") returned="C:\\Users\\FD1HVy\\Videos\\dYrp6RPEfNrynZ9.flv" [0075.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x543d2d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdcc [0075.829] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x3900ff0 | out: lpFindFileData=0x3900ff0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46190940, ftCreationTime.dwHighDateTime=0x1d5cb91, ftLastAccessTime.dwLowDateTime=0xe666b640, ftLastAccessTime.dwHighDateTime=0x1d5cd26, ftLastWriteTime.dwLowDateTime=0xe666b640, ftLastWriteTime.dwHighDateTime=0x1d5cd26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IgPHumGpOyi", cAlternateFileName="IGPHUM~1")) returned 1 [0075.829] wcscmp (_String1="IgPHumGpOyi", _String2=".") returned 1 [0075.829] wcscmp (_String1="IgPHumGpOyi", _String2="..") returned 1 [0075.829] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x46) returned 0x5532800 [0075.829] wcscpy (in: _Dest=0x5532800, _Source="C:\\Users\\FD1HVy\\Videos" | out: _Dest="C:\\Users\\FD1HVy\\Videos") returned="C:\\Users\\FD1HVy\\Videos" [0075.829] wcscat (in: _Dest=0x5532800, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0075.829] wcscat (in: _Dest=0x5532800, _Source="IgPHumGpOyi" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi" [0075.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5532800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd0 [0075.831] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x3900ff0 | out: lpFindFileData=0x3900ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2120c8c0, ftCreationTime.dwHighDateTime=0x1d5c83b, ftLastAccessTime.dwLowDateTime=0x93a410, ftLastAccessTime.dwHighDateTime=0x1d5c8d6, ftLastWriteTime.dwLowDateTime=0x93a410, ftLastWriteTime.dwHighDateTime=0x1d5c8d6, nFileSizeHigh=0x0, nFileSizeLow=0xc6c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="iLYC1Kq.swf", cAlternateFileName="")) returned 1 [0075.831] wcscmp (_String1="iLYC1Kq.swf", _String2=".") returned 1 [0075.831] wcscmp (_String1="iLYC1Kq.swf", _String2="..") returned 1 [0075.831] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x46) returned 0x55321c0 [0075.831] wcscpy (in: _Dest=0x55321c0, _Source="C:\\Users\\FD1HVy\\Videos" | out: _Dest="C:\\Users\\FD1HVy\\Videos") returned="C:\\Users\\FD1HVy\\Videos" [0075.831] wcscat (in: _Dest=0x55321c0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0075.831] wcscat (in: _Dest=0x55321c0, _Source="iLYC1Kq.swf" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\iLYC1Kq.swf") returned="C:\\Users\\FD1HVy\\Videos\\iLYC1Kq.swf" [0075.831] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55321c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd4 [0075.832] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x3900ff0 | out: lpFindFileData=0x3900ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea514df0, ftCreationTime.dwHighDateTime=0x1d5c8f4, ftLastAccessTime.dwLowDateTime=0x4860dfa0, ftLastAccessTime.dwHighDateTime=0x1d5d6c4, ftLastWriteTime.dwLowDateTime=0x4860dfa0, ftLastWriteTime.dwHighDateTime=0x1d5d6c4, nFileSizeHigh=0x0, nFileSizeLow=0xc4e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="JAMR22Wfa.mp4", cAlternateFileName="JAMR22~1.MP4")) returned 1 [0075.832] wcscmp (_String1="JAMR22Wfa.mp4", _String2=".") returned 1 [0075.832] wcscmp (_String1="JAMR22Wfa.mp4", _String2="..") returned 1 [0075.832] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x3900048 [0075.832] wcscpy (in: _Dest=0x3900048, _Source="C:\\Users\\FD1HVy\\Videos" | out: _Dest="C:\\Users\\FD1HVy\\Videos") returned="C:\\Users\\FD1HVy\\Videos" [0075.832] wcscat (in: _Dest=0x3900048, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0075.832] wcscat (in: _Dest=0x3900048, _Source="JAMR22Wfa.mp4" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\JAMR22Wfa.mp4") returned="C:\\Users\\FD1HVy\\Videos\\JAMR22Wfa.mp4" [0075.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3900048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd8 [0075.833] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x3900ff0 | out: lpFindFileData=0x3900ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd8539f0, ftCreationTime.dwHighDateTime=0x1d5d41e, ftLastAccessTime.dwLowDateTime=0x3e1c8760, ftLastAccessTime.dwHighDateTime=0x1d5ce45, ftLastWriteTime.dwLowDateTime=0x3e1c8760, ftLastWriteTime.dwHighDateTime=0x1d5ce45, nFileSizeHigh=0x0, nFileSizeLow=0x954a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SNKrcMAU.mkv", cAlternateFileName="")) returned 1 [0075.833] wcscmp (_String1="SNKrcMAU.mkv", _String2=".") returned 1 [0075.833] wcscmp (_String1="SNKrcMAU.mkv", _String2="..") returned 1 [0075.833] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x55322b0 [0075.833] wcscpy (in: _Dest=0x55322b0, _Source="C:\\Users\\FD1HVy\\Videos" | out: _Dest="C:\\Users\\FD1HVy\\Videos") returned="C:\\Users\\FD1HVy\\Videos" [0075.833] wcscat (in: _Dest=0x55322b0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0075.833] wcscat (in: _Dest=0x55322b0, _Source="SNKrcMAU.mkv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SNKrcMAU.mkv") returned="C:\\Users\\FD1HVy\\Videos\\SNKrcMAU.mkv" [0075.833] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55322b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xddc [0075.834] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x3900ff0 | out: lpFindFileData=0x3900ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x517f9960, ftCreationTime.dwHighDateTime=0x1d5d41b, ftLastAccessTime.dwLowDateTime=0xa50d0410, ftLastAccessTime.dwHighDateTime=0x1d5d037, ftLastWriteTime.dwLowDateTime=0xa50d0410, ftLastWriteTime.dwHighDateTime=0x1d5d037, nFileSizeHigh=0x0, nFileSizeLow=0x13d2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAw1mXxnf1gDdzqF5w4N.flv", cAlternateFileName="YAW1MX~1.FLV")) returned 1 [0075.834] wcscmp (_String1="YAw1mXxnf1gDdzqF5w4N.flv", _String2=".") returned 1 [0075.834] wcscmp (_String1="YAw1mXxnf1gDdzqF5w4N.flv", _String2="..") returned 1 [0075.834] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x38fd068 [0075.834] wcscpy (in: _Dest=0x38fd068, _Source="C:\\Users\\FD1HVy\\Videos" | out: _Dest="C:\\Users\\FD1HVy\\Videos") returned="C:\\Users\\FD1HVy\\Videos" [0075.834] wcscat (in: _Dest=0x38fd068, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0075.834] wcscat (in: _Dest=0x38fd068, _Source="YAw1mXxnf1gDdzqF5w4N.flv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\YAw1mXxnf1gDdzqF5w4N.flv") returned="C:\\Users\\FD1HVy\\Videos\\YAw1mXxnf1gDdzqF5w4N.flv" [0075.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fd068, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde0 [0075.834] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x3900ff0 | out: lpFindFileData=0x3900ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x517f9960, ftCreationTime.dwHighDateTime=0x1d5d41b, ftLastAccessTime.dwLowDateTime=0xa50d0410, ftLastAccessTime.dwHighDateTime=0x1d5d037, ftLastWriteTime.dwLowDateTime=0xa50d0410, ftLastWriteTime.dwHighDateTime=0x1d5d037, nFileSizeHigh=0x0, nFileSizeLow=0x13d2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAw1mXxnf1gDdzqF5w4N.flv", cAlternateFileName="YAW1MX~1.FLV")) returned 0 [0075.834] FindClose (in: hFindFile=0x389ee00 | out: hFindFile=0x389ee00) returned 1 [0075.835] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3900ff0) returned 1 [0075.835] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f300) returned 1 [0075.835] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e64a0) returned 1 Thread: id = 462 os_tid = 0x170c [0072.521] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0087.045] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0087.517] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.527] GetLastError () returned 0x5 [0089.527] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0089.528] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e7d30) returned 1 Thread: id = 463 os_tid = 0x1710 [0072.522] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0087.045] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0087.517] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.917] GetLastError () returned 0x5 [0087.917] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0087.917] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e79f0) returned 1 Thread: id = 464 os_tid = 0x1714 [0072.523] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x53f7610 [0072.523] wcscpy (in: _Dest=0x53f7610, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0072.523] wcscat (in: _Dest=0x53f7610, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0072.523] wcscat (in: _Dest=0x53f7610, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*" [0072.523] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3901258 [0072.523] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x3901258 | out: lpFindFileData=0x3901258*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ae5394, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaaf18f1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x68ae5394, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba13b0 [0079.125] wcscmp (_String1=".", _String2=".") returned 0 [0079.125] FindNextFileW (in: hFindFile=0x5ba13b0, lpFindFileData=0x3901258 | out: lpFindFileData=0x3901258*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ae5394, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaaf18f1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x68ae5394, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.125] wcscmp (_String1="..", _String2=".") returned 1 [0079.125] wcscmp (_String1="..", _String2="..") returned 0 [0079.125] FindNextFileW (in: hFindFile=0x5ba13b0, lpFindFileData=0x3901258 | out: lpFindFileData=0x3901258*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ae5394, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68ae5394, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68ae5394, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x31a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1 [0079.125] wcscmp (_String1="CodeIntegrity.cat", _String2=".") returned 1 [0079.125] wcscmp (_String1="CodeIntegrity.cat", _String2="..") returned 1 [0079.125] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x396f118 [0079.125] wcscpy (in: _Dest=0x396f118, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0079.125] wcscat (in: _Dest=0x396f118, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0079.125] wcscat (in: _Dest=0x396f118, _Source="CodeIntegrity.cat" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" [0080.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396f118, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13bc [0080.787] FindNextFileW (in: hFindFile=0x5ba13b0, lpFindFileData=0x3901258 | out: lpFindFileData=0x3901258*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ae5394, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68ae5394, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68ae5394, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x31a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 0 [0080.788] FindClose (in: hFindFile=0x5ba13b0 | out: hFindFile=0x5ba13b0) returned 1 [0080.788] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3901258) returned 1 [0080.788] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f7610) returned 1 [0080.788] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fec90) returned 1 Thread: id = 465 os_tid = 0x1718 [0072.524] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0087.045] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0087.517] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.916] GetLastError () returned 0x5 [0087.916] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0087.916] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e72a0) returned 1 Thread: id = 466 os_tid = 0x171c [0072.524] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb6) returned 0x39047e0 [0072.524] wcscpy (in: _Dest=0x39047e0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets" [0072.525] wcscat (in: _Dest=0x39047e0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\" [0072.525] wcscat (in: _Dest=0x39047e0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\*" [0072.525] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3901990 [0072.525] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x3901990 | out: lpFindFileData=0x3901990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ae5394, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaafbd2f7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x68bca1ad, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7567308 [0087.047] wcscmp (_String1=".", _String2=".") returned 0 [0087.047] FindNextFileW (hFindFile=0x7567308, lpFindFileData=0x3901990) Thread: id = 467 os_tid = 0x1720 [0072.525] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsApp.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\callsapp.winmd")) returned 0x20 [0087.045] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsApp.winmd", dwFileAttributes=0x20) returned 0 [0087.516] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsApp.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\callsapp.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.914] GetLastError () returned 0x5 [0087.915] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsApp.winmd", dwFileAttributes=0x20) returned 0 [0087.915] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e7920) returned 1 Thread: id = 468 os_tid = 0x1724 [0072.527] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsCore.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\callscore.winmd")) returned 0x20 [0087.044] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsCore.winmd", dwFileAttributes=0x20) returned 0 [0087.516] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsCore.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\callscore.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.913] GetLastError () returned 0x5 [0087.913] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsCore.winmd", dwFileAttributes=0x20) returned 0 [0087.913] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e7ac0) returned 1 Thread: id = 469 os_tid = 0x1728 [0072.527] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsResources.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\callsresources.winmd")) returned 0x20 [0087.044] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsResources.winmd", dwFileAttributes=0x20) returned 0 [0087.516] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsResources.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\callsresources.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.912] GetLastError () returned 0x5 [0087.912] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsResources.winmd", dwFileAttributes=0x20) returned 0 [0087.912] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ba830) returned 1 Thread: id = 470 os_tid = 0x172c [0072.528] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsRTShims.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\callsrtshims.winmd")) returned 0x20 [0087.044] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsRTShims.winmd", dwFileAttributes=0x20) returned 0 [0087.516] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsRTShims.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\callsrtshims.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.911] GetLastError () returned 0x5 [0087.911] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsRTShims.winmd", dwFileAttributes=0x20) returned 0 [0087.911] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b9ab0) returned 1 Thread: id = 471 os_tid = 0x1730 [0072.529] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Microsoft.People.Controls.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\microsoft.people.controls.winmd")) returned 0x20 [0087.044] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Microsoft.People.Controls.winmd", dwFileAttributes=0x20) returned 0 [0087.515] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Microsoft.People.Controls.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\microsoft.people.controls.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.909] GetLastError () returned 0x5 [0087.909] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Microsoft.People.Controls.winmd", dwFileAttributes=0x20) returned 0 [0087.910] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b4af8) Thread: id = 472 os_tid = 0x1734 [0072.529] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x5450890 [0072.529] wcscpy (in: _Dest=0x5450890, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0072.529] wcscat (in: _Dest=0x5450890, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0072.529] wcscat (in: _Dest=0x5450890, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0072.529] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x39014c0 [0072.529] FindFirstFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x39014c0) Thread: id = 473 os_tid = 0x1738 [0072.530] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\resources.pri")) returned 0x20 [0087.044] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0087.516] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.910] GetLastError () returned 0x5 [0087.910] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0087.910] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b4cd8) Thread: id = 474 os_tid = 0x173c [0072.531] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\WindowsPhoneReservedAppInfo.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\windowsphonereservedappinfo.xml")) returned 0x20 [0087.517] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\WindowsPhoneReservedAppInfo.xml", dwFileAttributes=0x20) returned 0 [0089.529] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\WindowsPhoneReservedAppInfo.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\windowsphonereservedappinfo.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.529] GetLastError () returned 0x5 [0089.529] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\WindowsPhoneReservedAppInfo.xml", dwFileAttributes=0x20) returned 0 [0089.529] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b4da0) returned 1 Thread: id = 475 os_tid = 0x1740 [0072.532] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0082.517] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0082.543] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.581] GetLastError () returned 0x5 [0082.581] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0082.594] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ba320) returned 1 Thread: id = 476 os_tid = 0x1744 [0072.533] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0082.543] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0082.567] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.581] GetLastError () returned 0x5 [0082.581] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0082.595] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53bb250) returned 1 Thread: id = 477 os_tid = 0x1748 [0072.534] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x38fdeb8 [0072.534] wcscpy (in: _Dest=0x38fdeb8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0072.534] wcscat (in: _Dest=0x38fdeb8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0072.534] wcscat (in: _Dest=0x38fdeb8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*" [0072.534] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3901728 [0072.534] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x3901728 | out: lpFindFileData=0x3901728*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5373138, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08a798, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd5373138, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f00 [0077.329] wcscmp (_String1=".", _String2=".") returned 0 [0077.329] FindNextFileW (in: hFindFile=0x5444f00, lpFindFileData=0x3901728 | out: lpFindFileData=0x3901728*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5373138, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08a798, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd5373138, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.329] wcscmp (_String1="..", _String2=".") returned 1 [0077.329] wcscmp (_String1="..", _String2="..") returned 0 [0077.329] FindNextFileW (in: hFindFile=0x5444f00, lpFindFileData=0x3901728 | out: lpFindFileData=0x3901728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5373138, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xd5373138, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xd5373138, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2b4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1 [0077.329] wcscmp (_String1="CodeIntegrity.cat", _String2=".") returned 1 [0077.329] wcscmp (_String1="CodeIntegrity.cat", _String2="..") returned 1 [0077.329] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x393e9f0 [0077.329] wcscpy (in: _Dest=0x393e9f0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0077.329] wcscat (in: _Dest=0x393e9f0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0077.329] wcscat (in: _Dest=0x393e9f0, _Source="CodeIntegrity.cat" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" [0080.929] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x393e9f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1244 [0080.930] FindNextFileW (in: hFindFile=0x5444f00, lpFindFileData=0x3901728 | out: lpFindFileData=0x3901728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5373138, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xd5373138, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xd5373138, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2b4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 0 [0080.930] FindClose (in: hFindFile=0x5444f00 | out: hFindFile=0x5444f00) returned 1 [0080.930] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3901728) returned 1 [0080.930] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38fdeb8) returned 1 [0080.930] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e7b90) returned 1 Thread: id = 478 os_tid = 0x174c [0072.534] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0082.568] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0082.582] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.620] GetLastError () returned 0x5 [0082.620] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0082.631] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b4e90) returned 1 Thread: id = 479 os_tid = 0x1750 [0072.535] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x53f9510 [0072.535] wcscpy (in: _Dest=0x53f9510, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets" [0072.535] wcscat (in: _Dest=0x53f9510, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\" [0072.535] wcscat (in: _Dest=0x53f9510, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\*" [0072.535] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3901bf8 [0072.535] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x3901bf8 | out: lpFindFileData=0x3901bf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd53994f2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08aff3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd53994f2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f040 [0074.819] wcscmp (_String1=".", _String2=".") returned 0 [0074.819] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x3901bf8 | out: lpFindFileData=0x3901bf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd53994f2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08aff3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd53994f2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.819] wcscmp (_String1="..", _String2=".") returned 1 [0074.819] wcscmp (_String1="..", _String2="..") returned 0 [0074.819] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x3901bf8 | out: lpFindFileData=0x3901bf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53994f2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xd53994f2, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xd53994f2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4f62, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrandingLogo.png", cAlternateFileName="")) returned 1 [0074.819] wcscmp (_String1="BrandingLogo.png", _String2=".") returned 1 [0074.819] wcscmp (_String1="BrandingLogo.png", _String2="..") returned 1 [0074.819] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xde) returned 0x38cee30 [0074.819] wcscpy (in: _Dest=0x38cee30, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets" [0074.819] wcscat (in: _Dest=0x38cee30, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.819] wcscat (in: _Dest=0x38cee30, _Source="BrandingLogo.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\BrandingLogo.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\BrandingLogo.png" [0074.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38cee30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb8c [0074.820] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x3901bf8 | out: lpFindFileData=0x3901bf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53994f2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xd53994f2, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xd53994f2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logo.scale-100.png", cAlternateFileName="")) returned 1 [0074.820] wcscmp (_String1="Logo.scale-100.png", _String2=".") returned 1 [0074.820] wcscmp (_String1="Logo.scale-100.png", _String2="..") returned 1 [0074.820] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x396e6c8 [0074.820] wcscpy (in: _Dest=0x396e6c8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets" [0074.820] wcscat (in: _Dest=0x396e6c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.820] wcscat (in: _Dest=0x396e6c8, _Source="Logo.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Logo.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Logo.scale-100.png" [0074.820] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396e6c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb90 [0074.821] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x3901bf8 | out: lpFindFileData=0x3901bf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53994f2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xd53994f2, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xd53994f2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.scale-100.png", cAlternateFileName="")) returned 1 [0074.821] wcscmp (_String1="SmallLogo.scale-100.png", _String2=".") returned 1 [0074.821] wcscmp (_String1="SmallLogo.scale-100.png", _String2="..") returned 1 [0074.821] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x393d978 [0074.821] wcscpy (in: _Dest=0x393d978, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets" [0074.821] wcscat (in: _Dest=0x393d978, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.821] wcscat (in: _Dest=0x393d978, _Source="SmallLogo.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.scale-100.png" [0074.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x393d978, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb94 [0074.822] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x3901bf8 | out: lpFindFileData=0x3901bf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53994f2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xd53994f2, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xd53994f2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.targetsize-16.png", cAlternateFileName="")) returned 1 [0074.822] wcscmp (_String1="SmallLogo.targetsize-16.png", _String2=".") returned 1 [0074.822] wcscmp (_String1="SmallLogo.targetsize-16.png", _String2="..") returned 1 [0074.822] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf4) returned 0x53fcf80 [0074.822] wcscpy (in: _Dest=0x53fcf80, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets" [0074.822] wcscat (in: _Dest=0x53fcf80, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.822] wcscat (in: _Dest=0x53fcf80, _Source="SmallLogo.targetsize-16.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-16.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-16.png" [0074.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53fcf80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb98 [0074.823] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x3901bf8 | out: lpFindFileData=0x3901bf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53994f2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xd53994f2, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xd53994f2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.targetsize-24.png", cAlternateFileName="")) returned 1 [0074.823] wcscmp (_String1="SmallLogo.targetsize-24.png", _String2=".") returned 1 [0074.823] wcscmp (_String1="SmallLogo.targetsize-24.png", _String2="..") returned 1 [0074.823] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf4) returned 0x53fd798 [0074.823] wcscpy (in: _Dest=0x53fd798, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets" [0074.823] wcscat (in: _Dest=0x53fd798, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.823] wcscat (in: _Dest=0x53fd798, _Source="SmallLogo.targetsize-24.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-24.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-24.png" [0074.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53fd798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb9c [0074.823] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x3901bf8 | out: lpFindFileData=0x3901bf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53994f2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xd53994f2, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xd53994f2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1051, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.targetsize-256.png", cAlternateFileName="")) returned 1 [0074.823] wcscmp (_String1="SmallLogo.targetsize-256.png", _String2=".") returned 1 [0074.823] wcscmp (_String1="SmallLogo.targetsize-256.png", _String2="..") returned 1 [0074.824] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf6) returned 0x53fd898 [0074.824] wcscpy (in: _Dest=0x53fd898, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets" [0074.824] wcscat (in: _Dest=0x53fd898, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.824] wcscat (in: _Dest=0x53fd898, _Source="SmallLogo.targetsize-256.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-256.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-256.png" [0074.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53fd898, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xba0 [0074.826] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x3901bf8 | out: lpFindFileData=0x3901bf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53994f2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xd53994f2, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xd53994f2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.targetsize-48.png", cAlternateFileName="")) returned 1 [0074.826] wcscmp (_String1="SmallLogo.targetsize-48.png", _String2=".") returned 1 [0074.826] wcscmp (_String1="SmallLogo.targetsize-48.png", _String2="..") returned 1 [0074.826] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf4) returned 0x53fd998 [0074.826] wcscpy (in: _Dest=0x53fd998, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets" [0074.826] wcscat (in: _Dest=0x53fd998, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.826] wcscat (in: _Dest=0x53fd998, _Source="SmallLogo.targetsize-48.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-48.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-48.png" [0074.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53fd998, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xba4 [0074.827] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x3901bf8 | out: lpFindFileData=0x3901bf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53994f2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xd53994f2, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xd53994f2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x950, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.scale-100.png", cAlternateFileName="")) returned 1 [0074.827] wcscmp (_String1="SplashScreen.scale-100.png", _String2=".") returned 1 [0074.827] wcscmp (_String1="SplashScreen.scale-100.png", _String2="..") returned 1 [0074.827] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x53fda98 [0074.827] wcscpy (in: _Dest=0x53fda98, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets" [0074.827] wcscat (in: _Dest=0x53fda98, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.827] wcscat (in: _Dest=0x53fda98, _Source="SplashScreen.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen.scale-100.png" [0074.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53fda98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xba8 [0074.827] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x3901bf8 | out: lpFindFileData=0x3901bf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53994f2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xd53994f2, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xd53994f2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x837, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square310x310Logo.scale-100.png", cAlternateFileName="")) returned 1 [0074.827] wcscmp (_String1="Square310x310Logo.scale-100.png", _String2=".") returned 1 [0074.827] wcscmp (_String1="Square310x310Logo.scale-100.png", _String2="..") returned 1 [0074.827] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x53fdb98 [0074.827] wcscpy (in: _Dest=0x53fdb98, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets" [0074.828] wcscat (in: _Dest=0x53fdb98, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.828] wcscat (in: _Dest=0x53fdb98, _Source="Square310x310Logo.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Square310x310Logo.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Square310x310Logo.scale-100.png" [0074.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53fdb98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbac [0074.828] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x3901bf8 | out: lpFindFileData=0x3901bf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53994f2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xd53994f2, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xd53994f2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square71x71Logo.scale-100.png", cAlternateFileName="")) returned 1 [0074.828] wcscmp (_String1="Square71x71Logo.scale-100.png", _String2=".") returned 1 [0074.828] wcscmp (_String1="Square71x71Logo.scale-100.png", _String2="..") returned 1 [0074.828] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf8) returned 0x53fdca0 [0074.828] wcscpy (in: _Dest=0x53fdca0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets" [0074.828] wcscat (in: _Dest=0x53fdca0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.828] wcscat (in: _Dest=0x53fdca0, _Source="Square71x71Logo.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Square71x71Logo.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Square71x71Logo.scale-100.png" [0074.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53fdca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbb0 [0074.829] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x3901bf8 | out: lpFindFileData=0x3901bf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53994f2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xd53994f2, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xd53994f2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.scale-100.png", cAlternateFileName="")) returned 1 [0074.829] wcscmp (_String1="StoreLogo.scale-100.png", _String2=".") returned 1 [0074.829] wcscmp (_String1="StoreLogo.scale-100.png", _String2="..") returned 1 [0074.829] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x393eae8 [0074.829] wcscpy (in: _Dest=0x393eae8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets" [0074.829] wcscat (in: _Dest=0x393eae8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.829] wcscat (in: _Dest=0x393eae8, _Source="StoreLogo.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\StoreLogo.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\StoreLogo.scale-100.png" [0074.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x393eae8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbb4 [0074.830] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x3901bf8 | out: lpFindFileData=0x3901bf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53994f2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xd53994f2, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xd53994f2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x447, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wide310x150Logo.scale-100.png", cAlternateFileName="")) returned 1 [0074.830] wcscmp (_String1="Wide310x150Logo.scale-100.png", _String2=".") returned 1 [0074.830] wcscmp (_String1="Wide310x150Logo.scale-100.png", _String2="..") returned 1 [0074.830] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf8) returned 0x54a3900 [0074.830] wcscpy (in: _Dest=0x54a3900, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets" [0074.830] wcscat (in: _Dest=0x54a3900, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\" [0074.830] wcscat (in: _Dest=0x54a3900, _Source="Wide310x150Logo.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Wide310x150Logo.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Wide310x150Logo.scale-100.png" [0074.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54a3900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbb8 [0074.831] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x3901bf8 | out: lpFindFileData=0x3901bf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53994f2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xd53994f2, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xd53994f2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x447, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wide310x150Logo.scale-100.png", cAlternateFileName="")) returned 0 [0074.831] FindClose (in: hFindFile=0x389f040 | out: hFindFile=0x389f040) returned 1 [0074.832] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3901bf8) returned 1 [0074.832] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f9510) returned 1 [0074.832] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e8350) returned 1 Thread: id = 480 os_tid = 0x1754 [0072.536] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x53f95d8 [0072.536] wcscpy (in: _Dest=0x53f95d8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ" [0072.536] wcscat (in: _Dest=0x53f95d8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\" [0072.536] wcscat (in: _Dest=0x53f95d8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\*" [0072.536] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3901e60 [0072.536] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\*", lpFindFileData=0x3901e60 | out: lpFindFileData=0x3901e60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08b876, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445900 [0082.828] wcscmp (_String1=".", _String2=".") returned 0 [0082.828] FindNextFileW (in: hFindFile=0x5445900, lpFindFileData=0x3901e60 | out: lpFindFileData=0x3901e60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08b876, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.828] wcscmp (_String1="..", _String2=".") returned 1 [0082.828] wcscmp (_String1="..", _String2="..") returned 0 [0082.828] FindNextFileW (in: hFindFile=0x5445900, lpFindFileData=0x3901e60 | out: lpFindFileData=0x3901e60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08c849, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0082.828] wcscmp (_String1="en-gb", _String2=".") returned 1 [0082.828] wcscmp (_String1="en-gb", _String2="..") returned 1 [0082.828] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x3970bb0 [0082.828] wcscpy (in: _Dest=0x3970bb0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ" [0082.828] wcscat (in: _Dest=0x3970bb0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\" [0082.828] wcscat (in: _Dest=0x3970bb0, _Source="en-gb" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\en-gb") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\en-gb" [0082.829] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x3972000 [0082.829] wcscpy (in: _Dest=0x3972000, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\en-gb" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\en-gb") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\en-gb" [0082.829] wcscat (in: _Dest=0x3972000, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\en-gb\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\en-gb\\" [0082.829] wcscat (in: _Dest=0x3972000, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\en-gb\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\en-gb\\*" [0082.829] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542de68 [0082.829] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\en-gb\\*", lpFindFileData=0x542de68 | out: lpFindFileData=0x542de68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08c849, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7567c88 [0087.676] wcscmp (_String1=".", _String2=".") returned 0 [0087.676] FindNextFileW (hFindFile=0x7567c88, lpFindFileData=0x542de68) Thread: id = 481 os_tid = 0x1758 [0072.537] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf6) returned 0x53fd590 [0072.537] wcscpy (in: _Dest=0x53fd590, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0072.537] wcscat (in: _Dest=0x53fd590, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0072.537] wcscat (in: _Dest=0x53fd590, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0072.537] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3902cd0 [0072.537] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x3902cd0 | out: lpFindFileData=0x3902cd0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x628cd443, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xab08dbee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628cd443, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ed40 [0085.997] wcscmp (_String1=".", _String2=".") returned 0 [0085.997] FindNextFileW (in: hFindFile=0x389ed40, lpFindFileData=0x3902cd0 | out: lpFindFileData=0x3902cd0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x628cd443, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xab08dbee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628cd443, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.997] wcscmp (_String1="..", _String2=".") returned 1 [0085.997] wcscmp (_String1="..", _String2="..") returned 0 [0085.997] FindNextFileW (in: hFindFile=0x389ed40, lpFindFileData=0x3902cd0 | out: lpFindFileData=0x3902cd0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x628cd443, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xab08dbee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628cd443, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0085.997] FindClose (in: hFindFile=0x389ed40 | out: hFindFile=0x389ed40) returned 1 [0085.998] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3902cd0) returned 1 [0085.998] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fd590) returned 1 [0085.998] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b4f70) returned 1 Thread: id = 482 os_tid = 0x175c [0072.538] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Package.StoreAssociation.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\package.storeassociation.xml")) returned 0x20 [0082.622] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Package.StoreAssociation.xml", dwFileAttributes=0x20) returned 0 [0082.631] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Package.StoreAssociation.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\package.storeassociation.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.644] GetLastError () returned 0x5 [0082.644] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Package.StoreAssociation.xml", dwFileAttributes=0x20) returned 0 [0087.047] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b5070) Thread: id = 483 os_tid = 0x1760 [0072.538] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\resources.pri")) returned 0x20 [0082.632] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0082.644] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.665] GetLastError () returned 0x5 [0087.665] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0087.665] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53baab8) returned 1 Thread: id = 484 os_tid = 0x1764 [0072.540] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x38fdf90 [0072.540] wcscpy (in: _Dest=0x38fdf90, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService" [0072.540] wcscat (in: _Dest=0x38fdf90, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\" [0072.540] wcscat (in: _Dest=0x38fdf90, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\*" [0072.540] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x39020c8 [0072.540] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\*", lpFindFileData=0x39020c8 | out: lpFindFileData=0x39020c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08e5b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445840 [0082.647] wcscmp (_String1=".", _String2=".") returned 0 [0082.647] FindNextFileW (in: hFindFile=0x5445840, lpFindFileData=0x39020c8 | out: lpFindFileData=0x39020c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08e5b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.647] wcscmp (_String1="..", _String2=".") returned 1 [0082.648] wcscmp (_String1="..", _String2="..") returned 0 [0082.648] FindNextFileW (in: hFindFile=0x5445840, lpFindFileData=0x39020c8 | out: lpFindFileData=0x39020c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08f2fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0082.648] wcscmp (_String1="en-GB", _String2=".") returned 1 [0082.648] wcscmp (_String1="en-GB", _String2="..") returned 1 [0082.648] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x53fc320 [0082.648] wcscpy (in: _Dest=0x53fc320, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService" [0082.648] wcscat (in: _Dest=0x53fc320, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\" [0082.648] wcscat (in: _Dest=0x53fc320, _Source="en-GB" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\en-GB") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\en-GB" [0082.648] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x54bb6c0 [0082.648] wcscpy (in: _Dest=0x54bb6c0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\en-GB" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\en-GB") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\en-GB" [0082.648] wcscat (in: _Dest=0x54bb6c0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\en-GB\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\en-GB\\" [0082.648] wcscat (in: _Dest=0x54bb6c0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\en-GB\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\en-GB\\*" [0082.648] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5430c20 [0082.648] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\en-GB\\*", lpFindFileData=0x5430c20 | out: lpFindFileData=0x5430c20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08f2fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x75677c8 [0087.668] wcscmp (_String1=".", _String2=".") returned 0 [0087.668] FindNextFileW (hFindFile=0x75677c8, lpFindFileData=0x5430c20) Thread: id = 485 os_tid = 0x1768 [0072.540] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x53f77b0 [0072.540] wcscpy (in: _Dest=0x53f77b0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\_Resources" [0072.540] wcscat (in: _Dest=0x53f77b0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\_Resources\\" [0072.541] wcscat (in: _Dest=0x53f77b0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\_Resources\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\_Resources\\*" [0072.541] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3902330 [0072.541] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x3902330 | out: lpFindFileData=0x3902330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5373138, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab089e41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd5373138, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7567288 [0087.047] wcscmp (_String1=".", _String2=".") returned 0 [0087.047] FindNextFileW (hFindFile=0x7567288, lpFindFileData=0x3902330) Thread: id = 486 os_tid = 0x176c [0072.544] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\appconfiguration.xml")) returned 0x20 [0082.672] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml", dwFileAttributes=0x20) returned 0 [0082.674] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\appconfiguration.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.761] GetLastError () returned 0x5 [0082.761] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml", dwFileAttributes=0x20) returned 0 [0082.768] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e7370) returned 1 Thread: id = 487 os_tid = 0x1770 [0072.545] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0082.652] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0082.652] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.664] GetLastError () returned 0x5 [0082.664] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0082.667] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e88c8) returned 1 Thread: id = 488 os_tid = 0x1774 [0072.546] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0082.757] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0082.761] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.768] GetLastError () returned 0x5 [0082.768] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0082.773] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e80f8) returned 1 Thread: id = 489 os_tid = 0x1778 [0072.547] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x53f96a0 [0072.547] wcscpy (in: _Dest=0x53f96a0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata" [0072.547] wcscat (in: _Dest=0x53f96a0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\" [0072.547] wcscat (in: _Dest=0x53f96a0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*" [0072.547] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3902598 [0072.547] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x3902598 | out: lpFindFileData=0x3902598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d1b5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445800 [0082.623] wcscmp (_String1=".", _String2=".") returned 0 [0082.623] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x3902598 | out: lpFindFileData=0x3902598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d1b5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.623] wcscmp (_String1="..", _String2=".") returned 1 [0082.623] wcscmp (_String1="..", _String2="..") returned 0 [0082.623] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x3902598 | out: lpFindFileData=0x3902598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c2c683a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2fe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1 [0082.624] wcscmp (_String1="CodeIntegrity.cat", _String2=".") returned 1 [0082.624] wcscmp (_String1="CodeIntegrity.cat", _String2="..") returned 1 [0082.624] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x54bc370 [0082.624] wcscpy (in: _Dest=0x54bc370, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata" [0082.624] wcscat (in: _Dest=0x54bc370, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\" [0082.624] wcscat (in: _Dest=0x54bc370, _Source="CodeIntegrity.cat" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" [0082.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bc370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f44 [0082.624] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x3902598 | out: lpFindFileData=0x3902598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c2c683a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2fe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 0 [0082.624] FindClose (in: hFindFile=0x5445800 | out: hFindFile=0x5445800) returned 1 [0082.624] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3902598) returned 1 [0082.624] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f96a0) returned 1 [0082.625] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5461ca8) returned 1 Thread: id = 490 os_tid = 0x177c [0072.547] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0082.653] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0082.657] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.668] GetLastError () returned 0x5 [0082.668] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0082.672] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e7440) returned 1 Thread: id = 491 os_tid = 0x1780 [0072.549] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x5446700 [0072.549] wcscpy (in: _Dest=0x5446700, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets" [0072.549] wcscat (in: _Dest=0x5446700, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\" [0072.549] wcscat (in: _Dest=0x5446700, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\*" [0072.549] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3903408 [0072.549] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x3903408 | out: lpFindFileData=0x3903408*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d25c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54459c0 [0082.635] wcscmp (_String1=".", _String2=".") returned 0 [0082.635] FindNextFileW (in: hFindFile=0x54459c0, lpFindFileData=0x3903408 | out: lpFindFileData=0x3903408*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d25c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.635] wcscmp (_String1="..", _String2=".") returned 1 [0082.635] wcscmp (_String1="..", _String2="..") returned 0 [0082.635] FindNextFileW (in: hFindFile=0x54459c0, lpFindFileData=0x3903408 | out: lpFindFileData=0x3903408*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d4131, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppTiles", cAlternateFileName="")) returned 1 [0082.635] wcscmp (_String1="AppTiles", _String2=".") returned 1 [0082.635] wcscmp (_String1="AppTiles", _String2="..") returned 1 [0082.635] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53f91f0 [0082.635] wcscpy (in: _Dest=0x53f91f0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets" [0082.635] wcscat (in: _Dest=0x53f91f0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\" [0082.635] wcscat (in: _Dest=0x53f91f0, _Source="AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0082.635] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53f91f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f50 [0082.635] FindNextFileW (in: hFindFile=0x54459c0, lpFindFileData=0x3903408 | out: lpFindFileData=0x3903408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c35f15d, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c35f15d, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x120f, dwReserved0=0x0, dwReserved1=0x0, cFileName="StatsLogo.png", cAlternateFileName="")) returned 1 [0082.635] wcscmp (_String1="StatsLogo.png", _String2=".") returned 1 [0082.636] wcscmp (_String1="StatsLogo.png", _String2="..") returned 1 [0082.636] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x3971f30 [0082.636] wcscpy (in: _Dest=0x3971f30, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets" [0082.636] wcscat (in: _Dest=0x3971f30, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\" [0082.636] wcscat (in: _Dest=0x3971f30, _Source="StatsLogo.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\StatsLogo.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\StatsLogo.png" [0082.636] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3971f30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f54 [0082.636] FindNextFileW (in: hFindFile=0x54459c0, lpFindFileData=0x3903408 | out: lpFindFileData=0x3903408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c35f15d, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c35f15d, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x120f, dwReserved0=0x0, dwReserved1=0x0, cFileName="StatsLogo.png", cAlternateFileName="")) returned 0 [0082.636] FindClose (in: hFindFile=0x54459c0 | out: hFindFile=0x54459c0) returned 1 [0082.636] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3903408) returned 1 [0082.636] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5446700) returned 1 [0082.636] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5446cc0) returned 1 Thread: id = 492 os_tid = 0x1784 [0072.550] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53f9da8 [0072.550] wcscpy (in: _Dest=0x53f9da8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration" [0072.550] wcscat (in: _Dest=0x53f9da8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\" [0072.550] wcscat (in: _Dest=0x53f9da8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\*" [0072.550] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3902800 [0072.550] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\*", lpFindFileData=0x3902800 | out: lpFindFileData=0x3902800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c35f15d, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c41d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445800 [0082.646] wcscmp (_String1=".", _String2=".") returned 0 [0082.646] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x3902800 | out: lpFindFileData=0x3902800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c35f15d, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c41d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.646] wcscmp (_String1="..", _String2=".") returned 1 [0082.646] wcscmp (_String1="..", _String2="..") returned 0 [0082.646] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x3902800 | out: lpFindFileData=0x3902800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c35f15d, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c35f15d, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c3853b7, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x23c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="configuration.sqlite", cAlternateFileName="")) returned 1 [0082.646] wcscmp (_String1="configuration.sqlite", _String2=".") returned 1 [0082.646] wcscmp (_String1="configuration.sqlite", _String2="..") returned 1 [0082.646] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe4) returned 0x54b9828 [0082.646] wcscpy (in: _Dest=0x54b9828, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration" [0082.646] wcscat (in: _Dest=0x54b9828, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\" [0082.646] wcscat (in: _Dest=0x54b9828, _Source="configuration.sqlite" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" [0082.646] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite")) returned 0x20 [0087.670] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite", dwFileAttributes=0x20) returned 0 [0087.670] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.670] GetLastError () returned 0x5 [0087.670] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite", dwFileAttributes=0x20) returned 0 [0087.670] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b9828) returned 1 [0087.670] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x3902800 | out: lpFindFileData=0x3902800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c35f15d, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c35f15d, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c3853b7, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x23c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="configuration.sqlite", cAlternateFileName="")) returned 0 [0087.670] FindClose (in: hFindFile=0x5445800 | out: hFindFile=0x5445800) returned 1 [0087.670] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3902800) returned 1 [0087.670] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f9da8) returned 1 [0087.670] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e8738) returned 1 Thread: id = 493 os_tid = 0x1788 [0072.550] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\marketconfiguration.xml")) returned 0x20 [0082.767] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml", dwFileAttributes=0x20) returned 0 [0082.769] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\marketconfiguration.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.774] GetLastError () returned 0x5 [0082.774] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml", dwFileAttributes=0x20) returned 0 [0082.781] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b9c60) returned 1 Thread: id = 494 os_tid = 0x178c [0072.552] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x38fe3c8 [0072.552] wcscpy (in: _Dest=0x38fe3c8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" [0072.552] wcscat (in: _Dest=0x38fe3c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\" [0072.552] wcscat (in: _Dest=0x38fe3c8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\*" [0072.552] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3902a68 [0072.552] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\*", lpFindFileData=0x3902a68 | out: lpFindFileData=0x3902a68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c490576, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c48a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c490576, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445940 [0082.663] wcscmp (_String1=".", _String2=".") returned 0 [0082.663] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x3902a68 | out: lpFindFileData=0x3902a68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c490576, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c48a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c490576, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.663] wcscmp (_String1="..", _String2=".") returned 1 [0082.663] wcscmp (_String1="..", _String2="..") returned 0 [0082.663] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x3902a68 | out: lpFindFileData=0x3902a68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c490576, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c490576, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c490576, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x62f, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootstrap.html", cAlternateFileName="")) returned 1 [0082.663] wcscmp (_String1="bootstrap.html", _String2=".") returned 1 [0082.663] wcscmp (_String1="bootstrap.html", _String2="..") returned 1 [0082.663] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x38b02e8 [0082.663] wcscpy (in: _Dest=0x38b02e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" [0082.664] wcscat (in: _Dest=0x38b02e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\" [0082.664] wcscat (in: _Dest=0x38b02e8, _Source="bootstrap.html" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html" [0082.664] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\bootstrap.html")) returned 0x20 [0087.673] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html", dwFileAttributes=0x20) returned 0 [0087.674] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\bootstrap.html"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.674] GetLastError () returned 0x5 [0087.674] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html", dwFileAttributes=0x20) returned 0 [0087.674] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b02e8) returned 1 [0087.674] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x3902a68 | out: lpFindFileData=0x3902a68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c490576, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c51ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c490576, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1 [0087.674] wcscmp (_String1="Themes", _String2=".") returned 1 [0087.674] wcscmp (_String1="Themes", _String2="..") returned 1 [0087.674] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x3933ae8 [0087.674] wcscpy (in: _Dest=0x3933ae8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" [0087.674] wcscat (in: _Dest=0x3933ae8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\" [0087.674] wcscat (in: _Dest=0x3933ae8, _Source="Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes" [0088.574] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3933ae8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f7c [0088.574] FindNextFileW (in: hFindFile=0x5445940, lpFindFileData=0x3902a68 | out: lpFindFileData=0x3902a68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c490576, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c51ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c490576, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0 [0088.574] FindClose (in: hFindFile=0x5445940 | out: hFindFile=0x5445940) returned 1 [0088.574] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3902a68) returned 1 [0088.574] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38fe3c8) returned 1 [0088.574] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53bab90) returned 1 Thread: id = 495 os_tid = 0x1790 [0072.553] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising.winmd")) returned 0x20 [0082.771] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd", dwFileAttributes=0x20) returned 0 [0082.774] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.782] GetLastError () returned 0x5 [0082.782] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd", dwFileAttributes=0x20) returned 0 [0087.669] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b5160) Thread: id = 496 os_tid = 0x1794 [0072.555] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.aria.clienttelemetry.winmd")) returned 0x20 [0082.665] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd", dwFileAttributes=0x20) returned 0 [0082.668] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.aria.clienttelemetry.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.673] GetLastError () returned 0x5 [0082.673] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd", dwFileAttributes=0x20) returned 0 [0082.761] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b5240) returned 1 Thread: id = 497 os_tid = 0x1798 [0072.556] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x38fef98 [0072.556] wcscpy (in: _Dest=0x38fef98, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services" [0072.556] wcscat (in: _Dest=0x38fef98, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\" [0072.556] wcscat (in: _Dest=0x38fef98, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\*" [0072.556] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3902f38 [0072.556] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\*", lpFindFileData=0x3902f38 | out: lpFindFileData=0x3902f38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c5add, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445400 [0082.780] wcscmp (_String1=".", _String2=".") returned 0 [0082.780] FindNextFileW (in: hFindFile=0x5445400, lpFindFileData=0x3902f38 | out: lpFindFileData=0x3902f38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c5add, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.780] wcscmp (_String1="..", _String2=".") returned 1 [0082.780] wcscmp (_String1="..", _String2="..") returned 0 [0082.780] FindNextFileW (in: hFindFile=0x5445400, lpFindFileData=0x3902f38 | out: lpFindFileData=0x3902f38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c62fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Personalization", cAlternateFileName="PERSON~1")) returned 1 [0082.780] wcscmp (_String1="Personalization", _String2=".") returned 1 [0082.780] wcscmp (_String1="Personalization", _String2="..") returned 1 [0082.780] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x393d788 [0082.780] wcscpy (in: _Dest=0x393d788, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services" [0082.780] wcscat (in: _Dest=0x393d788, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\" [0082.780] wcscat (in: _Dest=0x393d788, _Source="Personalization" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization" [0082.780] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x393e8f8 [0082.780] wcscpy (in: _Dest=0x393e8f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization" [0082.780] wcscat (in: _Dest=0x393e8f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\" [0082.780] wcscat (in: _Dest=0x393e8f8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\*" [0082.780] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542d730 [0082.781] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\*", lpFindFileData=0x542d730 | out: lpFindFileData=0x542d730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c62fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7567ac8 [0087.675] wcscmp (_String1=".", _String2=".") returned 0 [0087.675] FindNextFileW (hFindFile=0x7567ac8, lpFindFileData=0x542d730) Thread: id = 498 os_tid = 0x179c [0072.557] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xca) returned 0x38ff070 [0072.557] wcscpy (in: _Dest=0x38ff070, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell" [0072.557] wcscat (in: _Dest=0x38ff070, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\" [0072.557] wcscat (in: _Dest=0x38ff070, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\*" [0072.557] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x39031a0 [0072.557] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\*", lpFindFileData=0x39031a0 | out: lpFindFileData=0x39031a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa7402e1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445a40 [0082.783] wcscmp (_String1=".", _String2=".") returned 0 [0082.783] FindNextFileW (in: hFindFile=0x5445a40, lpFindFileData=0x39031a0 | out: lpFindFileData=0x39031a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa7402e1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.783] wcscmp (_String1="..", _String2=".") returned 1 [0082.783] wcscmp (_String1="..", _String2="..") returned 0 [0082.783] FindNextFileW (in: hFindFile=0x5445a40, lpFindFileData=0x39031a0 | out: lpFindFileData=0x39031a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa741010, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1 [0082.783] wcscmp (_String1="Themes", _String2=".") returned 1 [0082.783] wcscmp (_String1="Themes", _String2="..") returned 1 [0082.783] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd4) returned 0x53fc160 [0082.783] wcscpy (in: _Dest=0x53fc160, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell" [0082.783] wcscat (in: _Dest=0x53fc160, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\" [0082.783] wcscat (in: _Dest=0x53fc160, _Source="Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes" [0082.783] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x53fbfa0 [0082.783] wcscpy (in: _Dest=0x53fbfa0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes" [0082.783] wcscat (in: _Dest=0x53fbfa0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\" [0082.783] wcscat (in: _Dest=0x53fbfa0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\*" [0082.784] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542d260 [0082.784] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\*", lpFindFileData=0x542d260 | out: lpFindFileData=0x542d260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa741010, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7567c48 [0087.675] wcscmp (_String1=".", _String2=".") returned 0 [0087.675] FindNextFileW (in: hFindFile=0x7567c48, lpFindFileData=0x542d260 | out: lpFindFileData=0x542d260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa741010, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.675] wcscmp (_String1="..", _String2=".") returned 1 [0087.675] wcscmp (_String1="..", _String2="..") returned 0 [0087.675] FindNextFileW (in: hFindFile=0x7567c48, lpFindFileData=0x542d260 | out: lpFindFileData=0x542d260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa741b52, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Glyphs", cAlternateFileName="")) returned 1 [0087.675] wcscmp (_String1="Glyphs", _String2=".") returned 1 [0087.675] wcscmp (_String1="Glyphs", _String2="..") returned 1 [0087.675] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x54b8dd8 [0087.675] wcscpy (in: _Dest=0x54b8dd8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes" [0087.675] wcscat (in: _Dest=0x54b8dd8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\" [0087.675] wcscat (in: _Dest=0x54b8dd8, _Source="Glyphs" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs" [0088.571] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54b8dd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ed0 [0088.572] FindNextFileW (in: hFindFile=0x7567c48, lpFindFileData=0x542d260 | out: lpFindFileData=0x542d260*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa741b52, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Glyphs", cAlternateFileName="")) returned 0 [0088.572] FindClose (in: hFindFile=0x7567c48 | out: hFindFile=0x7567c48) returned 1 [0088.572] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542d260) returned 1 [0088.572] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fbfa0) returned 1 [0088.572] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fc160) returned 1 [0088.572] FindNextFileW (in: hFindFile=0x5445a40, lpFindFileData=0x39031a0 | out: lpFindFileData=0x39031a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa741010, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0 [0088.573] FindClose (in: hFindFile=0x5445a40 | out: hFindFile=0x5445a40) returned 1 [0088.573] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39031a0) returned 1 [0088.573] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ff070) returned 1 [0088.573] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e7510) returned 1 Thread: id = 499 os_tid = 0x17a0 [0072.558] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe6) returned 0x38b0978 [0072.558] wcscpy (in: _Dest=0x38b0978, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0072.558] wcscat (in: _Dest=0x38b0978, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0072.558] wcscat (in: _Dest=0x38b0978, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0072.558] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3903670 [0072.558] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x3903670 | out: lpFindFileData=0x3903670*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x608775e5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa743364, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608775e5, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7567648 [0087.515] wcscmp (_String1=".", _String2=".") returned 0 [0087.515] FindNextFileW (hFindFile=0x7567648, lpFindFileData=0x3903670) Thread: id = 500 os_tid = 0x17a4 [0072.559] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MicrosoftAdvertising.ini" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoftadvertising.ini")) returned 0x20 [0081.258] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MicrosoftAdvertising.ini", dwFileAttributes=0x20) returned 0 [0081.258] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MicrosoftAdvertising.ini" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoftadvertising.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0081.258] GetLastError () returned 0x5 [0081.258] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MicrosoftAdvertising.ini", dwFileAttributes=0x20) returned 0 [0081.258] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b9d38) returned 1 Thread: id = 501 os_tid = 0x17a8 [0072.560] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x53f6f90 [0072.560] wcscpy (in: _Dest=0x53f6f90, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS" [0072.560] wcscat (in: _Dest=0x53f6f90, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\" [0072.560] wcscat (in: _Dest=0x53f6f90, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\*" [0072.560] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x39038d8 [0072.560] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\*", lpFindFileData=0x39038d8 | out: lpFindFileData=0x39038d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c9a1593, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa743cf4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c9c77d0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445080 [0077.728] wcscmp (_String1=".", _String2=".") returned 0 [0077.728] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x39038d8 | out: lpFindFileData=0x39038d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c9a1593, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa743cf4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c9c77d0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.728] wcscmp (_String1="..", _String2=".") returned 1 [0077.728] wcscmp (_String1="..", _String2="..") returned 0 [0077.728] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x39038d8 | out: lpFindFileData=0x39038d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c9a1593, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c9a1593, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c9c77d0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4be9, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootstrap.js", cAlternateFileName="")) returned 1 [0077.728] wcscmp (_String1="bootstrap.js", _String2=".") returned 1 [0077.728] wcscmp (_String1="bootstrap.js", _String2="..") returned 1 [0077.728] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x54b20d8 [0077.728] wcscpy (in: _Dest=0x54b20d8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS" [0077.728] wcscat (in: _Dest=0x54b20d8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\" [0077.728] wcscat (in: _Dest=0x54b20d8, _Source="bootstrap.js" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js" [0080.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54b20d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1284 [0080.922] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x39038d8 | out: lpFindFileData=0x39038d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c9c77d0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c9c77d0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c9c77d0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x73d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ormma.js", cAlternateFileName="")) returned 1 [0080.922] wcscmp (_String1="ormma.js", _String2=".") returned 1 [0080.922] wcscmp (_String1="ormma.js", _String2="..") returned 1 [0080.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x7580a08 [0080.922] wcscpy (in: _Dest=0x7580a08, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS" [0080.922] wcscat (in: _Dest=0x7580a08, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\" [0080.922] wcscat (in: _Dest=0x7580a08, _Source="ormma.js" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js" [0080.922] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7580a08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c4 [0080.923] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x39038d8 | out: lpFindFileData=0x39038d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c9c77d0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c9c77d0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c9c77d0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x73d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ormma.js", cAlternateFileName="")) returned 0 [0080.923] FindClose (in: hFindFile=0x5445080 | out: hFindFile=0x5445080) returned 1 [0080.923] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39038d8) returned 1 [0080.923] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f6f90) returned 1 [0080.923] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e7f68) returned 1 Thread: id = 502 os_tid = 0x17ac [0072.561] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\PlatformConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\platformconfiguration.xml")) returned 0x20 [0082.558] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\PlatformConfiguration.xml", dwFileAttributes=0x20) returned 0 [0082.569] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\PlatformConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\platformconfiguration.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.586] GetLastError () returned 0x5 [0082.586] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\PlatformConfiguration.xml", dwFileAttributes=0x20) returned 0 [0082.600] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b5420) returned 1 Thread: id = 503 os_tid = 0x17b0 [0072.562] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri")) returned 0x20 [0082.520] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0082.557] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.569] GetLastError () returned 0x5 [0082.569] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0082.585] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e8030) returned 1 Thread: id = 504 os_tid = 0x17b4 [0072.562] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\SQLiteWrapper.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\sqlitewrapper.winmd")) returned 0x20 [0082.587] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\SQLiteWrapper.winmd", dwFileAttributes=0x20) returned 0 [0082.601] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\SQLiteWrapper.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\sqlitewrapper.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.622] GetLastError () returned 0x5 [0082.622] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\SQLiteWrapper.winmd", dwFileAttributes=0x20) returned 0 [0082.633] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e75e0) returned 1 Thread: id = 505 os_tid = 0x17b8 [0072.563] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x5445f18 [0072.563] wcscpy (in: _Dest=0x5445f18, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes" [0072.563] wcscat (in: _Dest=0x5445f18, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes\\" [0072.563] wcscat (in: _Dest=0x5445f18, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes\\*" [0072.563] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3903b40 [0072.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes\\*", lpFindFileData=0x3903b40 | out: lpFindFileData=0x3903b40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6caf896e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa7447d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6caf896e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445800 [0082.574] wcscmp (_String1=".", _String2=".") returned 0 [0082.574] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x3903b40 | out: lpFindFileData=0x3903b40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6caf896e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa7447d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6caf896e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.574] wcscmp (_String1="..", _String2=".") returned 1 [0082.574] wcscmp (_String1="..", _String2="..") returned 0 [0082.574] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x3903b40 | out: lpFindFileData=0x3903b40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6caf896e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa7452b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6caf896e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0082.574] wcscmp (_String1="Fonts", _String2=".") returned 1 [0082.574] wcscmp (_String1="Fonts", _String2="..") returned 1 [0082.574] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb8) returned 0x5b15d10 [0082.575] wcscpy (in: _Dest=0x5b15d10, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes" [0082.575] wcscat (in: _Dest=0x5b15d10, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes\\" [0082.575] wcscat (in: _Dest=0x5b15d10, _Source="Fonts" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes\\Fonts") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes\\Fonts" [0082.575] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5b15d10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f08 [0082.575] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x3903b40 | out: lpFindFileData=0x3903b40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6caf896e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa7452b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6caf896e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 0 [0082.575] FindClose (in: hFindFile=0x5445800 | out: hFindFile=0x5445800) returned 1 [0082.575] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3903b40) returned 1 [0082.575] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445f18) returned 1 [0082.576] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445da8) returned 1 Thread: id = 506 os_tid = 0x17bc [0072.564] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb8) returned 0x3905ce0 [0072.564] wcscpy (in: _Dest=0x3905ce0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources" [0072.564] wcscat (in: _Dest=0x3905ce0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\" [0072.564] wcscat (in: _Dest=0x3905ce0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\*" [0072.564] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3903da8 [0072.564] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x3903da8 | out: lpFindFileData=0x3903da8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d109a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445800 [0082.602] wcscmp (_String1=".", _String2=".") returned 0 [0082.602] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x3903da8 | out: lpFindFileData=0x3903da8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d109a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.602] wcscmp (_String1="..", _String2=".") returned 1 [0082.602] wcscmp (_String1="..", _String2="..") returned 0 [0082.602] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x3903da8 | out: lpFindFileData=0x3903da8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c2c683a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2985, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.rsrc", cAlternateFileName="")) returned 1 [0082.602] wcscmp (_String1="0.rsrc", _String2=".") returned 1 [0082.602] wcscmp (_String1="0.rsrc", _String2="..") returned 1 [0082.602] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x55fe578 [0082.602] wcscpy (in: _Dest=0x55fe578, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources" [0082.602] wcscat (in: _Dest=0x55fe578, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\" [0082.603] wcscat (in: _Dest=0x55fe578, _Source="0.rsrc" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\0.rsrc") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\0.rsrc" [0082.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55fe578, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f20 [0082.603] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x3903da8 | out: lpFindFileData=0x3903da8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c2c683a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa3, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.txt", cAlternateFileName="")) returned 1 [0082.603] wcscmp (_String1="index.txt", _String2=".") returned 1 [0082.603] wcscmp (_String1="index.txt", _String2="..") returned 1 [0082.603] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x55fe7e8 [0082.603] wcscpy (in: _Dest=0x55fe7e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources" [0082.603] wcscat (in: _Dest=0x55fe7e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\" [0082.603] wcscat (in: _Dest=0x55fe7e8, _Source="index.txt" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\index.txt") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\index.txt" [0082.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55fe7e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f24 [0082.604] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x3903da8 | out: lpFindFileData=0x3903da8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c2c683a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa3, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.txt", cAlternateFileName="")) returned 0 [0082.604] FindClose (in: hFindFile=0x5445800 | out: hFindFile=0x5445800) returned 1 [0082.604] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3903da8) returned 1 [0082.604] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3905ce0) returned 1 [0082.604] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5461528) returned 1 Thread: id = 507 os_tid = 0x17c0 [0072.565] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\appconfiguration.xml")) returned 0x20 [0082.826] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml", dwFileAttributes=0x20) returned 0 [0082.826] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\appconfiguration.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.826] GetLastError () returned 0x5 [0082.827] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml", dwFileAttributes=0x20) returned 0 [0082.827] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e76b0) returned 1 Thread: id = 508 os_tid = 0x17c4 [0072.566] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0082.767] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0082.770] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.782] GetLastError () returned 0x5 [0082.783] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0082.787] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e8b20) returned 1 Thread: id = 509 os_tid = 0x17c8 [0072.567] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0077.730] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0082.102] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.520] GetLastError () returned 0x5 [0082.520] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0082.557] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e8418) returned 1 Thread: id = 510 os_tid = 0x17cc [0072.567] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb8) returned 0x3905da0 [0072.567] wcscpy (in: _Dest=0x3905da0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata" [0072.567] wcscat (in: _Dest=0x3905da0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\" [0072.567] wcscat (in: _Dest=0x3905da0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*" [0072.567] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3938918 [0072.570] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x3938918 | out: lpFindFileData=0x3938918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d61ce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54453c0 [0082.775] wcscmp (_String1=".", _String2=".") returned 0 [0082.775] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938918 | out: lpFindFileData=0x3938918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d61ce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.775] wcscmp (_String1="..", _String2=".") returned 1 [0082.775] wcscmp (_String1="..", _String2="..") returned 0 [0082.775] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938918 | out: lpFindFileData=0x3938918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704a11ba, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2fe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1 [0082.775] wcscmp (_String1="CodeIntegrity.cat", _String2=".") returned 1 [0082.775] wcscmp (_String1="CodeIntegrity.cat", _String2="..") returned 1 [0082.775] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x53fce80 [0082.776] wcscpy (in: _Dest=0x53fce80, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata" [0082.776] wcscat (in: _Dest=0x53fce80, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\" [0082.776] wcscat (in: _Dest=0x53fce80, _Source="CodeIntegrity.cat" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" [0082.776] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat")) returned 0x20 [0082.789] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0082.789] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.789] GetLastError () returned 0x5 [0082.789] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0082.789] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fce80) returned 1 [0082.790] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938918 | out: lpFindFileData=0x3938918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704a11ba, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2fe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 0 [0082.790] FindClose (in: hFindFile=0x54453c0 | out: hFindFile=0x54453c0) returned 1 [0082.790] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3938918) returned 1 [0082.790] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3905da0) returned 1 [0082.790] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5461d68) returned 1 Thread: id = 511 os_tid = 0x17d0 [0072.592] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0081.259] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0081.259] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.519] GetLastError () returned 0x5 [0082.519] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0082.519] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e85a8) returned 1 Thread: id = 512 os_tid = 0x17d4 [0072.592] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xac) returned 0x5445fd0 [0072.592] wcscpy (in: _Dest=0x5445fd0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets" [0072.592] wcscat (in: _Dest=0x5445fd0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\" [0072.592] wcscat (in: _Dest=0x5445fd0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\*" [0072.592] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3939050 [0072.593] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x3939050 | out: lpFindFileData=0x3939050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d69dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445a00 [0082.779] wcscmp (_String1=".", _String2=".") returned 0 [0082.779] FindNextFileW (in: hFindFile=0x5445a00, lpFindFileData=0x3939050 | out: lpFindFileData=0x3939050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d69dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.779] wcscmp (_String1="..", _String2=".") returned 1 [0082.779] wcscmp (_String1="..", _String2="..") returned 0 [0082.779] FindNextFileW (in: hFindFile=0x5445a00, lpFindFileData=0x3939050 | out: lpFindFileData=0x3939050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d7904, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppTiles", cAlternateFileName="")) returned 1 [0082.779] wcscmp (_String1="AppTiles", _String2=".") returned 1 [0082.779] wcscmp (_String1="AppTiles", _String2="..") returned 1 [0082.779] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x53f9128 [0082.779] wcscpy (in: _Dest=0x53f9128, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets" [0082.779] wcscat (in: _Dest=0x53f9128, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\" [0082.779] wcscat (in: _Dest=0x53f9128, _Source="AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0082.779] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53fa7d0 [0082.779] wcscpy (in: _Dest=0x53fa7d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0082.779] wcscat (in: _Dest=0x53fa7d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\" [0082.779] wcscat (in: _Dest=0x53fa7d0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\*" [0082.779] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5430e88 [0082.780] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\*", lpFindFileData=0x5430e88 | out: lpFindFileData=0x5430e88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d7904, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445440 [0082.793] wcscmp (_String1=".", _String2=".") returned 0 [0082.793] FindNextFileW (in: hFindFile=0x5445440, lpFindFileData=0x5430e88 | out: lpFindFileData=0x5430e88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d7904, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.793] wcscmp (_String1="..", _String2=".") returned 1 [0082.793] wcscmp (_String1="..", _String2="..") returned 0 [0082.793] FindNextFileW (in: hFindFile=0x5445440, lpFindFileData=0x5430e88 | out: lpFindFileData=0x5430e88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa3cc321, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-black", cAlternateFileName="CONTRA~1")) returned 1 [0082.793] wcscmp (_String1="contrast-black", _String2=".") returned 1 [0082.793] wcscmp (_String1="contrast-black", _String2="..") returned 1 [0082.793] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x53fc5c0 [0082.793] wcscpy (in: _Dest=0x53fc5c0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0082.793] wcscat (in: _Dest=0x53fc5c0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\" [0082.793] wcscat (in: _Dest=0x53fc5c0, _Source="contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" [0082.793] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x54f1600 [0082.793] wcscpy (in: _Dest=0x54f1600, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" [0082.793] wcscat (in: _Dest=0x54f1600, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\" [0082.793] wcscat (in: _Dest=0x54f1600, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\*" [0082.793] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542dc00 [0082.793] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\*", lpFindFileData=0x542dc00 | out: lpFindFileData=0x542dc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa3cc321, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445480 [0082.795] wcscmp (_String1=".", _String2=".") returned 0 [0082.795] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x542dc00 | out: lpFindFileData=0x542dc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa3cc321, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.795] wcscmp (_String1="..", _String2=".") returned 1 [0082.795] wcscmp (_String1="..", _String2="..") returned 0 [0082.795] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x542dc00 | out: lpFindFileData=0x542dc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704a11ba, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1 [0082.796] wcscmp (_String1="News_LogoSmall.scale-100.png", _String2=".") returned 1 [0082.796] wcscmp (_String1="News_LogoSmall.scale-100.png", _String2="..") returned 1 [0082.796] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x7585420 [0082.796] wcscpy (in: _Dest=0x7585420, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" [0082.796] wcscat (in: _Dest=0x7585420, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\" [0082.796] wcscat (in: _Dest=0x7585420, _Source="News_LogoSmall.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.scale-100.png" [0082.796] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_logosmall.scale-100.png")) returned 0x20 [0082.797] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.scale-100.png", dwFileAttributes=0x20) returned 0 [0082.797] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_logosmall.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.797] GetLastError () returned 0x5 [0082.797] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.scale-100.png", dwFileAttributes=0x20) returned 0 [0082.797] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7585420) returned 1 [0082.798] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x542dc00 | out: lpFindFileData=0x542dc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704a11ba, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-16.png", cAlternateFileName="")) returned 1 [0082.798] wcscmp (_String1="News_LogoSmall.targetsize-16.png", _String2=".") returned 1 [0082.798] wcscmp (_String1="News_LogoSmall.targetsize-16.png", _String2="..") returned 1 [0082.798] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11a) returned 0x75859e8 [0082.798] wcscpy (in: _Dest=0x75859e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" [0082.798] wcscat (in: _Dest=0x75859e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\" [0082.798] wcscat (in: _Dest=0x75859e8, _Source="News_LogoSmall.targetsize-16.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-16.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-16.png" [0082.798] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_logosmall.targetsize-16.png")) returned 0x20 [0082.799] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-16.png", dwFileAttributes=0x20) returned 0 [0082.799] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_logosmall.targetsize-16.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.799] GetLastError () returned 0x5 [0082.799] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-16.png", dwFileAttributes=0x20) returned 0 [0082.799] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75859e8) returned 1 [0082.799] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x542dc00 | out: lpFindFileData=0x542dc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704a11ba, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-24.png", cAlternateFileName="")) returned 1 [0082.799] wcscmp (_String1="News_LogoSmall.targetsize-24.png", _String2=".") returned 1 [0082.799] wcscmp (_String1="News_LogoSmall.targetsize-24.png", _String2="..") returned 1 [0082.799] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11a) returned 0x7584c08 [0082.799] wcscpy (in: _Dest=0x7584c08, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" [0082.799] wcscat (in: _Dest=0x7584c08, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\" [0082.799] wcscat (in: _Dest=0x7584c08, _Source="News_LogoSmall.targetsize-24.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-24.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-24.png" [0082.799] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_logosmall.targetsize-24.png")) returned 0x20 [0082.800] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-24.png", dwFileAttributes=0x20) returned 0 [0082.800] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_logosmall.targetsize-24.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.800] GetLastError () returned 0x5 [0082.800] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-24.png", dwFileAttributes=0x20) returned 0 [0082.800] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7584c08) returned 1 [0082.800] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x542dc00 | out: lpFindFileData=0x542dc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704a11ba, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x386, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-256.png", cAlternateFileName="")) returned 1 [0082.800] wcscmp (_String1="News_LogoSmall.targetsize-256.png", _String2=".") returned 1 [0082.800] wcscmp (_String1="News_LogoSmall.targetsize-256.png", _String2="..") returned 1 [0082.800] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11c) returned 0x75841a0 [0082.801] wcscpy (in: _Dest=0x75841a0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" [0082.801] wcscat (in: _Dest=0x75841a0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\" [0082.801] wcscat (in: _Dest=0x75841a0, _Source="News_LogoSmall.targetsize-256.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-256.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-256.png" [0082.801] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_logosmall.targetsize-256.png")) returned 0x20 [0082.801] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-256.png", dwFileAttributes=0x20) returned 0 [0082.801] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_logosmall.targetsize-256.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.802] GetLastError () returned 0x5 [0082.802] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-256.png", dwFileAttributes=0x20) returned 0 [0082.802] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75841a0) returned 1 [0082.802] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x542dc00 | out: lpFindFileData=0x542dc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704a11ba, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-32.png", cAlternateFileName="")) returned 1 [0082.802] wcscmp (_String1="News_LogoSmall.targetsize-32.png", _String2=".") returned 1 [0082.802] wcscmp (_String1="News_LogoSmall.targetsize-32.png", _String2="..") returned 1 [0082.802] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11a) returned 0x7585420 [0082.802] wcscpy (in: _Dest=0x7585420, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" [0082.802] wcscat (in: _Dest=0x7585420, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\" [0082.802] wcscat (in: _Dest=0x7585420, _Source="News_LogoSmall.targetsize-32.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-32.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-32.png" [0082.802] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_logosmall.targetsize-32.png")) returned 0x20 [0082.802] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-32.png", dwFileAttributes=0x20) returned 0 [0082.802] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_logosmall.targetsize-32.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.802] GetLastError () returned 0x5 [0082.802] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-32.png", dwFileAttributes=0x20) returned 0 [0082.802] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7585420) returned 1 [0082.803] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x542dc00 | out: lpFindFileData=0x542dc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704c73fb, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-48.png", cAlternateFileName="")) returned 1 [0082.803] wcscmp (_String1="News_LogoSmall.targetsize-48.png", _String2=".") returned 1 [0082.803] wcscmp (_String1="News_LogoSmall.targetsize-48.png", _String2="..") returned 1 [0082.803] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11a) returned 0x75852f8 [0082.803] wcscpy (in: _Dest=0x75852f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" [0082.803] wcscat (in: _Dest=0x75852f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\" [0082.803] wcscat (in: _Dest=0x75852f8, _Source="News_LogoSmall.targetsize-48.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-48.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-48.png" [0082.803] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_logosmall.targetsize-48.png")) returned 0x20 [0082.803] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-48.png", dwFileAttributes=0x20) returned 0 [0082.804] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_logosmall.targetsize-48.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.804] GetLastError () returned 0x5 [0082.804] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-48.png", dwFileAttributes=0x20) returned 0 [0082.804] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75852f8) returned 1 [0082.804] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x542dc00 | out: lpFindFileData=0x542dc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704c73fb, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x428, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_SplashScreen.scale-100.png", cAlternateFileName="")) returned 1 [0082.804] wcscmp (_String1="News_SplashScreen.scale-100.png", _String2=".") returned 1 [0082.804] wcscmp (_String1="News_SplashScreen.scale-100.png", _String2="..") returned 1 [0082.804] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x118) returned 0x75849b8 [0082.804] wcscpy (in: _Dest=0x75849b8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" [0082.804] wcscat (in: _Dest=0x75849b8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\" [0082.804] wcscat (in: _Dest=0x75849b8, _Source="News_SplashScreen.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_SplashScreen.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_SplashScreen.scale-100.png" [0082.804] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_splashscreen.scale-100.png")) returned 0x20 [0082.805] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_SplashScreen.scale-100.png", dwFileAttributes=0x20) returned 0 [0082.805] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_splashscreen.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.805] GetLastError () returned 0x5 [0082.805] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_SplashScreen.scale-100.png", dwFileAttributes=0x20) returned 0 [0082.809] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75849b8) returned 1 [0082.809] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x542dc00 | out: lpFindFileData=0x542dc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704c73fb, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x355, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileLargeSquare.scale-100.png", cAlternateFileName="")) returned 1 [0082.809] wcscmp (_String1="News_TileLargeSquare.scale-100.png", _String2=".") returned 1 [0082.809] wcscmp (_String1="News_TileLargeSquare.scale-100.png", _String2="..") returned 1 [0082.809] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11e) returned 0x7584640 [0082.809] wcscpy (in: _Dest=0x7584640, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" [0082.809] wcscat (in: _Dest=0x7584640, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\" [0082.809] wcscat (in: _Dest=0x7584640, _Source="News_TileLargeSquare.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileLargeSquare.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileLargeSquare.scale-100.png" [0082.809] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_tilelargesquare.scale-100.png")) returned 0x20 [0082.810] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileLargeSquare.scale-100.png", dwFileAttributes=0x20) returned 0 [0082.810] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_tilelargesquare.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.810] GetLastError () returned 0x5 [0082.810] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileLargeSquare.scale-100.png", dwFileAttributes=0x20) returned 0 [0082.810] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7584640) returned 1 [0082.810] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x542dc00 | out: lpFindFileData=0x542dc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704c73fb, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x167, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileMediumSquare.scale-100.png", cAlternateFileName="")) returned 1 [0082.810] wcscmp (_String1="News_TileMediumSquare.scale-100.png", _String2=".") returned 1 [0082.810] wcscmp (_String1="News_TileMediumSquare.scale-100.png", _String2="..") returned 1 [0082.810] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x120) returned 0x7584640 [0082.811] wcscpy (in: _Dest=0x7584640, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" [0082.811] wcscat (in: _Dest=0x7584640, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\" [0082.811] wcscat (in: _Dest=0x7584640, _Source="News_TileMediumSquare.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileMediumSquare.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileMediumSquare.scale-100.png" [0082.811] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_tilemediumsquare.scale-100.png")) returned 0x20 [0082.811] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileMediumSquare.scale-100.png", dwFileAttributes=0x20) returned 0 [0082.811] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_tilemediumsquare.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.812] GetLastError () returned 0x5 [0082.812] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileMediumSquare.scale-100.png", dwFileAttributes=0x20) returned 0 [0082.812] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7584640) returned 1 [0082.812] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x542dc00 | out: lpFindFileData=0x542dc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704c73fb, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileSmallSquare.scale-100.png", cAlternateFileName="")) returned 1 [0082.812] wcscmp (_String1="News_TileSmallSquare.scale-100.png", _String2=".") returned 1 [0082.812] wcscmp (_String1="News_TileSmallSquare.scale-100.png", _String2="..") returned 1 [0082.812] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11e) returned 0x7585fb0 [0082.813] wcscpy (in: _Dest=0x7585fb0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" [0082.813] wcscat (in: _Dest=0x7585fb0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\" [0082.813] wcscat (in: _Dest=0x7585fb0, _Source="News_TileSmallSquare.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileSmallSquare.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileSmallSquare.scale-100.png" [0082.813] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_tilesmallsquare.scale-100.png")) returned 0x20 [0082.813] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileSmallSquare.scale-100.png", dwFileAttributes=0x20) returned 0 [0082.813] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_tilesmallsquare.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.814] GetLastError () returned 0x5 [0082.814] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileSmallSquare.scale-100.png", dwFileAttributes=0x20) returned 0 [0082.814] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7585fb0) returned 1 [0082.814] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x542dc00 | out: lpFindFileData=0x542dc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704c73fb, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileWide.scale-100.png", cAlternateFileName="")) returned 1 [0082.814] wcscmp (_String1="News_TileWide.scale-100.png", _String2=".") returned 1 [0082.814] wcscmp (_String1="News_TileWide.scale-100.png", _String2="..") returned 1 [0082.814] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x110) returned 0x74b1df0 [0085.972] wcscpy (in: _Dest=0x74b1df0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" [0085.972] wcscat (in: _Dest=0x74b1df0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\" [0085.973] wcscat (in: _Dest=0x74b1df0, _Source="News_TileWide.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileWide.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileWide.scale-100.png" [0088.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b1df0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f80 [0088.747] FindNextFileW (in: hFindFile=0x5445480, lpFindFileData=0x542dc00 | out: lpFindFileData=0x542dc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704c73fb, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileWide.scale-100.png", cAlternateFileName="")) returned 0 [0088.747] FindClose (in: hFindFile=0x5445480 | out: hFindFile=0x5445480) returned 1 [0088.748] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542dc00) returned 1 [0088.748] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f1600) returned 1 [0088.748] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fc5c0) returned 1 [0088.748] FindNextFileW (in: hFindFile=0x5445440, lpFindFileData=0x5430e88 | out: lpFindFileData=0x5430e88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa457e69, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0088.748] wcscmp (_String1="contrast-white", _String2=".") returned 1 [0088.748] wcscmp (_String1="contrast-white", _String2="..") returned 1 [0088.748] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x39348e8 [0088.748] wcscpy (in: _Dest=0x39348e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0088.748] wcscat (in: _Dest=0x39348e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\" [0088.748] wcscat (in: _Dest=0x39348e8, _Source="contrast-white" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" [0088.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x39348e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f88 [0088.749] FindNextFileW (in: hFindFile=0x5445440, lpFindFileData=0x5430e88 | out: lpFindFileData=0x5430e88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1 [0088.749] wcscmp (_String1="News_LogoSmall.scale-100.png", _String2=".") returned 1 [0088.749] wcscmp (_String1="News_LogoSmall.scale-100.png", _String2="..") returned 1 [0088.749] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf4) returned 0x5ba30f8 [0088.749] wcscpy (in: _Dest=0x5ba30f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0088.749] wcscat (in: _Dest=0x5ba30f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\" [0088.749] wcscat (in: _Dest=0x5ba30f8, _Source="News_LogoSmall.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.scale-100.png" [0088.749] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba30f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ec [0088.750] FindNextFileW (in: hFindFile=0x5445440, lpFindFileData=0x5430e88 | out: lpFindFileData=0x5430e88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-16.png", cAlternateFileName="")) returned 1 [0088.750] wcscmp (_String1="News_LogoSmall.targetsize-16.png", _String2=".") returned 1 [0088.750] wcscmp (_String1="News_LogoSmall.targetsize-16.png", _String2="..") returned 1 [0088.750] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x75816b8 [0088.750] wcscpy (in: _Dest=0x75816b8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0088.750] wcscat (in: _Dest=0x75816b8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\" [0088.750] wcscat (in: _Dest=0x75816b8, _Source="News_LogoSmall.targetsize-16.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-16.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-16.png" [0088.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x75816b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x678 [0088.751] FindNextFileW (in: hFindFile=0x5445440, lpFindFileData=0x5430e88 | out: lpFindFileData=0x5430e88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-24.png", cAlternateFileName="")) returned 1 [0088.751] wcscmp (_String1="News_LogoSmall.targetsize-24.png", _String2=".") returned 1 [0088.751] wcscmp (_String1="News_LogoSmall.targetsize-24.png", _String2="..") returned 1 [0088.751] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x75819d0 [0088.751] wcscpy (in: _Dest=0x75819d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0088.751] wcscat (in: _Dest=0x75819d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\" [0088.751] wcscat (in: _Dest=0x75819d0, _Source="News_LogoSmall.targetsize-24.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-24.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-24.png" [0088.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x75819d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f1c [0088.751] FindNextFileW (in: hFindFile=0x5445440, lpFindFileData=0x5430e88 | out: lpFindFileData=0x5430e88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x386, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-256.png", cAlternateFileName="")) returned 1 [0088.751] wcscmp (_String1="News_LogoSmall.targetsize-256.png", _String2=".") returned 1 [0088.751] wcscmp (_String1="News_LogoSmall.targetsize-256.png", _String2="..") returned 1 [0088.751] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfe) returned 0x7581190 [0088.751] wcscpy (in: _Dest=0x7581190, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0088.751] wcscat (in: _Dest=0x7581190, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\" [0088.752] wcscat (in: _Dest=0x7581190, _Source="News_LogoSmall.targetsize-256.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-256.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-256.png" [0088.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7581190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1918 [0088.752] FindNextFileW (in: hFindFile=0x5445440, lpFindFileData=0x5430e88 | out: lpFindFileData=0x5430e88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-32.png", cAlternateFileName="")) returned 1 [0088.752] wcscmp (_String1="News_LogoSmall.targetsize-32.png", _String2=".") returned 1 [0088.752] wcscmp (_String1="News_LogoSmall.targetsize-32.png", _String2="..") returned 1 [0088.752] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x75814a8 [0088.752] wcscpy (in: _Dest=0x75814a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0088.752] wcscat (in: _Dest=0x75814a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\" [0088.752] wcscat (in: _Dest=0x75814a8, _Source="News_LogoSmall.targetsize-32.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-32.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-32.png" [0088.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x75814a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1914 [0088.753] FindNextFileW (in: hFindFile=0x5445440, lpFindFileData=0x5430e88 | out: lpFindFileData=0x5430e88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-48.png", cAlternateFileName="")) returned 1 [0088.753] wcscmp (_String1="News_LogoSmall.targetsize-48.png", _String2=".") returned 1 [0088.753] wcscmp (_String1="News_LogoSmall.targetsize-48.png", _String2="..") returned 1 [0088.753] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x7582b58 [0088.753] wcscpy (in: _Dest=0x7582b58, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0088.753] wcscat (in: _Dest=0x7582b58, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\" [0088.753] wcscat (in: _Dest=0x7582b58, _Source="News_LogoSmall.targetsize-48.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-48.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-48.png" [0088.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7582b58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1200 [0088.754] FindNextFileW (in: hFindFile=0x5445440, lpFindFileData=0x5430e88 | out: lpFindFileData=0x5430e88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x428, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_SplashScreen.scale-100.png", cAlternateFileName="")) returned 1 [0088.754] wcscmp (_String1="News_SplashScreen.scale-100.png", _String2=".") returned 1 [0088.754] wcscmp (_String1="News_SplashScreen.scale-100.png", _String2="..") returned 1 [0088.754] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfa) returned 0x7582738 [0088.754] wcscpy (in: _Dest=0x7582738, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0088.754] wcscat (in: _Dest=0x7582738, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\" [0088.754] wcscat (in: _Dest=0x7582738, _Source="News_SplashScreen.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_SplashScreen.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_SplashScreen.scale-100.png" [0088.754] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7582738, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1900 [0088.754] FindNextFileW (in: hFindFile=0x5445440, lpFindFileData=0x5430e88 | out: lpFindFileData=0x5430e88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x355, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileLargeSquare.scale-100.png", cAlternateFileName="")) returned 1 [0088.754] wcscmp (_String1="News_TileLargeSquare.scale-100.png", _String2=".") returned 1 [0088.755] wcscmp (_String1="News_TileLargeSquare.scale-100.png", _String2="..") returned 1 [0088.755] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100) returned 0x7582840 [0088.755] wcscpy (in: _Dest=0x7582840, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0088.755] wcscat (in: _Dest=0x7582840, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\" [0088.755] wcscat (in: _Dest=0x7582840, _Source="News_TileLargeSquare.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileLargeSquare.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileLargeSquare.scale-100.png" [0088.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7582840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1210 [0088.755] FindNextFileW (in: hFindFile=0x5445440, lpFindFileData=0x5430e88 | out: lpFindFileData=0x5430e88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x167, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileMediumSquare.scale-100.png", cAlternateFileName="")) returned 1 [0088.755] wcscmp (_String1="News_TileMediumSquare.scale-100.png", _String2=".") returned 1 [0088.755] wcscmp (_String1="News_TileMediumSquare.scale-100.png", _String2="..") returned 1 [0088.755] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x102) returned 0x74b2250 [0088.755] wcscpy (in: _Dest=0x74b2250, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0088.755] wcscat (in: _Dest=0x74b2250, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\" [0088.755] wcscat (in: _Dest=0x74b2250, _Source="News_TileMediumSquare.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileMediumSquare.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileMediumSquare.scale-100.png" [0088.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b2250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18fc [0088.756] FindNextFileW (in: hFindFile=0x5445440, lpFindFileData=0x5430e88 | out: lpFindFileData=0x5430e88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileSmallSquare.scale-100.png", cAlternateFileName="")) returned 1 [0088.756] wcscmp (_String1="News_TileSmallSquare.scale-100.png", _String2=".") returned 1 [0088.756] wcscmp (_String1="News_TileSmallSquare.scale-100.png", _String2="..") returned 1 [0088.756] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100) returned 0x7581ef8 [0088.756] wcscpy (in: _Dest=0x7581ef8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0088.756] wcscat (in: _Dest=0x7581ef8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\" [0088.756] wcscat (in: _Dest=0x7581ef8, _Source="News_TileSmallSquare.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileSmallSquare.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileSmallSquare.scale-100.png" [0088.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7581ef8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x121c [0088.757] FindNextFileW (in: hFindFile=0x5445440, lpFindFileData=0x5430e88 | out: lpFindFileData=0x5430e88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileWide.scale-100.png", cAlternateFileName="")) returned 1 [0088.757] wcscmp (_String1="News_TileWide.scale-100.png", _String2=".") returned 1 [0088.757] wcscmp (_String1="News_TileWide.scale-100.png", _String2="..") returned 1 [0088.757] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba22f8 [0088.757] wcscpy (in: _Dest=0x5ba22f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0088.757] wcscat (in: _Dest=0x5ba22f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\" [0088.757] wcscat (in: _Dest=0x5ba22f8, _Source="News_TileWide.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileWide.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileWide.scale-100.png" [0088.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba22f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f8 [0088.758] FindNextFileW (in: hFindFile=0x5445440, lpFindFileData=0x5430e88 | out: lpFindFileData=0x5430e88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.png", cAlternateFileName="")) returned 1 [0088.758] wcscmp (_String1="StoreLogo.png", _String2=".") returned 1 [0088.758] wcscmp (_String1="StoreLogo.png", _String2="..") returned 1 [0088.758] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd6) returned 0x39349c8 [0088.758] wcscpy (in: _Dest=0x39349c8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0088.758] wcscat (in: _Dest=0x39349c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\" [0088.758] wcscat (in: _Dest=0x39349c8, _Source="StoreLogo.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\StoreLogo.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\StoreLogo.png" [0088.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x39349c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18ec [0088.758] FindNextFileW (in: hFindFile=0x5445440, lpFindFileData=0x5430e88 | out: lpFindFileData=0x5430e88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.png", cAlternateFileName="")) returned 0 [0088.759] FindClose (in: hFindFile=0x5445440 | out: hFindFile=0x5445440) returned 1 [0088.759] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5430e88) returned 1 [0088.759] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fa7d0) returned 1 [0088.759] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f9128) returned 1 [0088.759] FindNextFileW (in: hFindFile=0x5445a00, lpFindFileData=0x3939050 | out: lpFindFileData=0x3939050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d7904, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppTiles", cAlternateFileName="")) returned 0 [0088.759] FindClose (in: hFindFile=0x5445a00 | out: hFindFile=0x5445a00) returned 1 [0088.759] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3939050) returned 1 [0088.759] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445fd0) returned 1 [0088.759] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388f510) returned 1 Thread: id = 513 os_tid = 0x17d8 [0072.593] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x53fa7d0 [0072.593] wcscpy (in: _Dest=0x53fa7d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration" [0072.593] wcscat (in: _Dest=0x53fa7d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\" [0072.593] wcscat (in: _Dest=0x53fa7d0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\*" [0072.593] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x39392b8 [0072.593] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\*", lpFindFileData=0x39392b8 | out: lpFindFileData=0x39392b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x705138c0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa458f92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x705138c0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445800 [0082.560] wcscmp (_String1=".", _String2=".") returned 0 [0082.561] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x39392b8 | out: lpFindFileData=0x39392b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x705138c0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa458f92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x705138c0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.561] wcscmp (_String1="..", _String2=".") returned 1 [0082.561] wcscmp (_String1="..", _String2="..") returned 0 [0082.561] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x39392b8 | out: lpFindFileData=0x39392b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705138c0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x705138c0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x705138c0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="configuration.sqlite", cAlternateFileName="")) returned 1 [0082.561] wcscmp (_String1="configuration.sqlite", _String2=".") returned 1 [0082.561] wcscmp (_String1="configuration.sqlite", _String2="..") returned 1 [0082.561] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54bc1a0 [0082.561] wcscpy (in: _Dest=0x54bc1a0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration" [0082.561] wcscat (in: _Dest=0x54bc1a0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\" [0082.561] wcscat (in: _Dest=0x54bc1a0, _Source="configuration.sqlite" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" [0082.561] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bc1a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ef8 [0082.562] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x39392b8 | out: lpFindFileData=0x39392b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705138c0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x705138c0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x705138c0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="configuration.sqlite", cAlternateFileName="")) returned 0 [0082.562] FindClose (in: hFindFile=0x5445800 | out: hFindFile=0x5445800) returned 1 [0082.562] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39392b8) returned 1 [0082.562] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fa7d0) returned 1 [0082.562] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5461828) returned 1 Thread: id = 514 os_tid = 0x17dc [0072.594] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\marketconfiguration.xml")) returned 0x20 [0082.521] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml", dwFileAttributes=0x20) returned 0 [0082.559] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\marketconfiguration.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.570] GetLastError () returned 0x5 [0082.570] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml", dwFileAttributes=0x20) returned 0 [0082.587] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b9ee8) returned 1 Thread: id = 515 os_tid = 0x17e0 [0072.595] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xca) returned 0x38fe218 [0072.595] wcscpy (in: _Dest=0x38fe218, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" [0072.595] wcscat (in: _Dest=0x38fe218, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\" [0072.595] wcscat (in: _Dest=0x38fe218, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\*" [0072.595] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3939520 [0072.595] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\*", lpFindFileData=0x3939520 | out: lpFindFileData=0x3939520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70585fca, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa459889, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x705ac224, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445800 [0082.571] wcscmp (_String1=".", _String2=".") returned 0 [0082.571] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x3939520 | out: lpFindFileData=0x3939520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70585fca, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa459889, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x705ac224, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.571] wcscmp (_String1="..", _String2=".") returned 1 [0082.571] wcscmp (_String1="..", _String2="..") returned 0 [0082.571] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x3939520 | out: lpFindFileData=0x3939520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705ac224, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x705ac224, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x705ac224, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x62f, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootstrap.html", cAlternateFileName="")) returned 1 [0082.571] wcscmp (_String1="bootstrap.html", _String2=".") returned 1 [0082.571] wcscmp (_String1="bootstrap.html", _String2="..") returned 1 [0082.571] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe4) returned 0x396fe38 [0082.571] wcscpy (in: _Dest=0x396fe38, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" [0082.571] wcscat (in: _Dest=0x396fe38, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\" [0082.571] wcscat (in: _Dest=0x396fe38, _Source="bootstrap.html" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html" [0082.571] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396fe38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f00 [0082.572] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x3939520 | out: lpFindFileData=0x3939520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x705ac224, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45a502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x705ac224, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1 [0082.572] wcscmp (_String1="Themes", _String2=".") returned 1 [0082.572] wcscmp (_String1="Themes", _String2="..") returned 1 [0082.572] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd4) returned 0x53fc240 [0082.572] wcscpy (in: _Dest=0x53fc240, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" [0082.572] wcscat (in: _Dest=0x53fc240, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\" [0082.572] wcscat (in: _Dest=0x53fc240, _Source="Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes" [0082.572] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53fc240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f04 [0082.573] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x3939520 | out: lpFindFileData=0x3939520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x705ac224, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45a502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x705ac224, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0 [0082.573] FindClose (in: hFindFile=0x5445800 | out: hFindFile=0x5445800) returned 1 [0082.573] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3939520) returned 1 [0082.573] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38fe218) returned 1 [0082.573] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e7e00) returned 1 Thread: id = 516 os_tid = 0x17e4 [0072.596] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising.winmd")) returned 0x20 [0082.602] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd", dwFileAttributes=0x20) returned 0 [0082.623] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.634] GetLastError () returned 0x5 [0082.634] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd", dwFileAttributes=0x20) returned 0 [0082.645] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b5500) returned 1 Thread: id = 517 os_tid = 0x17e8 [0072.597] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.aria.clienttelemetry.winmd")) returned 0x20 [0082.589] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd", dwFileAttributes=0x20) returned 0 [0082.601] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.aria.clienttelemetry.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.623] GetLastError () returned 0x5 [0082.623] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd", dwFileAttributes=0x20) returned 0 [0082.634] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b55e0) returned 1 Thread: id = 518 os_tid = 0x17ec [0072.597] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x38fe2f0 [0072.597] wcscpy (in: _Dest=0x38fe2f0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services" [0072.597] wcscat (in: _Dest=0x38fe2f0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\" [0072.597] wcscat (in: _Dest=0x38fe2f0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\*" [0072.597] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3939788 [0072.597] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\*", lpFindFileData=0x3939788 | out: lpFindFileData=0x3939788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45af55, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445800 [0082.641] wcscmp (_String1=".", _String2=".") returned 0 [0082.641] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x3939788 | out: lpFindFileData=0x3939788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45af55, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.641] wcscmp (_String1="..", _String2=".") returned 1 [0082.641] wcscmp (_String1="..", _String2="..") returned 0 [0082.641] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x3939788 | out: lpFindFileData=0x3939788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45be97, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Personalization", cAlternateFileName="PERSON~1")) returned 1 [0082.641] wcscmp (_String1="Personalization", _String2=".") returned 1 [0082.641] wcscmp (_String1="Personalization", _String2="..") returned 1 [0082.641] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x54b9738 [0082.641] wcscpy (in: _Dest=0x54b9738, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services" [0082.641] wcscat (in: _Dest=0x54b9738, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\" [0082.641] wcscat (in: _Dest=0x54b9738, _Source="Personalization" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization" [0082.641] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54b9738, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f58 [0082.642] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x3939788 | out: lpFindFileData=0x3939788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45be97, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Personalization", cAlternateFileName="PERSON~1")) returned 0 [0082.642] FindClose (in: hFindFile=0x5445800 | out: hFindFile=0x5445800) returned 1 [0082.642] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3939788) returned 1 [0082.642] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38fe2f0) returned 1 [0082.642] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e7780) returned 1 Thread: id = 519 os_tid = 0x17f0 [0072.598] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x53f8310 [0072.598] wcscpy (in: _Dest=0x53f8310, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell" [0072.598] wcscat (in: _Dest=0x53f8310, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\" [0072.598] wcscat (in: _Dest=0x53f8310, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\*" [0072.598] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x39399f0 [0072.598] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\*", lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa4624cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445800 [0082.627] wcscmp (_String1=".", _String2=".") returned 0 [0082.627] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa4624cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.627] wcscmp (_String1="..", _String2=".") returned 1 [0082.627] wcscmp (_String1="..", _String2="..") returned 0 [0082.627] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa463310, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1 [0082.627] wcscmp (_String1="Themes", _String2=".") returned 1 [0082.627] wcscmp (_String1="Themes", _String2="..") returned 1 [0082.627] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x7580348 [0082.627] wcscpy (in: _Dest=0x7580348, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell" [0082.627] wcscat (in: _Dest=0x7580348, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\" [0082.627] wcscat (in: _Dest=0x7580348, _Source="Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes" [0082.627] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7580348, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f4c [0082.628] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa463310, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0 [0082.628] FindClose (in: hFindFile=0x5445800 | out: hFindFile=0x5445800) returned 1 [0082.629] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39399f0) returned 1 [0082.629] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f8310) returned 1 [0082.629] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e7850) returned 1 Thread: id = 520 os_tid = 0x17f4 [0072.599] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x38b02e8 [0072.599] wcscpy (in: _Dest=0x38b02e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0072.599] wcscat (in: _Dest=0x38b02e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0072.599] wcscat (in: _Dest=0x38b02e8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0072.599] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3939c58 [0072.599] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x3939c58 | out: lpFindFileData=0x3939c58*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5fac1d9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa466063, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54453c0 [0082.651] wcscmp (_String1=".", _String2=".") returned 0 [0082.651] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3939c58 | out: lpFindFileData=0x3939c58*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5fac1d9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa466063, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.651] wcscmp (_String1="..", _String2=".") returned 1 [0082.651] wcscmp (_String1="..", _String2="..") returned 0 [0082.651] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3939c58 | out: lpFindFileData=0x3939c58*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5fac1d9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa466063, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0082.652] FindClose (in: hFindFile=0x54453c0 | out: hFindFile=0x54453c0) returned 1 [0082.652] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3939c58) returned 1 [0082.652] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b02e8) returned 1 [0082.652] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x546dff8) returned 1 Thread: id = 521 os_tid = 0x17f8 [0072.602] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MicrosoftAdvertising.ini" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoftadvertising.ini")) returned 0x20 [0082.650] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MicrosoftAdvertising.ini", dwFileAttributes=0x20) returned 0 [0082.650] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MicrosoftAdvertising.ini" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoftadvertising.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.655] GetLastError () returned 0x5 [0082.655] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MicrosoftAdvertising.ini", dwFileAttributes=0x20) returned 0 [0082.658] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ba3f8) returned 1 Thread: id = 522 os_tid = 0x17fc [0072.602] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53f8f98 [0072.602] wcscpy (in: _Dest=0x53f8f98, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS" [0072.602] wcscat (in: _Dest=0x53f8f98, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\" [0072.602] wcscat (in: _Dest=0x53f8f98, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\*" [0072.602] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3939ec0 [0072.602] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\*", lpFindFileData=0x3939ec0 | out: lpFindFileData=0x3939ec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa466b87, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445900 [0082.661] wcscmp (_String1=".", _String2=".") returned 0 [0082.661] FindNextFileW (in: hFindFile=0x5445900, lpFindFileData=0x3939ec0 | out: lpFindFileData=0x3939ec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa466b87, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.661] wcscmp (_String1="..", _String2=".") returned 1 [0082.661] wcscmp (_String1="..", _String2="..") returned 0 [0082.661] FindNextFileW (in: hFindFile=0x5445900, lpFindFileData=0x3939ec0 | out: lpFindFileData=0x3939ec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x70775e5e, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4be9, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootstrap.js", cAlternateFileName="")) returned 1 [0082.661] wcscmp (_String1="bootstrap.js", _String2=".") returned 1 [0082.661] wcscmp (_String1="bootstrap.js", _String2="..") returned 1 [0082.661] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd4) returned 0x53fcb00 [0082.661] wcscpy (in: _Dest=0x53fcb00, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS" [0082.662] wcscat (in: _Dest=0x53fcb00, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\" [0082.662] wcscat (in: _Dest=0x53fcb00, _Source="bootstrap.js" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js" [0082.662] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs\\bootstrap.js")) returned 0x20 [0082.819] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js", dwFileAttributes=0x20) returned 0 [0082.819] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs\\bootstrap.js"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.819] GetLastError () returned 0x5 [0082.819] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js", dwFileAttributes=0x20) returned 0 [0082.819] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fcb00) returned 1 [0082.819] FindNextFileW (in: hFindFile=0x5445900, lpFindFileData=0x3939ec0 | out: lpFindFileData=0x3939ec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x70775e5e, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x73d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ormma.js", cAlternateFileName="")) returned 1 [0082.819] wcscmp (_String1="ormma.js", _String2=".") returned 1 [0082.819] wcscmp (_String1="ormma.js", _String2="..") returned 1 [0082.819] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x75805d0 [0082.819] wcscpy (in: _Dest=0x75805d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS" [0082.819] wcscat (in: _Dest=0x75805d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\" [0082.819] wcscat (in: _Dest=0x75805d0, _Source="ormma.js" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js" [0082.819] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs\\ormma.js")) returned 0x20 [0082.821] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js", dwFileAttributes=0x20) returned 0 [0082.821] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs\\ormma.js"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.822] GetLastError () returned 0x5 [0082.822] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js", dwFileAttributes=0x20) returned 0 [0082.822] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75805d0) returned 1 [0082.822] FindNextFileW (in: hFindFile=0x5445900, lpFindFileData=0x3939ec0 | out: lpFindFileData=0x3939ec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x70775e5e, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x73d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ormma.js", cAlternateFileName="")) returned 0 [0082.823] FindClose (in: hFindFile=0x5445900 | out: hFindFile=0x5445900) returned 1 [0082.823] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3939ec0) returned 1 [0082.823] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f8f98) returned 1 [0082.823] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e81c0) returned 1 Thread: id = 523 os_tid = 0xf98 [0072.603] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\PlatformConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\platformconfiguration.xml")) returned 0x20 [0082.658] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\PlatformConfiguration.xml", dwFileAttributes=0x20) returned 0 [0082.659] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\PlatformConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\platformconfiguration.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.666] GetLastError () returned 0x5 [0082.666] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\PlatformConfiguration.xml", dwFileAttributes=0x20) returned 0 [0082.669] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53bb328) returned 1 Thread: id = 524 os_tid = 0x1314 [0072.604] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri")) returned 0x20 [0082.672] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0082.674] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.765] GetLastError () returned 0x5 [0082.765] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0082.769] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54615e8) returned 1 Thread: id = 525 os_tid = 0x12a8 [0072.604] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\SQLiteWrapper.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\sqlitewrapper.winmd")) returned 0x20 [0082.669] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\SQLiteWrapper.winmd", dwFileAttributes=0x20) returned 0 [0082.670] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\SQLiteWrapper.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\sqlitewrapper.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.674] GetLastError () returned 0x5 [0082.674] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\SQLiteWrapper.winmd", dwFileAttributes=0x20) returned 0 [0082.764] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e7100) returned 1 Thread: id = 526 os_tid = 0x1278 [0072.605] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb4) returned 0x3904660 [0072.605] wcscpy (in: _Dest=0x3904660, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources" [0072.605] wcscat (in: _Dest=0x3904660, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\" [0072.605] wcscat (in: _Dest=0x3904660, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\*" [0072.605] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393a128 [0072.605] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x393a128 | out: lpFindFileData=0x393a128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d5b50, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445980 [0082.762] wcscmp (_String1=".", _String2=".") returned 0 [0082.762] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x393a128 | out: lpFindFileData=0x393a128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d5b50, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.762] wcscmp (_String1="..", _String2=".") returned 1 [0082.762] wcscmp (_String1="..", _String2="..") returned 0 [0082.762] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x393a128 | out: lpFindFileData=0x393a128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704a11ba, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2985, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.rsrc", cAlternateFileName="")) returned 1 [0082.762] wcscmp (_String1="0.rsrc", _String2=".") returned 1 [0082.762] wcscmp (_String1="0.rsrc", _String2="..") returned 1 [0082.762] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53f96a0 [0082.762] wcscpy (in: _Dest=0x53f96a0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources" [0082.762] wcscat (in: _Dest=0x53f96a0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\" [0082.762] wcscat (in: _Dest=0x53f96a0, _Source="0.rsrc" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\0.rsrc") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\0.rsrc" [0082.763] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\0.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\_resources\\0.rsrc")) returned 0x20 [0082.795] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\0.rsrc", dwFileAttributes=0x20) returned 0 [0082.797] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\0.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\_resources\\0.rsrc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.798] GetLastError () returned 0x5 [0082.798] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\0.rsrc", dwFileAttributes=0x20) returned 0 [0082.798] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f96a0) returned 1 [0082.814] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x393a128 | out: lpFindFileData=0x393a128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704a11ba, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa3, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.txt", cAlternateFileName="")) returned 1 [0082.814] wcscmp (_String1="index.txt", _String2=".") returned 1 [0082.814] wcscmp (_String1="index.txt", _String2="..") returned 1 [0082.814] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x3972000 [0082.814] wcscpy (in: _Dest=0x3972000, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources" [0082.814] wcscat (in: _Dest=0x3972000, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\" [0082.814] wcscat (in: _Dest=0x3972000, _Source="index.txt" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\index.txt") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\index.txt" [0082.814] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\index.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\_resources\\index.txt")) returned 0x20 [0082.816] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\index.txt", dwFileAttributes=0x20) returned 0 [0082.816] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\index.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\_resources\\index.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.817] GetLastError () returned 0x5 [0082.817] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\index.txt", dwFileAttributes=0x20) returned 0 [0082.818] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3972000) returned 1 [0082.818] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x393a128 | out: lpFindFileData=0x393a128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704a11ba, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa3, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.txt", cAlternateFileName="")) returned 0 [0082.818] FindClose (in: hFindFile=0x5445980 | out: hFindFile=0x5445980) returned 1 [0082.818] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393a128) returned 1 [0082.818] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3904660) returned 1 [0082.818] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54462b0) returned 1 Thread: id = 527 os_tid = 0x1318 [0072.609] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appconfiguration.xml")) returned 0x20 [0076.252] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml", dwFileAttributes=0x20) returned 0 [0076.253] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appconfiguration.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0076.253] GetLastError () returned 0x5 [0076.253] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml", dwFileAttributes=0x20) returned 0 [0076.253] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53bafc8) returned 1 Thread: id = 528 os_tid = 0x12dc [0072.611] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0081.250] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0081.250] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.479] GetLastError () returned 0x5 [0083.479] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.479] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f7af0) returned 1 Thread: id = 529 os_tid = 0x12b4 [0072.611] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0082.521] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0083.478] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.478] GetLastError () returned 0x5 [0083.478] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0083.478] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f7880) returned 1 Thread: id = 530 os_tid = 0x1348 [0072.612] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53f9380 [0072.612] wcscpy (in: _Dest=0x53f9380, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata" [0072.612] wcscat (in: _Dest=0x53f9380, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\" [0072.612] wcscat (in: _Dest=0x53f9380, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*" [0072.612] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3935690 [0072.612] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x3935690 | out: lpFindFileData=0x3935690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa098c51, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389eb80 [0083.381] wcscmp (_String1=".", _String2=".") returned 0 [0083.383] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x3935690 | out: lpFindFileData=0x3935690*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa098c51, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.383] wcscmp (_String1="..", _String2=".") returned 1 [0083.383] wcscmp (_String1="..", _String2="..") returned 0 [0083.383] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x3935690 | out: lpFindFileData=0x3935690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77492ec4, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2fe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1 [0083.384] wcscmp (_String1="CodeIntegrity.cat", _String2=".") returned 1 [0083.384] wcscmp (_String1="CodeIntegrity.cat", _String2="..") returned 1 [0083.384] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xde) returned 0x54f0dd8 [0083.399] wcscpy (in: _Dest=0x54f0dd8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata" [0083.399] wcscat (in: _Dest=0x54f0dd8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\" [0083.401] wcscat (in: _Dest=0x54f0dd8, _Source="CodeIntegrity.cat" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" [0083.413] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat")) returned 0x20 [0083.415] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0083.415] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.416] GetLastError () returned 0x5 [0083.416] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0083.416] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f0dd8) returned 1 [0083.416] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x3935690 | out: lpFindFileData=0x3935690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77492ec4, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2fe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 0 [0083.416] FindClose (in: hFindFile=0x389eb80 | out: hFindFile=0x389eb80) returned 1 [0083.416] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3935690) returned 1 [0083.416] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f9380) returned 1 [0083.416] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e8288) returned 1 Thread: id = 531 os_tid = 0x1344 [0072.613] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0083.477] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.477] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.477] GetLastError () returned 0x5 [0083.477] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.477] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f7fd0) returned 1 Thread: id = 532 os_tid = 0x1294 [0072.614] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb2) returned 0x3904720 [0072.614] wcscpy (in: _Dest=0x3904720, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets" [0072.614] wcscat (in: _Dest=0x3904720, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\" [0072.614] wcscat (in: _Dest=0x3904720, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\*" [0072.614] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x39358f8 [0072.614] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x39358f8 | out: lpFindFileData=0x39358f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0991e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389eac0 [0083.374] wcscmp (_String1=".", _String2=".") returned 0 [0083.374] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x39358f8 | out: lpFindFileData=0x39358f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0991e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.374] wcscmp (_String1="..", _String2=".") returned 1 [0083.374] wcscmp (_String1="..", _String2="..") returned 0 [0083.374] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x39358f8 | out: lpFindFileData=0x39358f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0dcf11, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x775054bc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppTiles", cAlternateFileName="")) returned 1 [0083.374] wcscmp (_String1="AppTiles", _String2=".") returned 1 [0083.374] wcscmp (_String1="AppTiles", _String2="..") returned 1 [0083.374] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x53f9510 [0083.374] wcscpy (in: _Dest=0x53f9510, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets" [0083.374] wcscat (in: _Dest=0x53f9510, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\" [0083.375] wcscat (in: _Dest=0x53f9510, _Source="AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0083.375] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x3970ef0 [0083.375] wcscpy (in: _Dest=0x3970ef0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0083.375] wcscat (in: _Dest=0x3970ef0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\" [0083.375] wcscat (in: _Dest=0x3970ef0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\*" [0083.375] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d1430 [0083.375] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\*", lpFindFileData=0x53d1430 | out: lpFindFileData=0x53d1430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0dcf11, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x775054bc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e740 [0083.377] wcscmp (_String1=".", _String2=".") returned 0 [0083.377] FindNextFileW (in: hFindFile=0x389e740, lpFindFileData=0x53d1430 | out: lpFindFileData=0x53d1430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0dcf11, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x775054bc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.377] wcscmp (_String1="..", _String2=".") returned 1 [0083.377] wcscmp (_String1="..", _String2="..") returned 0 [0083.377] FindNextFileW (in: hFindFile=0x389e740, lpFindFileData=0x53d1430 | out: lpFindFileData=0x53d1430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0df02e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x774b901c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-black", cAlternateFileName="CONTRA~1")) returned 1 [0083.377] wcscmp (_String1="contrast-black", _String2=".") returned 1 [0083.377] wcscmp (_String1="contrast-black", _String2="..") returned 1 [0083.377] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xde) returned 0x54f0780 [0083.377] wcscpy (in: _Dest=0x54f0780, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0083.377] wcscat (in: _Dest=0x54f0780, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\" [0083.377] wcscat (in: _Dest=0x54f0780, _Source="contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" [0083.377] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x39704c8 [0083.377] wcscpy (in: _Dest=0x39704c8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" [0083.377] wcscat (in: _Dest=0x39704c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\" [0083.377] wcscat (in: _Dest=0x39704c8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\*" [0083.377] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53ce1a8 [0083.377] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\*", lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0df02e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x774b901c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e7c0 [0083.380] wcscmp (_String1=".", _String2=".") returned 0 [0083.380] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0df02e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x774b901c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.380] wcscmp (_String1="..", _String2=".") returned 1 [0083.380] wcscmp (_String1="..", _String2="..") returned 0 [0083.380] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77492ec4, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1 [0083.380] wcscmp (_String1="Money_LogoSmall.scale-100.png", _String2=".") returned 1 [0083.380] wcscmp (_String1="Money_LogoSmall.scale-100.png", _String2="..") returned 1 [0083.380] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11a) returned 0x7585420 [0083.380] wcscpy (in: _Dest=0x7585420, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" [0083.380] wcscat (in: _Dest=0x7585420, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\" [0083.380] wcscat (in: _Dest=0x7585420, _Source="Money_LogoSmall.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.scale-100.png" [0083.380] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.scale-100.png")) returned 0x20 [0083.382] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.382] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.382] GetLastError () returned 0x5 [0083.382] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.382] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7585420) returned 1 [0083.382] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77492ec4, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.targetsize-16.png", cAlternateFileName="")) returned 1 [0083.382] wcscmp (_String1="Money_LogoSmall.targetsize-16.png", _String2=".") returned 1 [0083.382] wcscmp (_String1="Money_LogoSmall.targetsize-16.png", _String2="..") returned 1 [0083.382] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x122) returned 0x7587a08 [0083.382] wcscpy (in: _Dest=0x7587a08, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" [0083.382] wcscat (in: _Dest=0x7587a08, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\" [0083.382] wcscat (in: _Dest=0x7587a08, _Source="Money_LogoSmall.targetsize-16.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-16.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-16.png" [0083.382] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.targetsize-16.png")) returned 0x20 [0083.383] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-16.png", dwFileAttributes=0x20) returned 0 [0083.383] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.targetsize-16.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.383] GetLastError () returned 0x5 [0083.383] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-16.png", dwFileAttributes=0x20) returned 0 [0083.384] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7587a08) returned 1 [0083.384] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77492ec4, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.targetsize-24.png", cAlternateFileName="")) returned 1 [0083.384] wcscmp (_String1="Money_LogoSmall.targetsize-24.png", _String2=".") returned 1 [0083.384] wcscmp (_String1="Money_LogoSmall.targetsize-24.png", _String2="..") returned 1 [0083.384] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x122) returned 0x7586dd8 [0083.384] wcscpy (in: _Dest=0x7586dd8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" [0083.384] wcscat (in: _Dest=0x7586dd8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\" [0083.384] wcscat (in: _Dest=0x7586dd8, _Source="Money_LogoSmall.targetsize-24.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-24.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-24.png" [0083.384] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.targetsize-24.png")) returned 0x20 [0083.385] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-24.png", dwFileAttributes=0x20) returned 0 [0083.385] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.targetsize-24.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.385] GetLastError () returned 0x5 [0083.385] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-24.png", dwFileAttributes=0x20) returned 0 [0083.385] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7586dd8) returned 1 [0083.385] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77492ec4, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x774b901c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x697, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.targetsize-256.png", cAlternateFileName="")) returned 1 [0083.385] wcscmp (_String1="Money_LogoSmall.targetsize-256.png", _String2=".") returned 1 [0083.385] wcscmp (_String1="Money_LogoSmall.targetsize-256.png", _String2="..") returned 1 [0083.385] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x124) returned 0x75861a8 [0083.385] wcscpy (in: _Dest=0x75861a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" [0083.385] wcscat (in: _Dest=0x75861a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\" [0083.385] wcscat (in: _Dest=0x75861a8, _Source="Money_LogoSmall.targetsize-256.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-256.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-256.png" [0083.385] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.targetsize-256.png")) returned 0x20 [0083.386] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-256.png", dwFileAttributes=0x20) returned 0 [0083.386] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.targetsize-256.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.386] GetLastError () returned 0x5 [0083.386] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-256.png", dwFileAttributes=0x20) returned 0 [0083.386] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75861a8) returned 1 [0083.386] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774b901c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x774b901c, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x774b901c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.targetsize-32.png", cAlternateFileName="")) returned 1 [0083.386] wcscmp (_String1="Money_LogoSmall.targetsize-32.png", _String2=".") returned 1 [0083.386] wcscmp (_String1="Money_LogoSmall.targetsize-32.png", _String2="..") returned 1 [0083.386] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x122) returned 0x7587528 [0083.386] wcscpy (in: _Dest=0x7587528, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" [0083.386] wcscat (in: _Dest=0x7587528, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\" [0083.386] wcscat (in: _Dest=0x7587528, _Source="Money_LogoSmall.targetsize-32.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-32.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-32.png" [0083.386] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.targetsize-32.png")) returned 0x20 [0083.387] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-32.png", dwFileAttributes=0x20) returned 0 [0083.387] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.targetsize-32.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.388] GetLastError () returned 0x5 [0083.388] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-32.png", dwFileAttributes=0x20) returned 0 [0083.388] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7587528) returned 1 [0083.388] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774b901c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x774b901c, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x774b901c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.targetsize-48.png", cAlternateFileName="")) returned 1 [0083.388] wcscmp (_String1="Money_LogoSmall.targetsize-48.png", _String2=".") returned 1 [0083.389] wcscmp (_String1="Money_LogoSmall.targetsize-48.png", _String2="..") returned 1 [0083.389] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x122) returned 0x7587528 [0083.389] wcscpy (in: _Dest=0x7587528, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" [0083.389] wcscat (in: _Dest=0x7587528, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\" [0083.389] wcscat (in: _Dest=0x7587528, _Source="Money_LogoSmall.targetsize-48.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-48.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-48.png" [0083.389] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.targetsize-48.png")) returned 0x20 [0083.389] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-48.png", dwFileAttributes=0x20) returned 0 [0083.390] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.targetsize-48.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.390] GetLastError () returned 0x5 [0083.390] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-48.png", dwFileAttributes=0x20) returned 0 [0083.390] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7587528) returned 1 [0083.390] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774b901c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x774b901c, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x774b901c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x508, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_SplashScreen.scale-100.png", cAlternateFileName="")) returned 1 [0083.390] wcscmp (_String1="Money_SplashScreen.scale-100.png", _String2=".") returned 1 [0083.390] wcscmp (_String1="Money_SplashScreen.scale-100.png", _String2="..") returned 1 [0083.390] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x120) returned 0x75849b8 [0083.390] wcscpy (in: _Dest=0x75849b8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" [0083.390] wcscat (in: _Dest=0x75849b8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\" [0083.390] wcscat (in: _Dest=0x75849b8, _Source="Money_SplashScreen.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_SplashScreen.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_SplashScreen.scale-100.png" [0083.390] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_splashscreen.scale-100.png")) returned 0x20 [0083.391] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_SplashScreen.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.391] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_splashscreen.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.391] GetLastError () returned 0x5 [0083.391] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_SplashScreen.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.391] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75849b8) returned 1 [0083.391] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774b901c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x774b901c, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x774b901c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileLargeSquare.scale-100.png", cAlternateFileName="")) returned 1 [0083.391] wcscmp (_String1="Money_TileLargeSquare.scale-100.png", _String2=".") returned 1 [0083.391] wcscmp (_String1="Money_TileLargeSquare.scale-100.png", _String2="..") returned 1 [0083.391] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x126) returned 0x75867c0 [0083.391] wcscpy (in: _Dest=0x75867c0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" [0083.391] wcscat (in: _Dest=0x75867c0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\" [0083.391] wcscat (in: _Dest=0x75867c0, _Source="Money_TileLargeSquare.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileLargeSquare.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileLargeSquare.scale-100.png" [0083.391] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_tilelargesquare.scale-100.png")) returned 0x20 [0083.392] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileLargeSquare.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.392] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_tilelargesquare.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.392] GetLastError () returned 0x5 [0083.392] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileLargeSquare.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.393] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75867c0) returned 1 [0083.393] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774b901c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x774b901c, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x774b901c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileMediumSquare.scale-100.png", cAlternateFileName="")) returned 1 [0083.393] wcscmp (_String1="Money_TileMediumSquare.scale-100.png", _String2=".") returned 1 [0083.393] wcscmp (_String1="Money_TileMediumSquare.scale-100.png", _String2="..") returned 1 [0083.393] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x128) returned 0x75862e0 [0083.393] wcscpy (in: _Dest=0x75862e0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" [0083.393] wcscat (in: _Dest=0x75862e0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\" [0083.393] wcscat (in: _Dest=0x75862e0, _Source="Money_TileMediumSquare.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileMediumSquare.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileMediumSquare.scale-100.png" [0083.393] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_tilemediumsquare.scale-100.png")) returned 0x20 [0083.394] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileMediumSquare.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.394] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_tilemediumsquare.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.394] GetLastError () returned 0x5 [0083.394] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileMediumSquare.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.394] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75862e0) returned 1 [0083.394] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774b901c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x774b901c, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x774b901c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x129, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileSmallSquare.scale-100.png", cAlternateFileName="")) returned 1 [0083.394] wcscmp (_String1="Money_TileSmallSquare.scale-100.png", _String2=".") returned 1 [0083.394] wcscmp (_String1="Money_TileSmallSquare.scale-100.png", _String2="..") returned 1 [0083.394] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x126) returned 0x7588020 [0083.394] wcscpy (in: _Dest=0x7588020, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" [0083.394] wcscat (in: _Dest=0x7588020, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\" [0083.394] wcscat (in: _Dest=0x7588020, _Source="Money_TileSmallSquare.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileSmallSquare.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileSmallSquare.scale-100.png" [0083.394] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_tilesmallsquare.scale-100.png")) returned 0x20 [0083.395] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileSmallSquare.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.395] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_tilesmallsquare.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.395] GetLastError () returned 0x5 [0083.395] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileSmallSquare.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.395] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7588020) returned 1 [0083.395] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774b901c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x774b901c, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x774b901c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x25a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileWide.scale-100.png", cAlternateFileName="")) returned 1 [0083.395] wcscmp (_String1="Money_TileWide.scale-100.png", _String2=".") returned 1 [0083.396] wcscmp (_String1="Money_TileWide.scale-100.png", _String2="..") returned 1 [0083.396] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x118) returned 0x75858c0 [0083.396] wcscpy (in: _Dest=0x75858c0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" [0083.396] wcscat (in: _Dest=0x75858c0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\" [0083.396] wcscat (in: _Dest=0x75858c0, _Source="Money_TileWide.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileWide.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileWide.scale-100.png" [0083.396] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_tilewide.scale-100.png")) returned 0x20 [0083.396] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileWide.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.397] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_tilewide.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.397] GetLastError () returned 0x5 [0083.397] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileWide.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.397] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75858c0) returned 1 [0083.397] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774b901c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x774b901c, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x774b901c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x25a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileWide.scale-100.png", cAlternateFileName="")) returned 0 [0083.397] FindClose (in: hFindFile=0x389e7c0 | out: hFindFile=0x389e7c0) returned 1 [0083.398] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ce1a8) returned 1 [0083.398] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39704c8) returned 1 [0083.398] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f0780) returned 1 [0083.398] FindNextFileW (in: hFindFile=0x389e740, lpFindFileData=0x53d1430 | out: lpFindFileData=0x53d1430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x774b901c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa14080b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x774df276, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0083.398] wcscmp (_String1="contrast-white", _String2=".") returned 1 [0083.398] wcscmp (_String1="contrast-white", _String2="..") returned 1 [0083.398] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xde) returned 0x54f0ec0 [0083.398] wcscpy (in: _Dest=0x54f0ec0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0083.398] wcscat (in: _Dest=0x54f0ec0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\" [0083.398] wcscat (in: _Dest=0x54f0ec0, _Source="contrast-white" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" [0083.398] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x39704c8 [0083.398] wcscpy (in: _Dest=0x39704c8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" [0083.398] wcscat (in: _Dest=0x39704c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\" [0083.398] wcscat (in: _Dest=0x39704c8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\*" [0083.398] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53ce1a8 [0083.398] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\*", lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x774b901c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa14080b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x774df276, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ecc0 [0083.400] wcscmp (_String1=".", _String2=".") returned 0 [0083.400] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x774b901c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa14080b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x774df276, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.400] wcscmp (_String1="..", _String2=".") returned 1 [0083.400] wcscmp (_String1="..", _String2="..") returned 0 [0083.400] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774b901c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x774b901c, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x774b901c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1 [0083.400] wcscmp (_String1="Money_LogoSmall.scale-100.png", _String2=".") returned 1 [0083.400] wcscmp (_String1="Money_LogoSmall.scale-100.png", _String2="..") returned 1 [0083.400] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11a) returned 0x7585798 [0083.400] wcscpy (in: _Dest=0x7585798, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" [0083.400] wcscat (in: _Dest=0x7585798, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\" [0083.400] wcscat (in: _Dest=0x7585798, _Source="Money_LogoSmall.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.scale-100.png" [0083.400] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.scale-100.png")) returned 0x20 [0083.401] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.401] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.401] GetLastError () returned 0x5 [0083.401] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.401] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7585798) returned 1 [0083.402] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774b901c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x774b901c, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x774b901c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.targetsize-16.png", cAlternateFileName="")) returned 1 [0083.402] wcscmp (_String1="Money_LogoSmall.targetsize-16.png", _String2=".") returned 1 [0083.402] wcscmp (_String1="Money_LogoSmall.targetsize-16.png", _String2="..") returned 1 [0083.402] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x122) returned 0x75878d0 [0083.402] wcscpy (in: _Dest=0x75878d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" [0083.402] wcscat (in: _Dest=0x75878d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\" [0083.402] wcscat (in: _Dest=0x75878d0, _Source="Money_LogoSmall.targetsize-16.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-16.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-16.png" [0083.402] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.targetsize-16.png")) returned 0x20 [0083.402] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-16.png", dwFileAttributes=0x20) returned 0 [0083.402] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.targetsize-16.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.403] GetLastError () returned 0x5 [0083.403] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-16.png", dwFileAttributes=0x20) returned 0 [0083.403] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75878d0) returned 1 [0083.403] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774b901c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x774b901c, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x774b901c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.targetsize-24.png", cAlternateFileName="")) returned 1 [0083.403] wcscmp (_String1="Money_LogoSmall.targetsize-24.png", _String2=".") returned 1 [0083.403] wcscmp (_String1="Money_LogoSmall.targetsize-24.png", _String2="..") returned 1 [0083.403] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x122) returned 0x75878d0 [0083.403] wcscpy (in: _Dest=0x75878d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" [0083.403] wcscat (in: _Dest=0x75878d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\" [0083.403] wcscat (in: _Dest=0x75878d0, _Source="Money_LogoSmall.targetsize-24.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-24.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-24.png" [0083.403] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.targetsize-24.png")) returned 0x20 [0083.404] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-24.png", dwFileAttributes=0x20) returned 0 [0083.404] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.targetsize-24.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.404] GetLastError () returned 0x5 [0083.404] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-24.png", dwFileAttributes=0x20) returned 0 [0083.404] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75878d0) returned 1 [0083.404] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774df276, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x774df276, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x774df276, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x65d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.targetsize-256.png", cAlternateFileName="")) returned 1 [0083.404] wcscmp (_String1="Money_LogoSmall.targetsize-256.png", _String2=".") returned 1 [0083.404] wcscmp (_String1="Money_LogoSmall.targetsize-256.png", _String2="..") returned 1 [0083.404] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x124) returned 0x7587528 [0083.404] wcscpy (in: _Dest=0x7587528, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" [0083.404] wcscat (in: _Dest=0x7587528, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\" [0083.404] wcscat (in: _Dest=0x7587528, _Source="Money_LogoSmall.targetsize-256.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-256.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-256.png" [0083.404] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.targetsize-256.png")) returned 0x20 [0083.404] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-256.png", dwFileAttributes=0x20) returned 0 [0083.404] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.targetsize-256.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.404] GetLastError () returned 0x5 [0083.405] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-256.png", dwFileAttributes=0x20) returned 0 [0083.405] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7587528) returned 1 [0083.405] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774df276, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x774df276, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x774df276, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.targetsize-32.png", cAlternateFileName="")) returned 1 [0083.405] wcscmp (_String1="Money_LogoSmall.targetsize-32.png", _String2=".") returned 1 [0083.405] wcscmp (_String1="Money_LogoSmall.targetsize-32.png", _String2="..") returned 1 [0083.405] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x122) returned 0x7587048 [0083.405] wcscpy (in: _Dest=0x7587048, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" [0083.405] wcscat (in: _Dest=0x7587048, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\" [0083.405] wcscat (in: _Dest=0x7587048, _Source="Money_LogoSmall.targetsize-32.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-32.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-32.png" [0083.405] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.targetsize-32.png")) returned 0x20 [0083.405] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-32.png", dwFileAttributes=0x20) returned 0 [0083.405] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.targetsize-32.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.405] GetLastError () returned 0x5 [0083.405] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-32.png", dwFileAttributes=0x20) returned 0 [0083.405] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7587048) returned 1 [0083.405] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774df276, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x774df276, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x774df276, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.targetsize-48.png", cAlternateFileName="")) returned 1 [0083.405] wcscmp (_String1="Money_LogoSmall.targetsize-48.png", _String2=".") returned 1 [0083.405] wcscmp (_String1="Money_LogoSmall.targetsize-48.png", _String2="..") returned 1 [0083.406] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x122) returned 0x75867c0 [0083.406] wcscpy (in: _Dest=0x75867c0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" [0083.406] wcscat (in: _Dest=0x75867c0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\" [0083.406] wcscat (in: _Dest=0x75867c0, _Source="Money_LogoSmall.targetsize-48.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-48.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-48.png" [0083.406] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.targetsize-48.png")) returned 0x20 [0083.406] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-48.png", dwFileAttributes=0x20) returned 0 [0083.406] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.targetsize-48.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.406] GetLastError () returned 0x5 [0083.406] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-48.png", dwFileAttributes=0x20) returned 0 [0083.406] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75867c0) returned 1 [0083.406] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774df276, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x774df276, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x774df276, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_SplashScreen.scale-100.png", cAlternateFileName="")) returned 1 [0083.406] wcscmp (_String1="Money_SplashScreen.scale-100.png", _String2=".") returned 1 [0083.406] wcscmp (_String1="Money_SplashScreen.scale-100.png", _String2="..") returned 1 [0083.406] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x120) returned 0x75849b8 [0083.406] wcscpy (in: _Dest=0x75849b8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" [0083.406] wcscat (in: _Dest=0x75849b8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\" [0083.406] wcscat (in: _Dest=0x75849b8, _Source="Money_SplashScreen.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_SplashScreen.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_SplashScreen.scale-100.png" [0083.407] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_splashscreen.scale-100.png")) returned 0x20 [0083.407] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_SplashScreen.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.407] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_splashscreen.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.407] GetLastError () returned 0x5 [0083.407] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_SplashScreen.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.408] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75849b8) returned 1 [0083.408] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774df276, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x774df276, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x774df276, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x423, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileLargeSquare.scale-100.png", cAlternateFileName="")) returned 1 [0083.408] wcscmp (_String1="Money_TileLargeSquare.scale-100.png", _String2=".") returned 1 [0083.408] wcscmp (_String1="Money_TileLargeSquare.scale-100.png", _String2="..") returned 1 [0083.408] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x126) returned 0x7588020 [0083.408] wcscpy (in: _Dest=0x7588020, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" [0083.408] wcscat (in: _Dest=0x7588020, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\" [0083.408] wcscat (in: _Dest=0x7588020, _Source="Money_TileLargeSquare.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileLargeSquare.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileLargeSquare.scale-100.png" [0083.408] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_tilelargesquare.scale-100.png")) returned 0x20 [0083.408] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileLargeSquare.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.408] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_tilelargesquare.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.408] GetLastError () returned 0x5 [0083.408] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileLargeSquare.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.408] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7588020) returned 1 [0083.408] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774df276, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x774df276, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x774df276, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileMediumSquare.scale-100.png", cAlternateFileName="")) returned 1 [0083.408] wcscmp (_String1="Money_TileMediumSquare.scale-100.png", _String2=".") returned 1 [0083.408] wcscmp (_String1="Money_TileMediumSquare.scale-100.png", _String2="..") returned 1 [0083.408] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x128) returned 0x75872b8 [0083.408] wcscpy (in: _Dest=0x75872b8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" [0083.409] wcscat (in: _Dest=0x75872b8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\" [0083.409] wcscat (in: _Dest=0x75872b8, _Source="Money_TileMediumSquare.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileMediumSquare.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileMediumSquare.scale-100.png" [0083.409] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_tilemediumsquare.scale-100.png")) returned 0x20 [0083.409] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileMediumSquare.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.410] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_tilemediumsquare.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.410] GetLastError () returned 0x5 [0083.410] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileMediumSquare.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.410] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75872b8) returned 1 [0083.410] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774df276, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x774df276, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x774df276, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileSmallSquare.scale-100.png", cAlternateFileName="")) returned 1 [0083.410] wcscmp (_String1="Money_TileSmallSquare.scale-100.png", _String2=".") returned 1 [0083.410] wcscmp (_String1="Money_TileSmallSquare.scale-100.png", _String2="..") returned 1 [0083.410] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x126) returned 0x7588020 [0083.410] wcscpy (in: _Dest=0x7588020, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" [0083.410] wcscat (in: _Dest=0x7588020, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\" [0083.410] wcscat (in: _Dest=0x7588020, _Source="Money_TileSmallSquare.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileSmallSquare.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileSmallSquare.scale-100.png" [0083.410] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_tilesmallsquare.scale-100.png")) returned 0x20 [0083.410] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileSmallSquare.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.410] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_tilesmallsquare.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.410] GetLastError () returned 0x5 [0083.410] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileSmallSquare.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.411] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7588020) returned 1 [0083.411] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774df276, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x774df276, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x774df276, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileWide.scale-100.png", cAlternateFileName="")) returned 1 [0083.411] wcscmp (_String1="Money_TileWide.scale-100.png", _String2=".") returned 1 [0083.411] wcscmp (_String1="Money_TileWide.scale-100.png", _String2="..") returned 1 [0083.411] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x118) returned 0x7584c08 [0083.411] wcscpy (in: _Dest=0x7584c08, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" [0083.411] wcscat (in: _Dest=0x7584c08, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\" [0083.411] wcscat (in: _Dest=0x7584c08, _Source="Money_TileWide.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileWide.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileWide.scale-100.png" [0083.411] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_tilewide.scale-100.png")) returned 0x20 [0083.411] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileWide.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.412] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_tilewide.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.412] GetLastError () returned 0x5 [0083.412] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileWide.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.412] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7584c08) returned 1 [0083.412] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774df276, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x774df276, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x774df276, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileWide.scale-100.png", cAlternateFileName="")) returned 0 [0083.412] FindClose (in: hFindFile=0x389ecc0 | out: hFindFile=0x389ecc0) returned 1 [0083.413] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ce1a8) returned 1 [0083.413] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39704c8) returned 1 [0083.413] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f0ec0) returned 1 [0083.413] FindNextFileW (in: hFindFile=0x389e740, lpFindFileData=0x53d1430 | out: lpFindFileData=0x53d1430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774df276, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x774df276, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x774df276, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1 [0083.413] wcscmp (_String1="Money_LogoSmall.scale-100.png", _String2=".") returned 1 [0083.413] wcscmp (_String1="Money_LogoSmall.scale-100.png", _String2="..") returned 1 [0083.413] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x7582630 [0083.413] wcscpy (in: _Dest=0x7582630, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0083.413] wcscat (in: _Dest=0x7582630, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\" [0083.413] wcscat (in: _Dest=0x7582630, _Source="Money_LogoSmall.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.scale-100.png" [0083.413] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_logosmall.scale-100.png")) returned 0x20 [0084.902] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.scale-100.png", dwFileAttributes=0x20) returned 0 [0084.902] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_logosmall.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.902] GetLastError () returned 0x5 [0084.902] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.scale-100.png", dwFileAttributes=0x20) returned 0 [0084.902] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7582630) returned 1 [0084.902] FindNextFileW (in: hFindFile=0x389e740, lpFindFileData=0x53d1430 | out: lpFindFileData=0x53d1430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774df276, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x774df276, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x774df276, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.targetsize-16.png", cAlternateFileName="")) returned 1 [0084.902] wcscmp (_String1="Money_LogoSmall.targetsize-16.png", _String2=".") returned 1 [0084.902] wcscmp (_String1="Money_LogoSmall.targetsize-16.png", _String2="..") returned 1 [0084.902] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x104) returned 0xe137e50 [0084.902] wcscpy (in: _Dest=0xe137e50, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0084.902] wcscat (in: _Dest=0xe137e50, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\" [0084.902] wcscat (in: _Dest=0xe137e50, _Source="Money_LogoSmall.targetsize-16.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-16.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-16.png" [0084.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0xe137e50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20dc [0084.903] FindNextFileW (in: hFindFile=0x389e740, lpFindFileData=0x53d1430 | out: lpFindFileData=0x53d1430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x775054bc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x775054bc, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x775054bc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.targetsize-24.png", cAlternateFileName="")) returned 1 [0084.903] wcscmp (_String1="Money_LogoSmall.targetsize-24.png", _String2=".") returned 1 [0084.903] wcscmp (_String1="Money_LogoSmall.targetsize-24.png", _String2="..") returned 1 [0084.903] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x104) returned 0xe137c20 [0084.903] wcscpy (in: _Dest=0xe137c20, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0084.903] wcscat (in: _Dest=0xe137c20, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\" [0084.903] wcscat (in: _Dest=0xe137c20, _Source="Money_LogoSmall.targetsize-24.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-24.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-24.png" [0084.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0xe137c20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20d8 [0084.904] FindNextFileW (in: hFindFile=0x389e740, lpFindFileData=0x53d1430 | out: lpFindFileData=0x53d1430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x775054bc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x775054bc, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x775054bc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x697, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.targetsize-256.png", cAlternateFileName="")) returned 1 [0084.904] wcscmp (_String1="Money_LogoSmall.targetsize-256.png", _String2=".") returned 1 [0084.904] wcscmp (_String1="Money_LogoSmall.targetsize-256.png", _String2="..") returned 1 [0084.904] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0xe136f00 [0084.904] wcscpy (in: _Dest=0xe136f00, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0084.904] wcscat (in: _Dest=0xe136f00, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\" [0084.904] wcscat (in: _Dest=0xe136f00, _Source="Money_LogoSmall.targetsize-256.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-256.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-256.png" [0084.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0xe136f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20e0 [0084.904] FindNextFileW (in: hFindFile=0x389e740, lpFindFileData=0x53d1430 | out: lpFindFileData=0x53d1430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x775054bc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x775054bc, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x775054bc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.targetsize-32.png", cAlternateFileName="")) returned 1 [0084.904] wcscmp (_String1="Money_LogoSmall.targetsize-32.png", _String2=".") returned 1 [0084.904] wcscmp (_String1="Money_LogoSmall.targetsize-32.png", _String2="..") returned 1 [0084.904] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x104) returned 0xe136758 [0084.904] wcscpy (in: _Dest=0xe136758, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0084.904] wcscat (in: _Dest=0xe136758, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\" [0084.904] wcscat (in: _Dest=0xe136758, _Source="Money_LogoSmall.targetsize-32.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-32.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-32.png" [0084.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0xe136758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20e4 [0084.905] FindNextFileW (in: hFindFile=0x389e740, lpFindFileData=0x53d1430 | out: lpFindFileData=0x53d1430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x775054bc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x775054bc, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x775054bc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.targetsize-48.png", cAlternateFileName="")) returned 1 [0084.905] wcscmp (_String1="Money_LogoSmall.targetsize-48.png", _String2=".") returned 1 [0084.905] wcscmp (_String1="Money_LogoSmall.targetsize-48.png", _String2="..") returned 1 [0084.905] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x104) returned 0xe1362f8 [0084.905] wcscpy (in: _Dest=0xe1362f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0084.905] wcscat (in: _Dest=0xe1362f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\" [0084.905] wcscat (in: _Dest=0xe1362f8, _Source="Money_LogoSmall.targetsize-48.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-48.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-48.png" [0084.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0xe1362f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20f4 [0084.906] FindNextFileW (in: hFindFile=0x389e740, lpFindFileData=0x53d1430 | out: lpFindFileData=0x53d1430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x775054bc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x775054bc, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x775054bc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x508, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_SplashScreen.scale-100.png", cAlternateFileName="")) returned 1 [0084.906] wcscmp (_String1="Money_SplashScreen.scale-100.png", _String2=".") returned 1 [0084.906] wcscmp (_String1="Money_SplashScreen.scale-100.png", _String2="..") returned 1 [0084.906] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x102) returned 0xe137018 [0084.906] wcscpy (in: _Dest=0xe137018, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0084.906] wcscat (in: _Dest=0xe137018, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\" [0084.906] wcscat (in: _Dest=0xe137018, _Source="Money_SplashScreen.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_SplashScreen.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_SplashScreen.scale-100.png" [0084.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0xe137018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd48 [0084.906] FindNextFileW (in: hFindFile=0x389e740, lpFindFileData=0x53d1430 | out: lpFindFileData=0x53d1430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x775054bc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x775054bc, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x775054bc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileLargeSquare.scale-100.png", cAlternateFileName="")) returned 1 [0084.906] wcscmp (_String1="Money_TileLargeSquare.scale-100.png", _String2=".") returned 1 [0084.906] wcscmp (_String1="Money_TileLargeSquare.scale-100.png", _String2="..") returned 1 [0084.906] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x108) returned 0xe137360 [0084.907] wcscpy (in: _Dest=0xe137360, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0084.907] wcscat (in: _Dest=0xe137360, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\" [0084.907] wcscat (in: _Dest=0xe137360, _Source="Money_TileLargeSquare.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileLargeSquare.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileLargeSquare.scale-100.png" [0084.907] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0xe137360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd44 [0084.907] FindNextFileW (in: hFindFile=0x389e740, lpFindFileData=0x53d1430 | out: lpFindFileData=0x53d1430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x775054bc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x775054bc, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x775054bc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileMediumSquare.scale-100.png", cAlternateFileName="")) returned 1 [0084.907] wcscmp (_String1="Money_TileMediumSquare.scale-100.png", _String2=".") returned 1 [0084.907] wcscmp (_String1="Money_TileMediumSquare.scale-100.png", _String2="..") returned 1 [0084.907] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0xe136640 [0084.907] wcscpy (in: _Dest=0xe136640, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0084.907] wcscat (in: _Dest=0xe136640, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\" [0084.907] wcscat (in: _Dest=0xe136640, _Source="Money_TileMediumSquare.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileMediumSquare.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileMediumSquare.scale-100.png" [0084.907] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0xe136640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd40 [0084.908] FindNextFileW (in: hFindFile=0x389e740, lpFindFileData=0x53d1430 | out: lpFindFileData=0x53d1430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x775054bc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x775054bc, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x775054bc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x129, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileSmallSquare.scale-100.png", cAlternateFileName="")) returned 1 [0084.908] wcscmp (_String1="Money_TileSmallSquare.scale-100.png", _String2=".") returned 1 [0084.908] wcscmp (_String1="Money_TileSmallSquare.scale-100.png", _String2="..") returned 1 [0084.908] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x108) returned 0xe136988 [0084.908] wcscpy (in: _Dest=0xe136988, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0084.908] wcscat (in: _Dest=0xe136988, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\" [0084.908] wcscat (in: _Dest=0xe136988, _Source="Money_TileSmallSquare.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileSmallSquare.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileSmallSquare.scale-100.png" [0084.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0xe136988, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd3c [0084.909] FindNextFileW (in: hFindFile=0x389e740, lpFindFileData=0x53d1430 | out: lpFindFileData=0x53d1430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x775054bc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x775054bc, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x775054bc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x25a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileWide.scale-100.png", cAlternateFileName="")) returned 1 [0084.909] wcscmp (_String1="Money_TileWide.scale-100.png", _String2=".") returned 1 [0084.909] wcscmp (_String1="Money_TileWide.scale-100.png", _String2="..") returned 1 [0084.909] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfa) returned 0x549a658 [0084.909] wcscpy (in: _Dest=0x549a658, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0084.909] wcscat (in: _Dest=0x549a658, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\" [0084.909] wcscat (in: _Dest=0x549a658, _Source="Money_TileWide.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileWide.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileWide.scale-100.png" [0084.909] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549a658, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd38 [0084.909] FindNextFileW (in: hFindFile=0x389e740, lpFindFileData=0x53d1430 | out: lpFindFileData=0x53d1430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x775054bc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x775054bc, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x775054bc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.png", cAlternateFileName="")) returned 1 [0084.909] wcscmp (_String1="StoreLogo.png", _String2=".") returned 1 [0084.909] wcscmp (_String1="StoreLogo.png", _String2="..") returned 1 [0084.909] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x54f0dd8 [0084.909] wcscpy (in: _Dest=0x54f0dd8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" [0084.910] wcscat (in: _Dest=0x54f0dd8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\" [0084.910] wcscat (in: _Dest=0x54f0dd8, _Source="StoreLogo.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\StoreLogo.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\StoreLogo.png" [0084.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f0dd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xce4 [0084.910] FindNextFileW (in: hFindFile=0x389e740, lpFindFileData=0x53d1430 | out: lpFindFileData=0x53d1430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x775054bc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x775054bc, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x775054bc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.png", cAlternateFileName="")) returned 0 [0084.910] FindClose (in: hFindFile=0x389e740 | out: hFindFile=0x389e740) returned 1 [0084.910] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d1430) returned 1 [0084.910] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3970ef0) returned 1 [0084.910] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f9510) returned 1 [0084.910] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x39358f8 | out: lpFindFileData=0x39358f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0dcf11, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x775054bc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppTiles", cAlternateFileName="")) returned 0 [0084.910] FindClose (in: hFindFile=0x389eac0 | out: hFindFile=0x389eac0) returned 1 [0084.911] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39358f8) returned 1 [0084.911] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3904720) returned 1 [0084.911] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5447058) returned 1 Thread: id = 533 os_tid = 0x129c [0072.614] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x53f98f8 [0072.614] wcscpy (in: _Dest=0x53f98f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration" [0072.614] wcscat (in: _Dest=0x53f98f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\" [0072.615] wcscat (in: _Dest=0x53f98f8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\*" [0072.615] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3935b60 [0072.615] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\*", lpFindFileData=0x3935b60 | out: lpFindFileData=0x3935b60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa1412e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7752b705, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389eac0 [0083.363] wcscmp (_String1=".", _String2=".") returned 0 [0083.363] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x3935b60 | out: lpFindFileData=0x3935b60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa1412e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7752b705, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.363] wcscmp (_String1="..", _String2=".") returned 1 [0083.363] wcscmp (_String1="..", _String2="..") returned 0 [0083.363] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x3935b60 | out: lpFindFileData=0x3935b60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7752b705, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7752b705, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x15800, dwReserved0=0x0, dwReserved1=0x0, cFileName="configuration.sqlite", cAlternateFileName="")) returned 1 [0083.363] wcscmp (_String1="configuration.sqlite", _String2=".") returned 1 [0083.363] wcscmp (_String1="configuration.sqlite", _String2="..") returned 1 [0083.363] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe6) returned 0x39704c8 [0083.363] wcscpy (in: _Dest=0x39704c8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration" [0083.363] wcscat (in: _Dest=0x39704c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\" [0083.363] wcscat (in: _Dest=0x39704c8, _Source="configuration.sqlite" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" [0083.363] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite")) returned 0x20 [0083.373] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite", dwFileAttributes=0x20) returned 0 [0083.373] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.373] GetLastError () returned 0x5 [0083.373] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite", dwFileAttributes=0x20) returned 0 [0083.373] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39704c8) returned 1 [0083.373] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x3935b60 | out: lpFindFileData=0x3935b60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7752b705, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7752b705, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x15800, dwReserved0=0x0, dwReserved1=0x0, cFileName="configuration.sqlite", cAlternateFileName="")) returned 0 [0083.373] FindClose (in: hFindFile=0x389eac0 | out: hFindFile=0x389eac0) returned 1 [0083.373] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3935b60) returned 1 [0083.373] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f98f8) returned 1 [0083.373] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e8e40) returned 1 Thread: id = 534 os_tid = 0x1298 [0072.615] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x53f99c0 [0072.615] wcscpy (in: _Dest=0x53f99c0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources" [0072.615] wcscat (in: _Dest=0x53f99c0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\" [0072.615] wcscat (in: _Dest=0x53f99c0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\*" [0072.615] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3935dc8 [0072.615] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\*", lpFindFileData=0x3935dc8 | out: lpFindFileData=0x3935dc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20b499, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7755195b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ec40 [0083.458] wcscmp (_String1=".", _String2=".") returned 0 [0083.458] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x3935dc8 | out: lpFindFileData=0x3935dc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20b499, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7755195b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.458] wcscmp (_String1="..", _String2=".") returned 1 [0083.459] wcscmp (_String1="..", _String2="..") returned 0 [0083.459] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x3935dc8 | out: lpFindFileData=0x3935dc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7752b705, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7752b705, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1a52, dwReserved0=0x0, dwReserved1=0x0, cFileName="AboutLinks.json", cAlternateFileName="")) returned 1 [0083.459] wcscmp (_String1="AboutLinks.json", _String2=".") returned 1 [0083.459] wcscmp (_String1="AboutLinks.json", _String2="..") returned 1 [0083.459] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x54f1f10 [0083.459] wcscpy (in: _Dest=0x54f1f10, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources" [0083.459] wcscat (in: _Dest=0x54f1f10, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\" [0083.459] wcscat (in: _Dest=0x54f1f10, _Source="AboutLinks.json" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\AboutLinks.json") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\AboutLinks.json" [0083.459] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\AboutLinks.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\aboutlinks.json")) returned 0x20 [0083.459] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\AboutLinks.json", dwFileAttributes=0x20) returned 0 [0083.460] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\AboutLinks.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\aboutlinks.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.460] GetLastError () returned 0x5 [0083.460] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\AboutLinks.json", dwFileAttributes=0x20) returned 0 [0083.460] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f1f10) returned 1 [0083.460] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x3935dc8 | out: lpFindFileData=0x3935dc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7752b705, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7752b705, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4b1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="CurrencyInfo.json", cAlternateFileName="")) returned 1 [0083.460] wcscmp (_String1="CurrencyInfo.json", _String2=".") returned 1 [0083.460] wcscmp (_String1="CurrencyInfo.json", _String2="..") returned 1 [0083.460] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54f1f10 [0083.460] wcscpy (in: _Dest=0x54f1f10, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources" [0083.460] wcscat (in: _Dest=0x54f1f10, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\" [0083.460] wcscat (in: _Dest=0x54f1f10, _Source="CurrencyInfo.json" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\CurrencyInfo.json") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\CurrencyInfo.json" [0083.460] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\CurrencyInfo.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\currencyinfo.json")) returned 0x20 [0083.461] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\CurrencyInfo.json", dwFileAttributes=0x20) returned 0 [0083.461] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\CurrencyInfo.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\currencyinfo.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.461] GetLastError () returned 0x5 [0083.461] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\CurrencyInfo.json", dwFileAttributes=0x20) returned 0 [0083.461] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f1f10) returned 1 [0083.461] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x3935dc8 | out: lpFindFileData=0x3935dc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7752b705, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7752b705, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x32a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefaultCurrencyLoc.json", cAlternateFileName="")) returned 1 [0083.461] wcscmp (_String1="DefaultCurrencyLoc.json", _String2=".") returned 1 [0083.461] wcscmp (_String1="DefaultCurrencyLoc.json", _String2="..") returned 1 [0083.461] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x54505a8 [0083.461] wcscpy (in: _Dest=0x54505a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources" [0083.461] wcscat (in: _Dest=0x54505a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\" [0083.462] wcscat (in: _Dest=0x54505a8, _Source="DefaultCurrencyLoc.json" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\DefaultCurrencyLoc.json") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\DefaultCurrencyLoc.json" [0083.462] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\DefaultCurrencyLoc.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\defaultcurrencyloc.json")) returned 0x20 [0083.463] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\DefaultCurrencyLoc.json", dwFileAttributes=0x20) returned 0 [0083.463] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\DefaultCurrencyLoc.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\defaultcurrencyloc.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.463] GetLastError () returned 0x5 [0083.463] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\DefaultCurrencyLoc.json", dwFileAttributes=0x20) returned 0 [0083.463] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54505a8) returned 1 [0083.463] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x3935dc8 | out: lpFindFileData=0x3935dc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7752b705, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7752b705, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x8ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefaultFromToCurrency.json", cAlternateFileName="")) returned 1 [0083.463] wcscmp (_String1="DefaultFromToCurrency.json", _String2=".") returned 1 [0083.463] wcscmp (_String1="DefaultFromToCurrency.json", _String2="..") returned 1 [0083.463] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba41f8 [0083.463] wcscpy (in: _Dest=0x5ba41f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources" [0083.463] wcscat (in: _Dest=0x5ba41f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\" [0083.463] wcscat (in: _Dest=0x5ba41f8, _Source="DefaultFromToCurrency.json" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\DefaultFromToCurrency.json") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\DefaultFromToCurrency.json" [0083.464] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\DefaultFromToCurrency.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\defaultfromtocurrency.json")) returned 0x20 [0083.464] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\DefaultFromToCurrency.json", dwFileAttributes=0x20) returned 0 [0083.464] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\DefaultFromToCurrency.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\defaultfromtocurrency.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.464] GetLastError () returned 0x5 [0083.464] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\DefaultFromToCurrency.json", dwFileAttributes=0x20) returned 0 [0083.464] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba41f8) returned 1 [0083.464] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x3935dc8 | out: lpFindFileData=0x3935dc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7752b705, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7752b705, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x3b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExchangeDetails.json", cAlternateFileName="")) returned 1 [0083.464] wcscmp (_String1="ExchangeDetails.json", _String2=".") returned 1 [0083.464] wcscmp (_String1="ExchangeDetails.json", _String2="..") returned 1 [0083.464] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe6) returned 0x54b8bf8 [0083.464] wcscpy (in: _Dest=0x54b8bf8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources" [0083.464] wcscat (in: _Dest=0x54b8bf8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\" [0083.464] wcscat (in: _Dest=0x54b8bf8, _Source="ExchangeDetails.json" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ExchangeDetails.json") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ExchangeDetails.json" [0083.464] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ExchangeDetails.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\exchangedetails.json")) returned 0x20 [0083.465] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ExchangeDetails.json", dwFileAttributes=0x20) returned 0 [0083.465] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ExchangeDetails.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\exchangedetails.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.465] GetLastError () returned 0x5 [0083.465] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ExchangeDetails.json", dwFileAttributes=0x20) returned 0 [0083.465] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b8bf8) returned 1 [0083.465] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x3935dc8 | out: lpFindFileData=0x3935dc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7755195b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7755195b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7755195b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x36cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExchangesInfo.json", cAlternateFileName="")) returned 1 [0083.465] wcscmp (_String1="ExchangesInfo.json", _String2=".") returned 1 [0083.465] wcscmp (_String1="ExchangesInfo.json", _String2="..") returned 1 [0083.465] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x54ba188 [0083.465] wcscpy (in: _Dest=0x54ba188, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources" [0083.465] wcscat (in: _Dest=0x54ba188, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\" [0083.465] wcscat (in: _Dest=0x54ba188, _Source="ExchangesInfo.json" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ExchangesInfo.json") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ExchangesInfo.json" [0083.465] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ExchangesInfo.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\exchangesinfo.json")) returned 0x20 [0083.466] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ExchangesInfo.json", dwFileAttributes=0x20) returned 0 [0083.466] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ExchangesInfo.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\exchangesinfo.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.466] GetLastError () returned 0x5 [0083.466] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ExchangesInfo.json", dwFileAttributes=0x20) returned 0 [0083.466] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54ba188) returned 1 [0083.466] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x3935dc8 | out: lpFindFileData=0x3935dc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7755195b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7755195b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7755195b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1d73, dwReserved0=0x0, dwReserved1=0x0, cFileName="MarketsInfo.json", cAlternateFileName="")) returned 1 [0083.466] wcscmp (_String1="MarketsInfo.json", _String2=".") returned 1 [0083.466] wcscmp (_String1="MarketsInfo.json", _String2="..") returned 1 [0083.466] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xde) returned 0x54f1f10 [0083.466] wcscpy (in: _Dest=0x54f1f10, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources" [0083.466] wcscat (in: _Dest=0x54f1f10, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\" [0083.467] wcscat (in: _Dest=0x54f1f10, _Source="MarketsInfo.json" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\MarketsInfo.json") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\MarketsInfo.json" [0083.467] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\MarketsInfo.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\marketsinfo.json")) returned 0x20 [0083.467] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\MarketsInfo.json", dwFileAttributes=0x20) returned 0 [0083.467] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\MarketsInfo.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\marketsinfo.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.467] GetLastError () returned 0x5 [0083.467] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\MarketsInfo.json", dwFileAttributes=0x20) returned 0 [0083.468] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f1f10) returned 1 [0083.468] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x3935dc8 | out: lpFindFileData=0x3935dc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7755195b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7755195b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7755195b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2ba2, dwReserved0=0x0, dwReserved1=0x0, cFileName="NumberFormattingInfo.json", cAlternateFileName="")) returned 1 [0083.468] wcscmp (_String1="NumberFormattingInfo.json", _String2=".") returned 1 [0083.468] wcscmp (_String1="NumberFormattingInfo.json", _String2="..") returned 1 [0083.468] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x54505a8 [0083.468] wcscpy (in: _Dest=0x54505a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources" [0083.468] wcscat (in: _Dest=0x54505a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\" [0083.468] wcscat (in: _Dest=0x54505a8, _Source="NumberFormattingInfo.json" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\NumberFormattingInfo.json") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\NumberFormattingInfo.json" [0083.468] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\NumberFormattingInfo.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\numberformattinginfo.json")) returned 0x20 [0083.469] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\NumberFormattingInfo.json", dwFileAttributes=0x20) returned 0 [0083.469] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\NumberFormattingInfo.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\numberformattinginfo.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.470] GetLastError () returned 0x5 [0083.470] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\NumberFormattingInfo.json", dwFileAttributes=0x20) returned 0 [0083.470] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54505a8) returned 1 [0083.470] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x3935dc8 | out: lpFindFileData=0x3935dc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7755195b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7755195b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7755195b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2f34, dwReserved0=0x0, dwReserved1=0x0, cFileName="ToolsDefaultData.json", cAlternateFileName="")) returned 1 [0083.470] wcscmp (_String1="ToolsDefaultData.json", _String2=".") returned 1 [0083.470] wcscmp (_String1="ToolsDefaultData.json", _String2="..") returned 1 [0083.470] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x54b8b08 [0083.470] wcscpy (in: _Dest=0x54b8b08, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources" [0083.470] wcscat (in: _Dest=0x54b8b08, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\" [0083.470] wcscat (in: _Dest=0x54b8b08, _Source="ToolsDefaultData.json" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ToolsDefaultData.json") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ToolsDefaultData.json" [0083.470] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ToolsDefaultData.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\toolsdefaultdata.json")) returned 0x20 [0083.471] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ToolsDefaultData.json", dwFileAttributes=0x20) returned 0 [0083.472] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ToolsDefaultData.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\toolsdefaultdata.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.472] GetLastError () returned 0x5 [0083.472] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ToolsDefaultData.json", dwFileAttributes=0x20) returned 0 [0083.472] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b8b08) returned 1 [0083.472] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x3935dc8 | out: lpFindFileData=0x3935dc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7755195b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7755195b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7755195b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WorldMarketMajorInfo.json", cAlternateFileName="")) returned 1 [0083.472] wcscmp (_String1="WorldMarketMajorInfo.json", _String2=".") returned 1 [0083.472] wcscmp (_String1="WorldMarketMajorInfo.json", _String2="..") returned 1 [0083.472] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x544ffd8 [0083.472] wcscpy (in: _Dest=0x544ffd8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources" [0083.472] wcscat (in: _Dest=0x544ffd8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\" [0083.472] wcscat (in: _Dest=0x544ffd8, _Source="WorldMarketMajorInfo.json" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\WorldMarketMajorInfo.json") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\WorldMarketMajorInfo.json" [0083.473] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\WorldMarketMajorInfo.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\worldmarketmajorinfo.json")) returned 0x20 [0083.473] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\WorldMarketMajorInfo.json", dwFileAttributes=0x20) returned 0 [0083.473] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\WorldMarketMajorInfo.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\worldmarketmajorinfo.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.474] GetLastError () returned 0x5 [0083.474] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\WorldMarketMajorInfo.json", dwFileAttributes=0x20) returned 0 [0083.474] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x544ffd8) returned 1 [0083.474] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x3935dc8 | out: lpFindFileData=0x3935dc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7755195b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7755195b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7755195b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WorldMarketMajorInfo.json", cAlternateFileName="")) returned 0 [0083.474] FindClose (in: hFindFile=0x389ec40 | out: hFindFile=0x389ec40) returned 1 [0083.475] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3935dc8) returned 1 [0083.475] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f99c0) returned 1 [0083.475] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f9448) returned 1 Thread: id = 535 os_tid = 0x12d0 [0072.616] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\marketconfiguration.xml")) returned 0x20 [0083.458] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml", dwFileAttributes=0x20) returned 0 [0083.461] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\marketconfiguration.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.462] GetLastError () returned 0x5 [0083.462] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml", dwFileAttributes=0x20) returned 0 [0083.462] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53bb0a0) returned 1 Thread: id = 536 os_tid = 0x12b0 [0072.617] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x38fe728 [0072.617] wcscpy (in: _Dest=0x38fe728, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" [0072.617] wcscat (in: _Dest=0x38fe728, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\" [0072.617] wcscat (in: _Dest=0x38fe728, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\*" [0072.617] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3936030 [0072.617] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\*", lpFindFileData=0x3936030 | out: lpFindFileData=0x3936030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x776cf25e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20c37f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x776f534b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ec40 [0083.448] wcscmp (_String1=".", _String2=".") returned 0 [0083.448] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x3936030 | out: lpFindFileData=0x3936030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x776cf25e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20c37f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x776f534b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.448] wcscmp (_String1="..", _String2=".") returned 1 [0083.448] wcscmp (_String1="..", _String2="..") returned 0 [0083.448] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x3936030 | out: lpFindFileData=0x3936030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x776cf25e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x776cf25e, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x776f534b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x62f, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootstrap.html", cAlternateFileName="")) returned 1 [0083.448] wcscmp (_String1="bootstrap.html", _String2=".") returned 1 [0083.448] wcscmp (_String1="bootstrap.html", _String2="..") returned 1 [0083.448] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xea) returned 0x54505a8 [0083.448] wcscpy (in: _Dest=0x54505a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" [0083.448] wcscat (in: _Dest=0x54505a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\" [0083.448] wcscat (in: _Dest=0x54505a8, _Source="bootstrap.html" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html" [0083.448] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\bootstrap.html")) returned 0x20 [0083.448] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html", dwFileAttributes=0x20) returned 0 [0083.448] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\bootstrap.html"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.448] GetLastError () returned 0x5 [0083.448] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html", dwFileAttributes=0x20) returned 0 [0083.449] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54505a8) returned 1 [0083.449] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x3936030 | out: lpFindFileData=0x3936030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x776f534b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20cf06, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x776f534b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1 [0083.449] wcscmp (_String1="Themes", _String2=".") returned 1 [0083.449] wcscmp (_String1="Themes", _String2="..") returned 1 [0083.449] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x54f0dd8 [0083.449] wcscpy (in: _Dest=0x54f0dd8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" [0083.449] wcscat (in: _Dest=0x54f0dd8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\" [0083.449] wcscat (in: _Dest=0x54f0dd8, _Source="Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes" [0083.449] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xde) returned 0x54f0ec0 [0083.449] wcscpy (in: _Dest=0x54f0ec0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes" [0083.449] wcscat (in: _Dest=0x54f0ec0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\" [0083.449] wcscat (in: _Dest=0x54f0ec0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\*" [0083.449] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53cf4e8 [0083.449] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\*", lpFindFileData=0x53cf4e8 | out: lpFindFileData=0x53cf4e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x776f534b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20cf06, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x776f534b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e940 [0083.449] wcscmp (_String1=".", _String2=".") returned 0 [0083.449] FindNextFileW (in: hFindFile=0x389e940, lpFindFileData=0x53cf4e8 | out: lpFindFileData=0x53cf4e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x776f534b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20cf06, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x776f534b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.449] wcscmp (_String1="..", _String2=".") returned 1 [0083.449] wcscmp (_String1="..", _String2="..") returned 0 [0083.449] FindNextFileW (in: hFindFile=0x389e940, lpFindFileData=0x53cf4e8 | out: lpFindFileData=0x53cf4e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x776f534b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x776f534b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x776f534b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Generic.xbf", cAlternateFileName="")) returned 1 [0083.449] wcscmp (_String1="Generic.xbf", _String2=".") returned 1 [0083.449] wcscmp (_String1="Generic.xbf", _String2="..") returned 1 [0083.450] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba4ff8 [0083.450] wcscpy (in: _Dest=0x5ba4ff8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes" [0083.450] wcscat (in: _Dest=0x5ba4ff8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\" [0083.450] wcscat (in: _Dest=0x5ba4ff8, _Source="Generic.xbf" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\Generic.xbf") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\Generic.xbf" [0083.450] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\Generic.xbf" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\themes\\generic.xbf")) returned 0x20 [0083.454] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\Generic.xbf", dwFileAttributes=0x20) returned 0 [0083.454] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\Generic.xbf" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\themes\\generic.xbf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.454] GetLastError () returned 0x5 [0083.454] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\Generic.xbf", dwFileAttributes=0x20) returned 0 [0083.454] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba4ff8) returned 1 [0083.454] FindNextFileW (in: hFindFile=0x389e940, lpFindFileData=0x53cf4e8 | out: lpFindFileData=0x53cf4e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x776f534b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x776f534b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x776f534b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Generic.xbf", cAlternateFileName="")) returned 0 [0083.454] FindClose (in: hFindFile=0x389e940 | out: hFindFile=0x389e940) returned 1 [0083.454] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53cf4e8) returned 1 [0083.454] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f0ec0) returned 1 [0083.454] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f0dd8) returned 1 [0083.454] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x3936030 | out: lpFindFileData=0x3936030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x776f534b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20cf06, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x776f534b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0 [0083.454] FindClose (in: hFindFile=0x389ec40 | out: hFindFile=0x389ec40) returned 1 [0083.455] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3936030) returned 1 [0083.455] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38fe728) returned 1 [0083.455] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53bb400) returned 1 Thread: id = 537 os_tid = 0xfa0 [0072.618] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising.winmd")) returned 0x20 [0083.451] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd", dwFileAttributes=0x20) returned 0 [0083.456] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.456] GetLastError () returned 0x5 [0083.456] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd", dwFileAttributes=0x20) returned 0 [0083.456] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x546e588) returned 1 Thread: id = 538 os_tid = 0x1290 [0072.618] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.aria.clienttelemetry.winmd")) returned 0x20 [0084.894] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd", dwFileAttributes=0x20) returned 0 [0084.894] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.aria.clienttelemetry.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.894] GetLastError () returned 0x5 [0084.895] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd", dwFileAttributes=0x20) returned 0 [0084.895] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5450798) returned 1 Thread: id = 539 os_tid = 0x134c [0072.619] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x3933bc8 [0072.619] wcscpy (in: _Dest=0x3933bc8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services" [0072.619] wcscat (in: _Dest=0x3933bc8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\" [0072.619] wcscat (in: _Dest=0x3933bc8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\*" [0072.619] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3936298 [0072.619] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\*", lpFindFileData=0x3936298 | out: lpFindFileData=0x3936298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20dbad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ebc0 [0083.446] wcscmp (_String1=".", _String2=".") returned 0 [0083.446] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x3936298 | out: lpFindFileData=0x3936298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20dbad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.446] wcscmp (_String1="..", _String2=".") returned 1 [0083.447] wcscmp (_String1="..", _String2="..") returned 0 [0083.447] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x3936298 | out: lpFindFileData=0x3936298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20ead2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Personalization", cAlternateFileName="PERSON~1")) returned 1 [0083.447] wcscmp (_String1="Personalization", _String2=".") returned 1 [0083.447] wcscmp (_String1="Personalization", _String2="..") returned 1 [0083.447] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xee) returned 0x54502c0 [0083.447] wcscpy (in: _Dest=0x54502c0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services" [0083.447] wcscat (in: _Dest=0x54502c0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\" [0083.447] wcscat (in: _Dest=0x54502c0, _Source="Personalization" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization" [0083.447] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba45f8 [0083.447] wcscpy (in: _Dest=0x5ba45f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization" [0083.447] wcscat (in: _Dest=0x5ba45f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\" [0083.447] wcscat (in: _Dest=0x5ba45f8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\*" [0083.447] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53ce410 [0083.447] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\*", lpFindFileData=0x53ce410 | out: lpFindFileData=0x53ce410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20ead2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e840 [0083.447] wcscmp (_String1=".", _String2=".") returned 0 [0083.447] FindNextFileW (in: hFindFile=0x389e840, lpFindFileData=0x53ce410 | out: lpFindFileData=0x53ce410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20ead2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.447] wcscmp (_String1="..", _String2=".") returned 1 [0083.447] wcscmp (_String1="..", _String2="..") returned 0 [0083.447] FindNextFileW (in: hFindFile=0x389e840, lpFindFileData=0x53ce410 | out: lpFindFileData=0x53ce410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28c5b9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataModels", cAlternateFileName="DATAMO~1")) returned 1 [0083.447] wcscmp (_String1="DataModels", _String2=".") returned 1 [0083.447] wcscmp (_String1="DataModels", _String2="..") returned 1 [0083.447] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x104) returned 0x7579e08 [0084.892] wcscpy (in: _Dest=0x7579e08, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization" [0084.892] wcscat (in: _Dest=0x7579e08, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\" [0084.892] wcscat (in: _Dest=0x7579e08, _Source="DataModels" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels" [0084.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7579e08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20f0 [0084.893] FindNextFileW (in: hFindFile=0x389e840, lpFindFileData=0x53ce410 | out: lpFindFileData=0x53ce410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28c5b9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataModels", cAlternateFileName="DATAMO~1")) returned 0 [0084.893] FindClose (in: hFindFile=0x389e840 | out: hFindFile=0x389e840) returned 1 [0084.893] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ce410) returned 1 [0084.893] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba45f8) returned 1 [0084.893] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54502c0) returned 1 [0084.893] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x3936298 | out: lpFindFileData=0x3936298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20ead2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Personalization", cAlternateFileName="PERSON~1")) returned 0 [0084.893] FindClose (in: hFindFile=0x389ebc0 | out: hFindFile=0x389ebc0) returned 1 [0084.893] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3936298) returned 1 [0084.893] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3933bc8) returned 1 [0084.893] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b99d8) returned 1 Thread: id = 540 os_tid = 0x12a4 [0072.620] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x38fe8d8 [0072.620] wcscpy (in: _Dest=0x38fe8d8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell" [0072.620] wcscat (in: _Dest=0x38fe8d8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\" [0072.620] wcscat (in: _Dest=0x38fe8d8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\*" [0072.620] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3936500 [0072.620] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\*", lpFindFileData=0x3936500 | out: lpFindFileData=0x3936500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2911b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389eb80 [0083.443] wcscmp (_String1=".", _String2=".") returned 0 [0083.443] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x3936500 | out: lpFindFileData=0x3936500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2911b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.443] wcscmp (_String1="..", _String2=".") returned 1 [0083.443] wcscmp (_String1="..", _String2="..") returned 0 [0083.443] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x3936500 | out: lpFindFileData=0x3936500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa291621, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1 [0083.443] wcscmp (_String1="Themes", _String2=".") returned 1 [0083.443] wcscmp (_String1="Themes", _String2="..") returned 1 [0083.443] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd6) returned 0x53fccc0 [0083.443] wcscpy (in: _Dest=0x53fccc0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell" [0083.443] wcscat (in: _Dest=0x53fccc0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\" [0083.443] wcscat (in: _Dest=0x53fccc0, _Source="Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes" [0083.443] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x54f0780 [0083.443] wcscpy (in: _Dest=0x54f0780, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes" [0083.443] wcscat (in: _Dest=0x54f0780, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\" [0083.444] wcscat (in: _Dest=0x54f0780, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\*" [0083.444] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d1698 [0083.444] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\*", lpFindFileData=0x53d1698 | out: lpFindFileData=0x53d1698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa291621, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e7c0 [0083.444] wcscmp (_String1=".", _String2=".") returned 0 [0083.444] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x53d1698 | out: lpFindFileData=0x53d1698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa291621, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.444] wcscmp (_String1="..", _String2=".") returned 1 [0083.444] wcscmp (_String1="..", _String2="..") returned 0 [0083.444] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x53d1698 | out: lpFindFileData=0x53d1698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa291d28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Glyphs", cAlternateFileName="")) returned 1 [0083.444] wcscmp (_String1="Glyphs", _String2=".") returned 1 [0083.444] wcscmp (_String1="Glyphs", _String2="..") returned 1 [0083.444] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe4) returned 0x39704c8 [0083.444] wcscpy (in: _Dest=0x39704c8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes" [0083.444] wcscat (in: _Dest=0x39704c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\" [0083.444] wcscat (in: _Dest=0x39704c8, _Source="Glyphs" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs" [0083.444] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x54b90a8 [0083.444] wcscpy (in: _Dest=0x54b90a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs" [0083.444] wcscat (in: _Dest=0x54b90a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\" [0083.444] wcscat (in: _Dest=0x54b90a8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\*" [0083.444] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53ce1a8 [0083.444] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\*", lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa291d28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e800 [0083.444] wcscmp (_String1=".", _String2=".") returned 0 [0083.445] FindNextFileW (in: hFindFile=0x389e800, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa291d28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.445] wcscmp (_String1="..", _String2=".") returned 1 [0083.445] wcscmp (_String1="..", _String2="..") returned 0 [0083.445] FindNextFileW (in: hFindFile=0x389e800, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa292432, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Font", cAlternateFileName="")) returned 1 [0083.445] wcscmp (_String1="Font", _String2=".") returned 1 [0083.445] wcscmp (_String1="Font", _String2="..") returned 1 [0083.445] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xee) returned 0x5450b78 [0083.445] wcscpy (in: _Dest=0x5450b78, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs" [0083.445] wcscat (in: _Dest=0x5450b78, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\" [0083.445] wcscat (in: _Dest=0x5450b78, _Source="Font" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font" [0083.445] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba5af8 [0083.445] wcscpy (in: _Dest=0x5ba5af8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font" [0083.445] wcscat (in: _Dest=0x5ba5af8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\" [0083.445] wcscat (in: _Dest=0x5ba5af8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\*" [0083.445] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53cf280 [0083.445] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\*", lpFindFileData=0x53cf280 | out: lpFindFileData=0x53cf280*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa292432, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ea80 [0083.445] wcscmp (_String1=".", _String2=".") returned 0 [0083.445] FindNextFileW (in: hFindFile=0x389ea80, lpFindFileData=0x53cf280 | out: lpFindFileData=0x53cf280*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa292432, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.445] wcscmp (_String1="..", _String2=".") returned 1 [0083.445] wcscmp (_String1="..", _String2="..") returned 0 [0083.445] FindNextFileW (in: hFindFile=0x389ea80, lpFindFileData=0x53cf280 | out: lpFindFileData=0x53cf280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77bb9eb0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xcdcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNMDL2.ttf", cAlternateFileName="")) returned 1 [0083.445] wcscmp (_String1="MSNMDL2.ttf", _String2=".") returned 1 [0083.445] wcscmp (_String1="MSNMDL2.ttf", _String2="..") returned 1 [0083.445] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x757cf90 [0084.896] wcscpy (in: _Dest=0x757cf90, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font" [0084.896] wcscat (in: _Dest=0x757cf90, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\" [0084.896] wcscat (in: _Dest=0x757cf90, _Source="MSNMDL2.ttf" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\MSNMDL2.ttf") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\MSNMDL2.ttf" [0084.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x757cf90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20e8 [0084.897] FindNextFileW (in: hFindFile=0x389ea80, lpFindFileData=0x53cf280 | out: lpFindFileData=0x53cf280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77bb9eb0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xf530, dwReserved0=0x0, dwReserved1=0x0, cFileName="WeatherColorIcons.ttf", cAlternateFileName="")) returned 1 [0084.897] wcscmp (_String1="WeatherColorIcons.ttf", _String2=".") returned 1 [0084.897] wcscmp (_String1="WeatherColorIcons.ttf", _String2="..") returned 1 [0084.897] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11a) returned 0x7584768 [0084.897] wcscpy (in: _Dest=0x7584768, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font" [0084.897] wcscat (in: _Dest=0x7584768, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\" [0084.897] wcscat (in: _Dest=0x7584768, _Source="WeatherColorIcons.ttf" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\WeatherColorIcons.ttf") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\WeatherColorIcons.ttf" [0084.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7584768, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20ec [0084.897] FindNextFileW (in: hFindFile=0x389ea80, lpFindFileData=0x53cf280 | out: lpFindFileData=0x53cf280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77bb9eb0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xf530, dwReserved0=0x0, dwReserved1=0x0, cFileName="WeatherColorIcons.ttf", cAlternateFileName="")) returned 0 [0084.897] FindClose (in: hFindFile=0x389ea80 | out: hFindFile=0x389ea80) returned 1 [0084.898] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53cf280) returned 1 [0084.898] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba5af8) returned 1 [0084.898] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5450b78) returned 1 [0084.898] FindNextFileW (in: hFindFile=0x389e800, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa292432, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Font", cAlternateFileName="")) returned 0 [0084.898] FindClose (in: hFindFile=0x389e800 | out: hFindFile=0x389e800) returned 1 [0084.898] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ce1a8) returned 1 [0084.898] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b90a8) returned 1 [0084.898] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39704c8) returned 1 [0084.898] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x53d1698 | out: lpFindFileData=0x53d1698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa291d28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Glyphs", cAlternateFileName="")) returned 0 [0084.898] FindClose (in: hFindFile=0x389e7c0 | out: hFindFile=0x389e7c0) returned 1 [0084.898] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d1698) returned 1 [0084.898] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f0780) returned 1 [0084.898] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fccc0) returned 1 [0084.898] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x3936500 | out: lpFindFileData=0x3936500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa291621, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0 [0084.899] FindClose (in: hFindFile=0x389eb80 | out: hFindFile=0x389eb80) returned 1 [0084.899] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3936500) returned 1 [0084.899] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38fe8d8) returned 1 [0084.899] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f7a20) returned 1 Thread: id = 541 os_tid = 0x1350 [0072.621] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x38b03d8 [0072.621] wcscpy (in: _Dest=0x38b03d8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0072.621] wcscat (in: _Dest=0x38b03d8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0072.621] wcscat (in: _Dest=0x38b03d8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0072.621] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3936768 [0072.621] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5eefc3c1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa292b95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eefc3c1, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ebc0 [0083.446] wcscmp (_String1=".", _String2=".") returned 0 [0083.446] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5eefc3c1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa292b95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eefc3c1, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.446] wcscmp (_String1="..", _String2=".") returned 1 [0083.446] wcscmp (_String1="..", _String2="..") returned 0 [0083.446] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5eefc3c1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa292b95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eefc3c1, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0083.446] FindClose (in: hFindFile=0x389ebc0 | out: hFindFile=0x389ebc0) returned 1 [0083.446] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3936768) returned 1 [0083.446] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b03d8) returned 1 [0083.446] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x546e668) returned 1 Thread: id = 542 os_tid = 0xdec [0072.622] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MicrosoftAdvertising.ini" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoftadvertising.ini")) returned 0x20 [0083.442] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MicrosoftAdvertising.ini", dwFileAttributes=0x20) returned 0 [0083.443] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MicrosoftAdvertising.ini" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoftadvertising.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.443] GetLastError () returned 0x5 [0083.443] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MicrosoftAdvertising.ini", dwFileAttributes=0x20) returned 0 [0083.443] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x546e758) returned 1 Thread: id = 543 os_tid = 0x184 [0072.622] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x53f8e70 [0072.623] wcscpy (in: _Dest=0x53f8e70, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS" [0072.623] wcscat (in: _Dest=0x53f8e70, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\" [0072.623] wcscat (in: _Dest=0x53f8e70, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\*" [0072.623] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x39369d0 [0072.623] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\*", lpFindFileData=0x39369d0 | out: lpFindFileData=0x39369d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77be010a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa293090, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77be010a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e940 [0083.423] wcscmp (_String1=".", _String2=".") returned 0 [0083.423] FindNextFileW (in: hFindFile=0x389e940, lpFindFileData=0x39369d0 | out: lpFindFileData=0x39369d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77be010a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa293090, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77be010a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.423] wcscmp (_String1="..", _String2=".") returned 1 [0083.423] wcscmp (_String1="..", _String2="..") returned 0 [0083.423] FindNextFileW (in: hFindFile=0x389e940, lpFindFileData=0x39369d0 | out: lpFindFileData=0x39369d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77be010a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77be010a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77be010a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4be9, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootstrap.js", cAlternateFileName="")) returned 1 [0083.423] wcscmp (_String1="bootstrap.js", _String2=".") returned 1 [0083.424] wcscmp (_String1="bootstrap.js", _String2="..") returned 1 [0083.424] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x54f0780 [0083.424] wcscpy (in: _Dest=0x54f0780, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS" [0083.424] wcscat (in: _Dest=0x54f0780, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\" [0083.424] wcscat (in: _Dest=0x54f0780, _Source="bootstrap.js" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js" [0083.424] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs\\bootstrap.js")) returned 0x20 [0083.425] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js", dwFileAttributes=0x20) returned 0 [0083.438] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs\\bootstrap.js"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.438] GetLastError () returned 0x5 [0083.438] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js", dwFileAttributes=0x20) returned 0 [0083.438] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f0780) returned 1 [0083.438] FindNextFileW (in: hFindFile=0x389e940, lpFindFileData=0x39369d0 | out: lpFindFileData=0x39369d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77be010a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77be010a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77be010a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x73d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ormma.js", cAlternateFileName="")) returned 1 [0083.438] wcscmp (_String1="ormma.js", _String2=".") returned 1 [0083.438] wcscmp (_String1="ormma.js", _String2="..") returned 1 [0083.438] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x53fccc0 [0083.438] wcscpy (in: _Dest=0x53fccc0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS" [0083.438] wcscat (in: _Dest=0x53fccc0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\" [0083.438] wcscat (in: _Dest=0x53fccc0, _Source="ormma.js" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js" [0083.438] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs\\ormma.js")) returned 0x20 [0083.440] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js", dwFileAttributes=0x20) returned 0 [0083.440] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs\\ormma.js"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.441] GetLastError () returned 0x5 [0083.441] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js", dwFileAttributes=0x20) returned 0 [0083.441] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fccc0) returned 1 [0083.441] FindNextFileW (in: hFindFile=0x389e940, lpFindFileData=0x39369d0 | out: lpFindFileData=0x39369d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77be010a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77be010a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77be010a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x73d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ormma.js", cAlternateFileName="")) returned 0 [0083.441] FindClose (in: hFindFile=0x389e940 | out: hFindFile=0x389e940) returned 1 [0083.441] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39369d0) returned 1 [0083.441] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f8e70) returned 1 [0083.441] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f92b8) returned 1 Thread: id = 544 os_tid = 0xd88 [0072.623] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\PlatformConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\platformconfiguration.xml")) returned 0x20 [0083.439] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\PlatformConfiguration.xml", dwFileAttributes=0x20) returned 0 [0083.442] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\PlatformConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\platformconfiguration.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.442] GetLastError () returned 0x5 [0083.442] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\PlatformConfiguration.xml", dwFileAttributes=0x20) returned 0 [0083.442] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x546e838) returned 1 Thread: id = 545 os_tid = 0x1258 [0072.624] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri")) returned 0x20 [0083.422] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0083.422] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.422] GetLastError () returned 0x5 [0083.422] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0083.423] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f9768) returned 1 Thread: id = 546 os_tid = 0x600 [0072.625] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\SQLiteWrapper.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\sqlitewrapper.winmd")) returned 0x20 [0083.414] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\SQLiteWrapper.winmd", dwFileAttributes=0x20) returned 0 [0083.417] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\SQLiteWrapper.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\sqlitewrapper.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.417] GetLastError () returned 0x5 [0083.417] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\SQLiteWrapper.winmd", dwFileAttributes=0x20) returned 0 [0083.417] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f7540) returned 1 Thread: id = 547 os_tid = 0x11e4 [0072.625] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x53f9a88 [0072.625] wcscpy (in: _Dest=0x53f9a88, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources" [0072.625] wcscat (in: _Dest=0x53f9a88, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\" [0072.625] wcscat (in: _Dest=0x53f9a88, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\*" [0072.625] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3936c38 [0072.625] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0986e1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389eb80 [0083.418] wcscmp (_String1=".", _String2=".") returned 0 [0083.418] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0986e1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.418] wcscmp (_String1="..", _String2=".") returned 1 [0083.418] wcscmp (_String1="..", _String2="..") returned 0 [0083.418] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77492ec4, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2985, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.rsrc", cAlternateFileName="")) returned 1 [0083.418] wcscmp (_String1="0.rsrc", _String2=".") returned 1 [0083.418] wcscmp (_String1="0.rsrc", _String2="..") returned 1 [0083.418] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x3970fc0 [0083.418] wcscpy (in: _Dest=0x3970fc0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources" [0083.418] wcscat (in: _Dest=0x3970fc0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\" [0083.418] wcscat (in: _Dest=0x3970fc0, _Source="0.rsrc" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\0.rsrc") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\0.rsrc" [0083.419] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\0.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\_resources\\0.rsrc")) returned 0x20 [0083.419] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\0.rsrc", dwFileAttributes=0x20) returned 0 [0083.419] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\0.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\_resources\\0.rsrc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.420] GetLastError () returned 0x5 [0083.420] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\0.rsrc", dwFileAttributes=0x20) returned 0 [0083.420] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3970fc0) returned 1 [0083.420] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77492ec4, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa3, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.txt", cAlternateFileName="")) returned 1 [0083.420] wcscmp (_String1="index.txt", _String2=".") returned 1 [0083.420] wcscmp (_String1="index.txt", _String2="..") returned 1 [0083.420] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xca) returned 0x75805d0 [0083.420] wcscpy (in: _Dest=0x75805d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources" [0083.420] wcscat (in: _Dest=0x75805d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\" [0083.420] wcscat (in: _Dest=0x75805d0, _Source="index.txt" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\index.txt") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\index.txt" [0083.420] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\index.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\_resources\\index.txt")) returned 0x20 [0083.421] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\index.txt", dwFileAttributes=0x20) returned 0 [0083.421] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\index.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\_resources\\index.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.421] GetLastError () returned 0x5 [0083.421] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\index.txt", dwFileAttributes=0x20) returned 0 [0083.421] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75805d0) returned 1 [0083.421] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77492ec4, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa3, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.txt", cAlternateFileName="")) returned 0 [0083.421] FindClose (in: hFindFile=0x389eb80 | out: hFindFile=0x389eb80) returned 1 [0083.421] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3936c38) returned 1 [0083.421] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f9a88) returned 1 [0083.421] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5460fe8) returned 1 Thread: id = 548 os_tid = 0x168 [0072.626] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 0x80 [0089.268] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", dwFileAttributes=0x20) Thread: id = 549 os_tid = 0xfc0 [0072.627] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 0x80 [0077.955] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", dwFileAttributes=0x20) Thread: id = 550 os_tid = 0xf84 [0072.628] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 0x80 [0089.269] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", dwFileAttributes=0x20) Thread: id = 551 os_tid = 0xe8c [0072.629] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 0x80 [0077.955] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", dwFileAttributes=0x20) Thread: id = 552 os_tid = 0x880 [0072.629] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 0x80 [0075.717] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf", dwFileAttributes=0x20) Thread: id = 553 os_tid = 0x12bc [0072.630] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 0x80 [0077.106] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", dwFileAttributes=0x20) Thread: id = 554 os_tid = 0x128c [0072.630] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 0x80 [0077.324] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf", dwFileAttributes=0x20) Thread: id = 555 os_tid = 0x1284 [0072.631] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 0x80 [0081.217] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", dwFileAttributes=0x20) Thread: id = 556 os_tid = 0x12d4 [0072.631] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 0x80 [0077.223] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf", dwFileAttributes=0x20) Thread: id = 557 os_tid = 0x12c4 [0072.632] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 0x80 [0081.242] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", dwFileAttributes=0x20) Thread: id = 558 os_tid = 0x12ac [0072.633] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 0x80 [0077.212] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf", dwFileAttributes=0x20) Thread: id = 559 os_tid = 0xc18 [0072.642] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 0x80 [0081.241] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", dwFileAttributes=0x20) Thread: id = 560 os_tid = 0xa54 [0072.643] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 0x80 [0077.208] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf", dwFileAttributes=0x20) Thread: id = 561 os_tid = 0xe10 [0072.643] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 0x80 [0081.275] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", dwFileAttributes=0x20) Thread: id = 562 os_tid = 0x98c [0072.644] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 0x80 [0077.206] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf", dwFileAttributes=0x20) Thread: id = 563 os_tid = 0xd94 [0072.644] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 0x80 [0081.275] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", dwFileAttributes=0x20) Thread: id = 564 os_tid = 0x574 [0072.646] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 0x80 [0077.195] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf", dwFileAttributes=0x20) Thread: id = 565 os_tid = 0x8d0 [0072.647] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 0x80 [0081.276] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", dwFileAttributes=0x20) Thread: id = 566 os_tid = 0x1804 [0072.647] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 0x80 [0077.181] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf", dwFileAttributes=0x20) Thread: id = 567 os_tid = 0x1808 [0072.648] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 0x80 [0081.276] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", dwFileAttributes=0x20) Thread: id = 568 os_tid = 0x180c [0072.650] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 0x80 [0077.158] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf", dwFileAttributes=0x20) Thread: id = 569 os_tid = 0x1810 [0072.651] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 0x80 [0081.280] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", dwFileAttributes=0x20) Thread: id = 570 os_tid = 0x1814 [0072.651] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 0x80 [0077.156] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf", dwFileAttributes=0x20) Thread: id = 571 os_tid = 0x1818 [0072.652] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 0x80 [0081.277] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", dwFileAttributes=0x20) Thread: id = 572 os_tid = 0x181c [0072.652] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 0x80 [0077.154] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf", dwFileAttributes=0x20) Thread: id = 573 os_tid = 0x1820 [0072.653] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 0x80 [0081.277] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", dwFileAttributes=0x20) Thread: id = 574 os_tid = 0x1824 [0072.653] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 0x80 [0077.150] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf", dwFileAttributes=0x20) Thread: id = 575 os_tid = 0x1828 [0072.654] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 0x80 [0081.279] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", dwFileAttributes=0x20) Thread: id = 576 os_tid = 0x182c [0072.655] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 0x80 [0077.148] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf", dwFileAttributes=0x20) Thread: id = 577 os_tid = 0x1830 [0072.655] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 0x80 [0081.280] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", dwFileAttributes=0x20) Thread: id = 578 os_tid = 0x1834 [0072.656] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 0x80 [0077.124] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf", dwFileAttributes=0x20) Thread: id = 579 os_tid = 0x1838 [0072.657] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 0x80 [0081.280] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", dwFileAttributes=0x20) Thread: id = 580 os_tid = 0x183c [0072.657] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 0x80 [0077.110] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf", dwFileAttributes=0x20) Thread: id = 581 os_tid = 0x1840 [0072.658] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 0x80 [0081.281] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", dwFileAttributes=0x20) Thread: id = 582 os_tid = 0x1844 [0072.659] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 0x80 [0089.269] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf", dwFileAttributes=0x20) Thread: id = 583 os_tid = 0x1848 [0072.659] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 0x80 [0077.956] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", dwFileAttributes=0x20) Thread: id = 584 os_tid = 0x184c [0072.660] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 0x80 [0089.269] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf", dwFileAttributes=0x20) Thread: id = 585 os_tid = 0x1850 [0072.660] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 0x80 [0077.956] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", dwFileAttributes=0x20) Thread: id = 586 os_tid = 0x1854 [0072.759] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 0x80 [0077.107] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf", dwFileAttributes=0x20) Thread: id = 587 os_tid = 0x1858 [0072.760] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 0x80 [0081.281] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", dwFileAttributes=0x20) Thread: id = 588 os_tid = 0x185c [0074.990] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xca) returned 0x3974258 [0074.995] wcscpy (in: _Dest=0x3974258, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" [0074.995] wcscat (in: _Dest=0x3974258, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\" [0074.995] wcscat (in: _Dest=0x3974258, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\*" [0074.996] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3936ea0 [0074.996] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34052404, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc96ea5b4, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc96ea5b4, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba1130 [0079.156] wcscmp (_String1=".", _String2=".") returned 0 [0079.156] FindNextFileW (in: hFindFile=0x5ba1130, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34052404, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc96ea5b4, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc96ea5b4, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.156] wcscmp (_String1="..", _String2=".") returned 1 [0079.156] wcscmp (_String1="..", _String2="..") returned 0 [0079.156] FindNextFileW (in: hFindFile=0x5ba1130, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3421c04b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3421c04b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3421c04b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x176, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApplicationInsights.config", cAlternateFileName="")) returned 1 [0079.157] wcscmp (_String1="ApplicationInsights.config", _String2=".") returned 1 [0079.157] wcscmp (_String1="ApplicationInsights.config", _String2="..") returned 1 [0079.157] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x54999f8 [0079.157] wcscpy (in: _Dest=0x54999f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" [0079.157] wcscat (in: _Dest=0x54999f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\" [0079.157] wcscat (in: _Dest=0x54999f8, _Source="ApplicationInsights.config" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\ApplicationInsights.config") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\ApplicationInsights.config" [0080.570] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54999f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ec [0080.570] FindNextFileW (in: hFindFile=0x5ba1130, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3407866c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x340c4b15, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x340c4b15, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3708d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0080.570] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0080.570] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0080.570] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x54b8928 [0080.570] wcscpy (in: _Dest=0x54b8928, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" [0080.570] wcscat (in: _Dest=0x54b8928, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\" [0080.570] wcscat (in: _Dest=0x54b8928, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" [0080.570] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54b8928, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b0 [0080.571] FindNextFileW (in: hFindFile=0x5ba1130, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34052404, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3407866c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3407866c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2187, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0080.571] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0080.571] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0080.571] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x54b9648 [0080.571] wcscpy (in: _Dest=0x54b9648, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" [0080.571] wcscat (in: _Dest=0x54b9648, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\" [0080.571] wcscat (in: _Dest=0x54b9648, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" [0080.571] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54b9648, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x828 [0080.572] FindNextFileW (in: hFindFile=0x5ba1130, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340ead73, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabf3049c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x340ead73, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0080.572] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0080.572] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0080.572] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54bbc30 [0080.572] wcscpy (in: _Dest=0x54bbc30, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" [0080.572] wcscat (in: _Dest=0x54bbc30, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\" [0080.572] wcscat (in: _Dest=0x54bbc30, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0080.572] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54bbc30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418 [0080.573] FindNextFileW (in: hFindFile=0x5ba1130, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x340c4b15, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x340ead73, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x340ead73, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2981, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0080.573] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0080.573] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0080.573] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xea) returned 0x7285ee8 [0080.573] wcscpy (in: _Dest=0x7285ee8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" [0080.573] wcscat (in: _Dest=0x7285ee8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\" [0080.573] wcscat (in: _Dest=0x7285ee8, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" [0080.573] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7285ee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13fc [0080.573] FindNextFileW (in: hFindFile=0x5ba1130, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342422a4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabf30abf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x342422a4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Arkadium.Win10.Awards", cAlternateFileName="ARKADI~1.AWA")) returned 1 [0080.573] wcscmp (_String1="Arkadium.Win10.Awards", _String2=".") returned 1 [0080.573] wcscmp (_String1="Arkadium.Win10.Awards", _String2="..") returned 1 [0080.574] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba2cf8 [0080.574] wcscpy (in: _Dest=0x5ba2cf8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" [0080.574] wcscat (in: _Dest=0x5ba2cf8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\" [0080.574] wcscat (in: _Dest=0x5ba2cf8, _Source="Arkadium.Win10.Awards" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards" [0080.574] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba2cf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15a8 [0080.574] FindNextFileW (in: hFindFile=0x5ba1130, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342dac13, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabf9793f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x342dac13, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Arkadium.Win10.DailyChallenges", cAlternateFileName="ARKADI~1.DAI")) returned 1 [0080.574] wcscmp (_String1="Arkadium.Win10.DailyChallenges", _String2=".") returned 1 [0080.574] wcscmp (_String1="Arkadium.Win10.DailyChallenges", _String2="..") returned 1 [0080.574] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x104) returned 0x7412ac0 [0080.574] wcscpy (in: _Dest=0x7412ac0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" [0080.574] wcscat (in: _Dest=0x7412ac0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\" [0080.574] wcscat (in: _Dest=0x7412ac0, _Source="Arkadium.Win10.DailyChallenges" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges" [0080.575] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7412ac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15ac [0080.575] FindNextFileW (in: hFindFile=0x5ba1130, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3477c3bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac190436, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3477c3bd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Arkadium.Win10.News", cAlternateFileName="ARKADI~1.NEW")) returned 1 [0080.575] wcscmp (_String1="Arkadium.Win10.News", _String2=".") returned 1 [0080.575] wcscmp (_String1="Arkadium.Win10.News", _String2="..") returned 1 [0080.575] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xee) returned 0x7287818 [0080.575] wcscpy (in: _Dest=0x7287818, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" [0080.575] wcscat (in: _Dest=0x7287818, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\" [0080.575] wcscat (in: _Dest=0x7287818, _Source="Arkadium.Win10.News" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News" [0080.575] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7287818, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15b0 [0080.576] FindNextFileW (in: hFindFile=0x5ba1130, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x347a261b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac1fd71d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x347a261b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Arkadium.Win10.StarClub", cAlternateFileName="ARKADI~1.STA")) returned 1 [0080.576] wcscmp (_String1="Arkadium.Win10.StarClub", _String2=".") returned 1 [0080.576] wcscmp (_String1="Arkadium.Win10.StarClub", _String2="..") returned 1 [0080.576] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf6) returned 0x5ba35f8 [0080.576] wcscpy (in: _Dest=0x5ba35f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" [0080.576] wcscat (in: _Dest=0x5ba35f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\" [0080.576] wcscat (in: _Dest=0x5ba35f8, _Source="Arkadium.Win10.StarClub" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub" [0080.576] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba35f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15b4 [0080.577] FindNextFileW (in: hFindFile=0x5ba1130, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3499a434, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac3703f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3499a434, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Arkadium.Win10.Upsell", cAlternateFileName="ARKADI~1.UPS")) returned 1 [0080.577] wcscmp (_String1="Arkadium.Win10.Upsell", _String2=".") returned 1 [0080.577] wcscmp (_String1="Arkadium.Win10.Upsell", _String2="..") returned 1 [0080.577] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba28f8 [0080.577] wcscpy (in: _Dest=0x5ba28f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" [0080.577] wcscat (in: _Dest=0x5ba28f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\" [0080.577] wcscat (in: _Dest=0x5ba28f8, _Source="Arkadium.Win10.Upsell" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell" [0080.577] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba28f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15b8 [0080.578] FindNextFileW (in: hFindFile=0x5ba1130, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x349e68bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac371ee7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x349e68bd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Arkadium.Win10.Xaml.Toolkit", cAlternateFileName="ARKADI~1.TOO")) returned 1 [0080.578] wcscmp (_String1="Arkadium.Win10.Xaml.Toolkit", _String2=".") returned 1 [0080.578] wcscmp (_String1="Arkadium.Win10.Xaml.Toolkit", _String2="..") returned 1 [0080.578] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfe) returned 0x549a028 [0080.578] wcscpy (in: _Dest=0x549a028, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" [0080.578] wcscat (in: _Dest=0x549a028, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\" [0080.578] wcscat (in: _Dest=0x549a028, _Source="Arkadium.Win10.Xaml.Toolkit" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Xaml.Toolkit") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Xaml.Toolkit" [0080.578] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x549a028, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15bc [0080.579] FindNextFileW (in: hFindFile=0x5ba1130, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34b17b7d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac644067, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x377f6ca3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0080.579] wcscmp (_String1="Assets", _String2=".") returned 1 [0080.579] wcscmp (_String1="Assets", _String2="..") returned 1 [0080.579] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd4) returned 0x53fc080 [0080.579] wcscpy (in: _Dest=0x53fc080, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" [0080.579] wcscat (in: _Dest=0x53fc080, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\" [0080.579] wcscat (in: _Dest=0x53fc080, _Source="Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0080.579] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53fc080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c0 [0080.580] FindNextFileW (in: hFindFile=0x5ba1130, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37974437, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb1ac8e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37974437, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Avatars", cAlternateFileName="")) returned 1 [0080.580] wcscmp (_String1="Avatars", _String2=".") returned 1 [0080.580] wcscmp (_String1="Avatars", _String2="..") returned 1 [0080.580] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd6) returned 0x53fc400 [0080.580] wcscpy (in: _Dest=0x53fc400, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" [0080.580] wcscat (in: _Dest=0x53fc400, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\" [0080.580] wcscat (in: _Dest=0x53fc400, _Source="Avatars" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars" [0080.580] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53fc400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c4 [0080.581] FindNextFileW (in: hFindFile=0x5ba1130, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x377f6ca3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3794e1d5, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3794e1d5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2fbe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Avatars.dll", cAlternateFileName="")) returned 1 [0080.581] wcscmp (_String1="Avatars.dll", _String2=".") returned 1 [0080.581] wcscmp (_String1="Avatars.dll", _String2="..") returned 1 [0080.581] FindNextFileW (in: hFindFile=0x5ba1130, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3794e1d5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x37974437, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x37974437, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Avatars.winmd", cAlternateFileName="")) returned 1 [0080.581] wcscmp (_String1="Avatars.winmd", _String2=".") returned 1 [0080.581] wcscmp (_String1="Avatars.winmd", _String2="..") returned 1 [0080.581] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x54b90a8 [0080.581] wcscpy (in: _Dest=0x54b90a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" [0080.581] wcscat (in: _Dest=0x54b90a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\" [0080.581] wcscat (in: _Dest=0x54b90a8, _Source="Avatars.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars.winmd" [0080.581] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54b90a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c8 [0080.582] FindNextFileW (in: hFindFile=0x5ba1130, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37974437, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x37974437, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x37974437, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2a400, dwReserved0=0x0, dwReserved1=0x0, cFileName="CellNativeClientUniversal.dll", cAlternateFileName="")) returned 1 [0080.582] wcscmp (_String1="CellNativeClientUniversal.dll", _String2=".") returned 1 [0080.582] wcscmp (_String1="CellNativeClientUniversal.dll", _String2="..") returned 1 [0080.582] FindNextFileW (in: hFindFile=0x5ba1130, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37974437, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x37974437, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x37974437, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xff58, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClrCompression.dll", cAlternateFileName="")) returned 1 [0080.582] wcscmp (_String1="ClrCompression.dll", _String2=".") returned 1 [0080.582] wcscmp (_String1="ClrCompression.dll", _String2="..") returned 1 [0080.582] FindNextFileW (in: hFindFile=0x5ba1130, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37974437, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x379ca4b7, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x379ca4b7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x5c600, dwReserved0=0x0, dwReserved1=0x0, cFileName="commonEventLoggingLibrary_release.dll", cAlternateFileName="")) returned 1 [0080.582] wcscmp (_String1="commonEventLoggingLibrary_release.dll", _String2=".") returned 1 [0080.582] wcscmp (_String1="commonEventLoggingLibrary_release.dll", _String2="..") returned 1 [0080.582] FindNextFileW (in: hFindFile=0x5ba1130, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x379ca4b7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x37a24352, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x37a24352, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x14ba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="cpprest140_uwp_2_6.dll", cAlternateFileName="")) returned 1 [0080.582] wcscmp (_String1="cpprest140_uwp_2_6.dll", _String2=".") returned 1 [0080.582] wcscmp (_String1="cpprest140_uwp_2_6.dll", _String2="..") returned 1 [0080.582] FindNextFileW (in: hFindFile=0x5ba1130, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc96ea5b4, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xdae86288, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdae86288, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0080.582] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0080.582] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0080.582] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0x7412bd8 [0080.582] wcscpy (in: _Dest=0x7412bd8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" [0080.582] wcscat (in: _Dest=0x7412bd8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\" [0080.582] wcscat (in: _Dest=0x7412bd8, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0080.583] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7412bd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15cc [0080.583] FindNextFileW (in: hFindFile=0x5ba1130, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37a24352, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x37da1ae8, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x37da1ae8, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x845800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Xbox.Services.dll", cAlternateFileName="")) returned 1 [0080.583] wcscmp (_String1="Microsoft.Xbox.Services.dll", _String2=".") returned 1 [0080.583] wcscmp (_String1="Microsoft.Xbox.Services.dll", _String2="..") returned 1 [0080.583] FindNextFileW (in: hFindFile=0x5ba1130, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37dc7d42, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x37dedf9f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x37dedf9f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Xbox.Services.winmd", cAlternateFileName="")) returned 1 [0080.583] wcscmp (_String1="Microsoft.Xbox.Services.winmd", _String2=".") returned 1 [0080.583] wcscmp (_String1="Microsoft.Xbox.Services.winmd", _String2="..") returned 1 [0080.583] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x102) returned 0x7412cf0 [0080.583] wcscpy (in: _Dest=0x7412cf0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" [0080.583] wcscat (in: _Dest=0x7412cf0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\" [0080.583] wcscat (in: _Dest=0x7412cf0, _Source="Microsoft.Xbox.Services.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Microsoft.Xbox.Services.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Microsoft.Xbox.Services.winmd" [0080.583] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7412cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15d0 [0080.584] FindNextFileW (in: hFindFile=0x5ba1130, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37dedf9f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x37e86909, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x37e86909, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1797e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0080.584] wcscmp (_String1="resources.pri", _String2=".") returned 1 [0080.584] wcscmp (_String1="resources.pri", _String2="..") returned 1 [0080.584] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x54b9198 [0080.584] wcscpy (in: _Dest=0x54b9198, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" [0080.584] wcscat (in: _Dest=0x54b9198, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\" [0080.584] wcscat (in: _Dest=0x54b9198, _Source="resources.pri" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\resources.pri") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\resources.pri" [0080.584] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54b9198, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15d4 [0080.585] FindNextFileW (in: hFindFile=0x5ba1130, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37e86909, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb1ce25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37e86909, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharpDXEngine", cAlternateFileName="SHARPD~1")) returned 1 [0080.585] wcscmp (_String1="SharpDXEngine", _String2=".") returned 1 [0080.585] wcscmp (_String1="SharpDXEngine", _String2="..") returned 1 [0080.585] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x54ba098 [0080.585] wcscpy (in: _Dest=0x54ba098, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" [0080.585] wcscat (in: _Dest=0x54ba098, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\" [0080.585] wcscat (in: _Dest=0x54ba098, _Source="SharpDXEngine" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine" [0080.586] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54ba098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15d8 [0080.586] FindNextFileW (in: hFindFile=0x5ba1130, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37f709ad, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x38cb3b87, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x38cb3b87, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x21f6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solitaire.dll", cAlternateFileName="")) returned 1 [0080.586] wcscmp (_String1="Solitaire.dll", _String2=".") returned 1 [0080.586] wcscmp (_String1="Solitaire.dll", _String2="..") returned 1 [0080.586] FindNextFileW (in: hFindFile=0x5ba1130, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38cb3b87, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x38cb3b87, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x38cb3b87, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solitaire.exe", cAlternateFileName="")) returned 1 [0080.586] wcscmp (_String1="Solitaire.exe", _String2=".") returned 1 [0080.586] wcscmp (_String1="Solitaire.exe", _String2="..") returned 1 [0080.586] FindNextFileW (in: hFindFile=0x5ba1130, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38cb3b87, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x38cd9de1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x38cd9de1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x398a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ThirdPartyNotices_Arkadium.txt", cAlternateFileName="")) returned 1 [0080.586] wcscmp (_String1="ThirdPartyNotices_Arkadium.txt", _String2=".") returned 1 [0080.586] wcscmp (_String1="ThirdPartyNotices_Arkadium.txt", _String2="..") returned 1 [0080.586] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x104) returned 0x7412e08 [0080.586] wcscpy (in: _Dest=0x7412e08, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" [0080.586] wcscat (in: _Dest=0x7412e08, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\" [0080.587] wcscat (in: _Dest=0x7412e08, _Source="ThirdPartyNotices_Arkadium.txt" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\ThirdPartyNotices_Arkadium.txt") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\ThirdPartyNotices_Arkadium.txt" [0080.587] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7412e08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15dc [0080.587] FindNextFileW (in: hFindFile=0x5ba1130, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38cd9de1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x38cd9de1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x38cd9de1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="xboxservices.config", cAlternateFileName="")) returned 1 [0080.587] wcscmp (_String1="xboxservices.config", _String2=".") returned 1 [0080.587] wcscmp (_String1="xboxservices.config", _String2="..") returned 1 [0080.587] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xee) returned 0x7287910 [0080.587] wcscpy (in: _Dest=0x7287910, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" [0080.587] wcscat (in: _Dest=0x7287910, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\" [0080.587] wcscat (in: _Dest=0x7287910, _Source="xboxservices.config" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\xboxservices.config") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\xboxservices.config" [0080.587] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7287910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15e0 [0080.588] FindNextFileW (in: hFindFile=0x5ba1130, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34110fcc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabf2fada, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3421c04b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 1 [0080.588] wcscmp (_String1="_Resources", _String2=".") returned 1 [0080.588] wcscmp (_String1="_Resources", _String2="..") returned 1 [0080.588] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x54bba60 [0080.588] wcscpy (in: _Dest=0x54bba60, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe" [0080.588] wcscat (in: _Dest=0x54bba60, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\" [0080.588] wcscat (in: _Dest=0x54bba60, _Source="_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources" [0080.588] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54bba60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15e4 [0080.589] FindNextFileW (in: hFindFile=0x5ba1130, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34110fcc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabf2fada, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3421c04b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 0 [0080.589] FindClose (in: hFindFile=0x5ba1130 | out: hFindFile=0x5ba1130) returned 1 [0080.590] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3936ea0) returned 1 [0080.590] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3974258) returned 1 [0080.590] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f8cd0) returned 1 Thread: id = 589 os_tid = 0x1860 [0074.996] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x38cf1d0 [0074.996] wcscpy (in: _Dest=0x38cf1d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe" [0074.996] wcscat (in: _Dest=0x38cf1d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0074.996] wcscat (in: _Dest=0x38cf1d0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\*" [0074.996] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3937108 [0074.996] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\*", lpFindFileData=0x3937108 | out: lpFindFileData=0x3937108*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a98e846, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xcb314296, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcb314296, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f5c0 [0074.998] wcscmp (_String1=".", _String2=".") returned 0 [0074.998] FindNextFileW (in: hFindFile=0x389f5c0, lpFindFileData=0x3937108 | out: lpFindFileData=0x3937108*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a98e846, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xcb314296, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcb314296, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.998] wcscmp (_String1="..", _String2=".") returned 1 [0074.998] wcscmp (_String1="..", _String2="..") returned 0 [0074.998] FindNextFileW (in: hFindFile=0x389f5c0, lpFindFileData=0x3937108 | out: lpFindFileData=0x3937108*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a98e846, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x6a9b4a9f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x6a9b4a9f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0074.998] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0074.998] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0074.998] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfa) returned 0x38b8af8 [0074.998] wcscpy (in: _Dest=0x38b8af8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe" [0074.998] wcscat (in: _Dest=0x38b8af8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0074.998] wcscat (in: _Dest=0x38b8af8, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml" [0081.104] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b8af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1100 [0081.105] FindNextFileW (in: hFindFile=0x389f5c0, lpFindFileData=0x3937108 | out: lpFindFileData=0x3937108*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a98e846, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x6a98e846, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x6a98e846, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x33c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0081.105] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0081.105] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0081.105] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfa) returned 0x75816b8 [0081.105] wcscpy (in: _Dest=0x75816b8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe" [0081.105] wcscat (in: _Dest=0x75816b8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0081.105] wcscat (in: _Dest=0x75816b8, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml" [0081.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x75816b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ab0 [0081.106] FindNextFileW (in: hFindFile=0x389f5c0, lpFindFileData=0x3937108 | out: lpFindFileData=0x3937108*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a9b4a9f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x6a9dacf8, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x6a9dacf8, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2996, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0081.106] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0081.106] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0081.106] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x75814a8 [0081.106] wcscpy (in: _Dest=0x75814a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe" [0081.106] wcscat (in: _Dest=0x75814a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0081.106] wcscat (in: _Dest=0x75814a8, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x" [0081.106] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x75814a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ab4 [0081.107] FindNextFileW (in: hFindFile=0x389f5c0, lpFindFileData=0x3937108 | out: lpFindFileData=0x3937108*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a9dacf8, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadc94d2f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6aa271af, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0081.107] wcscmp (_String1="Assets", _String2=".") returned 1 [0081.107] wcscmp (_String1="Assets", _String2="..") returned 1 [0081.107] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe6) returned 0xe333158 [0091.753] wcscpy (in: _Dest=0xe333158, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe" [0091.753] wcscat (in: _Dest=0xe333158, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0091.753] wcscat (in: _Dest=0xe333158, _Source="Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" Thread: id = 590 os_tid = 0x1864 [0074.999] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x53f9510 [0074.999] wcscpy (in: _Dest=0x53f9510, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe" [0074.999] wcscat (in: _Dest=0x53f9510, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\" [0074.999] wcscat (in: _Dest=0x53f9510, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\*" [0074.999] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3937370 [0074.999] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x3937370 | out: lpFindFileData=0x3937370*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69c2543c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xcb2ee04f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcb2ee04f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba10f0 [0079.154] wcscmp (_String1=".", _String2=".") returned 0 [0079.154] FindNextFileW (in: hFindFile=0x5ba10f0, lpFindFileData=0x3937370 | out: lpFindFileData=0x3937370*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69c2543c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xcb2ee04f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcb2ee04f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.154] wcscmp (_String1="..", _String2=".") returned 1 [0079.154] wcscmp (_String1="..", _String2="..") returned 0 [0079.154] FindNextFileW (in: hFindFile=0x5ba10f0, lpFindFileData=0x3937370 | out: lpFindFileData=0x3937370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69dc8e24, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69dc8e24, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69dc8e24, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0079.154] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0079.154] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0079.154] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xde) returned 0x54f0fa8 [0079.155] wcscpy (in: _Dest=0x54f0fa8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe" [0079.155] wcscat (in: _Dest=0x54f0fa8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\" [0079.155] wcscat (in: _Dest=0x54f0fa8, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" [0080.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f0fa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x46c [0080.592] FindNextFileW (in: hFindFile=0x5ba10f0, lpFindFileData=0x3937370 | out: lpFindFileData=0x3937370*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69c2543c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd6c838, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69c2543c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0080.592] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0080.592] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0080.592] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd6) returned 0x53fc780 [0080.592] wcscpy (in: _Dest=0x53fc780, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe" [0080.593] wcscat (in: _Dest=0x53fc780, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\" [0080.593] wcscat (in: _Dest=0x53fc780, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0080.593] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53fc780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13f8 [0080.593] FindNextFileW (in: hFindFile=0x5ba10f0, lpFindFileData=0x3937370 | out: lpFindFileData=0x3937370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69dc8e24, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69dc8e24, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69dc8e24, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x299d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0080.593] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0080.593] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0080.593] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54bb238 [0080.593] wcscpy (in: _Dest=0x54bb238, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe" [0080.593] wcscat (in: _Dest=0x54bb238, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\" [0080.593] wcscat (in: _Dest=0x54bb238, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" [0080.593] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bb238, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15e8 [0080.594] FindNextFileW (in: hFindFile=0x5ba10f0, lpFindFileData=0x3937370 | out: lpFindFileData=0x3937370*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcb2ee04f, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xcb2ee04f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcb2ee04f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0080.594] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0080.594] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0080.594] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100) returned 0x549a238 [0080.594] wcscpy (in: _Dest=0x549a238, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe" [0080.594] wcscat (in: _Dest=0x549a238, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\" [0080.594] wcscat (in: _Dest=0x549a238, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" [0080.594] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x549a238, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15ec [0080.595] FindNextFileW (in: hFindFile=0x5ba10f0, lpFindFileData=0x3937370 | out: lpFindFileData=0x3937370*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcb2ee04f, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xcb2ee04f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcb2ee04f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0080.595] FindClose (in: hFindFile=0x5ba10f0 | out: hFindFile=0x5ba10f0) returned 1 [0080.596] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3937370) returned 1 [0080.596] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f9510) returned 1 [0080.596] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fa258) returned 1 Thread: id = 591 os_tid = 0x1868 [0074.999] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb6) returned 0x3904ba0 [0075.000] wcscpy (in: _Dest=0x3904ba0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" [0075.000] wcscat (in: _Dest=0x3904ba0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\" [0075.000] wcscat (in: _Dest=0x3904ba0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\*" [0075.000] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x39375d8 [0075.000] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69e152fc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xcb2ee04f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcb2ee04f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba13f0 [0079.127] wcscmp (_String1=".", _String2=".") returned 0 [0079.127] FindNextFileW (in: hFindFile=0x5ba13f0, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69e152fc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xcb2ee04f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcb2ee04f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.131] wcscmp (_String1="..", _String2=".") returned 1 [0079.131] wcscmp (_String1="..", _String2="..") returned 0 [0079.131] FindNextFileW (in: hFindFile=0x5ba13f0, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e152fc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69e3b535, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69e3b535, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x9141, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0079.131] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0079.131] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0079.131] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd4) returned 0x54b1ab8 [0079.131] wcscpy (in: _Dest=0x54b1ab8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" [0079.131] wcscat (in: _Dest=0x54b1ab8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\" [0079.131] wcscat (in: _Dest=0x54b1ab8, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" [0080.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54b1ab8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c0 [0080.772] FindNextFileW (in: hFindFile=0x5ba13f0, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e152fc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69e152fc, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69e152fc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x430e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0080.772] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0080.772] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0080.772] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd4) returned 0x5babfa0 [0080.772] wcscpy (in: _Dest=0x5babfa0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" [0080.772] wcscat (in: _Dest=0x5babfa0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\" [0080.772] wcscat (in: _Dest=0x5babfa0, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" [0080.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5babfa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c4 [0080.773] FindNextFileW (in: hFindFile=0x5ba13f0, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69e3b535, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd6eb7b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69e3b535, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0080.773] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0080.773] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0080.773] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x757f5c8 [0080.773] wcscpy (in: _Dest=0x757f5c8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" [0080.773] wcscat (in: _Dest=0x757f5c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\" [0080.773] wcscat (in: _Dest=0x757f5c8, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0080.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x757f5c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c8 [0080.774] FindNextFileW (in: hFindFile=0x5ba13f0, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e3b535, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69e3b535, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69e3b535, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x29c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0080.774] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0080.774] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0080.774] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd6) returned 0x5babd00 [0080.774] wcscpy (in: _Dest=0x5babd00, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" [0080.774] wcscat (in: _Dest=0x5babd00, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\" [0080.774] wcscat (in: _Dest=0x5babd00, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" [0080.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5babd00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16cc [0080.775] FindNextFileW (in: hFindFile=0x5ba13f0, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69e879ec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaddf87aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69efa0fc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0080.775] wcscmp (_String1="Assets", _String2=".") returned 1 [0080.775] wcscmp (_String1="Assets", _String2="..") returned 1 [0080.775] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x3975720 [0080.775] wcscpy (in: _Dest=0x3975720, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" [0080.775] wcscat (in: _Dest=0x3975720, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\" [0080.775] wcscat (in: _Dest=0x3975720, _Source="Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" [0080.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3975720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d0 [0080.776] FindNextFileW (in: hFindFile=0x5ba13f0, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69efa0fc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69f2035a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69f2035a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x100b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="clrcompression.dll", cAlternateFileName="")) returned 1 [0080.776] wcscmp (_String1="clrcompression.dll", _String2=".") returned 1 [0080.776] wcscmp (_String1="clrcompression.dll", _String2="..") returned 1 [0080.776] FindNextFileW (in: hFindFile=0x5ba13f0, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69f2035a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69fb8cc4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69fb8cc4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1e0cd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Applications.Telemetry.Windows.dll", cAlternateFileName="")) returned 1 [0080.776] wcscmp (_String1="Microsoft.Applications.Telemetry.Windows.dll", _String2=".") returned 1 [0080.776] wcscmp (_String1="Microsoft.Applications.Telemetry.Windows.dll", _String2="..") returned 1 [0080.776] FindNextFileW (in: hFindFile=0x5ba13f0, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69fb8cc4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69fb8cc4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69fb8cc4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x5200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Applications.Telemetry.Windows.winmd", cAlternateFileName="")) returned 1 [0080.776] wcscmp (_String1="Microsoft.Applications.Telemetry.Windows.winmd", _String2=".") returned 1 [0080.776] wcscmp (_String1="Microsoft.Applications.Telemetry.Windows.winmd", _String2="..") returned 1 [0080.776] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x110) returned 0x5ba8fd0 [0080.776] wcscpy (in: _Dest=0x5ba8fd0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" [0080.776] wcscat (in: _Dest=0x5ba8fd0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\" [0080.776] wcscat (in: _Dest=0x5ba8fd0, _Source="Microsoft.Applications.Telemetry.Windows.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.Applications.Telemetry.Windows.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.Applications.Telemetry.Windows.winmd" [0080.776] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba8fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d4 [0080.777] FindNextFileW (in: hFindFile=0x5ba13f0, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69fdef22, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x6a051632, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x6a051632, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1b3898, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Graphics.Canvas.dll", cAlternateFileName="")) returned 1 [0080.777] wcscmp (_String1="Microsoft.Graphics.Canvas.dll", _String2=".") returned 1 [0080.777] wcscmp (_String1="Microsoft.Graphics.Canvas.dll", _String2="..") returned 1 [0080.777] FindNextFileW (in: hFindFile=0x5ba13f0, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a051632, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x6a051632, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x6a051632, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x42698, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Graphics.Canvas.winmd", cAlternateFileName="")) returned 1 [0080.777] wcscmp (_String1="Microsoft.Graphics.Canvas.winmd", _String2=".") returned 1 [0080.777] wcscmp (_String1="Microsoft.Graphics.Canvas.winmd", _String2="..") returned 1 [0080.777] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba23f8 [0080.777] wcscpy (in: _Dest=0x5ba23f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" [0080.777] wcscat (in: _Dest=0x5ba23f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\" [0080.777] wcscat (in: _Dest=0x5ba23f8, _Source="Microsoft.Graphics.Canvas.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.Graphics.Canvas.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.Graphics.Canvas.winmd" [0080.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba23f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d8 [0080.778] FindNextFileW (in: hFindFile=0x5ba13f0, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a051632, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x6a1f5020, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x6a1f5020, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4afe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Input.Ink.Analysis.dll", cAlternateFileName="")) returned 1 [0080.778] wcscmp (_String1="Microsoft.Input.Ink.Analysis.dll", _String2=".") returned 1 [0080.778] wcscmp (_String1="Microsoft.Input.Ink.Analysis.dll", _String2="..") returned 1 [0080.778] FindNextFileW (in: hFindFile=0x5ba13f0, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a21b279, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x6a2414d2, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x6a2414d2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Input.Ink.Analysis.winmd", cAlternateFileName="")) returned 1 [0080.778] wcscmp (_String1="Microsoft.Input.Ink.Analysis.winmd", _String2=".") returned 1 [0080.778] wcscmp (_String1="Microsoft.Input.Ink.Analysis.winmd", _String2="..") returned 1 [0080.778] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf8) returned 0x5ba26f8 [0080.778] wcscpy (in: _Dest=0x5ba26f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" [0080.778] wcscat (in: _Dest=0x5ba26f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\" [0080.778] wcscat (in: _Dest=0x5ba26f8, _Source="Microsoft.Input.Ink.Analysis.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.Input.Ink.Analysis.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.Input.Ink.Analysis.winmd" [0080.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba26f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16dc [0080.779] FindNextFileW (in: hFindFile=0x5ba13f0, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a2414d2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x6a26772b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x6a26772b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x5d200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Notes.Upgrade.dll", cAlternateFileName="")) returned 1 [0080.779] wcscmp (_String1="Microsoft.Notes.Upgrade.dll", _String2=".") returned 1 [0080.779] wcscmp (_String1="Microsoft.Notes.Upgrade.dll", _String2="..") returned 1 [0080.779] FindNextFileW (in: hFindFile=0x5ba13f0, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a26772b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x6a26772b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x6a26772b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Notes.Upgrade.winmd", cAlternateFileName="")) returned 1 [0080.779] wcscmp (_String1="Microsoft.Notes.Upgrade.winmd", _String2=".") returned 1 [0080.779] wcscmp (_String1="Microsoft.Notes.Upgrade.winmd", _String2="..") returned 1 [0080.779] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xee) returned 0x7285fe0 [0080.779] wcscpy (in: _Dest=0x7285fe0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" [0080.779] wcscat (in: _Dest=0x7285fe0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\" [0080.779] wcscat (in: _Dest=0x7285fe0, _Source="Microsoft.Notes.Upgrade.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.Notes.Upgrade.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.Notes.Upgrade.winmd" [0080.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7285fe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16e0 [0080.780] FindNextFileW (in: hFindFile=0x5ba13f0, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a28d989, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x6a8837c7, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x6a8837c7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x10b6a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.StickyNotes.dll", cAlternateFileName="")) returned 1 [0080.780] wcscmp (_String1="Microsoft.StickyNotes.dll", _String2=".") returned 1 [0080.780] wcscmp (_String1="Microsoft.StickyNotes.dll", _String2="..") returned 1 [0080.780] FindNextFileW (in: hFindFile=0x5ba13f0, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a8837c7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x6a8a9a20, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x6a8a9a20, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.StickyNotes.exe", cAlternateFileName="")) returned 1 [0080.780] wcscmp (_String1="Microsoft.StickyNotes.exe", _String2=".") returned 1 [0080.780] wcscmp (_String1="Microsoft.StickyNotes.exe", _String2="..") returned 1 [0080.780] FindNextFileW (in: hFindFile=0x5ba13f0, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a8a9a20, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaddf973d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a8a9a20, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.StickyNotes.Views", cAlternateFileName="MICROS~1.VIE")) returned 1 [0080.780] wcscmp (_String1="Microsoft.StickyNotes.Views", _String2=".") returned 1 [0080.780] wcscmp (_String1="Microsoft.StickyNotes.Views", _String2="..") returned 1 [0080.780] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xea) returned 0x72860d8 [0080.780] wcscpy (in: _Dest=0x72860d8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" [0080.780] wcscat (in: _Dest=0x72860d8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\" [0080.780] wcscat (in: _Dest=0x72860d8, _Source="Microsoft.StickyNotes.Views" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.StickyNotes.Views") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.StickyNotes.Views" [0080.780] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x72860d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16e4 [0080.781] FindNextFileW (in: hFindFile=0x5ba13f0, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcb2ee04f, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xd8b5b46d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8b5b46d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0080.781] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0080.781] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0080.781] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf6) returned 0x5ba24f8 [0080.781] wcscpy (in: _Dest=0x5ba24f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" [0080.781] wcscat (in: _Dest=0x5ba24f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\" [0080.781] wcscat (in: _Dest=0x5ba24f8, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0080.781] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba24f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16e8 [0080.782] FindNextFileW (in: hFindFile=0x5ba13f0, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a8cfc83, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaddfb0cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a8cfc83, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0080.782] wcscmp (_String1="Resources", _String2=".") returned 1 [0080.782] wcscmp (_String1="Resources", _String2="..") returned 1 [0080.782] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x55fc908 [0080.782] wcscpy (in: _Dest=0x55fc908, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" [0080.782] wcscat (in: _Dest=0x55fc908, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\" [0080.782] wcscat (in: _Dest=0x55fc908, _Source="Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Resources" [0080.782] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55fc908, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16ec [0080.783] FindNextFileW (in: hFindFile=0x5ba13f0, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a8cfc83, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x6a8cfc83, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x6a8cfc83, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1fe70, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0080.783] wcscmp (_String1="resources.pri", _String2=".") returned 1 [0080.783] wcscmp (_String1="resources.pri", _String2="..") returned 1 [0080.783] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x757fad8 [0080.783] wcscpy (in: _Dest=0x757fad8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" [0080.783] wcscat (in: _Dest=0x757fad8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\" [0080.783] wcscat (in: _Dest=0x757fad8, _Source="resources.pri" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\resources.pri") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\resources.pri" [0080.783] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x757fad8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16f0 [0080.784] FindNextFileW (in: hFindFile=0x5ba13f0, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a8cfc83, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x6a9685e8, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x6a9685e8, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x169600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlite3.dll", cAlternateFileName="")) returned 1 [0080.784] wcscmp (_String1="sqlite3.dll", _String2=".") returned 1 [0080.784] wcscmp (_String1="sqlite3.dll", _String2="..") returned 1 [0080.784] FindNextFileW (in: hFindFile=0x5ba13f0, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69e61793, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd6e3ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69e61793, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 1 [0080.784] wcscmp (_String1="_Resources", _String2=".") returned 1 [0080.784] wcscmp (_String1="_Resources", _String2="..") returned 1 [0080.784] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x55fd058 [0080.784] wcscpy (in: _Dest=0x55fd058, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe" [0080.784] wcscat (in: _Dest=0x55fd058, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\" [0080.784] wcscat (in: _Dest=0x55fd058, _Source="_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources" [0080.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55fd058, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16f4 [0080.785] FindNextFileW (in: hFindFile=0x5ba13f0, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69e61793, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd6e3ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69e61793, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 0 [0080.785] FindClose (in: hFindFile=0x5ba13f0 | out: hFindFile=0x5ba13f0) returned 1 [0080.786] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39375d8) returned 1 [0080.786] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3904ba0) returned 1 [0080.786] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3905920) returned 1 Thread: id = 592 os_tid = 0x186c [0075.000] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x5446648 [0075.000] wcscpy (in: _Dest=0x5446648, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe" [0075.000] wcscat (in: _Dest=0x5446648, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\" [0075.000] wcscat (in: _Dest=0x5446648, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\*" [0075.000] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3937840 [0075.001] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x3937840 | out: lpFindFileData=0x3937840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa16112ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xcd2853a0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcd2853a0, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba1830 [0079.153] wcscmp (_String1=".", _String2=".") returned 0 [0079.153] FindNextFileW (in: hFindFile=0x5ba1830, lpFindFileData=0x3937840 | out: lpFindFileData=0x3937840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa16112ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xcd2853a0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcd2853a0, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.153] wcscmp (_String1="..", _String2=".") returned 1 [0079.153] wcscmp (_String1="..", _String2="..") returned 0 [0079.153] FindNextFileW (in: hFindFile=0x5ba1830, lpFindFileData=0x3937840 | out: lpFindFileData=0x3937840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa178ea44, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa178ea44, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xa178ea44, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0079.153] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0079.153] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0079.153] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x3974330 [0079.153] wcscpy (in: _Dest=0x3974330, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe" [0079.153] wcscat (in: _Dest=0x3974330, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\" [0079.153] wcscat (in: _Dest=0x3974330, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" [0080.598] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3974330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x57c [0080.598] FindNextFileW (in: hFindFile=0x5ba1830, lpFindFileData=0x3937840 | out: lpFindFileData=0x3937840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa16112ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadea87cd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa16112ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0080.598] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0080.598] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0080.598] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x55fd398 [0080.598] wcscpy (in: _Dest=0x55fd398, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe" [0080.598] wcscat (in: _Dest=0x55fd398, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\" [0080.598] wcscat (in: _Dest=0x55fd398, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0080.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55fd398, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13f4 [0080.599] FindNextFileW (in: hFindFile=0x5ba1830, lpFindFileData=0x3937840 | out: lpFindFileData=0x3937840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa178ea44, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa17b4c9e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xa17b4c9e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x299d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0080.599] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0080.599] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0080.599] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x38fe800 [0080.599] wcscpy (in: _Dest=0x38fe800, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe" [0080.599] wcscat (in: _Dest=0x38fe800, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\" [0080.599] wcscat (in: _Dest=0x38fe800, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" [0080.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fe800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15f0 [0080.600] FindNextFileW (in: hFindFile=0x5ba1830, lpFindFileData=0x3937840 | out: lpFindFileData=0x3937840*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcd2853a0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xcd2853a0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcd2853a0, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0080.600] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0080.600] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0080.600] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x7285cf8 [0080.600] wcscpy (in: _Dest=0x7285cf8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe" [0080.600] wcscat (in: _Dest=0x7285cf8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\" [0080.600] wcscat (in: _Dest=0x7285cf8, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" [0080.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7285cf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15f4 [0080.601] FindNextFileW (in: hFindFile=0x5ba1830, lpFindFileData=0x3937840 | out: lpFindFileData=0x3937840*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcd2853a0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xcd2853a0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcd2853a0, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0080.601] FindClose (in: hFindFile=0x5ba1830 | out: hFindFile=0x5ba1830) returned 1 [0080.602] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3937840) returned 1 [0080.602] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5446648) returned 1 [0080.602] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5446140) returned 1 Thread: id = 593 os_tid = 0x1870 [0075.001] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa6) returned 0x3889858 [0075.001] wcscpy (in: _Dest=0x3889858, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe" [0075.001] wcscat (in: _Dest=0x3889858, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\" [0075.001] wcscat (in: _Dest=0x3889858, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\*" [0075.001] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3937aa8 [0075.001] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x3937aa8 | out: lpFindFileData=0x3937aa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa17daefc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xcd2853a0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcd2853a0, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f600 [0075.002] wcscmp (_String1=".", _String2=".") returned 0 [0075.002] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x3937aa8 | out: lpFindFileData=0x3937aa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa17daefc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xcd2853a0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcd2853a0, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.003] wcscmp (_String1="..", _String2=".") returned 1 [0075.003] wcscmp (_String1="..", _String2="..") returned 0 [0075.003] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x3937aa8 | out: lpFindFileData=0x3937aa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1801155, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa1801155, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xa1801155, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x16d83, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0075.003] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0075.003] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0075.003] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x3970c80 [0075.003] wcscpy (in: _Dest=0x3970c80, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe" [0075.003] wcscat (in: _Dest=0x3970c80, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\" [0075.003] wcscat (in: _Dest=0x3970c80, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" [0081.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3970c80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ab8 [0081.108] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x3937aa8 | out: lpFindFileData=0x3937aa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa17daefc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa1801155, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xa1801155, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xcb65, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0081.108] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0081.108] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0081.108] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x55fd468 [0081.108] wcscpy (in: _Dest=0x55fd468, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe" [0081.108] wcscat (in: _Dest=0x55fd468, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\" [0081.108] wcscat (in: _Dest=0x55fd468, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" [0081.108] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55fd468, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1abc [0081.108] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x3937aa8 | out: lpFindFileData=0x3937aa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1801155, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadeaa4f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa18273b3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0081.109] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0081.109] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0081.109] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x53fa640 [0081.109] wcscpy (in: _Dest=0x53fa640, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe" [0081.109] wcscat (in: _Dest=0x53fa640, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\" [0081.109] wcscat (in: _Dest=0x53fa640, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0081.109] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53fa640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac0 [0081.109] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x3937aa8 | out: lpFindFileData=0x3937aa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1801155, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa1801155, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xa1801155, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x29c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0081.109] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0081.109] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0081.109] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x55fe648 [0081.109] wcscpy (in: _Dest=0x55fe648, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe" [0081.109] wcscat (in: _Dest=0x55fe648, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\" [0081.110] wcscat (in: _Dest=0x55fe648, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" [0081.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55fe648, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac4 [0081.110] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x3937aa8 | out: lpFindFileData=0x3937aa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa18273b3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadeab676, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2f98f1f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0081.110] wcscmp (_String1="Assets", _String2=".") returned 1 [0081.110] wcscmp (_String1="Assets", _String2="..") returned 1 [0081.110] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x55c76a0 [0081.110] wcscpy (in: _Dest=0x55c76a0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe" [0081.110] wcscat (in: _Dest=0x55c76a0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\" [0081.110] wcscat (in: _Dest=0x55c76a0, _Source="Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\Assets" [0081.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55c76a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac8 [0081.111] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x3937aa8 | out: lpFindFileData=0x3937aa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa300b634, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa300b634, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xa300b634, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x24a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Beihai.Common.Diagnostics.dll", cAlternateFileName="")) returned 1 [0081.111] wcscmp (_String1="Beihai.Common.Diagnostics.dll", _String2=".") returned 1 [0081.111] wcscmp (_String1="Beihai.Common.Diagnostics.dll", _String2="..") returned 1 [0081.111] FindNextFileW (in: hFindFile=0x389f600, lpFindFileData=0x3937aa8 | out: lpFindFileData=0x3937aa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa300b634, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa303188e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xa303188e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Beihai_Common_Diagnostics.winmd", cAlternateFileName="")) returned 1 [0081.111] wcscmp (_String1="Beihai_Common_Diagnostics.winmd", _String2=".") returned 1 [0081.111] wcscmp (_String1="Beihai_Common_Diagnostics.winmd", _String2="..") returned 1 [0081.111] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0xe335e80 [0091.754] wcscpy (in: _Dest=0xe335e80, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe" [0091.754] wcscat (in: _Dest=0xe335e80, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\" [0091.754] wcscat (in: _Dest=0xe335e80, _Source="Beihai_Common_Diagnostics.winmd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\Beihai_Common_Diagnostics.winmd") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\Beihai_Common_Diagnostics.winmd" Thread: id = 594 os_tid = 0x1874 [0075.003] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x3970bb0 [0075.003] wcscpy (in: _Dest=0x3970bb0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" [0075.003] wcscat (in: _Dest=0x3970bb0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\" [0075.003] wcscat (in: _Dest=0x3970bb0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\*" [0075.003] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3937d10 [0075.003] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb21852be, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae4c23b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69869570, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba17f0 [0079.151] wcscmp (_String1=".", _String2=".") returned 0 [0079.151] FindNextFileW (in: hFindFile=0x5ba17f0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb21852be, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae4c23b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69869570, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.151] wcscmp (_String1="..", _String2=".") returned 1 [0079.151] wcscmp (_String1="..", _String2="..") returned 0 [0079.151] FindNextFileW (in: hFindFile=0x5ba17f0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb21852be, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb21852be, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb21852be, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2471, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0079.151] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0079.151] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0079.151] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54f0ec0 [0079.151] wcscpy (in: _Dest=0x54f0ec0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" [0079.151] wcscat (in: _Dest=0x54f0ec0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\" [0079.151] wcscat (in: _Dest=0x54f0ec0, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" [0080.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f0ec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13f0 [0080.603] FindNextFileW (in: hFindFile=0x5ba17f0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb21852be, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb21852be, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb21852be, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x48a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0080.603] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0080.603] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0080.603] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54bb408 [0080.603] wcscpy (in: _Dest=0x54bb408, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" [0080.603] wcscat (in: _Dest=0x54bb408, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\" [0080.603] wcscat (in: _Dest=0x54bb408, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" [0080.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bb408, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15f8 [0080.604] FindNextFileW (in: hFindFile=0x5ba17f0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb21ab500, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae4c3e79, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb21ab500, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0080.604] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0080.604] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0080.604] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x3935288 [0080.604] wcscpy (in: _Dest=0x3935288, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" [0080.604] wcscat (in: _Dest=0x3935288, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\" [0080.604] wcscat (in: _Dest=0x3935288, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0080.604] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3935288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15fc [0080.605] FindNextFileW (in: hFindFile=0x5ba17f0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb21ab500, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb21ab500, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb21ab500, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2993, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0080.605] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0080.605] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0080.605] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x54b8a18 [0080.605] wcscpy (in: _Dest=0x54b8a18, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" [0080.605] wcscat (in: _Dest=0x54b8a18, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\" [0080.605] wcscat (in: _Dest=0x54b8a18, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" [0080.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54b8a18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1600 [0080.606] FindNextFileW (in: hFindFile=0x5ba17f0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb21ab500, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb21ab500, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb21ab500, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x203, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0080.606] wcscmp (_String1="logo.png", _String2=".") returned 1 [0080.606] wcscmp (_String1="logo.png", _String2="..") returned 1 [0080.606] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x38ff2f8 [0080.606] wcscpy (in: _Dest=0x38ff2f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" [0080.606] wcscat (in: _Dest=0x38ff2f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\" [0080.606] wcscat (in: _Dest=0x38ff2f8, _Source="logo.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\logo.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\logo.png" [0080.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38ff2f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1604 [0080.606] FindNextFileW (in: hFindFile=0x5ba17f0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x69869570, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd88c5fc4, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd88c5fc4, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0080.606] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0080.606] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0080.607] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x102) returned 0x7412f20 [0080.607] wcscpy (in: _Dest=0x7412f20, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" [0080.607] wcscat (in: _Dest=0x7412f20, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\" [0080.607] wcscat (in: _Dest=0x7412f20, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0080.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7412f20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1608 [0080.607] FindNextFileW (in: hFindFile=0x5ba17f0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb21ab500, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb21ab500, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb23e79d9, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x788000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedLibrary.dll", cAlternateFileName="")) returned 1 [0080.607] wcscmp (_String1="SharedLibrary.dll", _String2=".") returned 1 [0080.607] wcscmp (_String1="SharedLibrary.dll", _String2="..") returned 1 [0080.607] FindNextFileW (in: hFindFile=0x5ba17f0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb21ab500, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb21ab500, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb23e79d9, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x788000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedLibrary.dll", cAlternateFileName="")) returned 0 [0080.607] FindClose (in: hFindFile=0x5ba17f0 | out: hFindFile=0x5ba17f0) returned 1 [0080.608] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3937d10) returned 1 [0080.608] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3970bb0) returned 1 [0080.608] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f9b50) returned 1 Thread: id = 595 os_tid = 0x1878 [0075.004] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x3970d50 [0075.004] wcscpy (in: _Dest=0x3970d50, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe" [0075.004] wcscat (in: _Dest=0x3970d50, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\" [0075.004] wcscat (in: _Dest=0x3970d50, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\*" [0075.004] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3937f78 [0075.004] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x3937f78 | out: lpFindFileData=0x3937f78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb23e79d9, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae58079f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69b6448c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445880 [0081.248] wcscmp (_String1=".", _String2=".") returned 0 [0081.248] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x3937f78 | out: lpFindFileData=0x3937f78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb23e79d9, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae58079f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69b6448c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.248] wcscmp (_String1="..", _String2=".") returned 1 [0081.248] wcscmp (_String1="..", _String2="..") returned 0 [0081.248] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x3937f78 | out: lpFindFileData=0x3937f78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb23e79d9, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb23e79d9, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb240dc54, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1e2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0081.248] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0081.248] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0081.248] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54bbee8 [0081.248] wcscpy (in: _Dest=0x54bbee8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe" [0081.248] wcscat (in: _Dest=0x54bbee8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\" [0081.248] wcscat (in: _Dest=0x54bbee8, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" [0081.248] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bbee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1be8 [0081.249] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x3937f78 | out: lpFindFileData=0x3937f78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb23e79d9, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb23e79d9, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb23e79d9, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x48a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0081.249] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0081.249] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0081.249] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54bbfd0 [0081.249] wcscpy (in: _Dest=0x54bbfd0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe" [0081.249] wcscat (in: _Dest=0x54bbfd0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\" [0081.249] wcscat (in: _Dest=0x54bbfd0, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" [0081.249] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bbfd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bec [0081.249] FindNextFileW (in: hFindFile=0x5445880, lpFindFileData=0x3937f78 | out: lpFindFileData=0x3937f78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb240dc54, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae5814c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb240dc54, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0081.249] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0081.249] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0081.250] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) Thread: id = 596 os_tid = 0x187c [0075.005] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x3970e20 [0075.005] wcscpy (in: _Dest=0x3970e20, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe" [0075.005] wcscat (in: _Dest=0x3970e20, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\" [0075.005] wcscat (in: _Dest=0x3970e20, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\*" [0075.005] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x39381e0 [0075.005] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x39381e0 | out: lpFindFileData=0x39381e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f97eba2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae61172a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5c39f778, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba17b0 [0079.150] wcscmp (_String1=".", _String2=".") returned 0 [0079.150] FindNextFileW (in: hFindFile=0x5ba17b0, lpFindFileData=0x39381e0 | out: lpFindFileData=0x39381e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f97eba2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae61172a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5c39f778, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.150] wcscmp (_String1="..", _String2=".") returned 1 [0079.150] wcscmp (_String1="..", _String2="..") returned 0 [0079.150] FindNextFileW (in: hFindFile=0x5ba17b0, lpFindFileData=0x39381e0 | out: lpFindFileData=0x39381e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f97eba2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4f97eba2, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4f97eba2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2470, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0079.150] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0079.150] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0079.150] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54f0dd8 [0079.150] wcscpy (in: _Dest=0x54f0dd8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe" [0079.150] wcscat (in: _Dest=0x54f0dd8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\" [0079.150] wcscat (in: _Dest=0x54f0dd8, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" [0080.609] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f0dd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13ec [0080.610] FindNextFileW (in: hFindFile=0x5ba17b0, lpFindFileData=0x39381e0 | out: lpFindFileData=0x39381e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f97eba2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4f97eba2, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4f97eba2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0080.610] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0080.610] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0080.610] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54bb4f0 [0080.610] wcscpy (in: _Dest=0x54bb4f0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe" [0080.610] wcscat (in: _Dest=0x54bb4f0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\" [0080.610] wcscat (in: _Dest=0x54bb4f0, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" [0080.610] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bb4f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x160c [0080.611] FindNextFileW (in: hFindFile=0x5ba17b0, lpFindFileData=0x39381e0 | out: lpFindFileData=0x39381e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f97eba2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae6123e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4f97eba2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0080.611] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0080.611] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0080.611] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x3933ca8 [0080.611] wcscpy (in: _Dest=0x3933ca8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe" [0080.611] wcscat (in: _Dest=0x3933ca8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\" [0080.611] wcscat (in: _Dest=0x3933ca8, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0080.611] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3933ca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1610 [0080.612] FindNextFileW (in: hFindFile=0x5ba17b0, lpFindFileData=0x39381e0 | out: lpFindFileData=0x39381e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f97eba2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4f97eba2, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4f97eba2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2992, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0080.612] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0080.612] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0080.612] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x54b8b08 [0080.612] wcscpy (in: _Dest=0x54b8b08, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe" [0080.612] wcscat (in: _Dest=0x54b8b08, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\" [0080.612] wcscat (in: _Dest=0x54b8b08, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" [0080.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54b8b08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1614 [0080.613] FindNextFileW (in: hFindFile=0x5ba17b0, lpFindFileData=0x39381e0 | out: lpFindFileData=0x39381e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f97eba2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4f97eba2, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4f97eba2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x203, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0080.613] wcscmp (_String1="logo.png", _String2=".") returned 1 [0080.613] wcscmp (_String1="logo.png", _String2="..") returned 1 [0080.613] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x53bb760 [0080.613] wcscpy (in: _Dest=0x53bb760, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe" [0080.613] wcscat (in: _Dest=0x53bb760, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\" [0080.613] wcscat (in: _Dest=0x53bb760, _Source="logo.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\logo.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\logo.png" [0080.613] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53bb760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1618 [0080.614] FindNextFileW (in: hFindFile=0x5ba17b0, lpFindFileData=0x39381e0 | out: lpFindFileData=0x39381e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5c39f778, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xdae53146, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdae53146, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0080.614] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0080.614] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0080.614] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x102) returned 0x5baa150 [0080.614] wcscpy (in: _Dest=0x5baa150, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe" [0080.614] wcscat (in: _Dest=0x5baa150, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\" [0080.614] wcscat (in: _Dest=0x5baa150, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0080.615] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5baa150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x161c [0080.615] FindNextFileW (in: hFindFile=0x5ba17b0, lpFindFileData=0x39381e0 | out: lpFindFileData=0x39381e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f97eba2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4f97eba2, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4fbbaeee, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x788550, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedLibrary.dll", cAlternateFileName="")) returned 1 [0080.615] wcscmp (_String1="SharedLibrary.dll", _String2=".") returned 1 [0080.615] wcscmp (_String1="SharedLibrary.dll", _String2="..") returned 1 [0080.615] FindNextFileW (in: hFindFile=0x5ba17b0, lpFindFileData=0x39381e0 | out: lpFindFileData=0x39381e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f97eba2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4f97eba2, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4fbbaeee, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x788550, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedLibrary.dll", cAlternateFileName="")) returned 0 [0080.615] FindClose (in: hFindFile=0x5ba17b0 | out: hFindFile=0x5ba17b0) returned 1 [0080.616] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39381e0) returned 1 [0080.616] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3970e20) returned 1 [0080.616] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f9f38) returned 1 Thread: id = 597 os_tid = 0x1880 [0075.006] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x3970ef0 [0075.006] wcscpy (in: _Dest=0x3970ef0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe" [0075.006] wcscat (in: _Dest=0x3970ef0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\" [0075.006] wcscat (in: _Dest=0x3970ef0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\*" [0075.006] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3938448 [0075.006] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fbe1144, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae652687, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5be1c081, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba1770 [0079.148] wcscmp (_String1=".", _String2=".") returned 0 [0079.148] FindNextFileW (in: hFindFile=0x5ba1770, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fbe1144, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae652687, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5be1c081, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.148] wcscmp (_String1="..", _String2=".") returned 1 [0079.148] wcscmp (_String1="..", _String2="..") returned 0 [0079.148] FindNextFileW (in: hFindFile=0x5ba1770, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fbe1144, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4fbe1144, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4fbe1144, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1e2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0079.148] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0079.148] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0079.148] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54f0b20 [0079.148] wcscpy (in: _Dest=0x54f0b20, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe" [0079.148] wcscat (in: _Dest=0x54f0b20, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\" [0079.148] wcscat (in: _Dest=0x54f0b20, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" [0080.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f0b20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c4 [0080.618] FindNextFileW (in: hFindFile=0x5ba1770, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fbe1144, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4fbe1144, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4fbe1144, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0080.618] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0080.618] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0080.618] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54bb5d8 [0080.618] wcscpy (in: _Dest=0x54bb5d8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe" [0080.618] wcscat (in: _Dest=0x54bb5d8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\" [0080.618] wcscat (in: _Dest=0x54bb5d8, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" [0080.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bb5d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4 [0080.619] FindNextFileW (in: hFindFile=0x5ba1770, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fbe1144, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae653223, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4fbe1144, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0080.619] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0080.619] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0080.619] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x5bab1a0 [0080.619] wcscpy (in: _Dest=0x5bab1a0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe" [0080.619] wcscat (in: _Dest=0x5bab1a0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\" [0080.619] wcscat (in: _Dest=0x5bab1a0, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxMetadata" [0080.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5bab1a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x364 [0080.620] FindNextFileW (in: hFindFile=0x5ba1770, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fbe1144, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4fbe1144, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4fbe1144, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2991, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0080.620] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0080.620] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0080.620] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x54b9468 [0080.620] wcscpy (in: _Dest=0x54b9468, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe" [0080.620] wcscat (in: _Dest=0x54b9468, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\" [0080.620] wcscat (in: _Dest=0x54b9468, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" [0080.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54b9468, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13e8 [0080.621] FindNextFileW (in: hFindFile=0x5ba1770, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fbe1144, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4fbe1144, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4fbe1144, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x203, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0080.621] wcscmp (_String1="logo.png", _String2=".") returned 1 [0080.621] wcscmp (_String1="logo.png", _String2="..") returned 1 [0080.621] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x53bb5b0 [0080.621] wcscpy (in: _Dest=0x53bb5b0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe" [0080.621] wcscat (in: _Dest=0x53bb5b0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\" [0080.621] wcscat (in: _Dest=0x53bb5b0, _Source="logo.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\logo.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\logo.png" [0080.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53bb5b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1620 [0080.622] FindNextFileW (in: hFindFile=0x5ba1770, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5be1c081, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xdb90dade, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdb90dade, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0080.622] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0080.622] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0080.622] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x102) returned 0x5baa268 [0080.622] wcscpy (in: _Dest=0x5baa268, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe" [0080.622] wcscat (in: _Dest=0x5baa268, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\" [0080.622] wcscat (in: _Dest=0x5baa268, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0080.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5baa268, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1624 [0080.623] FindNextFileW (in: hFindFile=0x5ba1770, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fbe1144, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4fbe1144, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4ff4e801, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x628950, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedLibrary.dll", cAlternateFileName="")) returned 1 [0080.623] wcscmp (_String1="SharedLibrary.dll", _String2=".") returned 1 [0080.623] wcscmp (_String1="SharedLibrary.dll", _String2="..") returned 1 [0080.623] FindNextFileW (in: hFindFile=0x5ba1770, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fbe1144, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4fbe1144, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4ff4e801, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x628950, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedLibrary.dll", cAlternateFileName="")) returned 0 [0080.623] FindClose (in: hFindFile=0x5ba1770 | out: hFindFile=0x5ba1770) returned 1 [0080.623] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3938448) returned 1 [0080.624] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3970ef0) returned 1 [0080.624] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fa000) returned 1 Thread: id = 598 os_tid = 0x1884 [0075.007] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x3970fc0 [0075.007] wcscpy (in: _Dest=0x3970fc0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe" [0075.007] wcscat (in: _Dest=0x3970fc0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\" [0075.007] wcscat (in: _Dest=0x3970fc0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\*" [0075.007] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x39386b0 [0075.007] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x39386b0 | out: lpFindFileData=0x39386b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x569db5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb046ec20, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb046ec20, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba1730 [0079.146] wcscmp (_String1=".", _String2=".") returned 0 [0079.146] FindNextFileW (in: hFindFile=0x5ba1730, lpFindFileData=0x39386b0 | out: lpFindFileData=0x39386b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x569db5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb046ec20, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb046ec20, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.146] wcscmp (_String1="..", _String2=".") returned 1 [0079.147] wcscmp (_String1="..", _String2="..") returned 0 [0079.147] FindNextFileW (in: hFindFile=0x5ba1730, lpFindFileData=0x39386b0 | out: lpFindFileData=0x39386b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59000e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x59000e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x59000e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2470, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0079.147] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0079.147] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0079.147] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54f0a38 [0079.147] wcscpy (in: _Dest=0x54f0a38, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe" [0079.147] wcscat (in: _Dest=0x54f0a38, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\" [0079.147] wcscat (in: _Dest=0x54f0a38, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" [0080.627] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f0a38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13e4 [0080.627] FindNextFileW (in: hFindFile=0x5ba1730, lpFindFileData=0x39386b0 | out: lpFindFileData=0x39386b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x569db5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x569db5, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x569db5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x49d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0080.627] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0080.627] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0080.627] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54ba840 [0080.627] wcscpy (in: _Dest=0x54ba840, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe" [0080.627] wcscat (in: _Dest=0x54ba840, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\" [0080.627] wcscat (in: _Dest=0x54ba840, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" [0080.628] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54ba840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1628 [0080.628] FindNextFileW (in: hFindFile=0x5ba1730, lpFindFileData=0x39386b0 | out: lpFindFileData=0x39386b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b6267, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae6c9f8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5b6267, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0080.628] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0080.628] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0080.628] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x5bac940 [0080.629] wcscpy (in: _Dest=0x5bac940, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe" [0080.629] wcscat (in: _Dest=0x5bac940, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\" [0080.629] wcscat (in: _Dest=0x5bac940, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0080.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5bac940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x162c [0080.629] FindNextFileW (in: hFindFile=0x5ba1730, lpFindFileData=0x39386b0 | out: lpFindFileData=0x39386b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b6267, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b6267, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x5b6267, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2992, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0080.629] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0080.629] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0080.629] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x54ba188 [0080.629] wcscpy (in: _Dest=0x54ba188, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe" [0080.629] wcscat (in: _Dest=0x54ba188, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\" [0080.630] wcscat (in: _Dest=0x54ba188, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" [0080.630] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54ba188, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1630 [0080.630] FindNextFileW (in: hFindFile=0x5ba1730, lpFindFileData=0x39386b0 | out: lpFindFileData=0x39386b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc4c1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5dc4c1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x5dc4c1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x203, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0080.630] wcscmp (_String1="logo.png", _String2=".") returned 1 [0080.630] wcscmp (_String1="logo.png", _String2="..") returned 1 [0080.630] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x53bafc8 [0080.630] wcscpy (in: _Dest=0x53bafc8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe" [0080.630] wcscat (in: _Dest=0x53bafc8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\" [0080.630] wcscat (in: _Dest=0x53bafc8, _Source="logo.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\logo.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\logo.png" [0080.630] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53bafc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1634 [0080.631] FindNextFileW (in: hFindFile=0x5ba1730, lpFindFileData=0x39386b0 | out: lpFindFileData=0x39386b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb046ec20, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb046ec20, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xdb9fcec, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0080.631] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0080.631] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0080.631] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x102) returned 0x5ba9cf0 [0080.631] wcscpy (in: _Dest=0x5ba9cf0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe" [0080.631] wcscat (in: _Dest=0x5ba9cf0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\" [0080.631] wcscat (in: _Dest=0x5ba9cf0, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0080.631] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba9cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1638 [0080.632] FindNextFileW (in: hFindFile=0x5ba1730, lpFindFileData=0x39386b0 | out: lpFindFileData=0x39386b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc4c1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb39994, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xb39994, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x783b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedLibrary.dll", cAlternateFileName="")) returned 1 [0080.632] wcscmp (_String1="SharedLibrary.dll", _String2=".") returned 1 [0080.632] wcscmp (_String1="SharedLibrary.dll", _String2="..") returned 1 [0080.632] FindNextFileW (in: hFindFile=0x5ba1730, lpFindFileData=0x39386b0 | out: lpFindFileData=0x39386b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc4c1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb39994, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xb39994, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x783b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedLibrary.dll", cAlternateFileName="")) returned 0 [0080.632] FindClose (in: hFindFile=0x5ba1730 | out: hFindFile=0x5ba1730) returned 1 [0080.633] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39386b0) returned 1 [0080.633] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3970fc0) returned 1 [0080.633] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fa0c8) returned 1 Thread: id = 599 os_tid = 0x1888 [0075.007] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x3971090 [0075.007] wcscpy (in: _Dest=0x3971090, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe" [0075.007] wcscat (in: _Dest=0x3971090, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\" [0075.008] wcscat (in: _Dest=0x3971090, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\*" [0075.008] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3938b80 [0075.008] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x3938b80 | out: lpFindFileData=0x3938b80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf855c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf7c444d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xaf7c444d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba16f0 [0079.145] wcscmp (_String1=".", _String2=".") returned 0 [0079.145] FindNextFileW (in: hFindFile=0x5ba16f0, lpFindFileData=0x3938b80 | out: lpFindFileData=0x3938b80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf855c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf7c444d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xaf7c444d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.145] wcscmp (_String1="..", _String2=".") returned 1 [0079.145] wcscmp (_String1="..", _String2="..") returned 0 [0079.145] FindNextFileW (in: hFindFile=0x5ba16f0, lpFindFileData=0x3938b80 | out: lpFindFileData=0x3938b80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1e7b5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc44a0e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xc44a0e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1d9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0079.145] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0079.145] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0079.145] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54f0868 [0079.145] wcscpy (in: _Dest=0x54f0868, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe" [0079.145] wcscat (in: _Dest=0x54f0868, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\" [0079.145] wcscat (in: _Dest=0x54f0868, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" [0080.635] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f0868, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x460 [0080.635] FindNextFileW (in: hFindFile=0x5ba16f0, lpFindFileData=0x3938b80 | out: lpFindFileData=0x3938b80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf855c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc1e7b5, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xc1e7b5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x49d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0080.635] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0080.635] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0080.635] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54baa10 [0080.635] wcscpy (in: _Dest=0x54baa10, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe" [0080.635] wcscat (in: _Dest=0x54baa10, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\" [0080.635] wcscat (in: _Dest=0x54baa10, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" [0080.635] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54baa10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x468 [0080.636] FindNextFileW (in: hFindFile=0x5ba16f0, lpFindFileData=0x3938b80 | out: lpFindFileData=0x3938b80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc44a0e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae726a29, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc44a0e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0080.636] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0080.636] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0080.636] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x5baca20 [0080.636] wcscpy (in: _Dest=0x5baca20, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe" [0080.636] wcscat (in: _Dest=0x5baca20, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\" [0080.636] wcscat (in: _Dest=0x5baca20, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxMetadata" [0080.636] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5baca20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13e0 [0080.637] FindNextFileW (in: hFindFile=0x5ba16f0, lpFindFileData=0x3938b80 | out: lpFindFileData=0x3938b80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc44a0e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc44a0e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xc44a0e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2992, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0080.637] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0080.637] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0080.637] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x54ba278 [0080.637] wcscpy (in: _Dest=0x54ba278, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe" [0080.637] wcscat (in: _Dest=0x54ba278, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\" [0080.637] wcscat (in: _Dest=0x54ba278, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" [0080.637] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54ba278, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x163c [0080.638] FindNextFileW (in: hFindFile=0x5ba16f0, lpFindFileData=0x3938b80 | out: lpFindFileData=0x3938b80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc44a0e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc44a0e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xc44a0e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x203, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0080.638] wcscmp (_String1="logo.png", _String2=".") returned 1 [0080.638] wcscmp (_String1="logo.png", _String2="..") returned 1 [0080.638] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x3974258 [0080.638] wcscpy (in: _Dest=0x3974258, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe" [0080.638] wcscat (in: _Dest=0x3974258, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\" [0080.638] wcscat (in: _Dest=0x3974258, _Source="logo.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\logo.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\logo.png" [0080.638] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3974258, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1640 [0080.638] FindNextFileW (in: hFindFile=0x5ba16f0, lpFindFileData=0x3938b80 | out: lpFindFileData=0x3938b80*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xaf7c444d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xaf7c444d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd96398a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0080.639] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0080.639] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0080.639] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x102) returned 0x5ba9e08 [0080.639] wcscpy (in: _Dest=0x5ba9e08, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe" [0080.639] wcscat (in: _Dest=0x5ba9e08, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\" [0080.639] wcscat (in: _Dest=0x5ba9e08, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0080.639] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba9e08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1644 [0080.639] FindNextFileW (in: hFindFile=0x5ba16f0, lpFindFileData=0x3938b80 | out: lpFindFileData=0x3938b80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc44a0e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x1070c0a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x1070c0a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x602550, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedLibrary.dll", cAlternateFileName="")) returned 1 [0080.639] wcscmp (_String1="SharedLibrary.dll", _String2=".") returned 1 [0080.639] wcscmp (_String1="SharedLibrary.dll", _String2="..") returned 1 [0080.639] FindNextFileW (in: hFindFile=0x5ba16f0, lpFindFileData=0x3938b80 | out: lpFindFileData=0x3938b80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc44a0e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x1070c0a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x1070c0a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x602550, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedLibrary.dll", cAlternateFileName="")) returned 0 [0080.640] FindClose (in: hFindFile=0x5ba16f0 | out: hFindFile=0x5ba16f0) returned 1 [0080.640] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3938b80) returned 1 [0080.640] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3971090) returned 1 [0080.640] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fa190) returned 1 Thread: id = 600 os_tid = 0x188c [0075.008] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x3971160 [0075.008] wcscpy (in: _Dest=0x3971160, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe" [0075.008] wcscat (in: _Dest=0x3971160, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\" [0075.008] wcscat (in: _Dest=0x3971160, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\*" [0075.008] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3938de8 [0075.008] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x3938de8 | out: lpFindFileData=0x3938de8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x115e8dfa, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xae7e244c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x12f3e2a7, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba1630 [0079.143] wcscmp (_String1=".", _String2=".") returned 0 [0079.143] FindNextFileW (in: hFindFile=0x5ba1630, lpFindFileData=0x3938de8 | out: lpFindFileData=0x3938de8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x115e8dfa, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xae7e244c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x12f3e2a7, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.143] wcscmp (_String1="..", _String2=".") returned 1 [0079.143] wcscmp (_String1="..", _String2="..") returned 0 [0079.143] FindNextFileW (in: hFindFile=0x5ba1630, lpFindFileData=0x3938de8 | out: lpFindFileData=0x3938de8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1178c791, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x1178c791, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x12d01ea9, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x2272, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="APPXBL~1.XML")) returned 1 [0079.143] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0079.143] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0079.143] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54f0780 [0079.143] wcscpy (in: _Dest=0x54f0780, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe" [0079.143] wcscat (in: _Dest=0x54f0780, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\" [0079.143] wcscat (in: _Dest=0x54f0780, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" [0080.641] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f0780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13dc [0080.642] FindNextFileW (in: hFindFile=0x5ba1630, lpFindFileData=0x3938de8 | out: lpFindFileData=0x3938de8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11635228, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x11635228, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x12d01ea9, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x49d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="APPXMA~1.XML")) returned 1 [0080.642] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0080.642] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0080.642] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54baaf8 [0080.642] wcscpy (in: _Dest=0x54baaf8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe" [0080.642] wcscat (in: _Dest=0x54baaf8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\" [0080.642] wcscat (in: _Dest=0x54baaf8, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" [0080.642] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54baaf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1648 [0080.643] FindNextFileW (in: hFindFile=0x5ba1630, lpFindFileData=0x3938de8 | out: lpFindFileData=0x3938de8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11909f6c, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xae7e4415, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x11909f6c, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0080.643] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0080.643] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0080.643] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x5bacb00 [0080.643] wcscpy (in: _Dest=0x5bacb00, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe" [0080.643] wcscat (in: _Dest=0x5bacb00, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\" [0080.643] wcscat (in: _Dest=0x5bacb00, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0080.644] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5bacb00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x164c [0080.644] FindNextFileW (in: hFindFile=0x5ba1630, lpFindFileData=0x3938de8 | out: lpFindFileData=0x3938de8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119a28c1, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x119a28c1, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x12d01ea9, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x297e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="APPXSI~1.P7X")) returned 1 [0080.645] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0080.645] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0080.645] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x54ba368 [0080.645] wcscpy (in: _Dest=0x54ba368, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe" [0080.645] wcscat (in: _Dest=0x54ba368, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\" [0080.645] wcscat (in: _Dest=0x54ba368, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" [0080.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54ba368, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1650 [0080.646] FindNextFileW (in: hFindFile=0x5ba1630, lpFindFileData=0x3938de8 | out: lpFindFileData=0x3938de8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1eaa4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0xbd1eaa4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0xbd1eaa4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x203, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0080.646] wcscmp (_String1="logo.png", _String2=".") returned 1 [0080.646] wcscmp (_String1="logo.png", _String2="..") returned 1 [0080.646] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x39729e0 [0080.646] wcscpy (in: _Dest=0x39729e0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe" [0080.646] wcscat (in: _Dest=0x39729e0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\" [0080.646] wcscat (in: _Dest=0x39729e0, _Source="logo.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\logo.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\logo.png" [0080.646] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x39729e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1654 [0080.647] FindNextFileW (in: hFindFile=0x5ba1630, lpFindFileData=0x3938de8 | out: lpFindFileData=0x3938de8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12f3e2a7, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xdbfe8744, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdbfe8744, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0080.647] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0080.647] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0080.647] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x102) returned 0x5ba9f20 [0080.647] wcscpy (in: _Dest=0x5ba9f20, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe" [0080.647] wcscat (in: _Dest=0x5ba9f20, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\" [0080.647] wcscat (in: _Dest=0x5ba9f20, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0080.647] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba9f20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1658 [0080.648] FindNextFileW (in: hFindFile=0x5ba1630, lpFindFileData=0x3938de8 | out: lpFindFileData=0x3938de8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11a614e2, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x11a614e2, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x12d01ea9, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x717f50, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedLibrary.dll", cAlternateFileName="SHARED~1.DLL")) returned 1 [0080.648] wcscmp (_String1="SharedLibrary.dll", _String2=".") returned 1 [0080.648] wcscmp (_String1="SharedLibrary.dll", _String2="..") returned 1 [0080.648] FindNextFileW (in: hFindFile=0x5ba1630, lpFindFileData=0x3938de8 | out: lpFindFileData=0x3938de8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11a614e2, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x11a614e2, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x12d01ea9, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x717f50, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedLibrary.dll", cAlternateFileName="SHARED~1.DLL")) returned 0 [0080.648] FindClose (in: hFindFile=0x5ba1630 | out: hFindFile=0x5ba1630) returned 1 [0080.649] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3938de8) returned 1 [0080.649] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3971160) returned 1 [0080.649] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fa320) returned 1 Thread: id = 601 os_tid = 0x1890 [0075.009] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x3971230 [0075.009] wcscpy (in: _Dest=0x3971230, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe" [0075.009] wcscat (in: _Dest=0x3971230, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\" [0075.009] wcscat (in: _Dest=0x3971230, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\*" [0075.009] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393a390 [0075.009] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x393a390 | out: lpFindFileData=0x393a390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13f7c62e, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xae87e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x164e3d2d, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba15f0 [0079.141] wcscmp (_String1=".", _String2=".") returned 0 [0079.141] FindNextFileW (in: hFindFile=0x5ba15f0, lpFindFileData=0x393a390 | out: lpFindFileData=0x393a390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13f7c62e, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xae87e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x164e3d2d, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.141] wcscmp (_String1="..", _String2=".") returned 1 [0079.141] wcscmp (_String1="..", _String2="..") returned 0 [0079.141] FindNextFileW (in: hFindFile=0x5ba15f0, lpFindFileData=0x393a390 | out: lpFindFileData=0x393a390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1403b242, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x1403b242, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x164250c2, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x1cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="APPXBL~1.XML")) returned 1 [0079.141] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0079.141] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0079.142] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54f05b0 [0079.142] wcscpy (in: _Dest=0x54f05b0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe" [0079.142] wcscat (in: _Dest=0x54f05b0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\" [0079.142] wcscat (in: _Dest=0x54f05b0, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" [0080.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f05b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x458 [0080.652] FindNextFileW (in: hFindFile=0x5ba15f0, lpFindFileData=0x393a390 | out: lpFindFileData=0x393a390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13fa289f, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x13fa289f, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x164250c2, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x49d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="APPXMA~1.XML")) returned 1 [0080.652] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0080.652] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0080.652] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54babe0 [0080.652] wcscpy (in: _Dest=0x54babe0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe" [0080.652] wcscat (in: _Dest=0x54babe0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\" [0080.652] wcscat (in: _Dest=0x54babe0, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" [0080.652] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54babe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x45c [0080.653] FindNextFileW (in: hFindFile=0x5ba15f0, lpFindFileData=0x393a390 | out: lpFindFileData=0x393a390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14120099, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xae88003f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x14120099, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0080.653] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0080.653] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0080.653] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x5baafe0 [0080.653] wcscpy (in: _Dest=0x5baafe0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe" [0080.653] wcscat (in: _Dest=0x5baafe0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\" [0080.653] wcscat (in: _Dest=0x5baafe0, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxMetadata" [0080.653] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5baafe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13d8 [0080.654] FindNextFileW (in: hFindFile=0x5ba15f0, lpFindFileData=0x393a390 | out: lpFindFileData=0x393a390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x141b8a48, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x141b8a48, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x164250c2, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x297e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="APPXSI~1.P7X")) returned 1 [0080.654] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0080.654] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0080.654] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x54ba458 [0080.654] wcscpy (in: _Dest=0x54ba458, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe" [0080.654] wcscat (in: _Dest=0x54ba458, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\" [0080.655] wcscat (in: _Dest=0x54ba458, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" [0080.655] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54ba458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x165c [0080.655] FindNextFileW (in: hFindFile=0x5ba15f0, lpFindFileData=0x393a390 | out: lpFindFileData=0x393a390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1eaa4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0xbd1eaa4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0xbd1eaa4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x203, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0080.655] wcscmp (_String1="logo.png", _String2=".") returned 1 [0080.655] wcscmp (_String1="logo.png", _String2="..") returned 1 [0080.655] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x757f850 [0080.728] wcscpy (in: _Dest=0x757f850, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe" [0080.728] wcscat (in: _Dest=0x757f850, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\" [0080.728] wcscat (in: _Dest=0x757f850, _Source="logo.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\logo.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\logo.png" [0080.728] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x757f850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1660 [0080.728] FindNextFileW (in: hFindFile=0x5ba15f0, lpFindFileData=0x393a390 | out: lpFindFileData=0x393a390*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x164e3d2d, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xdc925941, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdc925941, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0080.728] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0080.728] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0080.729] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x102) returned 0x5baa380 [0080.729] wcscpy (in: _Dest=0x5baa380, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe" [0080.729] wcscat (in: _Dest=0x5baa380, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\" [0080.729] wcscat (in: _Dest=0x5baa380, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0080.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5baa380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1664 [0080.729] FindNextFileW (in: hFindFile=0x5ba15f0, lpFindFileData=0x393a390 | out: lpFindFileData=0x393a390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1425138b, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x1425138b, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x164250c2, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x5d9b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedLibrary.dll", cAlternateFileName="SHARED~1.DLL")) returned 1 [0080.729] wcscmp (_String1="SharedLibrary.dll", _String2=".") returned 1 [0080.729] wcscmp (_String1="SharedLibrary.dll", _String2="..") returned 1 [0080.729] FindNextFileW (in: hFindFile=0x5ba15f0, lpFindFileData=0x393a390 | out: lpFindFileData=0x393a390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1425138b, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x1425138b, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x164250c2, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x5d9b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedLibrary.dll", cAlternateFileName="SHARED~1.DLL")) returned 0 [0080.730] FindClose (in: hFindFile=0x5ba15f0 | out: hFindFile=0x5ba15f0) returned 1 [0080.730] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393a390) returned 1 [0080.730] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3971230) returned 1 [0080.730] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fa3e8) returned 1 Thread: id = 602 os_tid = 0x1894 [0075.010] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53faa28 [0075.010] wcscpy (in: _Dest=0x53faa28, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" [0075.010] wcscat (in: _Dest=0x53faa28, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\" [0075.010] wcscat (in: _Dest=0x53faa28, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\*" [0075.010] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393a5f8 [0075.011] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x393a5f8 | out: lpFindFileData=0x393a5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb26701cd, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae8ff986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69da07d7, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba15b0 [0079.140] wcscmp (_String1=".", _String2=".") returned 0 [0079.140] FindNextFileW (in: hFindFile=0x5ba15b0, lpFindFileData=0x393a5f8 | out: lpFindFileData=0x393a5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb26701cd, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae8ff986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69da07d7, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.140] wcscmp (_String1="..", _String2=".") returned 1 [0079.140] wcscmp (_String1="..", _String2="..") returned 0 [0079.140] FindNextFileW (in: hFindFile=0x5ba15b0, lpFindFileData=0x393a5f8 | out: lpFindFileData=0x393a5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb26701cd, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb26701cd, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb26701cd, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x467, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0079.140] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0079.140] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0079.140] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x54f03e0 [0079.140] wcscpy (in: _Dest=0x54f03e0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" [0079.140] wcscat (in: _Dest=0x54f03e0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\" [0079.140] wcscat (in: _Dest=0x54f03e0, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" [0080.731] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f03e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13d4 [0080.732] FindNextFileW (in: hFindFile=0x5ba15b0, lpFindFileData=0x393a5f8 | out: lpFindFileData=0x393a5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb26701cd, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb26701cd, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb26701cd, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0080.732] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0080.732] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0080.732] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x54bacc8 [0080.732] wcscpy (in: _Dest=0x54bacc8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" [0080.732] wcscat (in: _Dest=0x54bacc8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\" [0080.732] wcscat (in: _Dest=0x54bacc8, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" [0080.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bacc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1668 [0080.733] FindNextFileW (in: hFindFile=0x5ba15b0, lpFindFileData=0x393a5f8 | out: lpFindFileData=0x393a5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb2696342, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae900a2d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2696342, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0080.733] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0080.733] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0080.733] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd4) returned 0x5bab0c0 [0080.733] wcscpy (in: _Dest=0x5bab0c0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" [0080.733] wcscat (in: _Dest=0x5bab0c0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\" [0080.733] wcscat (in: _Dest=0x5bab0c0, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0080.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5bab0c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x166c [0080.734] FindNextFileW (in: hFindFile=0x5ba15b0, lpFindFileData=0x393a5f8 | out: lpFindFileData=0x393a5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2696342, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb2696342, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb2696342, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2992, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0080.734] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0080.734] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0080.734] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xde) returned 0x54bb890 [0080.734] wcscpy (in: _Dest=0x54bb890, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" [0080.734] wcscat (in: _Dest=0x54bb890, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\" [0080.734] wcscat (in: _Dest=0x54bb890, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" [0080.734] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bb890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1670 [0080.735] FindNextFileW (in: hFindFile=0x5ba15b0, lpFindFileData=0x393a5f8 | out: lpFindFileData=0x393a5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2696342, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb2696342, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb2696342, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xfec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="clrcompression.dll", cAlternateFileName="")) returned 1 [0080.735] wcscmp (_String1="clrcompression.dll", _String2=".") returned 1 [0080.735] wcscmp (_String1="clrcompression.dll", _String2="..") returned 1 [0080.735] FindNextFileW (in: hFindFile=0x5ba15b0, lpFindFileData=0x393a5f8 | out: lpFindFileData=0x393a5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2696342, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb2696342, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb2696342, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x203, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0080.735] wcscmp (_String1="logo.png", _String2=".") returned 1 [0080.735] wcscmp (_String1="logo.png", _String2="..") returned 1 [0080.735] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x757f340 [0080.735] wcscpy (in: _Dest=0x757f340, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" [0080.735] wcscat (in: _Dest=0x757f340, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\" [0080.735] wcscat (in: _Dest=0x757f340, _Source="logo.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\logo.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\logo.png" [0080.735] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x757f340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1674 [0080.736] FindNextFileW (in: hFindFile=0x5ba15b0, lpFindFileData=0x393a5f8 | out: lpFindFileData=0x393a5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x69da07d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xdd0e53b5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdd0e53b5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0080.736] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0080.736] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0080.736] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfe) returned 0x549a130 [0080.736] wcscpy (in: _Dest=0x549a130, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe" [0080.736] wcscat (in: _Dest=0x549a130, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\" [0080.736] wcscat (in: _Dest=0x549a130, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0080.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x549a130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1678 [0080.737] FindNextFileW (in: hFindFile=0x5ba15b0, lpFindFileData=0x393a5f8 | out: lpFindFileData=0x393a5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2696342, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb2696342, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb2696342, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x7898, dwReserved0=0x0, dwReserved1=0x0, cFileName="mrt100.dll", cAlternateFileName="")) returned 1 [0080.737] wcscmp (_String1="mrt100.dll", _String2=".") returned 1 [0080.737] wcscmp (_String1="mrt100.dll", _String2="..") returned 1 [0080.737] FindNextFileW (in: hFindFile=0x5ba15b0, lpFindFileData=0x393a5f8 | out: lpFindFileData=0x393a5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2696342, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb2696342, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb26bc675, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4d8a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="mrt100_app.dll", cAlternateFileName="")) returned 1 [0080.737] wcscmp (_String1="mrt100_app.dll", _String2=".") returned 1 [0080.737] wcscmp (_String1="mrt100_app.dll", _String2="..") returned 1 [0080.737] FindNextFileW (in: hFindFile=0x5ba15b0, lpFindFileData=0x393a5f8 | out: lpFindFileData=0x393a5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2696342, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb2696342, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb26bc675, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4d8a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="mrt100_app.dll", cAlternateFileName="")) returned 0 [0080.737] FindClose (in: hFindFile=0x5ba15b0 | out: hFindFile=0x5ba15b0) returned 1 [0080.738] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393a5f8) returned 1 [0080.738] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53faa28) returned 1 [0080.738] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fabb8) returned 1 Thread: id = 603 os_tid = 0x1898 [0075.011] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53e8670 [0075.011] wcscpy (in: _Dest=0x53e8670, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe" [0075.012] wcscat (in: _Dest=0x53e8670, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\" [0075.012] wcscat (in: _Dest=0x53e8670, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\*" [0075.012] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393a860 [0075.012] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x393a860 | out: lpFindFileData=0x393a860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb26e2784, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae9b674b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69fb68e3, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba1570 [0079.138] wcscmp (_String1=".", _String2=".") returned 0 [0079.138] FindNextFileW (in: hFindFile=0x5ba1570, lpFindFileData=0x393a860 | out: lpFindFileData=0x393a860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb26e2784, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae9b674b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69fb68e3, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.138] wcscmp (_String1="..", _String2=".") returned 1 [0079.138] wcscmp (_String1="..", _String2="..") returned 0 [0079.138] FindNextFileW (in: hFindFile=0x5ba1570, lpFindFileData=0x393a860 | out: lpFindFileData=0x393a860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb26e2784, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb26e2784, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb26e2784, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x41e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0079.138] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0079.138] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0079.138] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x54f02f8 [0079.138] wcscpy (in: _Dest=0x54f02f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe" [0079.138] wcscat (in: _Dest=0x54f02f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\" [0079.138] wcscat (in: _Dest=0x54f02f8, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" [0080.739] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f02f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13d0 [0080.739] FindNextFileW (in: hFindFile=0x5ba1570, lpFindFileData=0x393a860 | out: lpFindFileData=0x393a860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb26e2784, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb26e2784, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb26e2784, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0080.739] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0080.739] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0080.740] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x54badb0 [0080.740] wcscpy (in: _Dest=0x54badb0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe" [0080.740] wcscat (in: _Dest=0x54badb0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\" [0080.740] wcscat (in: _Dest=0x54badb0, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" [0080.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54badb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x167c [0080.740] FindNextFileW (in: hFindFile=0x5ba1570, lpFindFileData=0x393a860 | out: lpFindFileData=0x393a860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb2708a61, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae9b8a01, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2708a61, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0080.740] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0080.740] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0080.740] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd4) returned 0x5bab280 [0080.740] wcscpy (in: _Dest=0x5bab280, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe" [0080.740] wcscat (in: _Dest=0x5bab280, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\" [0080.740] wcscat (in: _Dest=0x5bab280, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxMetadata" [0080.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5bab280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1680 [0080.741] FindNextFileW (in: hFindFile=0x5ba1570, lpFindFileData=0x393a860 | out: lpFindFileData=0x393a860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb26e2784, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb26e2784, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb26e2784, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2992, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0080.741] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0080.741] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0080.741] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xde) returned 0x54bb978 [0080.741] wcscpy (in: _Dest=0x54bb978, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe" [0080.742] wcscat (in: _Dest=0x54bb978, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\" [0080.742] wcscat (in: _Dest=0x54bb978, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" [0080.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bb978, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1684 [0080.742] FindNextFileW (in: hFindFile=0x5ba1570, lpFindFileData=0x393a860 | out: lpFindFileData=0x393a860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2708a61, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb2708a61, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb2708a61, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xe8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="clrcompression.dll", cAlternateFileName="")) returned 1 [0080.742] wcscmp (_String1="clrcompression.dll", _String2=".") returned 1 [0080.742] wcscmp (_String1="clrcompression.dll", _String2="..") returned 1 [0080.742] FindNextFileW (in: hFindFile=0x5ba1570, lpFindFileData=0x393a860 | out: lpFindFileData=0x393a860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2708a61, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb2708a61, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb2708a61, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x203, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0080.742] wcscmp (_String1="logo.png", _String2=".") returned 1 [0080.742] wcscmp (_String1="logo.png", _String2="..") returned 1 [0080.742] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x757f418 [0080.742] wcscpy (in: _Dest=0x757f418, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe" [0080.742] wcscat (in: _Dest=0x757f418, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\" [0080.742] wcscat (in: _Dest=0x757f418, _Source="logo.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\logo.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\logo.png" [0080.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x757f418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1688 [0080.743] FindNextFileW (in: hFindFile=0x5ba1570, lpFindFileData=0x393a860 | out: lpFindFileData=0x393a860*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x69fb68e3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xddc386b4, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xddc386b4, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0080.743] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0080.743] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0080.743] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfe) returned 0x7581190 [0080.747] wcscpy (in: _Dest=0x7581190, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe" [0080.747] wcscat (in: _Dest=0x7581190, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\" [0080.747] wcscat (in: _Dest=0x7581190, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0080.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7581190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x168c [0080.748] FindNextFileW (in: hFindFile=0x5ba1570, lpFindFileData=0x393a860 | out: lpFindFileData=0x393a860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2708a61, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb2708a61, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb2708a61, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x6c98, dwReserved0=0x0, dwReserved1=0x0, cFileName="mrt100.dll", cAlternateFileName="")) returned 1 [0080.748] wcscmp (_String1="mrt100.dll", _String2=".") returned 1 [0080.748] wcscmp (_String1="mrt100.dll", _String2="..") returned 1 [0080.748] FindNextFileW (in: hFindFile=0x5ba1570, lpFindFileData=0x393a860 | out: lpFindFileData=0x393a860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2708a61, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb2708a61, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb272ec40, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x382b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mrt100_app.dll", cAlternateFileName="")) returned 1 [0080.748] wcscmp (_String1="mrt100_app.dll", _String2=".") returned 1 [0080.748] wcscmp (_String1="mrt100_app.dll", _String2="..") returned 1 [0080.748] FindNextFileW (in: hFindFile=0x5ba1570, lpFindFileData=0x393a860 | out: lpFindFileData=0x393a860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2708a61, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb2708a61, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb272ec40, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x382b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mrt100_app.dll", cAlternateFileName="")) returned 0 [0080.748] FindClose (in: hFindFile=0x5ba1570 | out: hFindFile=0x5ba1570) returned 1 [0080.749] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393a860) returned 1 [0080.749] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e8670) returned 1 [0080.749] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fac80) returned 1 Thread: id = 604 os_tid = 0x189c [0075.012] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53e8350 [0075.012] wcscpy (in: _Dest=0x53e8350, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe" [0075.012] wcscat (in: _Dest=0x53e8350, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\" [0075.012] wcscat (in: _Dest=0x53e8350, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\*" [0075.012] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393aac8 [0075.012] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x393aac8 | out: lpFindFileData=0x393aac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ff4e801, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaea38daa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5c77f49b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba1530 [0079.136] wcscmp (_String1=".", _String2=".") returned 0 [0079.136] FindNextFileW (in: hFindFile=0x5ba1530, lpFindFileData=0x393aac8 | out: lpFindFileData=0x393aac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ff4e801, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaea38daa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5c77f49b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.136] wcscmp (_String1="..", _String2=".") returned 1 [0079.136] wcscmp (_String1="..", _String2="..") returned 0 [0079.136] FindNextFileW (in: hFindFile=0x5ba1530, lpFindFileData=0x393aac8 | out: lpFindFileData=0x393aac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff4e801, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4ff4e801, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4ff4e801, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x3e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0079.137] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0079.137] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0079.137] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x54f0210 [0079.137] wcscpy (in: _Dest=0x54f0210, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe" [0079.137] wcscat (in: _Dest=0x54f0210, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\" [0079.137] wcscat (in: _Dest=0x54f0210, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" [0080.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f0210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13cc [0080.751] FindNextFileW (in: hFindFile=0x5ba1530, lpFindFileData=0x393aac8 | out: lpFindFileData=0x393aac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff4e801, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4ff4e801, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4ff4e801, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0080.751] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0080.751] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0080.751] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x54bae98 [0080.751] wcscpy (in: _Dest=0x54bae98, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe" [0080.751] wcscat (in: _Dest=0x54bae98, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\" [0080.751] wcscat (in: _Dest=0x54bae98, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" [0080.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bae98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1690 [0080.752] FindNextFileW (in: hFindFile=0x5ba1530, lpFindFileData=0x393aac8 | out: lpFindFileData=0x393aac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ff74b34, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaea3adf2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4ff74b34, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0080.752] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0080.752] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0080.752] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd4) returned 0x5bab360 [0080.752] wcscpy (in: _Dest=0x5bab360, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe" [0080.752] wcscat (in: _Dest=0x5bab360, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\" [0080.752] wcscat (in: _Dest=0x5bab360, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0080.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5bab360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1694 [0080.753] FindNextFileW (in: hFindFile=0x5ba1530, lpFindFileData=0x393aac8 | out: lpFindFileData=0x393aac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff74b34, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4ff74b34, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4ff74b34, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2992, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0080.753] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0080.753] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0080.753] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xde) returned 0x54bbb48 [0080.753] wcscpy (in: _Dest=0x54bbb48, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe" [0080.753] wcscat (in: _Dest=0x54bbb48, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\" [0080.753] wcscat (in: _Dest=0x54bbb48, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" [0080.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bbb48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1698 [0080.754] FindNextFileW (in: hFindFile=0x5ba1530, lpFindFileData=0x393aac8 | out: lpFindFileData=0x393aac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff74b34, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4ff74b34, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4ff74b34, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xfec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="clrcompression.dll", cAlternateFileName="")) returned 1 [0080.754] wcscmp (_String1="clrcompression.dll", _String2=".") returned 1 [0080.754] wcscmp (_String1="clrcompression.dll", _String2="..") returned 1 [0080.754] FindNextFileW (in: hFindFile=0x5ba1530, lpFindFileData=0x393aac8 | out: lpFindFileData=0x393aac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff74b34, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4ff74b34, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4ff74b34, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x203, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0080.754] wcscmp (_String1="logo.png", _String2=".") returned 1 [0080.754] wcscmp (_String1="logo.png", _String2="..") returned 1 [0080.754] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x757f4f0 [0080.754] wcscpy (in: _Dest=0x757f4f0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe" [0080.754] wcscat (in: _Dest=0x757f4f0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\" [0080.754] wcscat (in: _Dest=0x757f4f0, _Source="logo.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\logo.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\logo.png" [0080.754] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x757f4f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x169c [0080.757] FindNextFileW (in: hFindFile=0x5ba1530, lpFindFileData=0x393aac8 | out: lpFindFileData=0x393aac8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5c77f49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xde4445ea, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xde4445ea, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0080.757] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0080.757] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0080.757] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfe) returned 0x7582108 [0080.757] wcscpy (in: _Dest=0x7582108, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe" [0080.757] wcscat (in: _Dest=0x7582108, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\" [0080.757] wcscat (in: _Dest=0x7582108, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0080.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7582108, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16a0 [0080.758] FindNextFileW (in: hFindFile=0x5ba1530, lpFindFileData=0x393aac8 | out: lpFindFileData=0x393aac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff74b34, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4ff74b34, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4ff9ad7e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4dab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mrt100_app.dll", cAlternateFileName="")) returned 1 [0080.758] wcscmp (_String1="mrt100_app.dll", _String2=".") returned 1 [0080.758] wcscmp (_String1="mrt100_app.dll", _String2="..") returned 1 [0080.758] FindNextFileW (in: hFindFile=0x5ba1530, lpFindFileData=0x393aac8 | out: lpFindFileData=0x393aac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff74b34, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4ff74b34, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4ff9ad7e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4dab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mrt100_app.dll", cAlternateFileName="")) returned 0 [0080.758] FindClose (in: hFindFile=0x5ba1530 | out: hFindFile=0x5ba1530) returned 1 [0080.759] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393aac8) returned 1 [0080.759] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e8350) returned 1 [0080.759] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fad48) returned 1 Thread: id = 605 os_tid = 0x18a0 [0075.013] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x3975720 [0075.013] wcscpy (in: _Dest=0x3975720, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe" [0075.013] wcscat (in: _Dest=0x3975720, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\" [0075.013] wcscat (in: _Dest=0x3975720, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\*" [0075.013] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393ad30 [0075.013] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x393ad30 | out: lpFindFileData=0x393ad30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ffc0fdc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaeaf585c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5c58f618, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba16b0 [0079.135] wcscmp (_String1=".", _String2=".") returned 0 [0079.135] FindNextFileW (in: hFindFile=0x5ba16b0, lpFindFileData=0x393ad30 | out: lpFindFileData=0x393ad30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ffc0fdc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaeaf585c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5c58f618, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.135] wcscmp (_String1="..", _String2=".") returned 1 [0079.135] wcscmp (_String1="..", _String2="..") returned 0 [0079.135] FindNextFileW (in: hFindFile=0x5ba16b0, lpFindFileData=0x393ad30 | out: lpFindFileData=0x393ad30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ffc0fdc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4ffc0fdc, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4ffc0fdc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0079.135] wcscmp (_String1="AppxBlockMap.xml", _String2=".") returned 1 [0079.135] wcscmp (_String1="AppxBlockMap.xml", _String2="..") returned 1 [0079.135] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x54f04c8 [0079.135] wcscpy (in: _Dest=0x54f04c8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe" [0079.135] wcscat (in: _Dest=0x54f04c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\" [0079.135] wcscat (in: _Dest=0x54f04c8, _Source="AppxBlockMap.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" [0080.760] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c8 [0080.760] FindNextFileW (in: hFindFile=0x5ba16b0, lpFindFileData=0x393ad30 | out: lpFindFileData=0x393ad30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ffc0fdc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4ffc0fdc, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4ffc0fdc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0080.761] wcscmp (_String1="AppxManifest.xml", _String2=".") returned 1 [0080.761] wcscmp (_String1="AppxManifest.xml", _String2="..") returned 1 [0080.761] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x54bbd18 [0080.761] wcscpy (in: _Dest=0x54bbd18, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe" [0080.761] wcscat (in: _Dest=0x54bbd18, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\" [0080.761] wcscat (in: _Dest=0x54bbd18, _Source="AppxManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" [0080.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bbd18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16a4 [0080.761] FindNextFileW (in: hFindFile=0x5ba16b0, lpFindFileData=0x393ad30 | out: lpFindFileData=0x393ad30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ffc0fdc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaeaf6ce9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4ffc0fdc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0080.761] wcscmp (_String1="AppxMetadata", _String2=".") returned 1 [0080.761] wcscmp (_String1="AppxMetadata", _String2="..") returned 1 [0080.761] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd4) returned 0x5bab440 [0080.761] wcscpy (in: _Dest=0x5bab440, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe" [0080.761] wcscat (in: _Dest=0x5bab440, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\" [0080.761] wcscat (in: _Dest=0x5bab440, _Source="AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxMetadata" [0080.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5bab440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16a8 [0080.762] FindNextFileW (in: hFindFile=0x5ba16b0, lpFindFileData=0x393ad30 | out: lpFindFileData=0x393ad30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ffc0fdc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4ffc0fdc, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4ffc0fdc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2992, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0080.762] wcscmp (_String1="AppxSignature.p7x", _String2=".") returned 1 [0080.762] wcscmp (_String1="AppxSignature.p7x", _String2="..") returned 1 [0080.762] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xde) returned 0x54bbe00 [0080.762] wcscpy (in: _Dest=0x54bbe00, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe" [0080.762] wcscat (in: _Dest=0x54bbe00, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\" [0080.762] wcscat (in: _Dest=0x54bbe00, _Source="AppxSignature.p7x" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" [0080.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bbe00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16ac [0080.763] FindNextFileW (in: hFindFile=0x5ba16b0, lpFindFileData=0x393ad30 | out: lpFindFileData=0x393ad30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ffc0fdc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4ffc0fdc, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4ffc0fdc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xe8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="clrcompression.dll", cAlternateFileName="")) returned 1 [0080.763] wcscmp (_String1="clrcompression.dll", _String2=".") returned 1 [0080.763] wcscmp (_String1="clrcompression.dll", _String2="..") returned 1 [0080.763] FindNextFileW (in: hFindFile=0x5ba16b0, lpFindFileData=0x393ad30 | out: lpFindFileData=0x393ad30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ffc0fdc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4ffc0fdc, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4ffc0fdc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x203, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0080.763] wcscmp (_String1="logo.png", _String2=".") returned 1 [0080.763] wcscmp (_String1="logo.png", _String2="..") returned 1 [0080.763] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x757fe38 [0080.763] wcscpy (in: _Dest=0x757fe38, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe" [0080.763] wcscat (in: _Dest=0x757fe38, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\" [0080.763] wcscat (in: _Dest=0x757fe38, _Source="logo.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\logo.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\logo.png" [0080.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x757fe38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b0 [0080.764] FindNextFileW (in: hFindFile=0x5ba16b0, lpFindFileData=0x393ad30 | out: lpFindFileData=0x393ad30*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5c58f618, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xdefbdb44, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdefbdb44, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0080.764] wcscmp (_String1="microsoft.system.package.metadata", _String2=".") returned 1 [0080.764] wcscmp (_String1="microsoft.system.package.metadata", _String2="..") returned 1 [0080.764] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfe) returned 0x7581298 [0080.764] wcscpy (in: _Dest=0x7581298, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe" [0080.764] wcscat (in: _Dest=0x7581298, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\" [0080.764] wcscat (in: _Dest=0x7581298, _Source="microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0080.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7581298, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b4 [0080.765] FindNextFileW (in: hFindFile=0x5ba16b0, lpFindFileData=0x393ad30 | out: lpFindFileData=0x393ad30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ffc0fdc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4ffc0fdc, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4ffe7226, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x382a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="mrt100_app.dll", cAlternateFileName="")) returned 1 [0080.765] wcscmp (_String1="mrt100_app.dll", _String2=".") returned 1 [0080.765] wcscmp (_String1="mrt100_app.dll", _String2="..") returned 1 [0080.765] FindNextFileW (in: hFindFile=0x5ba16b0, lpFindFileData=0x393ad30 | out: lpFindFileData=0x393ad30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ffc0fdc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4ffc0fdc, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4ffe7226, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x382a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="mrt100_app.dll", cAlternateFileName="")) returned 0 [0080.765] FindClose (in: hFindFile=0x5ba16b0 | out: hFindFile=0x5ba16b0) returned 1 [0080.766] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393ad30) returned 1 [0080.766] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3975720) returned 1 [0080.766] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53faaf0) returned 1 Thread: id = 606 os_tid = 0x18a4 [0075.075] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default user.dat")) returned 0x20 [0082.452] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat", dwFileAttributes=0x20) returned 1 [0082.480] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default user.dat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3b0 [0089.654] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x17e7fad4 | out: lpFileSize=0x17e7fad4*=602320) returned 1 [0089.654] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x930cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.654] ReadFile (in: hFile=0x3b0, lpBuffer=0x17e7fa58, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x17e7fa54, lpOverlapped=0x0 | out: lpBuffer=0x17e7fa58*, lpNumberOfBytesRead=0x17e7fa54*=0x4, lpOverlapped=0x0) returned 1 [0089.655] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.655] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080a60 [0089.655] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0809e8 [0089.655] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080718 [0089.655] NtQuerySystemTime (in: CurrentTime=0x17e7fa34 | out: CurrentTime=0x17e7fa34*=132260136468212429) returned 0x0 [0089.655] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0x8271cfb8 [0089.655] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0x372118b6 [0089.655] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0xe80ddcd7 [0089.655] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0x21d18c02 [0089.655] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0xa5df8772 [0089.655] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0x60674dc0 [0089.655] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0xc60bccc2 [0089.655] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0x8234a924 [0089.655] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0x68c01ef0 [0089.655] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0x707b669f [0089.656] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0x79c5273d [0089.656] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0x8c129cf5 [0089.656] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0x2b4a9f14 [0089.656] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0xbe09d08e [0089.656] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0x6ee9a3c8 [0089.656] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0xd9c5f563 [0089.656] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0x87b3ffec [0089.656] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0xf10b753e [0089.656] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0xb8dd7c92 [0089.656] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0xeb5b4c71 [0089.656] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0xddf1d5b7 [0089.656] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0xf44ecb9f [0089.656] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0xcdaa32aa [0089.656] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0xdbbf0893 [0089.656] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0x56fa47b5 [0089.656] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0x8164633f [0089.656] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0xadfbb64c [0089.656] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0x16d928c [0089.656] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0x51338d6d [0089.656] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0xeb546614 [0089.656] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0x9f23529 [0089.656] RtlRandom (in: Seed=0x17e7fa40 | out: Seed=0x17e7fa40) returned 0x474b29fb [0091.461] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.461] ReadFile (in: hFile=0x3b0, lpBuffer=0x74928c8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x17e7f9ec, lpOverlapped=0x0 | out: lpBuffer=0x74928c8*, lpNumberOfBytesRead=0x17e7f9ec*=0xc800, lpOverlapped=0x0) returned 1 [0091.464] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.464] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8720 [0091.464] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0xe4d0518 [0091.464] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09abb8 [0091.464] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09abb8) returned 1 [0091.465] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x710e9f0 [0091.466] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09acf8 [0091.466] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09ae10 [0091.466] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09ae10) returned 1 [0091.466] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4d0518) returned 1 [0091.466] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8720) returned 1 [0091.466] WriteFile (hFile=0x3b0, lpBuffer=0x710e9f0, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x17e7f9ec, lpOverlapped=0x0) Thread: id = 607 os_tid = 0x18a8 [0075.076] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\FD1HVy.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\fd1hvy.dat")) returned 0x20 [0082.481] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\FD1HVy.dat", dwFileAttributes=0x20) returned 1 [0089.679] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\FD1HVy.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\fd1hvy.dat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb4c [0089.695] GetFileSizeEx (in: hFile=0xb4c, lpFileSize=0x17eff990 | out: lpFileSize=0x17eff990*=0) returned 1 [0089.695] FlushFileBuffers (hFile=0xb4c) returned 1 [0089.698] CloseHandle (hObject=0xb4c) returned 1 [0089.698] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\FD1HVy.dat", dwFileAttributes=0x20) returned 1 [0089.698] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38d0620) returned 1 Thread: id = 608 os_tid = 0x18ac [0075.077] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp")) returned 0x20 [0082.481] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp", dwFileAttributes=0x20) returned 1 [0089.678] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xbbc [0089.696] GetFileSizeEx (in: hFile=0xbbc, lpFileSize=0x17f7fa58 | out: lpFileSize=0x17f7fa58*=602168) returned 1 [0089.696] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0x93034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.696] ReadFile (in: hFile=0xbbc, lpBuffer=0x17f7f9dc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x17f7f9d8, lpOverlapped=0x0 | out: lpBuffer=0x17f7f9dc*, lpNumberOfBytesRead=0x17f7f9d8*=0x4, lpOverlapped=0x0) returned 1 [0089.699] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.699] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080a60 [0089.699] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0806f0 [0089.699] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080718 [0089.699] NtQuerySystemTime (in: CurrentTime=0x17f7f9b8 | out: CurrentTime=0x17f7f9b8*=132260136468525305) returned 0x0 [0089.699] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0x4182d969 [0089.699] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0xa1342def [0089.699] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0x46206a4c [0089.699] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0x7f36a50c [0089.699] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0x6c57e2d0 [0089.699] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0xb6f6ed8f [0089.699] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0xa8aaa8f3 [0089.699] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0x874d99f1 [0089.699] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0x227c96f3 [0089.699] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0xc6f1a716 [0089.699] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0x58292365 [0089.699] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0xbc920b0f [0089.699] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0x5eba0e97 [0089.699] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0xd0eea257 [0089.699] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0x80857d18 [0089.699] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0x3bedcb60 [0089.699] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0x8befb8d8 [0089.699] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0x2e3a8528 [0089.699] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0xe10b1f13 [0089.699] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0x6af4975f [0089.699] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0xbab1d06b [0089.700] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0xcdb50aab [0089.700] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0xacb2d80c [0089.700] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0x2abfd733 [0089.700] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0x10b25468 [0089.700] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0xde387a23 [0089.700] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0xf0645091 [0089.700] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0xbfc8185e [0089.700] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0xf5d64ad9 [0089.700] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0xb2fa19ce [0089.700] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0x59c434b8 [0089.700] RtlRandom (in: Seed=0x17f7f9c4 | out: Seed=0x17f7f9c4) returned 0x17ffc5d3 [0091.454] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.454] ReadFile (in: hFile=0xbbc, lpBuffer=0xe298b08, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x17f7f970, lpOverlapped=0x0 | out: lpBuffer=0xe298b08*, lpNumberOfBytesRead=0x17f7f970*=0xc800, lpOverlapped=0x0) returned 1 [0091.457] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.457] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8720 [0091.457] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0xe4d0518 [0091.457] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080538 [0091.457] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe080538) returned 1 [0091.458] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe30b360 [0091.459] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080538 [0091.459] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09ae10 [0091.459] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09ae10) returned 1 [0091.459] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4d0518) returned 1 [0091.459] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8720) returned 1 [0091.459] WriteFile (hFile=0xbbc, lpBuffer=0xe30b360, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x17f7f970, lpOverlapped=0x0) Thread: id = 609 os_tid = 0x18b0 [0075.078] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.png")) returned 0x20 [0082.481] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png", dwFileAttributes=0x20) returned 1 [0089.823] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xc28 [0089.824] GetFileSizeEx (in: hFile=0xc28, lpFileSize=0x17fff740 | out: lpFileSize=0x17fff740*=5400) returned 1 [0089.824] SetFilePointerEx (in: hFile=0xc28, liDistanceToMove=0x1514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.824] ReadFile (in: hFile=0xc28, lpBuffer=0x17fff6c4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x17fff6c0, lpOverlapped=0x0 | out: lpBuffer=0x17fff6c4*, lpNumberOfBytesRead=0x17fff6c0*=0x4, lpOverlapped=0x0) returned 1 [0089.825] SetFilePointerEx (in: hFile=0xc28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.825] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080718 [0089.825] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080858 [0089.825] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080c18 [0089.825] NtQuerySystemTime (in: CurrentTime=0x17fff6a0 | out: CurrentTime=0x17fff6a0*=132260136469777747) returned 0x0 [0089.825] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0x78f97151 [0089.825] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0x7024ac6 [0089.825] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0xdde75c48 [0089.825] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0x55242be5 [0089.825] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0xe65454ef [0089.825] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0x7aed26b4 [0089.825] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0x7056144 [0089.825] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0xc65ba969 [0089.825] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0xe5775114 [0089.825] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0xd246ede0 [0089.825] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0x6e5cdcf5 [0089.826] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0xbb142ac7 [0089.826] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0xcdf0f06b [0089.826] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0xd49517fd [0089.826] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0xc8d8d32b [0089.826] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0x9e925d62 [0089.826] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0x874b4f06 [0089.826] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0x19db4902 [0089.826] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0x4eccf26e [0089.826] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0xe09da2d [0089.826] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0xeb7aae38 [0089.826] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0x2c0d5a74 [0089.826] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0xd06e5954 [0089.826] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0x91413140 [0089.826] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0x8aaec5af [0089.826] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0x584d0e19 [0089.826] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0x7dc2bdc8 [0089.826] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0xb364a406 [0089.826] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0x9c732cd9 [0089.826] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0x3a7e7cb6 [0089.826] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0x35f84a4 [0089.826] RtlRandom (in: Seed=0x17fff6ac | out: Seed=0x17fff6ac) returned 0xea0b59e5 [0091.447] ReadFile (in: hFile=0xc28, lpBuffer=0xe209280, nNumberOfBytesToRead=0x1518, lpNumberOfBytesRead=0x17fff69c, lpOverlapped=0x0 | out: lpBuffer=0xe209280*, lpNumberOfBytesRead=0x17fff69c*=0x1518, lpOverlapped=0x0) returned 1 [0091.450] SetFilePointerEx (in: hFile=0xc28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.450] WriteFile (hFile=0xc28, lpBuffer=0xe2572c8, nNumberOfBytesToWrite=0x1518, lpNumberOfBytesWritten=0x17fff698, lpOverlapped=0x0) Thread: id = 610 os_tid = 0x18b4 [0075.078] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-192.png")) returned 0x20 [0082.480] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png", dwFileAttributes=0x20) returned 1 [0089.679] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-192.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xc24 [0089.812] GetFileSizeEx (in: hFile=0xc24, lpFileSize=0x1807fc68 | out: lpFileSize=0x1807fc68*=2407) returned 1 [0089.812] SetFilePointerEx (in: hFile=0xc24, liDistanceToMove=0x963, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.812] ReadFile (in: hFile=0xc24, lpBuffer=0x1807fbec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1807fbe8, lpOverlapped=0x0 | out: lpBuffer=0x1807fbec*, lpNumberOfBytesRead=0x1807fbe8*=0x4, lpOverlapped=0x0) returned 1 [0089.813] SetFilePointerEx (in: hFile=0xc24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.813] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080718 [0089.813] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0807b8 [0089.813] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080858 [0089.814] NtQuerySystemTime (in: CurrentTime=0x1807fbc8 | out: CurrentTime=0x1807fbc8*=132260136469777747) returned 0x0 [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0xcd956d4 [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0x7792e7be [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0xa023ae1a [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0xb9d1a0b3 [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0x300c1305 [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0x98b01a2d [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0xe10cdde3 [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0xe663418c [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0x81281d7e [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0x442e3ca7 [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0x782288cb [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0xe44bff40 [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0xfb160dd1 [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0xa8b7834 [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0x24d81ddf [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0xc88f1927 [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0xd1ed9b86 [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0x18b7cad6 [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0xc41d6529 [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0x43ca16fb [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0xcca0aea8 [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0x2070c135 [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0x4d4ce55f [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0xa054b14f [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0xb5dd4d25 [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0x9d343179 [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0x12f7033c [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0x474d83c8 [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0x46ab9888 [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0x277795fd [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0xf457a203 [0089.814] RtlRandom (in: Seed=0x1807fbd4 | out: Seed=0x1807fbd4) returned 0x9e4ed0c9 [0091.451] ReadFile (in: hFile=0xc24, lpBuffer=0xe318b70, nNumberOfBytesToRead=0x967, lpNumberOfBytesRead=0x1807fbc4, lpOverlapped=0x0 | out: lpBuffer=0xe318b70*, lpNumberOfBytesRead=0x1807fbc4*=0x967, lpOverlapped=0x0) returned 1 [0091.452] SetFilePointerEx (in: hFile=0xc24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.452] WriteFile (hFile=0xc24, lpBuffer=0xe325378, nNumberOfBytesToWrite=0x967, lpNumberOfBytesWritten=0x1807fbc0, lpOverlapped=0x0) Thread: id = 611 os_tid = 0x18b8 [0075.079] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-32.png")) returned 0x20 [0082.480] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png", dwFileAttributes=0x20) returned 1 [0089.679] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-32.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb4c [0089.800] GetFileSizeEx (in: hFile=0xb4c, lpFileSize=0x180ffe58 | out: lpFileSize=0x180ffe58*=415) returned 1 [0089.800] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0x19b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.800] ReadFile (in: hFile=0xb4c, lpBuffer=0x180ffddc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x180ffdd8, lpOverlapped=0x0 | out: lpBuffer=0x180ffddc*, lpNumberOfBytesRead=0x180ffdd8*=0x4, lpOverlapped=0x0) returned 1 [0089.801] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.801] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080718 [0089.801] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080a60 [0089.801] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0807b8 [0089.801] NtQuerySystemTime (in: CurrentTime=0x180ffdb8 | out: CurrentTime=0x180ffdb8*=132260136469618932) returned 0x0 [0089.801] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0x43dd1fdb [0089.801] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0xcadaffc2 [0089.802] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0x46be55fe [0089.802] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0x4c146798 [0089.802] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0x110d2f93 [0089.802] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0xc912335a [0089.802] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0x330c0b36 [0089.802] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0x2c0ecedf [0089.802] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0xedc8fed1 [0089.802] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0x55484f90 [0089.802] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0x15fd8628 [0089.802] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0xa9f79809 [0089.802] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0x1fbda260 [0089.802] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0xb7f7567c [0089.802] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0xf307e881 [0089.802] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0x9c84acf0 [0089.802] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0x285589b0 [0089.802] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0xd98b2bb3 [0089.802] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0xe5be1143 [0089.802] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0xe9d091ad [0089.802] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0xbe658dd9 [0089.802] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0x5cb1e64b [0089.802] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0xe90b4bf3 [0089.802] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0xf684a922 [0089.802] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0x2be1c97 [0089.802] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0xb0155720 [0089.802] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0x2b8a5d56 [0089.802] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0xbaeef1dd [0089.802] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0xe263f4d6 [0089.802] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0x48285c4 [0089.802] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0x135da0fa [0089.802] RtlRandom (in: Seed=0x180ffdc4 | out: Seed=0x180ffdc4) returned 0xe90a49d8 [0091.453] ReadFile (in: hFile=0xb4c, lpBuffer=0xe27dae8, nNumberOfBytesToRead=0x19f, lpNumberOfBytesRead=0x180ffdb4, lpOverlapped=0x0 | out: lpBuffer=0xe27dae8*, lpNumberOfBytesRead=0x180ffdb4*=0x19f, lpOverlapped=0x0) returned 1 [0091.453] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.453] WriteFile (hFile=0xb4c, lpBuffer=0xe28a2f0, nNumberOfBytesToWrite=0x19f, lpNumberOfBytesWritten=0x180ffdb0, lpOverlapped=0x0) Thread: id = 612 os_tid = 0x18bc [0075.082] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-40.png")) returned 0x20 [0082.480] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png", dwFileAttributes=0x20) returned 1 [0089.680] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-40.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3ec [0089.683] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x1817f74c | out: lpFileSize=0x1817f74c*=433) returned 1 [0089.683] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x1ad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.683] ReadFile (in: hFile=0x3ec, lpBuffer=0x1817f6d0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1817f6cc, lpOverlapped=0x0 | out: lpBuffer=0x1817f6d0*, lpNumberOfBytesRead=0x1817f6cc*=0x4, lpOverlapped=0x0) returned 1 [0089.684] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.684] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080a60 [0089.684] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080a38 [0089.684] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080718 [0089.684] NtQuerySystemTime (in: CurrentTime=0x1817f6ac | out: CurrentTime=0x1817f6ac*=132260136468368998) returned 0x0 [0089.684] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0xb86cf07e [0089.684] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0x403d6a72 [0089.684] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0x882a6d1d [0089.684] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0x229c4973 [0089.684] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0x1df22218 [0089.684] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0xcb3981da [0089.684] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0xb4b5e34d [0089.684] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0xc4391344 [0089.684] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0x512e8a80 [0089.684] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0x15df33e6 [0089.684] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0x49f3114c [0089.684] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0x30d93a13 [0089.684] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0x3b94095 [0089.684] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0xda2930c [0089.684] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0x84b898e4 [0089.684] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0xdd7cfe1f [0089.684] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0x8adbbc3 [0089.684] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0xb5449239 [0089.684] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0xaf0cb0c6 [0089.684] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0xfc1e05d8 [0089.684] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0x5dbee0de [0089.684] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0xc57631ab [0089.684] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0x1be24e85 [0089.685] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0xaf180b0a [0089.685] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0x928f42bc [0089.685] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0xc7de546a [0089.685] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0xedf95749 [0089.685] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0xb4c0b483 [0089.685] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0xefbc00b0 [0089.685] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0xd87f458f [0089.685] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0x40057b9a [0089.685] RtlRandom (in: Seed=0x1817f6b8 | out: Seed=0x1817f6b8) returned 0x290cbf74 [0091.456] ReadFile (in: hFile=0x3ec, lpBuffer=0xe2a5310, nNumberOfBytesToRead=0x1b1, lpNumberOfBytesRead=0x1817f6a8, lpOverlapped=0x0 | out: lpBuffer=0xe2a5310*, lpNumberOfBytesRead=0x1817f6a8*=0x1b1, lpOverlapped=0x0) returned 1 [0091.457] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.457] WriteFile (hFile=0x3ec, lpBuffer=0xe2feb58, nNumberOfBytesToWrite=0x1b1, lpNumberOfBytesWritten=0x1817f6a4, lpOverlapped=0x0) Thread: id = 613 os_tid = 0x18c0 [0075.083] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-48.png")) returned 0x20 [0075.083] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png", dwFileAttributes=0x20) returned 1 [0075.083] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-48.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xc6c [0075.083] GetFileSizeEx (in: hFile=0xc6c, lpFileSize=0x181ffb68 | out: lpFileSize=0x181ffb68*=501) returned 1 [0075.083] SetFilePointerEx (in: hFile=0xc6c, liDistanceToMove=0x1f1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.083] ReadFile (in: hFile=0xc6c, lpBuffer=0x181ffaec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x181ffae8, lpOverlapped=0x0 | out: lpBuffer=0x181ffaec*, lpNumberOfBytesRead=0x181ffae8*=0x4, lpOverlapped=0x0) returned 1 [0075.084] SetFilePointerEx (in: hFile=0xc6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.084] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5030 [0075.084] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5210 [0075.085] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ef0 [0075.085] NtQuerySystemTime (in: CurrentTime=0x181ffac8 | out: CurrentTime=0x181ffac8*=132260136322398118) returned 0x0 [0075.085] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0xe4be136f [0075.085] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0xc9d835d4 [0075.085] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0x2521028e [0075.085] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0x833252f9 [0075.085] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0x83274070 [0075.085] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0xcbaeb875 [0075.085] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0xc2e6f33 [0075.085] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0x45fc038 [0075.085] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0x8ccd85cd [0075.085] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0x32c2c574 [0075.085] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0x3566bb8 [0075.085] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0xf06ff024 [0075.085] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0x3f093b1a [0075.085] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0xe4e5411d [0075.085] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0x8cfc2c02 [0075.085] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0xae7de65b [0075.085] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0x43176ce9 [0075.085] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0x21063c0e [0075.085] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0x40824931 [0075.085] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0x24fa70c8 [0075.085] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0x923bbb77 [0075.085] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0xa97315ce [0075.085] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0x96485657 [0075.085] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0xe520cf9d [0075.085] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0xd0f9e294 [0075.085] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0x35c779bf [0075.085] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0x1b8ddd95 [0075.085] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0xfde3c34 [0075.085] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0x6bd9c300 [0075.086] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0x45671697 [0075.086] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0x87623106 [0075.086] RtlRandom (in: Seed=0x181ffad4 | out: Seed=0x181ffad4) returned 0xe3b0719b [0075.100] ReadFile (in: hFile=0xc6c, lpBuffer=0x54de000, nNumberOfBytesToRead=0x1f5, lpNumberOfBytesRead=0x181ffac4, lpOverlapped=0x0 | out: lpBuffer=0x54de000*, lpNumberOfBytesRead=0x181ffac4*=0x1f5, lpOverlapped=0x0) returned 1 [0075.100] SetFilePointerEx (in: hFile=0xc6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.101] WriteFile (in: hFile=0xc6c, lpBuffer=0x54ea808*, nNumberOfBytesToWrite=0x1f5, lpNumberOfBytesWritten=0x181ffac0, lpOverlapped=0x0 | out: lpBuffer=0x54ea808*, lpNumberOfBytesWritten=0x181ffac0*=0x1f5, lpOverlapped=0x0) returned 1 [0075.104] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a51c0 [0075.104] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a51e8 [0075.104] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a51e8) returned 1 [0075.104] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54ea808) returned 1 [0075.104] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54de000) returned 1 [0075.104] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5467d28) returned 1 [0075.104] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5ad0) returned 1 [0075.104] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x23) returned 0x38a6ac0 [0075.104] SetFilePointerEx (in: hFile=0xc6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.104] WriteFile (in: hFile=0xc6c, lpBuffer=0x38b8c00*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x181ffb28, lpOverlapped=0x0 | out: lpBuffer=0x38b8c00*, lpNumberOfBytesWritten=0x181ffb28*=0x107, lpOverlapped=0x0) returned 1 [0075.108] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b8c00) returned 1 [0075.108] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6bb0) returned 1 [0075.108] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5030) returned 1 [0075.108] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6ac0) returned 1 [0075.108] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a51c0) returned 1 [0075.108] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5210) returned 1 [0075.108] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a50a8) returned 1 [0075.108] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e78) returned 1 [0075.108] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb6) returned 0x3904de0 [0075.108] wcscpy (in: _Dest=0x3904de0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png" [0075.108] wcscat (in: _Dest=0x3904de0, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png.mailto[knoocknoo@cock.li].a0a70") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png.mailto[knoocknoo@cock.li].a0a70" [0075.108] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x181ffae0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0075.108] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x3973ac0 [0089.825] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3973ac0) returned 1 [0089.835] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3974e88) returned 1 [0089.835] NtQueryInformationFile (in: FileHandle=0xc6c, IoStatusBlock=0x181ffaec, FileInformation=0x181ffac4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x181ffaec, FileInformation=0x181ffac4) returned 0x0 [0089.835] NtSetInformationFile (FileHandle=0xc6c, IoStatusBlock=0x181ffaec, FileInformation=0x181ffac4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.855] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3904de0) returned 1 [0092.855] FlushFileBuffers (hFile=0xc6c) Thread: id = 614 os_tid = 0x18c4 [0075.110] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp")) returned 0x20 [0082.480] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp", dwFileAttributes=0x20) returned 1 [0089.680] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x82c [0089.835] GetFileSizeEx (in: hFile=0x82c, lpFileSize=0x1827fc74 | out: lpFileSize=0x1827fc74*=602168) returned 1 [0089.835] SetFilePointerEx (in: hFile=0x82c, liDistanceToMove=0x93034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.836] ReadFile (in: hFile=0x82c, lpBuffer=0x1827fbf8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1827fbf4, lpOverlapped=0x0 | out: lpBuffer=0x1827fbf8*, lpNumberOfBytesRead=0x1827fbf4*=0x4, lpOverlapped=0x0) returned 1 [0089.837] SetFilePointerEx (in: hFile=0x82c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.837] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080718 [0089.837] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080e70 [0089.837] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080c18 [0089.837] NtQuerySystemTime (in: CurrentTime=0x1827fbd4 | out: CurrentTime=0x1827fbd4*=132260136469931171) returned 0x0 [0089.837] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0xd0fe6589 [0089.837] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0x4fd63abc [0089.837] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0xe538778b [0089.837] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0xa175d281 [0089.837] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0xc1589a8f [0089.837] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0x69d4d995 [0089.837] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0x8f8785ef [0089.837] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0x268c6ed9 [0089.837] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0xf6571ff9 [0089.837] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0xf3cb9db0 [0089.837] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0xf24d81da [0089.837] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0x418acb0a [0089.837] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0x4aa8916a [0089.837] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0xfe671ed9 [0089.837] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0x9731043c [0089.837] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0x364413ef [0089.838] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0xb9397daa [0089.838] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0xd3169ecb [0089.838] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0x3db9b98 [0089.838] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0x2fc2f07c [0089.838] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0x4bbc9c31 [0089.838] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0x6a204c20 [0089.838] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0xb0c43013 [0089.838] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0xed612d9f [0089.838] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0x321e7dab [0089.838] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0x3ea8d6a9 [0089.838] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0xd729411c [0089.838] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0x70eab015 [0089.838] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0x96e02283 [0089.838] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0xd7df3e2e [0089.838] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0x7bd68551 [0089.838] RtlRandom (in: Seed=0x1827fbe0 | out: Seed=0x1827fbe0) returned 0x2dae0f87 [0091.445] SetFilePointerEx (in: hFile=0x82c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.445] ReadFile (in: hFile=0x82c, lpBuffer=0xe1fca78, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1827fb8c, lpOverlapped=0x0 | out: lpBuffer=0xe1fca78*, lpNumberOfBytesRead=0x1827fb8c*=0xc800, lpOverlapped=0x0) returned 1 [0091.448] SetFilePointerEx (in: hFile=0x82c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.448] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8720 [0091.448] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0xe4d0518 [0091.448] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080510 [0091.448] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe080510) returned 1 [0091.449] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe263ad0 [0091.450] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080510 [0091.450] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080538 [0091.450] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe080538) returned 1 [0091.450] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4d0518) returned 1 [0091.450] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8720) returned 1 [0091.450] WriteFile (hFile=0x82c, lpBuffer=0xe263ad0, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1827fb8c, lpOverlapped=0x0) Thread: id = 615 os_tid = 0x18c8 [0075.111] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.png")) returned 0x20 [0075.111] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png", dwFileAttributes=0x20) returned 1 [0075.111] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xc70 [0075.112] GetFileSizeEx (in: hFile=0xc70, lpFileSize=0x182ffb00 | out: lpFileSize=0x182ffb00*=5400) returned 1 [0075.112] SetFilePointerEx (in: hFile=0xc70, liDistanceToMove=0x1514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.112] ReadFile (in: hFile=0xc70, lpBuffer=0x182ffa84, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x182ffa80, lpOverlapped=0x0 | out: lpBuffer=0x182ffa84*, lpNumberOfBytesRead=0x182ffa80*=0x4, lpOverlapped=0x0) returned 1 [0075.113] SetFilePointerEx (in: hFile=0xc70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.113] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5030 [0075.113] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5210 [0075.113] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ef0 [0075.113] NtQuerySystemTime (in: CurrentTime=0x182ffa60 | out: CurrentTime=0x182ffa60*=132260136322709938) returned 0x0 [0075.113] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0xa6a0ee4a [0075.113] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0x31372510 [0075.113] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0xb86852a6 [0075.113] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0xb0686d1a [0075.113] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0x6a937bf6 [0075.113] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0x4384a95e [0075.113] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0xce234aa8 [0075.113] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0x118eea50 [0075.113] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0x8bf9a78a [0075.113] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0x2c411708 [0075.113] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0xd4649da5 [0075.113] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0xb77923fc [0075.113] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0xf4083394 [0075.113] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0x1ef48c2c [0075.113] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0x6bb483f [0075.113] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0x1031eb66 [0075.113] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0xadfa684a [0075.113] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0x72e96bb7 [0075.114] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0xf102b9f2 [0075.114] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0x3f72b2a [0075.114] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0x7e6fb921 [0075.114] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0x2bcfe91c [0075.114] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0x6ed921db [0075.114] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0xe4c1d775 [0075.114] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0xd12e8b0f [0075.114] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0x4e850dbc [0075.114] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0x62b8141d [0075.114] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0xdc5d147b [0075.114] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0x25f16ffd [0075.114] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0xc0bd96ac [0075.114] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0x2a595d1c [0075.114] RtlRandom (in: Seed=0x182ffa6c | out: Seed=0x182ffa6c) returned 0xe9f8c3fe [0075.130] ReadFile (in: hFile=0xc70, lpBuffer=0x54de000, nNumberOfBytesToRead=0x1518, lpNumberOfBytesRead=0x182ffa5c, lpOverlapped=0x0 | out: lpBuffer=0x54de000*, lpNumberOfBytesRead=0x182ffa5c*=0x1518, lpOverlapped=0x0) returned 1 [0075.131] SetFilePointerEx (in: hFile=0xc70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.131] WriteFile (in: hFile=0xc70, lpBuffer=0x54ea808*, nNumberOfBytesToWrite=0x1518, lpNumberOfBytesWritten=0x182ffa58, lpOverlapped=0x0 | out: lpBuffer=0x54ea808*, lpNumberOfBytesWritten=0x182ffa58*=0x1518, lpOverlapped=0x0) returned 1 [0075.134] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a51c0 [0075.134] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a51e8 [0075.134] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a51e8) returned 1 [0075.134] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54ea808) returned 1 [0075.134] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54de000) returned 1 [0075.134] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5467d28) returned 1 [0075.134] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5ad0) returned 1 [0075.134] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d) returned 0x38a51e8 [0075.134] SetFilePointerEx (in: hFile=0xc70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.134] WriteFile (in: hFile=0xc70, lpBuffer=0x38b8c00*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0x182ffac0, lpOverlapped=0x0 | out: lpBuffer=0x38b8c00*, lpNumberOfBytesWritten=0x182ffac0*=0x101, lpOverlapped=0x0) returned 1 [0075.136] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b8c00) returned 1 [0075.136] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4ea0) returned 1 [0075.137] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5030) returned 1 [0075.137] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a51e8) returned 1 [0075.137] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a51c0) returned 1 [0075.137] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5210) returned 1 [0075.137] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a50a8) returned 1 [0075.137] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4e78) returned 1 [0075.137] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x54467b8 [0075.137] wcscpy (in: _Dest=0x54467b8, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png" [0075.137] wcscat (in: _Dest=0x54467b8, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png.mailto[knoocknoo@cock.li].a0a70") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png.mailto[knoocknoo@cock.li].a0a70" [0075.137] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x182ffa78, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0075.137] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x39717e0 [0089.695] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39717e0) returned 1 [0089.695] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3904c60) returned 1 [0089.695] NtQueryInformationFile (in: FileHandle=0xc70, IoStatusBlock=0x182ffa84, FileInformation=0x182ffa5c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x182ffa84, FileInformation=0x182ffa5c) returned 0x0 [0089.695] NtSetInformationFile (FileHandle=0xc70, IoStatusBlock=0x182ffa84, FileInformation=0x182ffa5c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0092.769] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54467b8) returned 1 [0092.769] FlushFileBuffers (hFile=0xc70) Thread: id = 616 os_tid = 0x18cc [0075.147] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CameraIcon_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\cameraicon_contrast-black.png")) returned 0x20 [0082.564] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CameraIcon_contrast-black.png", dwFileAttributes=0x20) returned 0 [0087.470] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CameraIcon_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\cameraicon_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.624] GetLastError () returned 0x5 [0087.624] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CameraIcon_contrast-black.png", dwFileAttributes=0x20) returned 0 [0088.195] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393d690) returned 1 Thread: id = 617 os_tid = 0x18d0 [0075.150] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CameraIcon_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\cameraicon_contrast-white.png")) returned 0x20 [0087.466] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CameraIcon_contrast-white.png", dwFileAttributes=0x20) returned 0 [0087.623] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CameraIcon_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\cameraicon_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.641] GetLastError () returned 0x5 [0087.641] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CameraIcon_contrast-white.png", dwFileAttributes=0x20) returned 0 [0087.642] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393d880) returned 1 Thread: id = 618 os_tid = 0x18d4 [0075.151] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x3971300 [0075.151] wcscpy (in: _Dest=0x3971300, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog" [0075.151] wcscat (in: _Dest=0x3971300, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\" [0075.151] wcscat (in: _Dest=0x3971300, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\*" [0075.151] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393af98 [0075.151] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\*", lpFindFileData=0x393af98 | out: lpFindFileData=0x393af98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96e25227, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a3eee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970877d7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7567548 [0087.466] wcscmp (_String1=".", _String2=".") returned 0 [0087.466] FindNextFileW (hFindFile=0x7567548, lpFindFileData=0x393af98) Thread: id = 619 os_tid = 0x18d8 [0075.152] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x39713d0 [0075.152] wcscpy (in: _Dest=0x39713d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Contrast" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Contrast") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Contrast" [0075.152] wcscat (in: _Dest=0x39713d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\" [0075.152] wcscat (in: _Dest=0x39713d0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\*" [0075.152] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393b200 [0075.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\*", lpFindFileData=0x393b200 | out: lpFindFileData=0x393b200*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a4daf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970ada35, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x75674c8 [0087.464] wcscmp (_String1=".", _String2=".") returned 0 [0087.464] FindNextFileW (hFindFile=0x75674c8, lpFindFileData=0x393b200) Thread: id = 620 os_tid = 0x18dc [0075.153] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x3933d88 [0075.153] wcscpy (in: _Dest=0x3933d88, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black" [0075.153] wcscat (in: _Dest=0x3933d88, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\" [0075.153] wcscat (in: _Dest=0x3933d88, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\*" [0075.153] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393b468 [0075.153] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\*", lpFindFileData=0x393b468 | out: lpFindFileData=0x393b468*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a7570, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970ada35, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7567408 [0087.461] wcscmp (_String1=".", _String2=".") returned 0 [0087.461] FindNextFileW (hFindFile=0x7567408, lpFindFileData=0x393b468) Thread: id = 621 os_tid = 0x18e0 [0075.153] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x3933e68 [0075.153] wcscpy (in: _Dest=0x3933e68, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white" [0075.153] wcscat (in: _Dest=0x3933e68, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\" [0075.154] wcscat (in: _Dest=0x3933e68, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\*" [0075.154] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393b6d0 [0075.154] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\*", lpFindFileData=0x393b6d0 | out: lpFindFileData=0x393b6d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a7e68, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970ada35, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x75673c8 [0087.460] wcscmp (_String1=".", _String2=".") returned 0 [0087.460] FindNextFileW (hFindFile=0x75673c8, lpFindFileData=0x393b6d0) Thread: id = 622 os_tid = 0x18e4 [0075.154] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CubeTile_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\cubetile_contrast-black.png")) returned 0x20 [0087.460] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CubeTile_contrast-black.png", dwFileAttributes=0x20) returned 0 [0087.623] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CubeTile_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\cubetile_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.639] GetLastError () returned 0x5 [0087.639] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CubeTile_contrast-black.png", dwFileAttributes=0x20) returned 0 [0087.639] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b05b8) returned 1 Thread: id = 623 os_tid = 0x18e8 [0075.155] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CubeTile_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\cubetile_contrast-white.png")) returned 0x20 [0087.460] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CubeTile_contrast-white.png", dwFileAttributes=0x20) returned 0 [0087.623] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CubeTile_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\cubetile_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.640] GetLastError () returned 0x5 [0087.640] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CubeTile_contrast-white.png", dwFileAttributes=0x20) returned 0 [0087.640] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b06a8) returned 1 Thread: id = 624 os_tid = 0x18ec [0075.155] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\DarkBlue.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\darkblue.png")) returned 0x20 [0087.460] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\DarkBlue.png", dwFileAttributes=0x20) returned 0 [0087.623] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\DarkBlue.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\darkblue.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.638] GetLastError () returned 0x5 [0087.638] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\DarkBlue.png", dwFileAttributes=0x20) returned 0 [0087.638] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38feec0) returned 1 Thread: id = 625 os_tid = 0x18f0 [0075.155] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\DashboardDefaultThumbnail.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\dashboarddefaultthumbnail.png")) returned 0x20 [0087.459] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\DashboardDefaultThumbnail.png", dwFileAttributes=0x20) returned 0 [0087.622] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\DashboardDefaultThumbnail.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\dashboarddefaultthumbnail.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.635] GetLastError () returned 0x5 [0087.635] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\DashboardDefaultThumbnail.png", dwFileAttributes=0x20) returned 0 [0087.635] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393da70) returned 1 Thread: id = 626 os_tid = 0x18f4 [0075.156] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x39730a0 [0075.156] wcscpy (in: _Dest=0x39730a0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps" [0075.156] wcscat (in: _Dest=0x39730a0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\" [0075.156] wcscat (in: _Dest=0x39730a0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\*" [0075.156] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393b938 [0075.156] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\*", lpFindFileData=0x393b938 | out: lpFindFileData=0x393b938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970d3c8f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9987cd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x972809b4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7567508 [0087.464] wcscmp (_String1=".", _String2=".") returned 0 [0087.465] FindNextFileW (hFindFile=0x7567508, lpFindFileData=0x393b938) Thread: id = 627 os_tid = 0x18f8 [0075.157] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HelpIcon_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\helpicon_contrast-black.png")) returned 0x20 [0087.459] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HelpIcon_contrast-black.png", dwFileAttributes=0x20) returned 0 [0087.617] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HelpIcon_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\helpicon_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.634] GetLastError () returned 0x5 [0087.634] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HelpIcon_contrast-black.png", dwFileAttributes=0x20) returned 0 [0087.634] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b0888) returned 1 Thread: id = 628 os_tid = 0x18fc [0075.157] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HelpIcon_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\helpicon_contrast-white.png")) returned 0x20 [0087.445] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HelpIcon_contrast-white.png", dwFileAttributes=0x20) returned 0 [0087.616] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HelpIcon_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\helpicon_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.633] GetLastError () returned 0x5 [0087.633] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HelpIcon_contrast-white.png", dwFileAttributes=0x20) returned 0 [0087.634] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b0798) returned 1 Thread: id = 629 os_tid = 0x1900 [0075.158] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x39714a0 [0075.158] wcscpy (in: _Dest=0x39714a0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HeroHelp" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HeroHelp") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HeroHelp" [0075.158] wcscat (in: _Dest=0x39714a0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HeroHelp\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HeroHelp\\" [0075.158] wcscat (in: _Dest=0x39714a0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HeroHelp\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HeroHelp\\*" [0075.158] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393bba0 [0075.158] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HeroHelp\\*", lpFindFileData=0x393bba0 | out: lpFindFileData=0x393bba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x972809b4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa998957e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x972da738, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7567448 [0087.462] wcscmp (_String1=".", _String2=".") returned 0 [0087.462] FindNextFileW (hFindFile=0x7567448, lpFindFileData=0x393bba0) Thread: id = 630 os_tid = 0x1904 [0075.159] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LightBlue.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\lightblue.png")) returned 0x20 [0087.444] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LightBlue.png", dwFileAttributes=0x20) returned 0 [0087.616] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LightBlue.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\lightblue.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.632] GetLastError () returned 0x5 [0087.633] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LightBlue.png", dwFileAttributes=0x20) returned 0 [0087.633] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ff4a8) returned 1 Thread: id = 631 os_tid = 0x1908 [0075.159] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIconRTL_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\loadiconrtl_contrast-black.png")) returned 0x20 [0087.444] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIconRTL_contrast-black.png", dwFileAttributes=0x20) returned 0 [0087.616] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIconRTL_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\loadiconrtl_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.632] GetLastError () returned 0x5 [0087.632] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIconRTL_contrast-black.png", dwFileAttributes=0x20) returned 0 [0087.632] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393e138) returned 1 Thread: id = 632 os_tid = 0x190c [0075.160] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIconRTL_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\loadiconrtl_contrast-white.png")) returned 0x20 [0087.429] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIconRTL_contrast-white.png", dwFileAttributes=0x20) returned 0 [0087.616] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIconRTL_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\loadiconrtl_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.631] GetLastError () returned 0x5 [0087.631] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIconRTL_contrast-white.png", dwFileAttributes=0x20) returned 0 [0087.631] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393edd0) returned 1 Thread: id = 633 os_tid = 0x1910 [0075.160] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIcon_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\loadicon_contrast-black.png")) returned 0x20 [0087.429] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIcon_contrast-black.png", dwFileAttributes=0x20) returned 0 [0087.616] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIcon_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\loadicon_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.629] GetLastError () returned 0x5 [0087.629] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIcon_contrast-black.png", dwFileAttributes=0x20) returned 0 [0087.629] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396fb68) returned 1 Thread: id = 634 os_tid = 0x1914 [0075.161] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIcon_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\loadicon_contrast-white.png")) returned 0x20 [0087.428] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIcon_contrast-white.png", dwFileAttributes=0x20) returned 0 [0087.615] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIcon_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\loadicon_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.628] GetLastError () returned 0x5 [0087.628] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIcon_contrast-white.png", dwFileAttributes=0x20) returned 0 [0087.628] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396f7a8) returned 1 Thread: id = 635 os_tid = 0x1918 [0075.161] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x39341e8 [0075.161] wcscpy (in: _Dest=0x39341e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" [0075.161] wcscat (in: _Dest=0x39341e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\" [0075.162] wcscat (in: _Dest=0x39341e8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\*" [0075.162] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393be08 [0075.162] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\*", lpFindFileData=0x393be08 | out: lpFindFileData=0x393be08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97326c19, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa998a0eb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x974a57e1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ec00 [0075.163] wcscmp (_String1=".", _String2=".") returned 0 [0075.163] FindNextFileW (in: hFindFile=0x389ec00, lpFindFileData=0x393be08 | out: lpFindFileData=0x393be08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97326c19, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa998a0eb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x974a57e1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.163] wcscmp (_String1="..", _String2=".") returned 1 [0075.163] wcscmp (_String1="..", _String2="..") returned 0 [0075.163] FindNextFileW (in: hFindFile=0x389ec00, lpFindFileData=0x393be08 | out: lpFindFileData=0x393be08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97326c19, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9a18213, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9739a738, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-black", cAlternateFileName="CONTRA~1")) returned 1 [0075.163] wcscmp (_String1="contrast-black", _String2=".") returned 1 [0075.163] wcscmp (_String1="contrast-black", _String2="..") returned 1 [0075.163] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x393e420 [0075.163] wcscpy (in: _Dest=0x393e420, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" [0075.163] wcscat (in: _Dest=0x393e420, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\" [0075.163] wcscat (in: _Dest=0x393e420, _Source="contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black" [0075.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x393e420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc84 [0075.983] FindNextFileW (in: hFindFile=0x389ec00, lpFindFileData=0x393be08 | out: lpFindFileData=0x393be08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9739a738, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9a9f7f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x974330d0, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0075.983] wcscmp (_String1="contrast-white", _String2=".") returned 1 [0075.983] wcscmp (_String1="contrast-white", _String2="..") returned 1 [0075.983] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x393e800 [0075.983] wcscpy (in: _Dest=0x393e800, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" [0075.983] wcscat (in: _Dest=0x393e800, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\" [0075.983] wcscat (in: _Dest=0x393e800, _Source="contrast-white" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white" [0075.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x393e800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1004 [0075.984] FindNextFileW (in: hFindFile=0x389ec00, lpFindFileData=0x393be08 | out: lpFindFileData=0x393be08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x974330d0, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9745932e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9745932e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xbe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icon.targetsize-16.png", cAlternateFileName="")) returned 1 [0075.984] wcscmp (_String1="Icon.targetsize-16.png", _String2=".") returned 1 [0075.984] wcscmp (_String1="Icon.targetsize-16.png", _String2="..") returned 1 [0075.984] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x550b578 [0075.984] wcscpy (in: _Dest=0x550b578, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" [0075.984] wcscat (in: _Dest=0x550b578, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\" [0075.984] wcscat (in: _Dest=0x550b578, _Source="Icon.targetsize-16.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-16.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-16.png" [0075.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x550b578, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1008 [0075.985] FindNextFileW (in: hFindFile=0x389ec00, lpFindFileData=0x393be08 | out: lpFindFileData=0x393be08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9745932e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9745932e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9745932e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x16f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icon.targetsize-256.png", cAlternateFileName="")) returned 1 [0075.985] wcscmp (_String1="Icon.targetsize-256.png", _String2=".") returned 1 [0075.985] wcscmp (_String1="Icon.targetsize-256.png", _String2="..") returned 1 [0075.985] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfe) returned 0x550b680 [0075.985] wcscpy (in: _Dest=0x550b680, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" [0075.985] wcscat (in: _Dest=0x550b680, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\" [0075.985] wcscat (in: _Dest=0x550b680, _Source="Icon.targetsize-256.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-256.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-256.png" [0075.985] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x550b680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100c [0075.986] FindNextFileW (in: hFindFile=0x389ec00, lpFindFileData=0x393be08 | out: lpFindFileData=0x393be08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9745932e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9745932e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9745932e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xcae, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icon.targetsize-32.png", cAlternateFileName="")) returned 1 [0075.986] wcscmp (_String1="Icon.targetsize-32.png", _String2=".") returned 1 [0075.986] wcscmp (_String1="Icon.targetsize-32.png", _String2="..") returned 1 [0075.986] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x550b998 [0075.986] wcscpy (in: _Dest=0x550b998, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" [0075.986] wcscat (in: _Dest=0x550b998, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\" [0075.986] wcscat (in: _Dest=0x550b998, _Source="Icon.targetsize-32.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-32.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-32.png" [0075.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x550b998, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1010 [0075.987] FindNextFileW (in: hFindFile=0x389ec00, lpFindFileData=0x393be08 | out: lpFindFileData=0x393be08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9745932e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9745932e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9745932e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icon.targetsize-48.png", cAlternateFileName="")) returned 1 [0075.987] wcscmp (_String1="Icon.targetsize-48.png", _String2=".") returned 1 [0075.987] wcscmp (_String1="Icon.targetsize-48.png", _String2="..") returned 1 [0075.987] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x550b788 [0075.987] wcscpy (in: _Dest=0x550b788, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" [0075.987] wcscat (in: _Dest=0x550b788, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\" [0075.987] wcscat (in: _Dest=0x550b788, _Source="Icon.targetsize-48.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-48.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-48.png" [0075.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x550b788, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1014 [0075.988] FindNextFileW (in: hFindFile=0x389ec00, lpFindFileData=0x393be08 | out: lpFindFileData=0x393be08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9745932e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9745932e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9745932e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1833, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.scale-100.png", cAlternateFileName="")) returned 1 [0075.988] wcscmp (_String1="SplashScreen.scale-100.png", _String2=".") returned 1 [0075.988] wcscmp (_String1="SplashScreen.scale-100.png", _String2="..") returned 1 [0075.988] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x104) returned 0x38b9000 [0075.988] wcscpy (in: _Dest=0x38b9000, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" [0075.988] wcscat (in: _Dest=0x38b9000, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\" [0075.988] wcscat (in: _Dest=0x38b9000, _Source="SplashScreen.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\SplashScreen.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\SplashScreen.scale-100.png" [0075.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b9000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1018 [0075.989] FindNextFileW (in: hFindFile=0x389ec00, lpFindFileData=0x393be08 | out: lpFindFileData=0x393be08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9745932e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9745932e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9745932e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1039, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square150x150Logo.scale-100.png", cAlternateFileName="")) returned 1 [0075.989] wcscmp (_String1="Square150x150Logo.scale-100.png", _String2=".") returned 1 [0075.989] wcscmp (_String1="Square150x150Logo.scale-100.png", _String2="..") returned 1 [0075.989] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x38b9110 [0075.989] wcscpy (in: _Dest=0x38b9110, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" [0075.989] wcscat (in: _Dest=0x38b9110, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\" [0075.989] wcscat (in: _Dest=0x38b9110, _Source="Square150x150Logo.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square150x150Logo.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square150x150Logo.scale-100.png" [0075.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b9110, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x101c [0075.990] FindNextFileW (in: hFindFile=0x389ec00, lpFindFileData=0x393be08 | out: lpFindFileData=0x393be08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9745932e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9745932e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9745932e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x10bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square310x150Logo.scale-100.png", cAlternateFileName="")) returned 1 [0075.990] wcscmp (_String1="Square310x150Logo.scale-100.png", _String2=".") returned 1 [0075.990] wcscmp (_String1="Square310x150Logo.scale-100.png", _String2="..") returned 1 [0075.990] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x3979dc0 [0075.990] wcscpy (in: _Dest=0x3979dc0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" [0075.990] wcscat (in: _Dest=0x3979dc0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\" [0075.990] wcscat (in: _Dest=0x3979dc0, _Source="Square310x150Logo.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square310x150Logo.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square310x150Logo.scale-100.png" [0075.990] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3979dc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1020 [0075.991] FindNextFileW (in: hFindFile=0x389ec00, lpFindFileData=0x393be08 | out: lpFindFileData=0x393be08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9745932e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9747f583, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9747f583, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x163f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square310x310Logo.scale-100.png", cAlternateFileName="")) returned 1 [0075.991] wcscmp (_String1="Square310x310Logo.scale-100.png", _String2=".") returned 1 [0075.991] wcscmp (_String1="Square310x310Logo.scale-100.png", _String2="..") returned 1 [0075.991] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x54987e0 [0075.991] wcscpy (in: _Dest=0x54987e0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" [0075.991] wcscat (in: _Dest=0x54987e0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\" [0075.991] wcscat (in: _Dest=0x54987e0, _Source="Square310x310Logo.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square310x310Logo.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square310x310Logo.scale-100.png" [0075.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54987e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1024 [0075.992] FindNextFileW (in: hFindFile=0x389ec00, lpFindFileData=0x393be08 | out: lpFindFileData=0x393be08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9747f583, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9747f583, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9747f583, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xda3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square44x44Logo.scale-100.png", cAlternateFileName="")) returned 1 [0075.992] wcscmp (_String1="Square44x44Logo.scale-100.png", _String2=".") returned 1 [0075.992] wcscmp (_String1="Square44x44Logo.scale-100.png", _String2="..") returned 1 [0075.992] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0x54988f8 [0075.992] wcscpy (in: _Dest=0x54988f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" [0075.992] wcscat (in: _Dest=0x54988f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\" [0075.992] wcscat (in: _Dest=0x54988f8, _Source="Square44x44Logo.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.scale-100.png" [0075.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54988f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1028 [0075.993] FindNextFileW (in: hFindFile=0x389ec00, lpFindFileData=0x393be08 | out: lpFindFileData=0x393be08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9747f583, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9747f583, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9747f583, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xbc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square44x44Logo.targetsize-16.png", cAlternateFileName="")) returned 1 [0075.993] wcscmp (_String1="Square44x44Logo.targetsize-16.png", _String2=".") returned 1 [0075.993] wcscmp (_String1="Square44x44Logo.targetsize-16.png", _String2="..") returned 1 [0075.993] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x5498a10 [0075.993] wcscpy (in: _Dest=0x5498a10, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" [0075.993] wcscat (in: _Dest=0x5498a10, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\" [0075.993] wcscat (in: _Dest=0x5498a10, _Source="Square44x44Logo.targetsize-16.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-16.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-16.png" [0075.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5498a10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x102c [0075.994] FindNextFileW (in: hFindFile=0x389ec00, lpFindFileData=0x393be08 | out: lpFindFileData=0x393be08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9747f583, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9747f583, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9747f583, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xc15, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square44x44Logo.targetsize-16_altform-unplated.png", cAlternateFileName="")) returned 1 [0075.994] wcscmp (_String1="Square44x44Logo.targetsize-16_altform-unplated.png", _String2=".") returned 1 [0075.994] wcscmp (_String1="Square44x44Logo.targetsize-16_altform-unplated.png", _String2="..") returned 1 [0075.994] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x134) returned 0x5498b30 [0075.994] wcscpy (in: _Dest=0x5498b30, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" [0075.994] wcscat (in: _Dest=0x5498b30, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\" [0075.994] wcscat (in: _Dest=0x5498b30, _Source="Square44x44Logo.targetsize-16_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-16_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-16_altform-unplated.png" [0075.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5498b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1030 [0075.995] FindNextFileW (in: hFindFile=0x389ec00, lpFindFileData=0x393be08 | out: lpFindFileData=0x393be08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9747f583, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9747f583, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9747f583, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xc58, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square44x44Logo.targetsize-24.png", cAlternateFileName="")) returned 1 [0075.995] wcscmp (_String1="Square44x44Logo.targetsize-24.png", _String2=".") returned 1 [0075.995] wcscmp (_String1="Square44x44Logo.targetsize-24.png", _String2="..") returned 1 [0075.995] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x5498c70 [0075.995] wcscpy (in: _Dest=0x5498c70, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" [0075.995] wcscat (in: _Dest=0x5498c70, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\" [0075.995] wcscat (in: _Dest=0x5498c70, _Source="Square44x44Logo.targetsize-24.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-24.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-24.png" [0075.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5498c70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1034 [0075.995] FindNextFileW (in: hFindFile=0x389ec00, lpFindFileData=0x393be08 | out: lpFindFileData=0x393be08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9747f583, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9747f583, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9747f583, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xcd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square44x44Logo.targetsize-24_altform-unplated.png", cAlternateFileName="")) returned 1 [0075.995] wcscmp (_String1="Square44x44Logo.targetsize-24_altform-unplated.png", _String2=".") returned 1 [0075.995] wcscmp (_String1="Square44x44Logo.targetsize-24_altform-unplated.png", _String2="..") returned 1 [0075.995] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x134) returned 0x5498d90 [0075.996] wcscpy (in: _Dest=0x5498d90, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" [0075.996] wcscat (in: _Dest=0x5498d90, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\" [0075.996] wcscat (in: _Dest=0x5498d90, _Source="Square44x44Logo.targetsize-24_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-24_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-24_altform-unplated.png" [0075.996] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5498d90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1038 [0075.996] FindNextFileW (in: hFindFile=0x389ec00, lpFindFileData=0x393be08 | out: lpFindFileData=0x393be08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9747f583, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9747f583, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9747f583, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1a2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square44x44Logo.targetsize-256.png", cAlternateFileName="")) returned 1 [0075.996] wcscmp (_String1="Square44x44Logo.targetsize-256.png", _String2=".") returned 1 [0075.996] wcscmp (_String1="Square44x44Logo.targetsize-256.png", _String2="..") returned 1 [0075.996] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x114) returned 0x5498ed0 [0075.996] wcscpy (in: _Dest=0x5498ed0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" [0075.996] wcscat (in: _Dest=0x5498ed0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\" [0075.996] wcscat (in: _Dest=0x5498ed0, _Source="Square44x44Logo.targetsize-256.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-256.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-256.png" [0075.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5498ed0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x103c [0075.997] FindNextFileW (in: hFindFile=0x389ec00, lpFindFileData=0x393be08 | out: lpFindFileData=0x393be08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x974a57e1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x974a57e1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x974a57e1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x203b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square44x44Logo.targetsize-256_altform-unplated.png", cAlternateFileName="")) returned 1 [0075.997] wcscmp (_String1="Square44x44Logo.targetsize-256_altform-unplated.png", _String2=".") returned 1 [0075.997] wcscmp (_String1="Square44x44Logo.targetsize-256_altform-unplated.png", _String2="..") returned 1 [0075.997] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x136) returned 0x5498ff0 [0075.997] wcscpy (in: _Dest=0x5498ff0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" [0075.997] wcscat (in: _Dest=0x5498ff0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\" [0075.997] wcscat (in: _Dest=0x5498ff0, _Source="Square44x44Logo.targetsize-256_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-256_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-256_altform-unplated.png" [0075.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5498ff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1040 [0075.998] FindNextFileW (in: hFindFile=0x389ec00, lpFindFileData=0x393be08 | out: lpFindFileData=0x393be08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x974a57e1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x974a57e1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x974a57e1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xdbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square44x44Logo.targetsize-48.png", cAlternateFileName="")) returned 1 [0075.998] wcscmp (_String1="Square44x44Logo.targetsize-48.png", _String2=".") returned 1 [0075.998] wcscmp (_String1="Square44x44Logo.targetsize-48.png", _String2="..") returned 1 [0075.998] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x5499130 [0075.998] wcscpy (in: _Dest=0x5499130, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" [0075.998] wcscat (in: _Dest=0x5499130, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\" [0075.998] wcscat (in: _Dest=0x5499130, _Source="Square44x44Logo.targetsize-48.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-48.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-48.png" [0075.998] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5499130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1044 [0075.999] FindNextFileW (in: hFindFile=0x389ec00, lpFindFileData=0x393be08 | out: lpFindFileData=0x393be08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x974a57e1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x974a57e1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x974a57e1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xe7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square44x44Logo.targetsize-48_altform-unplated.png", cAlternateFileName="")) returned 1 [0075.999] wcscmp (_String1="Square44x44Logo.targetsize-48_altform-unplated.png", _String2=".") returned 1 [0075.999] wcscmp (_String1="Square44x44Logo.targetsize-48_altform-unplated.png", _String2="..") returned 1 [0075.999] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x134) returned 0x5499250 [0075.999] wcscpy (in: _Dest=0x5499250, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" [0075.999] wcscat (in: _Dest=0x5499250, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\" [0075.999] wcscat (in: _Dest=0x5499250, _Source="Square44x44Logo.targetsize-48_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-48_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-48_altform-unplated.png" [0075.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5499250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1048 [0076.000] FindNextFileW (in: hFindFile=0x389ec00, lpFindFileData=0x393be08 | out: lpFindFileData=0x393be08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x974a57e1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x974a57e1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x974a57e1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xe34, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square71x71Logo.scale-100.png", cAlternateFileName="")) returned 1 [0076.000] wcscmp (_String1="Square71x71Logo.scale-100.png", _String2=".") returned 1 [0076.000] wcscmp (_String1="Square71x71Logo.scale-100.png", _String2="..") returned 1 [0076.000] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0x5499390 [0076.000] wcscpy (in: _Dest=0x5499390, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" [0076.000] wcscat (in: _Dest=0x5499390, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\" [0076.000] wcscat (in: _Dest=0x5499390, _Source="Square71x71Logo.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square71x71Logo.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square71x71Logo.scale-100.png" [0076.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5499390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104c [0076.001] FindNextFileW (in: hFindFile=0x389ec00, lpFindFileData=0x393be08 | out: lpFindFileData=0x393be08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x974a57e1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x974a57e1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x974a57e1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xdcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.scale-100.png", cAlternateFileName="")) returned 1 [0076.001] wcscmp (_String1="StoreLogo.scale-100.png", _String2=".") returned 1 [0076.001] wcscmp (_String1="StoreLogo.scale-100.png", _String2="..") returned 1 [0076.001] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfe) returned 0x550b890 [0076.001] wcscpy (in: _Dest=0x550b890, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets" [0076.001] wcscat (in: _Dest=0x550b890, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\" [0076.001] wcscat (in: _Dest=0x550b890, _Source="StoreLogo.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\StoreLogo.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\StoreLogo.scale-100.png" [0076.001] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x550b890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1050 [0076.002] FindNextFileW (in: hFindFile=0x389ec00, lpFindFileData=0x393be08 | out: lpFindFileData=0x393be08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x974a57e1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x974a57e1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x974a57e1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xdcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.scale-100.png", cAlternateFileName="")) returned 0 [0076.002] FindClose (in: hFindFile=0x389ec00 | out: hFindFile=0x389ec00) returned 1 [0076.003] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393be08) returned 1 [0076.003] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39341e8) returned 1 [0076.003] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ff2f8) returned 1 Thread: id = 636 os_tid = 0x191c [0075.164] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\MediumBlue.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\mediumblue.png")) returned 0x20 [0087.427] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\MediumBlue.png", dwFileAttributes=0x20) returned 0 [0087.615] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\MediumBlue.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\mediumblue.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.627] GetLastError () returned 0x5 [0087.627] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\MediumBlue.png", dwFileAttributes=0x20) returned 0 [0087.627] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ff3d0) returned 1 Thread: id = 637 os_tid = 0x1920 [0075.164] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x3971570 [0075.164] wcscpy (in: _Dest=0x3971570, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office" [0075.164] wcscat (in: _Dest=0x3971570, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\" [0075.164] wcscat (in: _Dest=0x3971570, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\*" [0075.164] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393c070 [0075.165] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\*", lpFindFileData=0x393c070 | out: lpFindFileData=0x393c070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x974a57e1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9aa16f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x975664ea, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7567388 [0087.429] wcscmp (_String1=".", _String2=".") returned 0 [0087.429] FindNextFileW (hFindFile=0x7567388, lpFindFileData=0x393c070) Thread: id = 638 os_tid = 0x1924 [0075.165] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x3971710 [0075.165] wcscpy (in: _Dest=0x3971710, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Resources" [0075.165] wcscat (in: _Dest=0x3971710, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Resources\\" [0075.165] wcscat (in: _Dest=0x3971710, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Resources\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Resources\\*" [0075.165] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393c2d8 [0075.165] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Resources\\*", lpFindFileData=0x393c2d8 | out: lpFindFileData=0x393c2d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x975664ea, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9aa22bd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9758c747, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7567348 [0087.426] wcscmp (_String1=".", _String2=".") returned 0 [0087.426] FindNextFileW (hFindFile=0x7567348, lpFindFileData=0x393c2d8) Thread: id = 639 os_tid = 0x1928 [0075.166] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\ScanIcon_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\scanicon_contrast-black.png")) returned 0x20 [0087.427] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\ScanIcon_contrast-black.png", dwFileAttributes=0x20) returned 0 [0087.615] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\ScanIcon_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\scanicon_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.626] GetLastError () returned 0x5 [0087.626] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\ScanIcon_contrast-black.png", dwFileAttributes=0x20) returned 0 [0087.626] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396fc58) returned 1 Thread: id = 640 os_tid = 0x192c [0075.166] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\ScanIcon_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\scanicon_contrast-white.png")) returned 0x20 [0087.426] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\ScanIcon_contrast-white.png", dwFileAttributes=0x20) returned 0 [0087.615] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\ScanIcon_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\scanicon_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.625] GetLastError () returned 0x5 [0087.625] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\ScanIcon_contrast-white.png", dwFileAttributes=0x20) returned 0 [0087.625] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396e998) returned 1 Thread: id = 641 os_tid = 0x1930 [0075.167] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x39343a8 [0075.167] wcscpy (in: _Dest=0x39343a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps" [0075.167] wcscat (in: _Dest=0x39343a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\" [0075.167] wcscat (in: _Dest=0x39343a8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\*" [0075.167] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393c540 [0075.167] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\*", lpFindFileData=0x393c540 | out: lpFindFileData=0x393c540*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x975d8bfa, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9b12d9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9764f8c5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7567748 [0087.646] wcscmp (_String1=".", _String2=".") returned 0 [0087.646] FindNextFileW (hFindFile=0x7567748, lpFindFileData=0x393c540) Thread: id = 642 os_tid = 0x1934 [0075.167] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x39718b0 [0075.167] wcscpy (in: _Dest=0x39718b0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow" [0075.168] wcscat (in: _Dest=0x39718b0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\" [0075.168] wcscat (in: _Dest=0x39718b0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\*" [0075.168] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393c7a8 [0075.168] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\*", lpFindFileData=0x393c7a8 | out: lpFindFileData=0x393c7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9764f8c5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9b67c1d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x976e822e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7567488 [0087.462] wcscmp (_String1=".", _String2=".") returned 0 [0087.462] FindNextFileW (hFindFile=0x7567488, lpFindFileData=0x393c7a8) Thread: id = 643 os_tid = 0x1938 [0075.171] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0085.998] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0087.613] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.646] GetLastError () returned 0x5 [0087.646] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0089.520] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38af0b8) returned 1 Thread: id = 644 os_tid = 0x193c [0075.172] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxmanifest.xml")) Thread: id = 645 os_tid = 0x1940 [0075.176] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxsignature.p7x")) Thread: id = 646 os_tid = 0x1944 [0075.176] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfe) returned 0x3978b30 [0075.177] wcscpy (in: _Dest=0x3978b30, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0075.177] wcscat (in: _Dest=0x3978b30, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0075.177] wcscat (in: _Dest=0x3978b30, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\*" [0075.177] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393ca10 [0075.177] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x393ca10 | out: lpFindFileData=0x393ca10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x391eadfd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabe0794e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3925d50d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e840 [0086.005] wcscmp (_String1=".", _String2=".") returned 0 [0086.005] FindNextFileW (in: hFindFile=0x389e840, lpFindFileData=0x393ca10 | out: lpFindFileData=0x393ca10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x391eadfd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabe0794e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3925d50d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.005] wcscmp (_String1="..", _String2=".") returned 1 [0086.005] wcscmp (_String1="..", _String2="..") returned 0 [0086.005] FindNextFileW (in: hFindFile=0x389e840, lpFindFileData=0x393ca10 | out: lpFindFileData=0x393ca10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x391eadfd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x391eadfd, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x391eadfd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x5415, dwReserved0=0x0, dwReserved1=0x0, cFileName="ads_win10_300x250.scale-100.jpg", cAlternateFileName="")) returned 1 [0086.005] wcscmp (_String1="ads_win10_300x250.scale-100.jpg", _String2=".") returned 1 [0086.005] wcscmp (_String1="ads_win10_300x250.scale-100.jpg", _String2="..") returned 1 [0086.005] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x13a) returned 0x758ae88 [0086.005] wcscpy (in: _Dest=0x758ae88, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0086.005] wcscat (in: _Dest=0x758ae88, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0086.005] wcscat (in: _Dest=0x758ae88, _Source="ads_win10_300x250.scale-100.jpg" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\ads_win10_300x250.scale-100.jpg") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\ads_win10_300x250.scale-100.jpg" [0088.674] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x758ae88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c84 [0088.675] FindNextFileW (in: hFindFile=0x389e840, lpFindFileData=0x393ca10 | out: lpFindFileData=0x393ca10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x391eadfd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x39211056, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x39211056, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4c2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ads_win10_728x90.scale-100.jpg", cAlternateFileName="")) returned 1 [0088.675] wcscmp (_String1="ads_win10_728x90.scale-100.jpg", _String2=".") returned 1 [0088.675] wcscmp (_String1="ads_win10_728x90.scale-100.jpg", _String2="..") returned 1 [0088.675] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x138) returned 0x758abf8 [0088.675] wcscpy (in: _Dest=0x758abf8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0088.675] wcscat (in: _Dest=0x758abf8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0088.675] wcscat (in: _Dest=0x758abf8, _Source="ads_win10_728x90.scale-100.jpg" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\ads_win10_728x90.scale-100.jpg") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\ads_win10_728x90.scale-100.jpg" [0088.675] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x758abf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ebc [0088.676] FindNextFileW (in: hFindFile=0x389e840, lpFindFileData=0x393ca10 | out: lpFindFileData=0x393ca10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39211056, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabe5a941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x392372b0, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Livetiles", cAlternateFileName="LIVETI~1")) returned 1 [0088.676] wcscmp (_String1="Livetiles", _String2=".") returned 1 [0088.676] wcscmp (_String1="Livetiles", _String2="..") returned 1 [0088.676] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x74b1648 [0088.676] wcscpy (in: _Dest=0x74b1648, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0088.676] wcscat (in: _Dest=0x74b1648, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0088.676] wcscat (in: _Dest=0x74b1648, _Source="Livetiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Livetiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Livetiles" [0088.676] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x74b1648, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c4 [0088.676] FindNextFileW (in: hFindFile=0x389e840, lpFindFileData=0x393ca10 | out: lpFindFileData=0x393ca10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3925d50d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3925d50d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3925d50d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1210, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.scale-100.png", cAlternateFileName="")) returned 1 [0088.677] wcscmp (_String1="SplashScreen.scale-100.png", _String2=".") returned 1 [0088.677] wcscmp (_String1="SplashScreen.scale-100.png", _String2="..") returned 1 [0088.677] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x130) returned 0x5ba1d18 [0088.677] wcscpy (in: _Dest=0x5ba1d18, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0088.677] wcscat (in: _Dest=0x5ba1d18, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0088.677] wcscat (in: _Dest=0x5ba1d18, _Source="SplashScreen.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\SplashScreen.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\SplashScreen.scale-100.png" [0088.677] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba1d18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1efc [0088.677] FindNextFileW (in: hFindFile=0x389e840, lpFindFileData=0x393ca10 | out: lpFindFileData=0x393ca10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3925d50d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3925d50d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3925d50d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1210, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.scale-100.png", cAlternateFileName="")) returned 0 [0088.677] FindClose (in: hFindFile=0x389e840 | out: hFindFile=0x389e840) returned 1 [0088.677] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393ca10) returned 1 [0088.678] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3978b30) Thread: id = 647 os_tid = 0x1948 [0075.177] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x134) returned 0x3978d48 [0075.177] wcscpy (in: _Dest=0x3978d48, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata" [0075.177] wcscat (in: _Dest=0x3978d48, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0075.177] wcscat (in: _Dest=0x3978d48, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0075.178] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393cc78 [0075.178] FindFirstFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x393cc78) Thread: id = 648 os_tid = 0x194c [0075.178] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri")) Thread: id = 649 os_tid = 0x1950 [0075.252] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\BrandingLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\brandinglogo.png")) returned 0x20 [0081.251] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\BrandingLogo.png", dwFileAttributes=0x20) returned 0 [0081.251] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\BrandingLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\brandinglogo.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0081.251] GetLastError () returned 0x5 [0081.251] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\BrandingLogo.png", dwFileAttributes=0x20) returned 0 [0081.251] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38cee30) returned 1 Thread: id = 650 os_tid = 0x1954 [0075.261] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\logo.scale-100.png")) returned 0x20 [0089.930] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Logo.scale-100.png", dwFileAttributes=0x20) returned 0 [0089.930] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\logo.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.930] GetLastError () returned 0x5 [0089.930] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Logo.scale-100.png", dwFileAttributes=0x20) returned 0 [0089.930] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396e6c8) returned 1 Thread: id = 651 os_tid = 0x1958 [0075.262] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\smalllogo.scale-100.png")) returned 0x20 [0089.931] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.scale-100.png", dwFileAttributes=0x20) returned 0 [0089.931] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\smalllogo.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.931] GetLastError () returned 0x5 [0089.931] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.scale-100.png", dwFileAttributes=0x20) returned 0 [0089.931] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393d978) returned 1 Thread: id = 652 os_tid = 0x195c [0075.263] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\smalllogo.targetsize-16.png")) returned 0x20 [0089.929] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-16.png", dwFileAttributes=0x20) returned 0 [0089.929] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\smalllogo.targetsize-16.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.929] GetLastError () returned 0x5 [0089.929] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-16.png", dwFileAttributes=0x20) returned 0 [0089.929] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fcf80) returned 1 Thread: id = 653 os_tid = 0x1960 [0075.264] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\smalllogo.targetsize-24.png")) returned 0x20 [0089.929] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-24.png", dwFileAttributes=0x20) returned 0 [0089.929] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\smalllogo.targetsize-24.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.929] GetLastError () returned 0x5 [0089.929] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-24.png", dwFileAttributes=0x20) returned 0 [0089.929] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fd798) returned 1 Thread: id = 654 os_tid = 0x1964 [0075.265] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\smalllogo.targetsize-256.png")) returned 0x20 [0089.928] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-256.png", dwFileAttributes=0x20) returned 0 [0089.928] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\smalllogo.targetsize-256.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.928] GetLastError () returned 0x5 [0089.928] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-256.png", dwFileAttributes=0x20) returned 0 [0089.928] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fd898) returned 1 Thread: id = 655 os_tid = 0x1968 [0075.266] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\smalllogo.targetsize-48.png")) returned 0x20 [0089.928] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-48.png", dwFileAttributes=0x20) returned 0 [0089.928] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\smalllogo.targetsize-48.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.928] GetLastError () returned 0x5 [0089.928] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-48.png", dwFileAttributes=0x20) returned 0 [0089.928] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fd998) returned 1 Thread: id = 656 os_tid = 0x196c [0075.270] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\splashscreen.scale-100.png")) returned 0x20 [0087.664] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen.scale-100.png", dwFileAttributes=0x20) returned 0 [0089.932] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\splashscreen.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.932] GetLastError () returned 0x5 [0089.932] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen.scale-100.png", dwFileAttributes=0x20) returned 0 [0089.932] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fda98) returned 1 Thread: id = 657 os_tid = 0x1970 [0075.271] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Square310x310Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\square310x310logo.scale-100.png")) returned 0x20 [0091.517] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Square310x310Logo.scale-100.png", dwFileAttributes=0x20) returned 0 [0091.517] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Square310x310Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\square310x310logo.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.518] GetLastError () returned 0x5 [0091.518] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Square310x310Logo.scale-100.png", dwFileAttributes=0x20) returned 0 [0091.518] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fdb98) returned 1 Thread: id = 658 os_tid = 0x1974 [0075.272] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Square71x71Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\square71x71logo.scale-100.png")) returned 0x20 [0091.423] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Square71x71Logo.scale-100.png", dwFileAttributes=0x20) returned 0 [0091.424] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Square71x71Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\square71x71logo.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.424] GetLastError () returned 0x5 [0091.424] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Square71x71Logo.scale-100.png", dwFileAttributes=0x20) returned 0 [0091.424] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fdca0) returned 1 Thread: id = 659 os_tid = 0x1978 [0075.273] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\StoreLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\storelogo.scale-100.png")) returned 0x20 [0089.927] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\StoreLogo.scale-100.png", dwFileAttributes=0x20) returned 0 [0089.927] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\StoreLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\storelogo.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.927] GetLastError () returned 0x5 [0089.927] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\StoreLogo.scale-100.png", dwFileAttributes=0x20) returned 0 [0089.927] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393eae8) returned 1 Thread: id = 660 os_tid = 0x197c [0075.274] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Wide310x150Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\wide310x150logo.scale-100.png")) returned 0x20 [0089.925] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Wide310x150Logo.scale-100.png", dwFileAttributes=0x20) returned 0 [0089.925] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Wide310x150Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\wide310x150logo.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.925] GetLastError () returned 0x5 [0089.925] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Wide310x150Logo.scale-100.png", dwFileAttributes=0x20) returned 0 [0089.925] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a3900) returned 1 Thread: id = 661 os_tid = 0x1980 [0075.274] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0077.726] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0077.726] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0077.726] GetLastError () returned 0x5 [0077.727] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0077.727] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fdda0) returned 1 Thread: id = 662 os_tid = 0x1984 [0075.279] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0086.004] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0086.004] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.004] GetLastError () returned 0x5 [0086.004] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0086.004] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fdea8) returned 1 Thread: id = 663 os_tid = 0x1988 [0075.281] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxsignature.p7x")) Thread: id = 664 os_tid = 0x198c [0075.282] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x393f2a8 [0075.283] wcscpy (in: _Dest=0x393f2a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0075.283] wcscat (in: _Dest=0x393f2a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0075.283] wcscat (in: _Dest=0x393f2a8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\*" [0075.283] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393cee0 [0075.283] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x393cee0 | out: lpFindFileData=0x393cee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d2bc66a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab13f343, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d32ed7f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445740 [0082.551] wcscmp (_String1=".", _String2=".") returned 0 [0082.551] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x393cee0 | out: lpFindFileData=0x393cee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d2bc66a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab13f343, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d32ed7f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.552] wcscmp (_String1="..", _String2=".") returned 1 [0082.552] wcscmp (_String1="..", _String2="..") returned 0 [0082.552] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x393cee0 | out: lpFindFileData=0x393cee0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d2bc66a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9d2bc66a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9d2bc66a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x123, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.scale-100.png", cAlternateFileName="")) returned 1 [0082.552] wcscmp (_String1="AppPackageAppList.scale-100.png", _String2=".") returned 1 [0082.552] wcscmp (_String1="AppPackageAppList.scale-100.png", _String2="..") returned 1 [0082.552] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x128) returned 0x7586418 [0082.552] wcscpy (in: _Dest=0x7586418, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0082.552] wcscat (in: _Dest=0x7586418, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0082.552] wcscat (in: _Dest=0x7586418, _Source="AppPackageAppList.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageAppList.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageAppList.scale-100.png" [0082.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7586418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ee0 [0082.552] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x393cee0 | out: lpFindFileData=0x393cee0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d2bc66a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9d2bc66a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9d2bc66a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageBadgeLogo.scale-100.png", cAlternateFileName="")) returned 1 [0082.552] wcscmp (_String1="AppPackageBadgeLogo.scale-100.png", _String2=".") returned 1 [0082.552] wcscmp (_String1="AppPackageBadgeLogo.scale-100.png", _String2="..") returned 1 [0082.553] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12c) returned 0x7587db0 [0082.553] wcscpy (in: _Dest=0x7587db0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0082.553] wcscat (in: _Dest=0x7587db0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0082.553] wcscat (in: _Dest=0x7587db0, _Source="AppPackageBadgeLogo.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageBadgeLogo.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageBadgeLogo.scale-100.png" [0082.553] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7587db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ee4 [0082.553] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x393cee0 | out: lpFindFileData=0x393cee0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d2e28c8, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9d2e28c8, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9d2e28c8, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageLargeTile.scale-100.png", cAlternateFileName="")) returned 1 [0082.553] wcscmp (_String1="AppPackageLargeTile.scale-100.png", _String2=".") returned 1 [0082.553] wcscmp (_String1="AppPackageLargeTile.scale-100.png", _String2="..") returned 1 [0082.553] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12c) returned 0x7587ee8 [0082.554] wcscpy (in: _Dest=0x7587ee8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0082.554] wcscat (in: _Dest=0x7587ee8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0082.554] wcscat (in: _Dest=0x7587ee8, _Source="AppPackageLargeTile.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageLargeTile.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageLargeTile.scale-100.png" [0082.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7587ee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ee8 [0082.554] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x393cee0 | out: lpFindFileData=0x393cee0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d2e28c8, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9d2e28c8, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9d2e28c8, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageMedTile.scale-100.png", cAlternateFileName="")) returned 1 [0082.554] wcscmp (_String1="AppPackageMedTile.scale-100.png", _String2=".") returned 1 [0082.554] wcscmp (_String1="AppPackageMedTile.scale-100.png", _String2="..") returned 1 [0082.554] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x128) returned 0x75873f0 [0082.554] wcscpy (in: _Dest=0x75873f0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0082.554] wcscat (in: _Dest=0x75873f0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0082.554] wcscat (in: _Dest=0x75873f0, _Source="AppPackageMedTile.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageMedTile.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageMedTile.scale-100.png" [0082.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x75873f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1eec [0082.555] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x393cee0 | out: lpFindFileData=0x393cee0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d2e28c8, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9d2e28c8, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9d2e28c8, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x166, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageSmallTile.scale-100.png", cAlternateFileName="")) returned 1 [0082.555] wcscmp (_String1="AppPackageSmallTile.scale-100.png", _String2=".") returned 1 [0082.555] wcscmp (_String1="AppPackageSmallTile.scale-100.png", _String2="..") returned 1 [0082.555] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12c) returned 0x7586550 [0082.555] wcscpy (in: _Dest=0x7586550, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0082.555] wcscat (in: _Dest=0x7586550, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0082.555] wcscat (in: _Dest=0x7586550, _Source="AppPackageSmallTile.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageSmallTile.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageSmallTile.scale-100.png" [0082.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7586550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ef0 [0082.556] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x393cee0 | out: lpFindFileData=0x393cee0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d2e28c8, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9d2e28c8, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9d2e28c8, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageSplashScreen.scale-100.png", cAlternateFileName="")) returned 1 [0082.556] wcscmp (_String1="AppPackageSplashScreen.scale-100.png", _String2=".") returned 1 [0082.556] wcscmp (_String1="AppPackageSplashScreen.scale-100.png", _String2="..") returned 1 [0082.556] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x132) returned 0x546dff8 [0086.002] wcscpy (in: _Dest=0x546dff8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0086.002] wcscat (in: _Dest=0x546dff8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0086.002] wcscat (in: _Dest=0x546dff8, _Source="AppPackageSplashScreen.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageSplashScreen.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageSplashScreen.scale-100.png" [0088.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x546dff8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ec4 [0088.680] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x393cee0 | out: lpFindFileData=0x393cee0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d2e28c8, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9d2e28c8, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9d2e28c8, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x13d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageStoreLogo.scale-100.png", cAlternateFileName="")) returned 1 [0088.680] wcscmp (_String1="AppPackageStoreLogo.scale-100.png", _String2=".") returned 1 [0088.680] wcscmp (_String1="AppPackageStoreLogo.scale-100.png", _String2="..") returned 1 [0088.680] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12c) returned 0x5ba1358 [0088.680] wcscpy (in: _Dest=0x5ba1358, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0088.680] wcscat (in: _Dest=0x5ba1358, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0088.680] wcscat (in: _Dest=0x5ba1358, _Source="AppPackageStoreLogo.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageStoreLogo.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageStoreLogo.scale-100.png" [0088.680] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba1358, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1998 [0088.680] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x393cee0 | out: lpFindFileData=0x393cee0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d308b21, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9d308b21, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9d308b21, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageWideTile.scale-100.png", cAlternateFileName="")) returned 1 [0088.680] wcscmp (_String1="AppPackageWideTile.scale-100.png", _String2=".") returned 1 [0088.680] wcscmp (_String1="AppPackageWideTile.scale-100.png", _String2="..") returned 1 [0088.680] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12a) returned 0x5ba1490 [0088.680] wcscpy (in: _Dest=0x5ba1490, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0088.680] wcscat (in: _Dest=0x5ba1490, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0088.680] wcscat (in: _Dest=0x5ba1490, _Source="AppPackageWideTile.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageWideTile.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageWideTile.scale-100.png" [0088.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba1490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1990 [0088.681] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x393cee0 | out: lpFindFileData=0x393cee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d308b21, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab1ce307, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d32ed7f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-black", cAlternateFileName="CONTRA~1")) returned 1 [0088.681] wcscmp (_String1="contrast-black", _String2=".") returned 1 [0088.681] wcscmp (_String1="contrast-black", _String2="..") returned 1 [0088.681] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x74b1f08 [0088.681] wcscpy (in: _Dest=0x74b1f08, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0088.681] wcscat (in: _Dest=0x74b1f08, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0088.681] wcscat (in: _Dest=0x74b1f08, _Source="contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black" [0088.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x74b1f08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1984 [0088.682] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x393cee0 | out: lpFindFileData=0x393cee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d32ed7f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab1d0bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d37b231, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0088.682] wcscmp (_String1="contrast-white", _String2=".") returned 1 [0088.682] wcscmp (_String1="contrast-white", _String2="..") returned 1 [0088.682] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x74b2020 [0088.682] wcscpy (in: _Dest=0x74b2020, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0088.682] wcscat (in: _Dest=0x74b2020, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0088.682] wcscat (in: _Dest=0x74b2020, _Source="contrast-white" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white" [0088.682] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x74b2020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11f0 [0088.683] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x393cee0 | out: lpFindFileData=0x393cee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d32ed7f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab1d0bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d37b231, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 0 [0088.683] FindClose (in: hFindFile=0x5445740 | out: hFindFile=0x5445740) returned 1 [0088.684] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393cee0) returned 1 [0088.684] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393f2a8) returned 1 [0088.684] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396ea88) returned 1 Thread: id = 665 os_tid = 0x1990 [0075.285] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x122) returned 0x3979418 [0075.286] wcscpy (in: _Dest=0x3979418, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata" [0075.286] wcscat (in: _Dest=0x3979418, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0075.286] wcscat (in: _Dest=0x3979418, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0075.286] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393d148 [0075.286] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x393d148 | out: lpFindFileData=0x393d148*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb9355ef2, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb9355ef2, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb9355ef2, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ed40 [0085.994] wcscmp (_String1=".", _String2=".") returned 0 [0085.994] FindNextFileW (in: hFindFile=0x389ed40, lpFindFileData=0x393d148 | out: lpFindFileData=0x393d148*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb9355ef2, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb9355ef2, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb9355ef2, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.994] wcscmp (_String1="..", _String2=".") returned 1 [0085.994] wcscmp (_String1="..", _String2="..") returned 0 [0085.994] FindNextFileW (in: hFindFile=0x389ed40, lpFindFileData=0x393d148 | out: lpFindFileData=0x393d148*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb9355ef2, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb9355ef2, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb9355ef2, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0085.994] FindClose (in: hFindFile=0x389ed40 | out: hFindFile=0x389ed40) returned 1 [0085.994] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393d148) returned 1 [0085.995] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3979418) returned 1 [0085.995] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39727b0) returned 1 Thread: id = 666 os_tid = 0x1994 [0075.287] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri")) returned 0x20 [0082.570] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0082.585] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.603] GetLastError () returned 0x5 [0087.603] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0087.603] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a3a00) returned 1 Thread: id = 667 os_tid = 0x1998 [0075.357] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 0x20 [0080.374] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx", dwFileAttributes=0x20) returned 1 [0080.384] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1520 [0080.385] GetFileSizeEx (in: hFile=0x1520, lpFileSize=0x19effb98 | out: lpFileSize=0x19effb98*=69632) returned 1 [0080.385] SetFilePointerEx (in: hFile=0x1520, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.385] ReadFile (in: hFile=0x1520, lpBuffer=0x19effb1c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x19effb18, lpOverlapped=0x0 | out: lpBuffer=0x19effb1c*, lpNumberOfBytesRead=0x19effb18*=0x4, lpOverlapped=0x0) returned 1 [0080.391] SetFilePointerEx (in: hFile=0x1520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.391] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a15c8 [0080.391] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a16b8 [0080.392] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1708 [0080.392] NtQuerySystemTime (in: CurrentTime=0x19effaf8 | out: CurrentTime=0x19effaf8*=132260136375441857) returned 0x0 [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0xaf383d78 [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0x8d9802e9 [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0xc3985656 [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0x21c7c69f [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0xce8c2a07 [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0xe0574d42 [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0x2fa54b18 [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0xd5c07395 [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0xd5b6e3ab [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0x1096204c [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0x9a4ac7ba [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0x352407a [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0xdba93cb7 [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0x80fdfdf4 [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0x4f4131a2 [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0x869bd9a1 [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0x2a6c115e [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0xe39aae83 [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0x189e7cc6 [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0x5df40381 [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0x981665d8 [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0x3c1c2e69 [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0x7a8013bc [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0x4bdd252f [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0x17ea55bb [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0x81360f8c [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0x68afb8cc [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0x4ff47d49 [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0x2c25aaa1 [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0x9165791d [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0xb12afb01 [0080.392] RtlRandom (in: Seed=0x19effb04 | out: Seed=0x19effb04) returned 0xa72dc702 [0080.402] SetFilePointerEx (in: hFile=0x1520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.402] ReadFile (in: hFile=0x1520, lpBuffer=0x7565148, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x19effad8, lpOverlapped=0x0 | out: lpBuffer=0x7565148*, lpNumberOfBytesRead=0x19effad8*=0xc800, lpOverlapped=0x0) returned 1 [0080.403] SetFilePointerEx (in: hFile=0x1520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.403] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x74129b8 [0080.403] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5eedcf0 [0080.403] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a17f8 [0080.403] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a17f8) returned 1 [0080.404] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x7571950 [0080.408] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a15c8 [0080.408] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1820 [0080.408] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1820) returned 1 [0080.408] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eedcf0) returned 1 [0080.408] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74129b8) returned 1 [0080.408] WriteFile (in: hFile=0x1520, lpBuffer=0x7571950*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x19effad8, lpOverlapped=0x0 | out: lpBuffer=0x7571950*, lpNumberOfBytesWritten=0x19effad8*=0xc800, lpOverlapped=0x0) returned 1 [0084.170] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7571950) returned 1 [0084.180] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7565148) returned 1 [0084.180] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5b) returned 0x6e95a30 [0084.180] SetFilePointerEx (in: hFile=0x1520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.181] WriteFile (in: hFile=0x1520, lpBuffer=0x758a968*, nNumberOfBytesToWrite=0x13f, lpNumberOfBytesWritten=0x19effb58, lpOverlapped=0x0 | out: lpBuffer=0x758a968*, lpNumberOfBytesWritten=0x19effb58*=0x13f, lpOverlapped=0x0) returned 1 [0088.161] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x758a968) returned 1 [0088.161] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x6e95bd0) returned 1 [0088.161] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7566008) returned 1 [0088.161] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x6e95a30) returned 1 [0088.161] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a15c8) returned 1 [0088.161] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a16b8) returned 1 [0088.161] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1730) returned 1 [0088.161] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1758) returned 1 [0088.161] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa0) returned 0x54a2790 [0088.161] wcscpy (in: _Dest=0x54a2790, _Source="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" [0088.161] wcscat (in: _Dest=0x54a2790, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.mailto[knoocknoo@cock.li].a0a70" [0088.161] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x19effb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0088.161] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb6) returned 0x5b16310 Thread: id = 668 os_tid = 0x199c [0075.359] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 0x20 [0080.355] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx", dwFileAttributes=0x20) returned 1 [0080.366] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x151c [0080.366] GetFileSizeEx (in: hFile=0x151c, lpFileSize=0x19f7f7a8 | out: lpFileSize=0x19f7f7a8*=69632) returned 1 [0080.366] SetFilePointerEx (in: hFile=0x151c, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.372] ReadFile (in: hFile=0x151c, lpBuffer=0x19f7f72c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x19f7f728, lpOverlapped=0x0 | out: lpBuffer=0x19f7f72c*, lpNumberOfBytesRead=0x19f7f728*=0x4, lpOverlapped=0x0) returned 1 [0080.374] SetFilePointerEx (in: hFile=0x151c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.374] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a15c8 [0080.374] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1618 [0080.374] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a16b8 [0080.374] NtQuerySystemTime (in: CurrentTime=0x19f7f708 | out: CurrentTime=0x19f7f708*=132260136375285551) returned 0x0 [0080.374] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0x323a3136 [0080.374] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0x15e810b9 [0080.374] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0xe97ddf86 [0080.374] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0xe0d2d02b [0080.374] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0xa1c884aa [0080.374] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0x2b912465 [0080.374] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0xbcd3d7d1 [0080.374] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0x9db1834 [0080.374] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0x6b482eaa [0080.374] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0x13bab561 [0080.374] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0x1226c618 [0080.374] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0x95c2d808 [0080.374] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0x52467679 [0080.374] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0xd63a775a [0080.375] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0xb415a872 [0080.375] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0xb0ceaa6 [0080.375] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0xd7453b60 [0080.375] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0xc19aee4e [0080.375] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0xa0103378 [0080.375] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0xb64b964a [0080.375] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0x93423128 [0080.375] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0x8171e86e [0080.375] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0xb70bca1c [0080.375] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0xdb603008 [0080.375] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0xaf605ced [0080.375] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0xa19beed1 [0080.375] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0x93617a28 [0080.375] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0x91b3e723 [0080.375] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0x5e34384 [0080.375] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0xac11ce6f [0080.375] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0xfe95de26 [0080.375] RtlRandom (in: Seed=0x19f7f714 | out: Seed=0x19f7f714) returned 0x60d048a5 [0080.384] SetFilePointerEx (in: hFile=0x151c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.384] ReadFile (in: hFile=0x151c, lpBuffer=0x754c138, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x19f7f6e8, lpOverlapped=0x0 | out: lpBuffer=0x754c138*, lpNumberOfBytesRead=0x19f7f6e8*=0xc800, lpOverlapped=0x0) returned 1 [0080.385] SetFilePointerEx (in: hFile=0x151c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.385] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x7412e38 [0080.385] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5eedcf0 [0080.385] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a15c8 [0080.385] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a15c8) returned 1 [0080.386] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x7558940 [0080.390] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a17d0 [0080.390] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a15c8 [0080.390] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a15c8) returned 1 [0080.390] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eedcf0) returned 1 [0080.390] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7412e38) returned 1 [0080.390] WriteFile (in: hFile=0x151c, lpBuffer=0x7558940*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x19f7f6e8, lpOverlapped=0x0 | out: lpBuffer=0x7558940*, lpNumberOfBytesWritten=0x19f7f6e8*=0xc800, lpOverlapped=0x0) returned 1 [0084.133] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7558940) returned 1 [0084.182] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x754c138) returned 1 [0084.182] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x69) returned 0x7566978 [0084.182] SetFilePointerEx (in: hFile=0x151c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.182] WriteFile (in: hFile=0x151c, lpBuffer=0x758b7e0*, nNumberOfBytesToWrite=0x14d, lpNumberOfBytesWritten=0x19f7f768, lpOverlapped=0x0 | out: lpBuffer=0x758b7e0*, lpNumberOfBytesWritten=0x19f7f768*=0x14d, lpOverlapped=0x0) returned 1 [0088.163] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x758b7e0) Thread: id = 669 os_tid = 0x19a0 [0075.359] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 0x20 [0080.336] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0080.347] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1518 [0080.354] GetFileSizeEx (in: hFile=0x1518, lpFileSize=0x19ffff08 | out: lpFileSize=0x19ffff08*=69632) returned 1 [0080.354] SetFilePointerEx (in: hFile=0x1518, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.354] ReadFile (in: hFile=0x1518, lpBuffer=0x19fffe8c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x19fffe88, lpOverlapped=0x0 | out: lpBuffer=0x19fffe8c*, lpNumberOfBytesRead=0x19fffe88*=0x4, lpOverlapped=0x0) returned 1 [0080.355] SetFilePointerEx (in: hFile=0x1518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.355] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a15c8 [0080.355] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1578 [0080.355] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a16b8 [0080.355] NtQuerySystemTime (in: CurrentTime=0x19fffe68 | out: CurrentTime=0x19fffe68*=132260136375129468) returned 0x0 [0080.355] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0x4952d150 [0080.355] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0x7986b20d [0080.356] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0x8fe9ac82 [0080.356] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0xf83bdba8 [0080.356] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0x5271ec01 [0080.356] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0x14d463ba [0080.356] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0x909ff553 [0080.356] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0x4e9f70c1 [0080.356] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0x1974701a [0080.356] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0xff737b7c [0080.356] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0x9e8ad5dd [0080.356] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0x995b9250 [0080.356] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0x5dbdb884 [0080.356] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0x888ff8a2 [0080.356] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0x9d9a2ba1 [0080.356] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0x11f35f7c [0080.356] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0x293ab2cd [0080.356] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0x9c890720 [0080.356] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0x4b6f46f6 [0080.356] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0x93e642ab [0080.356] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0xb853b66e [0080.356] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0x2d32dd3b [0080.356] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0x100c718a [0080.356] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0xda7b4a53 [0080.356] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0x2e9cc080 [0080.356] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0x77539d9a [0080.356] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0x62205368 [0080.356] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0xb2f64ddf [0080.356] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0xd7e300e8 [0080.356] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0xef1f4de9 [0080.356] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0xe35285e5 [0080.356] RtlRandom (in: Seed=0x19fffe74 | out: Seed=0x19fffe74) returned 0xe5f45431 [0080.366] SetFilePointerEx (in: hFile=0x1518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.366] ReadFile (in: hFile=0x1518, lpBuffer=0x7533128, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x19fffe48, lpOverlapped=0x0 | out: lpBuffer=0x7533128*, lpNumberOfBytesRead=0x19fffe48*=0xc800, lpOverlapped=0x0) returned 1 [0080.367] SetFilePointerEx (in: hFile=0x1518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.367] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x7412928 [0080.367] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5eeded0 [0080.367] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a16e0 [0080.367] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a16e0) returned 1 [0080.368] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x753f930 [0080.372] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1780 [0080.372] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a15c8 [0080.372] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a15c8) returned 1 [0080.372] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eeded0) returned 1 [0080.372] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7412928) returned 1 [0080.372] WriteFile (in: hFile=0x1518, lpBuffer=0x753f930*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x19fffe48, lpOverlapped=0x0 | out: lpBuffer=0x753f930*, lpNumberOfBytesWritten=0x19fffe48*=0xc800, lpOverlapped=0x0) returned 1 [0089.495] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x753f930) returned 1 [0091.517] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7533128) returned 1 [0091.517] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x67) returned 0x5468cc0 [0091.517] SetFilePointerEx (in: hFile=0x1518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.517] WriteFile (hFile=0x1518, lpBuffer=0xe538990, nNumberOfBytesToWrite=0x14b, lpNumberOfBytesWritten=0x19fffec8, lpOverlapped=0x0) Thread: id = 670 os_tid = 0x19a4 [0075.360] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 0x20 [0080.317] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx", dwFileAttributes=0x20) returned 1 [0080.335] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1514 [0080.335] GetFileSizeEx (in: hFile=0x1514, lpFileSize=0x1a07fe40 | out: lpFileSize=0x1a07fe40*=69632) returned 1 [0080.335] SetFilePointerEx (in: hFile=0x1514, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.335] ReadFile (in: hFile=0x1514, lpBuffer=0x1a07fdc4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1a07fdc0, lpOverlapped=0x0 | out: lpBuffer=0x1a07fdc4*, lpNumberOfBytesRead=0x1a07fdc0*=0x4, lpOverlapped=0x0) returned 1 [0080.336] SetFilePointerEx (in: hFile=0x1514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.336] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a15c8 [0080.336] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1a00 [0080.336] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a16b8 [0080.336] NtQuerySystemTime (in: CurrentTime=0x1a07fda0 | out: CurrentTime=0x1a07fda0*=132260136374995515) returned 0x0 [0080.336] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0x639cdee8 [0080.336] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0x893b9d25 [0080.336] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0x6c3f12bd [0080.336] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0xca82e17e [0080.337] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0xef2fd17c [0080.337] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0xa22f1260 [0080.337] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0xfb6a7dca [0080.337] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0xdcce6338 [0080.337] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0x1181cea7 [0080.337] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0xad72daad [0080.337] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0x190fc8e8 [0080.337] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0x3e8e5321 [0080.337] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0x570ed666 [0080.337] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0x25255469 [0080.337] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0xa8448fc4 [0080.337] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0xb5dee99c [0080.337] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0xf92835ab [0080.337] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0xb85476fb [0080.337] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0x595379d6 [0080.337] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0xcc25fe99 [0080.337] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0xc3ccca52 [0080.337] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0x3dad15d1 [0080.337] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0x4dbe156d [0080.337] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0x865327e7 [0080.337] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0xbf106419 [0080.337] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0x71a9b136 [0080.337] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0x2c8d3918 [0080.337] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0x98872726 [0080.337] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0x3621e88a [0080.337] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0x1138d109 [0080.337] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0x7ca371b8 [0080.337] RtlRandom (in: Seed=0x1a07fdac | out: Seed=0x1a07fdac) returned 0xc2657a8 [0080.347] SetFilePointerEx (in: hFile=0x1514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.347] ReadFile (in: hFile=0x1514, lpBuffer=0x751a118, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1a07fd80, lpOverlapped=0x0 | out: lpBuffer=0x751a118*, lpNumberOfBytesRead=0x1a07fd80*=0xc800, lpOverlapped=0x0) returned 1 [0080.348] SetFilePointerEx (in: hFile=0x1514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.348] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x7413810 [0080.348] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5eedcf0 [0080.348] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a17a8 [0080.348] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a17a8) returned 1 [0080.349] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x7526920 [0080.353] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1690 [0080.353] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a17f8 [0080.353] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a17f8) returned 1 [0080.353] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eedcf0) returned 1 [0080.353] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7413810) returned 1 [0080.353] WriteFile (in: hFile=0x1514, lpBuffer=0x7526920*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1a07fd80, lpOverlapped=0x0 | out: lpBuffer=0x7526920*, lpNumberOfBytesWritten=0x1a07fd80*=0xc800, lpOverlapped=0x0) returned 1 [0087.564] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7526920) Thread: id = 671 os_tid = 0x19a8 [0075.362] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 0x20 [0080.194] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0080.205] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1510 [0080.205] GetFileSizeEx (in: hFile=0x1510, lpFileSize=0x1a0ffbb4 | out: lpFileSize=0x1a0ffbb4*=69632) returned 1 [0080.316] SetFilePointerEx (in: hFile=0x1510, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.316] ReadFile (in: hFile=0x1510, lpBuffer=0x1a0ffb38, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1a0ffb34, lpOverlapped=0x0 | out: lpBuffer=0x1a0ffb38*, lpNumberOfBytesRead=0x1a0ffb34*=0x4, lpOverlapped=0x0) returned 1 [0080.318] SetFilePointerEx (in: hFile=0x1510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.318] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a15c8 [0080.318] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1988 [0080.318] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a16b8 [0080.318] NtQuerySystemTime (in: CurrentTime=0x1a0ffb14 | out: CurrentTime=0x1a0ffb14*=132260136374816856) returned 0x0 [0080.318] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0xfcdbdeeb [0080.318] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0x7dfb6887 [0080.318] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0x58f81500 [0080.318] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0x37990cab [0080.318] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0x823522e5 [0080.318] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0x94c2c7e7 [0080.318] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0x62f0368b [0080.318] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0x2b4def [0080.318] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0x3e0dfcfa [0080.318] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0xcd8366e7 [0080.318] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0x4b66f308 [0080.318] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0xdb207ee8 [0080.318] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0xa3006bd3 [0080.318] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0xb4fb76fa [0080.318] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0xdfdbe039 [0080.318] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0xb3bbf52f [0080.318] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0x5c6b1f7c [0080.318] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0x65e85319 [0080.318] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0x3f417999 [0080.318] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0xb97bee5f [0080.318] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0xf3130f6f [0080.318] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0x89817e3e [0080.318] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0x243b4a25 [0080.318] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0xda809da5 [0080.318] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0xc37eac9e [0080.319] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0x71922456 [0080.319] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0xee073c47 [0080.319] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0xff76d6ef [0080.319] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0x59d3ee1b [0080.319] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0x28e38d88 [0080.319] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0x6c2aa567 [0080.319] RtlRandom (in: Seed=0x1a0ffb20 | out: Seed=0x1a0ffb20) returned 0x6d15e790 [0080.328] SetFilePointerEx (in: hFile=0x1510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.328] ReadFile (in: hFile=0x1510, lpBuffer=0x7501108, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1a0ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x7501108*, lpNumberOfBytesRead=0x1a0ffaf4*=0xc800, lpOverlapped=0x0) returned 1 [0080.329] SetFilePointerEx (in: hFile=0x1510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.329] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x7412b68 [0080.329] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5eedcf0 [0080.329] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1a00 [0080.329] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1a00) returned 1 [0080.330] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x750d910 [0080.334] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1668 [0080.334] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a15a0 [0080.334] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a15a0) returned 1 [0080.334] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eedcf0) returned 1 [0080.334] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7412b68) returned 1 [0080.334] WriteFile (in: hFile=0x1510, lpBuffer=0x750d910*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1a0ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x750d910*, lpNumberOfBytesWritten=0x1a0ffaf4*=0xc800, lpOverlapped=0x0) returned 1 [0084.066] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x750d910) returned 1 [0084.222] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7501108) returned 1 [0084.223] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5f) returned 0x6e95a98 [0084.223] SetFilePointerEx (in: hFile=0x1510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.223] WriteFile (in: hFile=0x1510, lpBuffer=0x758bbb8*, nNumberOfBytesToWrite=0x143, lpNumberOfBytesWritten=0x1a0ffb74, lpOverlapped=0x0 | out: lpBuffer=0x758bbb8*, lpNumberOfBytesWritten=0x1a0ffb74*=0x143, lpOverlapped=0x0) returned 1 [0088.167] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x758bbb8) Thread: id = 672 os_tid = 0x19ac [0075.363] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 0x20 [0080.177] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx", dwFileAttributes=0x20) returned 1 [0080.177] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x150c [0080.188] GetFileSizeEx (in: hFile=0x150c, lpFileSize=0x1a17fe90 | out: lpFileSize=0x1a17fe90*=69632) returned 1 [0080.188] SetFilePointerEx (in: hFile=0x150c, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.188] ReadFile (in: hFile=0x150c, lpBuffer=0x1a17fe14, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1a17fe10, lpOverlapped=0x0 | out: lpBuffer=0x1a17fe14*, lpNumberOfBytesRead=0x1a17fe10*=0x4, lpOverlapped=0x0) returned 1 [0080.195] SetFilePointerEx (in: hFile=0x150c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.195] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a15c8 [0080.195] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a18e8 [0080.195] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a16b8 [0080.195] NtQuerySystemTime (in: CurrentTime=0x1a17fdf0 | out: CurrentTime=0x1a17fdf0*=132260136373585977) returned 0x0 [0080.195] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0xe1f3e1eb [0080.195] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0x6e234210 [0080.195] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0xf8d74852 [0080.195] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0x2193e0f2 [0080.195] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0xfaab4112 [0080.195] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0x2eecaa63 [0080.195] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0x89f87fd7 [0080.195] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0xac828b8d [0080.195] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0x9ab08329 [0080.195] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0x69a180c1 [0080.195] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0x5dd8829 [0080.195] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0x3276797 [0080.195] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0x34d15b7d [0080.195] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0x4b272a6f [0080.195] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0x47353f91 [0080.195] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0x48ec810f [0080.195] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0x8ee332f2 [0080.195] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0xee00b6d4 [0080.195] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0x15012140 [0080.195] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0x567e0d9d [0080.195] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0x267fac7e [0080.195] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0xc328252e [0080.195] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0x6cde8c5e [0080.195] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0xb3e3b8c8 [0080.195] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0x83d8381e [0080.195] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0x567d2acf [0080.195] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0x8d6572a2 [0080.195] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0x1039cb72 [0080.195] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0x3c9b631a [0080.195] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0xe5eac8da [0080.196] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0x2aa10352 [0080.196] RtlRandom (in: Seed=0x1a17fdfc | out: Seed=0x1a17fdfc) returned 0xfd350a9c [0080.205] SetFilePointerEx (in: hFile=0x150c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.205] ReadFile (in: hFile=0x150c, lpBuffer=0x74e80f8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1a17fdd0, lpOverlapped=0x0 | out: lpBuffer=0x74e80f8*, lpNumberOfBytesRead=0x1a17fdd0*=0xc800, lpOverlapped=0x0) returned 1 [0080.301] SetFilePointerEx (in: hFile=0x150c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.302] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x7412ad8 [0080.302] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5eedde0 [0080.302] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1a00 [0080.302] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1a00) returned 1 [0080.302] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x74f4900 [0080.307] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1960 [0080.307] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a17f8 [0080.307] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a17f8) returned 1 [0080.307] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eedde0) returned 1 [0080.307] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7412ad8) returned 1 [0080.307] WriteFile (in: hFile=0x150c, lpBuffer=0x74f4900*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1a17fdd0, lpOverlapped=0x0 | out: lpBuffer=0x74f4900*, lpNumberOfBytesWritten=0x1a17fdd0*=0xc800, lpOverlapped=0x0) returned 1 [0083.884] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74f4900) returned 1 [0084.540] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e80f8) returned 1 [0084.540] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6f) returned 0x7575190 [0084.540] SetFilePointerEx (in: hFile=0x150c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.540] WriteFile (in: hFile=0x150c, lpBuffer=0x55ca728*, nNumberOfBytesToWrite=0x153, lpNumberOfBytesWritten=0x1a17fe50, lpOverlapped=0x0 | out: lpBuffer=0x55ca728*, lpNumberOfBytesWritten=0x1a17fe50*=0x153, lpOverlapped=0x0) returned 1 [0088.562] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55ca728) Thread: id = 673 os_tid = 0x19b0 [0075.363] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 0x20 [0080.159] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0080.159] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1508 [0080.170] GetFileSizeEx (in: hFile=0x1508, lpFileSize=0x1a1ff864 | out: lpFileSize=0x1a1ff864*=69632) returned 1 [0080.170] SetFilePointerEx (in: hFile=0x1508, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.170] ReadFile (in: hFile=0x1508, lpBuffer=0x1a1ff7e8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1a1ff7e4, lpOverlapped=0x0 | out: lpBuffer=0x1a1ff7e8*, lpNumberOfBytesRead=0x1a1ff7e4*=0x4, lpOverlapped=0x0) returned 1 [0080.177] SetFilePointerEx (in: hFile=0x1508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.177] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a12f8 [0080.177] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1898 [0080.177] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a16b8 [0080.177] NtQuerySystemTime (in: CurrentTime=0x1a1ff7c4 | out: CurrentTime=0x1a1ff7c4*=132260136373410492) returned 0x0 [0080.177] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0x30c5ad0e [0080.177] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0xe8c8d8aa [0080.177] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0x495e71bd [0080.177] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0x1174c2f8 [0080.177] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0x732d19ba [0080.177] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0xdb8953e2 [0080.177] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0xdbdd2fe5 [0080.177] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0xb73ac4e8 [0080.177] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0xd4910807 [0080.178] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0x39de3f98 [0080.178] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0x35f753b6 [0080.178] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0x11ced613 [0080.178] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0x7f32e2ff [0080.178] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0x6ac7daa7 [0080.178] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0x6c7c43cf [0080.178] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0x5d4e4967 [0080.178] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0x4aa6172b [0080.178] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0x62123ff3 [0080.178] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0x6728e622 [0080.178] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0xea4bc6a6 [0080.178] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0x17bcf26 [0080.178] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0x6553de04 [0080.178] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0xc28135d0 [0080.178] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0xd3540ca2 [0080.178] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0xc9de7826 [0080.178] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0x2617c730 [0080.178] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0xf093ff10 [0080.178] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0xd53f0f3a [0080.178] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0xa9c9cf97 [0080.178] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0x1790c603 [0080.178] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0x688ddf64 [0080.178] RtlRandom (in: Seed=0x1a1ff7d0 | out: Seed=0x1a1ff7d0) returned 0x3cdef01 [0080.187] SetFilePointerEx (in: hFile=0x1508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.187] ReadFile (in: hFile=0x1508, lpBuffer=0x74cf0e8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1a1ff7a4, lpOverlapped=0x0 | out: lpBuffer=0x74cf0e8*, lpNumberOfBytesRead=0x1a1ff7a4*=0xc800, lpOverlapped=0x0) returned 1 [0080.188] SetFilePointerEx (in: hFile=0x1508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.188] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x7413420 [0080.188] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5eedcf0 [0080.189] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a12f8 [0080.189] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a12f8) returned 1 [0080.189] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x74db8f0 [0080.193] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a12f8 [0080.193] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1578 [0080.193] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1578) returned 1 [0080.193] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eedcf0) returned 1 [0080.193] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7413420) returned 1 [0080.193] WriteFile (in: hFile=0x1508, lpBuffer=0x74db8f0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1a1ff7a4, lpOverlapped=0x0 | out: lpBuffer=0x74db8f0*, lpNumberOfBytesWritten=0x1a1ff7a4*=0xc800, lpOverlapped=0x0) returned 1 [0083.521] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74db8f0) returned 1 [0084.882] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74cf0e8) returned 1 [0084.882] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x91) returned 0x55c58f8 [0084.882] SetFilePointerEx (in: hFile=0x1508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.882] WriteFile (in: hFile=0x1508, lpBuffer=0x397dff0*, nNumberOfBytesToWrite=0x175, lpNumberOfBytesWritten=0x1a1ff824, lpOverlapped=0x0 | out: lpBuffer=0x397dff0*, lpNumberOfBytesWritten=0x1a1ff824*=0x175, lpOverlapped=0x0) returned 1 [0088.938] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397dff0) returned 1 [0089.151] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c5e98) returned 1 [0089.151] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe11a9c8) returned 1 [0089.151] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c58f8) returned 1 [0089.151] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a12f8) returned 1 [0089.151] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1898) returned 1 [0089.151] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1848) returned 1 [0089.152] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a18c0) returned 1 [0089.152] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd6) returned 0x3934108 [0089.152] wcscpy (in: _Dest=0x3934108, _Source="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" [0089.152] wcscat (in: _Dest=0x3934108, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.mailto[knoocknoo@cock.li].a0a70" [0089.152] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1a1ff7dc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.152] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x393e040 Thread: id = 674 os_tid = 0x19b4 [0075.365] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 0x20 [0080.140] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0080.152] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1504 [0080.152] GetFileSizeEx (in: hFile=0x1504, lpFileSize=0x1a27fd6c | out: lpFileSize=0x1a27fd6c*=69632) returned 1 [0080.152] SetFilePointerEx (in: hFile=0x1504, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.158] ReadFile (in: hFile=0x1504, lpBuffer=0x1a27fcf0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1a27fcec, lpOverlapped=0x0 | out: lpBuffer=0x1a27fcf0*, lpNumberOfBytesRead=0x1a27fcec*=0x4, lpOverlapped=0x0) returned 1 [0080.159] SetFilePointerEx (in: hFile=0x1504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.159] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a11b8 [0080.159] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1258 [0080.159] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a12f8 [0080.159] NtQuerySystemTime (in: CurrentTime=0x1a27fccc | out: CurrentTime=0x1a27fccc*=132260136373254123) returned 0x0 [0080.159] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0x6a953d7a [0080.159] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0xbf20fae9 [0080.159] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0x86cca540 [0080.159] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0x135c3247 [0080.160] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0x4405cda9 [0080.160] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0x84df3509 [0080.160] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0x2352ca49 [0080.160] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0x6eef703f [0080.160] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0xe9e6e45f [0080.160] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0x182f899a [0080.160] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0xa4e7ddbd [0080.160] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0x27dec58a [0080.160] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0xf1062787 [0080.160] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0xbf31488f [0080.160] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0x88961b72 [0080.160] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0x3139b827 [0080.160] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0xc8e5e17d [0080.160] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0xacfbce63 [0080.160] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0xc9be5f9f [0080.160] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0x1f7914f [0080.160] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0x1ab2f037 [0080.160] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0x71ac885c [0080.160] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0x1820f75a [0080.160] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0xabb18a3 [0080.160] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0x3a75af43 [0080.160] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0x40b74282 [0080.160] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0x43186ba2 [0080.160] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0x87aeb09a [0080.160] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0x228aa0b6 [0080.160] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0x9f5ef6df [0080.160] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0xccb2885f [0080.160] RtlRandom (in: Seed=0x1a27fcd8 | out: Seed=0x1a27fcd8) returned 0x9e5f797d [0080.169] SetFilePointerEx (in: hFile=0x1504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.169] ReadFile (in: hFile=0x1504, lpBuffer=0x74b60d8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1a27fcac, lpOverlapped=0x0 | out: lpBuffer=0x74b60d8*, lpNumberOfBytesRead=0x1a27fcac*=0xc800, lpOverlapped=0x0) returned 1 [0080.171] SetFilePointerEx (in: hFile=0x1504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.171] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x7412fa0 [0080.171] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5eedcf0 [0080.171] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a11b8 [0080.171] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a11b8) returned 1 [0080.171] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x74c28e0 [0080.175] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a11b8 [0080.175] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a12f8 [0080.175] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a12f8) returned 1 [0080.175] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eedcf0) returned 1 [0080.175] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7412fa0) returned 1 [0080.176] WriteFile (in: hFile=0x1504, lpBuffer=0x74c28e0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1a27fcac, lpOverlapped=0x0 | out: lpBuffer=0x74c28e0*, lpNumberOfBytesWritten=0x1a27fcac*=0xc800, lpOverlapped=0x0) returned 1 [0087.562] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74c28e0) Thread: id = 675 os_tid = 0x19b8 [0075.365] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 0x20 [0080.101] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0080.113] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14fc [0080.113] GetFileSizeEx (in: hFile=0x14fc, lpFileSize=0x1a2ff8b4 | out: lpFileSize=0x1a2ff8b4*=69632) returned 1 [0080.113] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.113] ReadFile (in: hFile=0x14fc, lpBuffer=0x1a2ff838, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1a2ff834, lpOverlapped=0x0 | out: lpBuffer=0x1a2ff838*, lpNumberOfBytesRead=0x1a2ff834*=0x4, lpOverlapped=0x0) returned 1 [0080.120] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.120] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a10c8 [0080.120] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1140 [0080.121] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a11b8 [0080.121] NtQuerySystemTime (in: CurrentTime=0x1a2ff814 | out: CurrentTime=0x1a2ff814*=132260136372785618) returned 0x0 [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0x5c92edc1 [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0xbc18cbe6 [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0xb460ee9e [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0x1ce0b6fa [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0xe0fc3754 [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0x9957e66b [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0xcb59d0de [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0xa1a4def1 [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0xb5eb8294 [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0x4ebff0c3 [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0x6665c325 [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0x8d51da0c [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0x81a5d666 [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0xec1a9081 [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0x11a70f01 [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0xe291b373 [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0xd55ca56d [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0x84cd4e7c [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0x1df660e [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0xe03550fd [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0x796d0f34 [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0xa986bbc4 [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0x23c169a3 [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0x90eb04ae [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0x86b924fa [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0x223c7372 [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0x20bf73b [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0x5f043d2 [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0x49d555b3 [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0x758f3fe6 [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0xce579cc7 [0080.121] RtlRandom (in: Seed=0x1a2ff820 | out: Seed=0x1a2ff820) returned 0x1dc3e2c9 [0080.131] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.131] ReadFile (in: hFile=0x14fc, lpBuffer=0x74840b8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1a2ff7f4, lpOverlapped=0x0 | out: lpBuffer=0x74840b8*, lpNumberOfBytesRead=0x1a2ff7f4*=0xc800, lpOverlapped=0x0) returned 1 [0080.135] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.135] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x7412da8 [0080.135] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5eedcf0 [0080.135] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1280 [0080.135] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1280) returned 1 [0080.136] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x74908c0 [0080.140] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a10c8 [0080.140] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a12d0 [0080.140] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a12d0) returned 1 [0080.140] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eedcf0) returned 1 [0080.140] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7412da8) returned 1 [0080.140] WriteFile (in: hFile=0x14fc, lpBuffer=0x74908c0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1a2ff7f4, lpOverlapped=0x0 | out: lpBuffer=0x74908c0*, lpNumberOfBytesWritten=0x1a2ff7f4*=0xc800, lpOverlapped=0x0) returned 1 [0083.488] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74908c0) returned 1 [0084.891] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74840b8) returned 1 [0084.891] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x99) returned 0x54a24f0 [0084.891] SetFilePointerEx (in: hFile=0x14fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.891] WriteFile (in: hFile=0x14fc, lpBuffer=0xe018d20*, nNumberOfBytesToWrite=0x17d, lpNumberOfBytesWritten=0x1a2ff874, lpOverlapped=0x0 | out: lpBuffer=0xe018d20*, lpNumberOfBytesWritten=0x1a2ff874*=0x17d, lpOverlapped=0x0) returned 1 [0088.943] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe018d20) returned 1 [0088.943] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a28e0) returned 1 [0088.943] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe11aa18) returned 1 [0088.943] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a24f0) returned 1 [0088.943] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a10c8) returned 1 [0088.943] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1140) returned 1 [0088.943] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1168) returned 1 [0088.944] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a11e0) returned 1 [0088.944] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xde) returned 0x54f0dd8 [0088.944] wcscpy (in: _Dest=0x54f0dd8, _Source="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" [0088.944] wcscat (in: _Dest=0x54f0dd8, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.mailto[knoocknoo@cock.li].a0a70" [0088.944] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1a2ff82c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0088.944] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf4) returned 0x5ba32f8 Thread: id = 676 os_tid = 0x19bc [0075.366] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 0x20 [0080.120] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0080.132] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1500 [0080.132] GetFileSizeEx (in: hFile=0x1500, lpFileSize=0x1a37fc94 | out: lpFileSize=0x1a37fc94*=69632) returned 1 [0080.132] SetFilePointerEx (in: hFile=0x1500, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.132] ReadFile (in: hFile=0x1500, lpBuffer=0x1a37fc18, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1a37fc14, lpOverlapped=0x0 | out: lpBuffer=0x1a37fc18*, lpNumberOfBytesRead=0x1a37fc14*=0x4, lpOverlapped=0x0) returned 1 [0080.141] SetFilePointerEx (in: hFile=0x1500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.141] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a11b8 [0080.141] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1208 [0080.141] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1258 [0080.141] NtQuerySystemTime (in: CurrentTime=0x1a37fbf4 | out: CurrentTime=0x1a37fbf4*=132260136372941785) returned 0x0 [0080.141] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0xcd69b664 [0080.141] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0xe8884b17 [0080.141] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0x219da825 [0080.141] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0x2187ca5d [0080.141] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0x5f876fb8 [0080.141] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0xc875f1ef [0080.141] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0x44ba259b [0080.141] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0xbf145398 [0080.141] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0xb4de9c3b [0080.141] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0xd8f887dd [0080.141] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0x5ab850e [0080.141] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0xc78bfac8 [0080.141] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0xd1eec9c0 [0080.141] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0x38b2cca3 [0080.141] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0xaebcf77e [0080.141] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0x794521fc [0080.141] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0x6caaddc3 [0080.141] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0x2b03e450 [0080.141] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0xbc7bbd7f [0080.141] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0xd39fc40c [0080.141] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0x7694db22 [0080.141] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0x87f6d842 [0080.141] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0x50409c42 [0080.142] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0xb2e7e8bd [0080.142] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0xa768801c [0080.142] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0x4e0a4cf1 [0080.142] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0x4ef7edd2 [0080.142] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0xb532cce8 [0080.142] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0x11b52198 [0080.142] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0x5da8099d [0080.142] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0x8f301b06 [0080.142] RtlRandom (in: Seed=0x1a37fc00 | out: Seed=0x1a37fc00) returned 0x1c14bdbc [0080.151] SetFilePointerEx (in: hFile=0x1500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.151] ReadFile (in: hFile=0x1500, lpBuffer=0x749d0c8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1a37fbd4, lpOverlapped=0x0 | out: lpBuffer=0x749d0c8*, lpNumberOfBytesRead=0x1a37fbd4*=0xc800, lpOverlapped=0x0) returned 1 [0080.153] SetFilePointerEx (in: hFile=0x1500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.153] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x7412928 [0080.153] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5eedde0 [0080.153] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a11b8 [0080.153] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a11b8) returned 1 [0080.154] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x74a98d0 [0080.157] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a12d0 [0080.157] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a11b8 [0080.157] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a11b8) returned 1 [0080.157] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eedde0) returned 1 [0080.157] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7412928) returned 1 [0080.157] WriteFile (in: hFile=0x1500, lpBuffer=0x74a98d0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1a37fbd4, lpOverlapped=0x0 | out: lpBuffer=0x74a98d0*, lpNumberOfBytesWritten=0x1a37fbd4*=0xc800, lpOverlapped=0x0) returned 1 [0083.489] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74a98d0) returned 1 [0084.891] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x749d0c8) returned 1 [0084.891] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa5) returned 0x388f670 [0084.891] SetFilePointerEx (in: hFile=0x1500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.891] WriteFile (in: hFile=0x1500, lpBuffer=0x397e170*, nNumberOfBytesToWrite=0x189, lpNumberOfBytesWritten=0x1a37fc54, lpOverlapped=0x0 | out: lpBuffer=0x397e170*, lpNumberOfBytesWritten=0x1a37fc54*=0x189, lpOverlapped=0x0) returned 1 [0088.941] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397e170) returned 1 [0089.150] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388f930) returned 1 [0089.150] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe11a9f0) returned 1 [0089.150] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388f670) returned 1 [0089.151] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a12d0) returned 1 [0089.151] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1208) returned 1 [0089.151] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1280) returned 1 [0089.151] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a12a8) returned 1 [0089.151] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xea) returned 0x393de50 [0089.151] wcscpy (in: _Dest=0x393de50, _Source="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" [0089.151] wcscat (in: _Dest=0x393de50, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70" [0089.151] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1a37fc0c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.151] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100) returned 0x7581ce8 Thread: id = 677 os_tid = 0x19c0 [0075.367] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 0x20 [0080.084] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0080.095] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14f8 [0080.095] GetFileSizeEx (in: hFile=0x14f8, lpFileSize=0x1a3ffe1c | out: lpFileSize=0x1a3ffe1c*=69632) returned 1 [0080.095] SetFilePointerEx (in: hFile=0x14f8, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.100] ReadFile (in: hFile=0x14f8, lpBuffer=0x1a3ffda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1a3ffd9c, lpOverlapped=0x0 | out: lpBuffer=0x1a3ffda0*, lpNumberOfBytesRead=0x1a3ffd9c*=0x4, lpOverlapped=0x0) returned 1 [0080.102] SetFilePointerEx (in: hFile=0x14f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.102] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a10c8 [0080.102] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1528 [0080.102] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a11b8 [0080.102] NtQuerySystemTime (in: CurrentTime=0x1a3ffd7c | out: CurrentTime=0x1a3ffd7c*=132260136372629242) returned 0x0 [0080.102] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0xf8ac0f4b [0080.102] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0x43d803c4 [0080.102] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0xefe4e2af [0080.102] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0x6d0531d3 [0080.102] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0x622a355d [0080.102] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0x177c94c7 [0080.102] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0xf4a6ec3e [0080.102] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0xdfce7ca5 [0080.102] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0xc7f17fda [0080.102] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0xd57d4d81 [0080.102] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0x84d0feb9 [0080.102] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0xee43c903 [0080.102] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0x339c6276 [0080.102] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0x29cf5ce3 [0080.102] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0xa5e5bde9 [0080.102] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0x31250e75 [0080.102] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0x1d57c168 [0080.102] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0x9bc7bf5e [0080.102] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0xcffad7fa [0080.102] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0xe9d5a2e [0080.102] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0x6832cfbb [0080.102] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0x43676fba [0080.102] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0xfd493a1e [0080.102] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0x5196a108 [0080.103] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0xf74cb833 [0080.103] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0xb158b86c [0080.103] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0x52cb54ee [0080.103] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0xb3726afe [0080.103] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0x50bc5a83 [0080.103] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0x7e27a040 [0080.103] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0xd1eca7c3 [0080.103] RtlRandom (in: Seed=0x1a3ffd88 | out: Seed=0x1a3ffd88) returned 0xbda8dc01 [0080.112] SetFilePointerEx (in: hFile=0x14f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.112] ReadFile (in: hFile=0x14f8, lpBuffer=0x746b0a8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1a3ffd5c, lpOverlapped=0x0 | out: lpBuffer=0x746b0a8*, lpNumberOfBytesRead=0x1a3ffd5c*=0xc800, lpOverlapped=0x0) returned 1 [0080.114] SetFilePointerEx (in: hFile=0x14f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.114] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x7412e38 [0080.114] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5eede58 [0080.114] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a10c8 [0080.114] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a10c8) returned 1 [0080.115] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x74778b0 [0080.119] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1118 [0080.119] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1140 [0080.119] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1140) returned 1 [0080.119] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eede58) returned 1 [0080.119] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7412e38) returned 1 [0080.119] WriteFile (in: hFile=0x14f8, lpBuffer=0x74778b0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1a3ffd5c, lpOverlapped=0x0 | out: lpBuffer=0x74778b0*, lpNumberOfBytesWritten=0x1a3ffd5c*=0xc800, lpOverlapped=0x0) returned 1 [0083.281] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74778b0) returned 1 [0084.932] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x746b0a8) returned 1 [0084.932] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x61) returned 0x5468d30 [0084.932] SetFilePointerEx (in: hFile=0x14f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.932] WriteFile (in: hFile=0x14f8, lpBuffer=0x38ab0a8*, nNumberOfBytesToWrite=0x145, lpNumberOfBytesWritten=0x1a3ffddc, lpOverlapped=0x0 | out: lpBuffer=0x38ab0a8*, lpNumberOfBytesWritten=0x1a3ffddc*=0x145, lpOverlapped=0x0) returned 1 [0088.945] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ab0a8) returned 1 [0089.150] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5468010) returned 1 [0089.150] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe11ab58) returned 1 [0089.150] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5468d30) returned 1 [0089.150] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1118) returned 1 [0089.150] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1528) returned 1 [0089.150] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1078) returned 1 [0089.150] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a10f0) returned 1 [0089.150] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa6) returned 0x388f510 [0089.150] wcscpy (in: _Dest=0x388f510, _Source="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" [0089.150] wcscat (in: _Dest=0x388f510, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70" [0089.150] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1a3ffd94, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.150] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x53f9830 Thread: id = 678 os_tid = 0x19c4 [0075.372] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 0x20 [0080.065] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0080.065] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14f4 [0080.077] GetFileSizeEx (in: hFile=0x14f4, lpFileSize=0x1a47f7dc | out: lpFileSize=0x1a47f7dc*=69632) returned 1 [0080.077] SetFilePointerEx (in: hFile=0x14f4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.077] ReadFile (in: hFile=0x14f4, lpBuffer=0x1a47f760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1a47f75c, lpOverlapped=0x0 | out: lpBuffer=0x1a47f760*, lpNumberOfBytesRead=0x1a47f75c*=0x4, lpOverlapped=0x0) returned 1 [0080.084] SetFilePointerEx (in: hFile=0x14f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.084] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a11b8 [0080.084] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1500 [0080.084] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1528 [0080.084] NtQuerySystemTime (in: CurrentTime=0x1a47f73c | out: CurrentTime=0x1a47f73c*=132260136372480877) returned 0x0 [0080.084] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0x94e9111d [0080.085] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0x3fbf8f08 [0080.085] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0x757f3d03 [0080.085] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0xd4708324 [0080.085] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0xdfb146d3 [0080.085] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0x976c1014 [0080.085] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0x2306ef01 [0080.085] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0x6baf3d8 [0080.085] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0x17dbaabb [0080.085] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0xbdf07a09 [0080.085] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0xd616fc38 [0080.085] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0x7ef2fdd2 [0080.085] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0x3e8d7bfb [0080.085] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0x245cb80c [0080.085] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0x86e2942e [0080.085] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0xc7c9ce04 [0080.085] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0xbd91b81e [0080.085] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0x2f773742 [0080.085] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0x37c2a6c2 [0080.085] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0xc654f019 [0080.085] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0xdc6aa7ef [0080.085] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0x99894dd [0080.085] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0x28dea8a0 [0080.085] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0x8b8c782c [0080.085] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0x4b2a48f2 [0080.085] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0xa5539fdb [0080.085] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0x5db1553f [0080.085] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0xfa855f5a [0080.085] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0x82e4074c [0080.085] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0x72bad598 [0080.085] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0xd84396be [0080.085] RtlRandom (in: Seed=0x1a47f748 | out: Seed=0x1a47f748) returned 0x47357c2c [0080.094] SetFilePointerEx (in: hFile=0x14f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.095] ReadFile (in: hFile=0x14f4, lpBuffer=0x7452098, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1a47f71c, lpOverlapped=0x0 | out: lpBuffer=0x7452098*, lpNumberOfBytesRead=0x1a47f71c*=0xc800, lpOverlapped=0x0) returned 1 [0080.096] SetFilePointerEx (in: hFile=0x14f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.096] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x7412970 [0080.096] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5eedcf0 [0080.096] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1528 [0080.096] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1528) returned 1 [0080.097] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x745e8a0 [0080.100] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a10a0 [0080.100] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a12a8 [0080.100] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a12a8) returned 1 [0080.100] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eedcf0) returned 1 [0080.100] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7412970) returned 1 [0080.100] WriteFile (in: hFile=0x14f4, lpBuffer=0x745e8a0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1a47f71c, lpOverlapped=0x0 | out: lpBuffer=0x745e8a0*, lpNumberOfBytesWritten=0x1a47f71c*=0xc800, lpOverlapped=0x0) returned 1 [0083.210] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x745e8a0) returned 1 [0084.940] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7452098) returned 1 [0084.940] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7d) returned 0x3976918 [0084.941] SetFilePointerEx (in: hFile=0x14f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.941] WriteFile (in: hFile=0x14f4, lpBuffer=0x546e588*, nNumberOfBytesToWrite=0x161, lpNumberOfBytesWritten=0x1a47f79c, lpOverlapped=0x0 | out: lpBuffer=0x546e588*, lpNumberOfBytesWritten=0x1a47f79c*=0x161, lpOverlapped=0x0) returned 1 [0088.948] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x546e588) returned 1 [0089.149] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3976b38) returned 1 [0089.149] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe11aa40) returned 1 [0089.149] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3976918) returned 1 [0089.149] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a10a0) returned 1 [0089.149] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1500) returned 1 [0089.150] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1050) returned 1 [0089.150] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1230) returned 1 [0089.150] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x53f73a0 [0089.150] wcscpy (in: _Dest=0x53f73a0, _Source="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" [0089.150] wcscat (in: _Dest=0x53f73a0, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70" [0089.150] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1a47f754, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.150] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x3933688 Thread: id = 679 os_tid = 0x19c8 [0075.373] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 0x20 [0080.058] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx", dwFileAttributes=0x20) returned 1 [0080.063] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14f0 [0080.063] GetFileSizeEx (in: hFile=0x14f0, lpFileSize=0x1a4ff81c | out: lpFileSize=0x1a4ff81c*=69632) returned 1 [0080.064] SetFilePointerEx (in: hFile=0x14f0, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.064] ReadFile (in: hFile=0x14f0, lpBuffer=0x1a4ff7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1a4ff79c, lpOverlapped=0x0 | out: lpBuffer=0x1a4ff7a0*, lpNumberOfBytesRead=0x1a4ff79c*=0x4, lpOverlapped=0x0) returned 1 [0080.065] SetFilePointerEx (in: hFile=0x14f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.065] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a10c8 [0080.065] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1460 [0080.065] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a11b8 [0080.065] NtQuerySystemTime (in: CurrentTime=0x1a4ff77c | out: CurrentTime=0x1a4ff77c*=132260136372316850) returned 0x0 [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0x8eb3fa3a [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0x11b1934d [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0xe42b3c16 [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0x311a4e6d [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0x1f31d1b6 [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0x1b488a35 [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0xae8545a3 [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0x63c34b8a [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0x159ce983 [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0x3972668f [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0xe6c157b4 [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0x85df2b18 [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0xfa0be09a [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0xf0452b9a [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0xdc96f10c [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0xcb0d477 [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0x2bd6eee3 [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0xa15f729d [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0x3f0b5963 [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0xe827e507 [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0x73ed32ff [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0xec3beb19 [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0x50013cdb [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0x5e1575ce [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0xbe012b1e [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0xddf726c1 [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0x5a0f685b [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0x6558c591 [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0xf281c00d [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0xd8003b38 [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0xdc00490e [0080.066] RtlRandom (in: Seed=0x1a4ff788 | out: Seed=0x1a4ff788) returned 0xf4f40696 [0080.075] SetFilePointerEx (in: hFile=0x14f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.076] ReadFile (in: hFile=0x14f0, lpBuffer=0x7439088, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1a4ff75c, lpOverlapped=0x0 | out: lpBuffer=0x7439088*, lpNumberOfBytesRead=0x1a4ff75c*=0xc800, lpOverlapped=0x0) returned 1 [0080.078] SetFilePointerEx (in: hFile=0x14f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.078] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x7413030 [0080.078] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5eedcf0 [0080.078] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1500 [0080.078] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1500) returned 1 [0080.079] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x7445890 [0080.083] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1190 [0080.083] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1168 [0080.083] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1168) returned 1 [0080.083] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eedcf0) returned 1 [0080.083] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7413030) returned 1 [0080.083] WriteFile (in: hFile=0x14f0, lpBuffer=0x7445890*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1a4ff75c, lpOverlapped=0x0 | out: lpBuffer=0x7445890*, lpNumberOfBytesWritten=0x1a4ff75c*=0xc800, lpOverlapped=0x0) returned 1 [0083.211] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7445890) returned 1 [0084.940] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7439088) returned 1 [0084.940] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x65) returned 0x5468080 [0084.940] SetFilePointerEx (in: hFile=0x14f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.940] WriteFile (in: hFile=0x14f0, lpBuffer=0x5470a08*, nNumberOfBytesToWrite=0x149, lpNumberOfBytesWritten=0x1a4ff7dc, lpOverlapped=0x0 | out: lpBuffer=0x5470a08*, lpNumberOfBytesWritten=0x1a4ff7dc*=0x149, lpOverlapped=0x0) returned 1 [0088.949] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5470a08) returned 1 [0089.149] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54680f0) returned 1 [0089.149] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe11ab80) returned 1 [0089.149] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5468080) returned 1 [0089.149] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1190) returned 1 [0089.149] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1460) returned 1 [0089.149] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a14b0) returned 1 [0089.149] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a14d8) returned 1 [0089.149] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xaa) returned 0x55c8728 [0089.149] wcscpy (in: _Dest=0x55c8728, _Source="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" [0089.149] wcscat (in: _Dest=0x55c8728, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.mailto[knoocknoo@cock.li].a0a70" [0089.149] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1a4ff794, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.149] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x3975270 Thread: id = 680 os_tid = 0x19cc [0075.374] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 0x20 [0080.029] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx", dwFileAttributes=0x20) returned 1 [0080.040] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14ec [0080.041] GetFileSizeEx (in: hFile=0x14ec, lpFileSize=0x1a57f8d8 | out: lpFileSize=0x1a57f8d8*=69632) returned 1 [0080.041] SetFilePointerEx (in: hFile=0x14ec, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.041] ReadFile (in: hFile=0x14ec, lpBuffer=0x1a57f85c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1a57f858, lpOverlapped=0x0 | out: lpBuffer=0x1a57f85c*, lpNumberOfBytesRead=0x1a57f858*=0x4, lpOverlapped=0x0) returned 1 [0080.047] SetFilePointerEx (in: hFile=0x14ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.047] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a10c8 [0080.047] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a13c0 [0080.047] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a11b8 [0080.047] NtQuerySystemTime (in: CurrentTime=0x1a57f838 | out: CurrentTime=0x1a57f838*=132260136372004926) returned 0x0 [0080.047] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0xab02f1b2 [0080.047] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0xe035ea05 [0080.047] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0x28bac864 [0080.047] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0xc6ee2853 [0080.047] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0xea80ea7d [0080.047] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0xabe289e9 [0080.047] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0xa9ec526b [0080.047] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0xbb34fb20 [0080.047] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0xae43995c [0080.048] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0x56e3b44d [0080.048] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0x45724736 [0080.048] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0xb042dff1 [0080.048] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0xc4d25a4b [0080.048] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0x800c6c9f [0080.048] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0x3c6a2e46 [0080.048] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0x5c6edb8 [0080.048] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0x4407edb7 [0080.048] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0xa5b5ecd [0080.048] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0xfa82104e [0080.048] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0x82f1522b [0080.048] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0xd53f0d26 [0080.048] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0x9735a153 [0080.048] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0x5027d885 [0080.048] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0x92c25e4a [0080.048] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0x9becdf1c [0080.048] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0xbee47c3b [0080.048] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0xd6866856 [0080.048] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0xea8dcb4c [0080.048] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0x4724917c [0080.048] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0xf5bd1139 [0080.048] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0x1ddb5e87 [0080.048] RtlRandom (in: Seed=0x1a57f844 | out: Seed=0x1a57f844) returned 0x27717817 [0080.057] SetFilePointerEx (in: hFile=0x14ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.058] ReadFile (in: hFile=0x14ec, lpBuffer=0x7420078, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1a57f818, lpOverlapped=0x0 | out: lpBuffer=0x7420078*, lpNumberOfBytesRead=0x1a57f818*=0xc800, lpOverlapped=0x0) returned 1 [0080.059] SetFilePointerEx (in: hFile=0x14ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.059] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x7412f58 [0080.059] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5eedcf0 [0080.059] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a14b0 [0080.059] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a14b0) returned 1 [0080.059] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x742c880 [0080.063] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1438 [0080.063] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1460 [0080.063] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1460) returned 1 [0080.063] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eedcf0) returned 1 [0080.063] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7412f58) returned 1 [0080.063] WriteFile (in: hFile=0x14ec, lpBuffer=0x742c880*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1a57f818, lpOverlapped=0x0 | out: lpBuffer=0x742c880*, lpNumberOfBytesWritten=0x1a57f818*=0xc800, lpOverlapped=0x0) returned 1 [0083.095] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x742c880) returned 1 [0085.111] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7420078) returned 1 [0085.111] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x67) returned 0x5468630 [0085.111] SetFilePointerEx (in: hFile=0x14ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.111] WriteFile (in: hFile=0x14ec, lpBuffer=0x757db00*, nNumberOfBytesToWrite=0x14b, lpNumberOfBytesWritten=0x1a57f898, lpOverlapped=0x0 | out: lpBuffer=0x757db00*, lpNumberOfBytesWritten=0x1a57f898*=0x14b, lpOverlapped=0x0) returned 1 [0088.957] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757db00) returned 1 [0089.111] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5468710) returned 1 [0089.111] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e3ff8) returned 1 [0089.111] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5468630) returned 1 [0089.111] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1438) returned 1 [0089.111] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a13c0) returned 1 [0089.111] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a13e8) returned 1 [0089.111] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1410) returned 1 [0089.111] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xac) returned 0x55c8670 [0089.111] wcscpy (in: _Dest=0x55c8670, _Source="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" [0089.111] wcscat (in: _Dest=0x55c8670, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.mailto[knoocknoo@cock.li].a0a70" [0089.111] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1a57f850, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.111] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x53f72d0 Thread: id = 681 os_tid = 0x19d0 [0075.375] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 0x20 [0080.011] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0080.028] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14e8 [0080.028] GetFileSizeEx (in: hFile=0x14e8, lpFileSize=0x1a5ffb0c | out: lpFileSize=0x1a5ffb0c*=69632) returned 1 [0080.028] SetFilePointerEx (in: hFile=0x14e8, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.028] ReadFile (in: hFile=0x14e8, lpBuffer=0x1a5ffa90, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1a5ffa8c, lpOverlapped=0x0 | out: lpBuffer=0x1a5ffa90*, lpNumberOfBytesRead=0x1a5ffa8c*=0x4, lpOverlapped=0x0) returned 1 [0080.030] SetFilePointerEx (in: hFile=0x14e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.030] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e680 [0080.030] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1348 [0080.030] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1410 [0080.030] NtQuerySystemTime (in: CurrentTime=0x1a5ffa6c | out: CurrentTime=0x1a5ffa6c*=132260136371848029) returned 0x0 [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0x9aae9931 [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0x7efaa1ef [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0xe00a240 [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0xd86865b7 [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0xe90f3d96 [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0x3843b78e [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0xf5331ac0 [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0x6cee9b5f [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0xd524effc [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0xf178709e [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0xe282df5a [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0x4f933c5 [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0x5c49dcc6 [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0x5eb2226 [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0x9b5a10be [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0xffc1283 [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0x49de3a69 [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0x8282dce1 [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0x80dd32f7 [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0x93c0f0ae [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0xd40b8fb8 [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0x246e2bfa [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0xf3894017 [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0x8cbec69 [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0xb2fdd5d6 [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0xf9e2c9ad [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0x48127a05 [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0x7863e6dd [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0xfb597ad2 [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0x188c424d [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0xfa64928a [0080.030] RtlRandom (in: Seed=0x1a5ffa78 | out: Seed=0x1a5ffa78) returned 0x68e2c93c [0080.040] SetFilePointerEx (in: hFile=0x14e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.040] ReadFile (in: hFile=0x14e8, lpBuffer=0x7406060, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1a5ffa4c, lpOverlapped=0x0 | out: lpBuffer=0x7406060*, lpNumberOfBytesRead=0x1a5ffa4c*=0xc800, lpOverlapped=0x0) returned 1 [0080.041] SetFilePointerEx (in: hFile=0x14e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.041] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x7413588 [0080.041] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5eee0b0 [0080.041] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a12a8 [0080.041] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a12a8) returned 1 [0080.042] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x7413870 [0080.046] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1488 [0080.046] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a11e0 [0080.046] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a11e0) returned 1 [0080.046] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee0b0) returned 1 [0080.046] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7413588) returned 1 [0080.046] WriteFile (in: hFile=0x14e8, lpBuffer=0x7413870*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1a5ffa4c, lpOverlapped=0x0 | out: lpBuffer=0x7413870*, lpNumberOfBytesWritten=0x1a5ffa4c*=0xc800, lpOverlapped=0x0) returned 1 [0083.096] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7413870) returned 1 [0085.109] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7406060) returned 1 [0085.109] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7f) returned 0x39769a0 [0085.109] SetFilePointerEx (in: hFile=0x14e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.109] WriteFile (in: hFile=0x14e8, lpBuffer=0x757d990*, nNumberOfBytesToWrite=0x163, lpNumberOfBytesWritten=0x1a5ffacc, lpOverlapped=0x0 | out: lpBuffer=0x757d990*, lpNumberOfBytesWritten=0x1a5ffacc*=0x163, lpOverlapped=0x0) returned 1 [0088.959] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757d990) returned 1 [0089.110] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3976bc0) returned 1 [0089.110] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e3e40) returned 1 [0089.110] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39769a0) returned 1 [0089.110] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1488) returned 1 [0089.110] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1348) returned 1 [0089.110] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1370) returned 1 [0089.110] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1398) returned 1 [0089.110] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x53f7200 [0089.110] wcscpy (in: _Dest=0x53f7200, _Source="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" [0089.110] wcscat (in: _Dest=0x53f7200, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70" [0089.111] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1a5ffa84, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.111] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x54f17d0 Thread: id = 682 os_tid = 0x19d4 [0075.376] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 0x20 [0079.983] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0080.004] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14e4 [0080.010] GetFileSizeEx (in: hFile=0x14e4, lpFileSize=0x1a67fcc0 | out: lpFileSize=0x1a67fcc0*=69632) returned 1 [0080.010] SetFilePointerEx (in: hFile=0x14e4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.010] ReadFile (in: hFile=0x14e4, lpBuffer=0x1a67fc44, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1a67fc40, lpOverlapped=0x0 | out: lpBuffer=0x1a67fc44*, lpNumberOfBytesRead=0x1a67fc40*=0x4, lpOverlapped=0x0) returned 1 [0080.012] SetFilePointerEx (in: hFile=0x14e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.012] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e680 [0080.012] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e7c0 [0080.012] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e7e8 [0080.012] NtQuerySystemTime (in: CurrentTime=0x1a67fc20 | out: CurrentTime=0x1a67fc20*=132260136371698642) returned 0x0 [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0xd0c548a6 [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0x6576d9db [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0xa403b486 [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0x1ab95779 [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0xfbe2fe92 [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0x221adccc [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0x60bdd879 [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0x8408f1cb [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0xf54c7475 [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0xffc46a26 [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0x4bf9d87e [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0xb0c12fc2 [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0xfd0ac607 [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0x52acf90e [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0xbd306ff2 [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0xeb9f10f3 [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0xb0a921db [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0x26f840ab [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0xeecbf47d [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0xd6d81421 [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0x203bc97 [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0x73d93636 [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0x64b47a2e [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0xb64f531e [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0x1b3f23d3 [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0xf65f0290 [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0x79f6c688 [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0x4d6e898c [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0x6153f762 [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0xabf39f39 [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0x6c563887 [0080.012] RtlRandom (in: Seed=0x1a67fc2c | out: Seed=0x1a67fc2c) returned 0x8fb5bf22 [0080.022] SetFilePointerEx (in: hFile=0x14e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.022] ReadFile (in: hFile=0x14e4, lpBuffer=0x73ed050, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1a67fc00, lpOverlapped=0x0 | out: lpBuffer=0x73ed050*, lpNumberOfBytesRead=0x1a67fc00*=0xc800, lpOverlapped=0x0) returned 1 [0080.023] SetFilePointerEx (in: hFile=0x14e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.023] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x73a1798 [0080.023] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5eedcf0 [0080.023] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e680 [0080.023] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e680) returned 1 [0080.024] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x73f9858 [0080.027] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e7e8 [0080.027] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e680 [0080.028] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e680) returned 1 [0080.028] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eedcf0) returned 1 [0080.028] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1798) returned 1 [0080.028] WriteFile (in: hFile=0x14e4, lpBuffer=0x73f9858*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1a67fc00, lpOverlapped=0x0 | out: lpBuffer=0x73f9858*, lpNumberOfBytesWritten=0x1a67fc00*=0xc800, lpOverlapped=0x0) returned 1 [0087.561] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73f9858) Thread: id = 683 os_tid = 0x19d8 [0075.378] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 0x20 [0079.966] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0079.966] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14e0 [0079.977] GetFileSizeEx (in: hFile=0x14e0, lpFileSize=0x1a6ffd2c | out: lpFileSize=0x1a6ffd2c*=69632) returned 1 [0079.977] SetFilePointerEx (in: hFile=0x14e0, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.977] ReadFile (in: hFile=0x14e0, lpBuffer=0x1a6ffcb0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1a6ffcac, lpOverlapped=0x0 | out: lpBuffer=0x1a6ffcb0*, lpNumberOfBytesRead=0x1a6ffcac*=0x4, lpOverlapped=0x0) returned 1 [0079.983] SetFilePointerEx (in: hFile=0x14e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.984] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e630 [0079.984] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e798 [0079.984] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e680 [0079.984] NtQuerySystemTime (in: CurrentTime=0x1a6ffc8c | out: CurrentTime=0x1a6ffc8c*=132260136371379190) returned 0x0 [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0x9892b377 [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0x85149cf1 [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0x825c51ee [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0xb89d5fc0 [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0x9b83a098 [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0x38004145 [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0xc8b12812 [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0x12514aaa [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0xff3945fb [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0x3948cde9 [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0xc22037a6 [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0x12c54705 [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0xd07a7236 [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0xbb2e4ffa [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0x239af6b5 [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0xa54efff8 [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0xa781a70f [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0x9d339d0c [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0xc63f0dd1 [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0x5ebf014 [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0xc0c14543 [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0x9b4ba67e [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0xe2006c6 [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0xdadb97c4 [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0x29fbbfbf [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0x62aee344 [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0xefd81dee [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0x1944ae82 [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0x4f6f8a2c [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0x894c3516 [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0x564e757 [0079.984] RtlRandom (in: Seed=0x1a6ffc98 | out: Seed=0x1a6ffc98) returned 0x4b2330d9 [0079.994] SetFilePointerEx (in: hFile=0x14e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.994] ReadFile (in: hFile=0x14e0, lpBuffer=0x73d4040, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1a6ffc6c, lpOverlapped=0x0 | out: lpBuffer=0x73d4040*, lpNumberOfBytesRead=0x1a6ffc6c*=0xc800, lpOverlapped=0x0) returned 1 [0080.005] SetFilePointerEx (in: hFile=0x14e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.005] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x73a1798 [0080.005] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5eedd68 [0080.005] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e630 [0080.005] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e630) returned 1 [0080.006] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x73e0848 [0080.010] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e630 [0080.010] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e7c0 [0080.010] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e7c0) returned 1 [0080.010] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eedd68) returned 1 [0080.010] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1798) returned 1 [0080.010] WriteFile (in: hFile=0x14e0, lpBuffer=0x73e0848*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1a6ffc6c, lpOverlapped=0x0 | out: lpBuffer=0x73e0848*, lpNumberOfBytesWritten=0x1a6ffc6c*=0xc800, lpOverlapped=0x0) returned 1 [0083.075] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73e0848) returned 1 [0085.309] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73d4040) returned 1 [0085.309] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x75) returned 0x38d16a0 [0085.309] SetFilePointerEx (in: hFile=0x14e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.309] WriteFile (in: hFile=0x14e0, lpBuffer=0x757dc58*, nNumberOfBytesToWrite=0x159, lpNumberOfBytesWritten=0x1a6ffcec, lpOverlapped=0x0 | out: lpBuffer=0x757dc58*, lpNumberOfBytesWritten=0x1a6ffcec*=0x159, lpOverlapped=0x0) returned 1 [0088.991] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757dc58) returned 1 [0089.052] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38d1a20) returned 1 [0089.052] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe215d90) returned 1 [0089.052] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38d16a0) returned 1 [0089.052] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e630) returned 1 [0089.052] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e798) returned 1 [0089.052] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e720) returned 1 [0089.053] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e748) returned 1 [0089.053] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x39750e0 [0089.053] wcscpy (in: _Dest=0x39750e0, _Source="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" [0089.053] wcscat (in: _Dest=0x39750e0, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70" [0089.053] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1a6ffca4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.053] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x757f190 Thread: id = 684 os_tid = 0x19dc [0075.379] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 0x20 [0079.964] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx", dwFileAttributes=0x20) returned 1 [0079.964] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14dc [0079.964] GetFileSizeEx (in: hFile=0x14dc, lpFileSize=0x1a77f7fc | out: lpFileSize=0x1a77f7fc*=69632) returned 1 [0079.964] SetFilePointerEx (in: hFile=0x14dc, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.964] ReadFile (in: hFile=0x14dc, lpBuffer=0x1a77f780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1a77f77c, lpOverlapped=0x0 | out: lpBuffer=0x1a77f780*, lpNumberOfBytesRead=0x1a77f77c*=0x4, lpOverlapped=0x0) returned 1 [0079.966] SetFilePointerEx (in: hFile=0x14dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.967] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e748 [0079.967] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e5b8 [0079.967] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e7c0 [0079.967] NtQuerySystemTime (in: CurrentTime=0x1a77f75c | out: CurrentTime=0x1a77f75c*=132260136371237151) returned 0x0 [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0x487c7121 [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0xab481d2d [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0x3b5a59d4 [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0x3efad9de [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0x489245b7 [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0x45a26701 [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0x5fb882d1 [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0x60e40544 [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0x6730d9f1 [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0xe3753937 [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0xaf6d084d [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0x1fbfe27 [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0xd680b9da [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0x3a11319d [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0x99e5eda4 [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0xef9b230a [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0x929242db [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0x20062c91 [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0xb9e211d7 [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0xa7f02d74 [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0x2da5f4d5 [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0xa032168 [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0xdc62d384 [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0xd21baef [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0xcbe8d261 [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0xee33b550 [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0x1ee93714 [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0x8142bdb4 [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0x7c587548 [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0x4110e9d0 [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0x8aea71f9 [0079.967] RtlRandom (in: Seed=0x1a77f768 | out: Seed=0x1a77f768) returned 0xd371f8ae [0079.977] SetFilePointerEx (in: hFile=0x14dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.977] ReadFile (in: hFile=0x14dc, lpBuffer=0x73bb030, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1a77f73c, lpOverlapped=0x0 | out: lpBuffer=0x73bb030*, lpNumberOfBytesRead=0x1a77f73c*=0xc800, lpOverlapped=0x0) returned 1 [0079.978] SetFilePointerEx (in: hFile=0x14dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.978] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x73a1630 [0079.978] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5eedf48 [0079.978] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e608 [0079.978] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e608) returned 1 [0079.979] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x73c7838 [0079.982] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e608 [0079.982] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e798 [0079.982] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e798) returned 1 [0079.982] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eedf48) returned 1 [0079.982] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1630) returned 1 [0079.982] WriteFile (in: hFile=0x14dc, lpBuffer=0x73c7838*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1a77f73c, lpOverlapped=0x0 | out: lpBuffer=0x73c7838*, lpNumberOfBytesWritten=0x1a77f73c*=0xc800, lpOverlapped=0x0) returned 1 [0083.061] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73c7838) returned 1 [0085.315] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73bb030) returned 1 [0085.315] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x65) returned 0x5468b70 [0085.315] SetFilePointerEx (in: hFile=0x14dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.315] WriteFile (in: hFile=0x14dc, lpBuffer=0x757df60*, nNumberOfBytesToWrite=0x149, lpNumberOfBytesWritten=0x1a77f7bc, lpOverlapped=0x0 | out: lpBuffer=0x757df60*, lpNumberOfBytesWritten=0x1a77f7bc*=0x149, lpOverlapped=0x0) returned 1 [0088.993] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757df60) returned 1 [0089.052] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5468be0) returned 1 [0089.052] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe215f70) returned 1 [0089.052] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5468b70) returned 1 [0089.052] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e608) returned 1 [0089.052] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e5b8) returned 1 [0089.052] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e6f8) returned 1 [0089.052] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e5e0) returned 1 [0089.052] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xaa) returned 0x55c8448 [0089.052] wcscpy (in: _Dest=0x55c8448, _Source="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" [0089.052] wcscat (in: _Dest=0x55c8448, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.mailto[knoocknoo@cock.li].a0a70" [0089.052] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1a77f774, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.052] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x3974f50 Thread: id = 685 os_tid = 0x19e0 [0075.380] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 0x20 [0079.929] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", dwFileAttributes=0x20) returned 1 [0079.929] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14d8 [0079.930] GetFileSizeEx (in: hFile=0x14d8, lpFileSize=0x1a7ffe3c | out: lpFileSize=0x1a7ffe3c*=69632) returned 1 [0079.930] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.930] ReadFile (in: hFile=0x14d8, lpBuffer=0x1a7ffdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1a7ffdbc, lpOverlapped=0x0 | out: lpBuffer=0x1a7ffdc0*, lpNumberOfBytesRead=0x1a7ffdbc*=0x4, lpOverlapped=0x0) returned 1 [0079.942] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.942] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e360 [0079.942] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e568 [0079.942] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e770 [0079.942] NtQuerySystemTime (in: CurrentTime=0x1a7ffd9c | out: CurrentTime=0x1a7ffd9c*=132260136371066828) returned 0x0 [0079.942] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0xdbc2947e [0079.942] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0xd9d6f1 [0079.942] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0xca5584e6 [0079.942] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0xaa58b555 [0079.942] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0x26259b3e [0079.942] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0x5f8007d7 [0079.942] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0x2bea07df [0079.942] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0x7ec4582a [0079.943] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0xfb95a1d2 [0079.943] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0x73e1b7f1 [0079.943] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0xc8597272 [0079.943] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0x4f187f27 [0079.943] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0x3dfc9da9 [0079.943] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0xe466f36 [0079.943] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0xcce470c0 [0079.943] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0x9720a7c2 [0079.943] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0x67036f1b [0079.943] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0x5adc0cb6 [0079.943] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0x143017d4 [0079.943] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0xb91022a6 [0079.943] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0x50c9008a [0079.943] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0xb27e05b0 [0079.943] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0x789ce148 [0079.943] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0x81d0302a [0079.943] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0xa6f14dd9 [0079.943] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0x376f55b6 [0079.943] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0xef3cb892 [0079.943] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0xdbe27aff [0079.943] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0x1cbf4c2d [0079.943] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0xb9307738 [0079.943] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0xc363741d [0079.943] RtlRandom (in: Seed=0x1a7ffda8 | out: Seed=0x1a7ffda8) returned 0xd6bf014c [0079.952] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.953] ReadFile (in: hFile=0x14d8, lpBuffer=0x7394810, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1a7ffd7c, lpOverlapped=0x0 | out: lpBuffer=0x7394810*, lpNumberOfBytesRead=0x1a7ffd7c*=0xc800, lpOverlapped=0x0) returned 1 [0079.959] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.959] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x73a1438 [0079.959] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5eedcf0 [0079.959] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e770 [0079.959] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e770) returned 1 [0079.960] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x73ae828 [0079.963] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e770 [0079.963] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e680 [0079.963] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e680) returned 1 [0079.963] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eedcf0) returned 1 [0079.963] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a1438) returned 1 [0079.963] WriteFile (in: hFile=0x14d8, lpBuffer=0x73ae828*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1a7ffd7c, lpOverlapped=0x0 | out: lpBuffer=0x73ae828*, lpNumberOfBytesWritten=0x1a7ffd7c*=0xc800, lpOverlapped=0x0) returned 1 [0083.061] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73ae828) returned 1 [0085.313] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7394810) returned 1 [0085.313] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb1) returned 0x5b16010 [0085.313] SetFilePointerEx (in: hFile=0x14d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.313] WriteFile (in: hFile=0x14d8, lpBuffer=0x757ddc0*, nNumberOfBytesToWrite=0x195, lpNumberOfBytesWritten=0x1a7ffdfc, lpOverlapped=0x0 | out: lpBuffer=0x757ddc0*, lpNumberOfBytesWritten=0x1a7ffdfc*=0x195, lpOverlapped=0x0) returned 1 [0088.995] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757ddc0) returned 1 [0089.051] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5b16cd0) returned 1 [0089.051] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe215f48) returned 1 [0089.051] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5b16010) returned 1 [0089.051] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e770) returned 1 [0089.051] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e568) returned 1 [0089.051] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e6d0) returned 1 [0089.051] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e590) returned 1 [0089.051] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf6) returned 0x5ba27f8 [0089.051] wcscpy (in: _Dest=0x5ba27f8, _Source="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" [0089.051] wcscat (in: _Dest=0x5ba27f8, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.mailto[knoocknoo@cock.li].a0a70" [0089.051] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1a7ffdb4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.051] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10c) returned 0x757a498 Thread: id = 686 os_tid = 0x19e4 [0075.391] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5d58 [0075.391] wcscpy (in: _Dest=0x38a5d58, _Source="C:\\Users\\FD1HVy\\AppData\\Local" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local") returned="C:\\Users\\FD1HVy\\AppData\\Local" [0075.391] wcscat (in: _Dest=0x38a5d58, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\" [0075.391] wcscat (in: _Dest=0x38a5d58, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\*") returned="C:\\Users\\FD1HVy\\AppData\\Local\\*" [0075.391] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393d3b0 [0075.391] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\*", lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb6f6a4d1, ftLastAccessTime.dwHighDateTime=0x1d5d815, ftLastWriteTime.dwLowDateTime=0xb6f6a4d1, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e900 [0075.391] wcscmp (_String1=".", _String2=".") returned 0 [0075.391] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb6f6a4d1, ftLastAccessTime.dwHighDateTime=0x1d5d815, ftLastWriteTime.dwLowDateTime=0xb6f6a4d1, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.392] wcscmp (_String1="..", _String2=".") returned 1 [0075.392] wcscmp (_String1="..", _String2="..") returned 0 [0075.392] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa96a60b1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4462fde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa96a60b1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveSync", cAlternateFileName="ACTIVE~1")) returned 1 [0075.392] wcscmp (_String1="ActiveSync", _String2=".") returned 1 [0075.392] wcscmp (_String1="ActiveSync", _String2="..") returned 1 [0075.392] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x38b6548 [0075.392] wcscpy (in: _Dest=0x38b6548, _Source="C:\\Users\\FD1HVy\\AppData\\Local" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local") returned="C:\\Users\\FD1HVy\\AppData\\Local" [0075.392] wcscat (in: _Dest=0x38b6548, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\" [0075.392] wcscat (in: _Dest=0x38b6548, _Source="ActiveSync" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\ActiveSync") returned="C:\\Users\\FD1HVy\\AppData\\Local\\ActiveSync" [0075.785] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b6548, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xce4 [0075.785] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0075.785] wcscmp (_String1="Adobe", _String2=".") returned 1 [0075.785] wcscmp (_String1="Adobe", _String2="..") returned 1 [0075.786] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x5533e80 [0075.786] wcscpy (in: _Dest=0x5533e80, _Source="C:\\Users\\FD1HVy\\AppData\\Local" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local") returned="C:\\Users\\FD1HVy\\AppData\\Local" [0075.786] wcscat (in: _Dest=0x5533e80, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\" [0075.786] wcscat (in: _Dest=0x5533e80, _Source="Adobe" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe" [0075.786] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5533e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd38 [0075.786] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0075.786] wcscmp (_String1="Application Data", _String2=".") returned 1 [0075.786] wcscmp (_String1="Application Data", _String2="..") returned 1 [0075.786] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x38fc640 [0075.786] wcscpy (in: _Dest=0x38fc640, _Source="C:\\Users\\FD1HVy\\AppData\\Local" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local") returned="C:\\Users\\FD1HVy\\AppData\\Local" [0075.786] wcscat (in: _Dest=0x38fc640, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\" [0075.787] wcscat (in: _Dest=0x38fc640, _Source="Application Data" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Application Data") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Application Data" [0075.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38fc640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd3c [0075.787] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CEF", cAlternateFileName="")) returned 1 [0075.787] wcscmp (_String1="CEF", _String2=".") returned 1 [0075.787] wcscmp (_String1="CEF", _String2="..") returned 1 [0075.787] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x5533ed0 [0075.787] wcscpy (in: _Dest=0x5533ed0, _Source="C:\\Users\\FD1HVy\\AppData\\Local" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local") returned="C:\\Users\\FD1HVy\\AppData\\Local" [0075.787] wcscat (in: _Dest=0x5533ed0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\" [0075.787] wcscat (in: _Dest=0x5533ed0, _Source="CEF" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\CEF") returned="C:\\Users\\FD1HVy\\AppData\\Local\\CEF" [0075.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5533ed0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd40 [0075.788] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a165bd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc46ec579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x476c0de7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Comms", cAlternateFileName="")) returned 1 [0075.788] wcscmp (_String1="Comms", _String2=".") returned 1 [0075.788] wcscmp (_String1="Comms", _String2="..") returned 1 [0075.788] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x5533f20 [0075.788] wcscpy (in: _Dest=0x5533f20, _Source="C:\\Users\\FD1HVy\\AppData\\Local" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local") returned="C:\\Users\\FD1HVy\\AppData\\Local" [0075.788] wcscat (in: _Dest=0x5533f20, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\" [0075.788] wcscat (in: _Dest=0x5533f20, _Source="Comms" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Comms") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Comms" [0075.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5533f20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd44 [0075.789] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc58b9bba, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc58b9bba, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc58b9bba, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ConnectedDevicesPlatform", cAlternateFileName="CONNEC~1")) returned 1 [0075.789] wcscmp (_String1="ConnectedDevicesPlatform", _String2=".") returned 1 [0075.789] wcscmp (_String1="ConnectedDevicesPlatform", _String2="..") returned 1 [0075.789] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6e) returned 0x5497430 [0075.789] wcscpy (in: _Dest=0x5497430, _Source="C:\\Users\\FD1HVy\\AppData\\Local" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local") returned="C:\\Users\\FD1HVy\\AppData\\Local" [0075.789] wcscat (in: _Dest=0x5497430, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\" [0075.789] wcscat (in: _Dest=0x5497430, _Source="ConnectedDevicesPlatform" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform") returned="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform" [0075.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5497430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd48 [0075.790] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a3bd622, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x7e3bdb64, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1 [0075.790] wcscmp (_String1="Google", _String2=".") returned 1 [0075.790] wcscmp (_String1="Google", _String2="..") returned 1 [0075.790] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x38ffe38 [0075.790] wcscpy (in: _Dest=0x38ffe38, _Source="C:\\Users\\FD1HVy\\AppData\\Local" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local") returned="C:\\Users\\FD1HVy\\AppData\\Local" [0075.790] wcscat (in: _Dest=0x38ffe38, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\" [0075.790] wcscat (in: _Dest=0x38ffe38, _Source="Google" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Google") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Google" [0075.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38ffe38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd4c [0075.791] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0075.791] wcscmp (_String1="History", _String2=".") returned 1 [0075.791] wcscmp (_String1="History", _String2="..") returned 1 [0075.791] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x38fff98 [0075.791] wcscpy (in: _Dest=0x38fff98, _Source="C:\\Users\\FD1HVy\\AppData\\Local" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local") returned="C:\\Users\\FD1HVy\\AppData\\Local" [0075.791] wcscat (in: _Dest=0x38fff98, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\" [0075.791] wcscat (in: _Dest=0x38fff98, _Source="History" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\History") returned="C:\\Users\\FD1HVy\\AppData\\Local\\History" [0075.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38fff98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd50 [0075.791] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4a3b706e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x4a3b706e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd17602f9, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0x13141, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1 [0075.791] wcscmp (_String1="IconCache.db", _String2=".") returned 1 [0075.791] wcscmp (_String1="IconCache.db", _String2="..") returned 1 [0075.791] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xeff5a990, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xeff5a990, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0075.791] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0075.792] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0075.792] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x3900048 [0075.792] wcscpy (in: _Dest=0x3900048, _Source="C:\\Users\\FD1HVy\\AppData\\Local" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local") returned="C:\\Users\\FD1HVy\\AppData\\Local" [0075.792] wcscat (in: _Dest=0x3900048, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\" [0075.792] wcscat (in: _Dest=0x3900048, _Source="Microsoft" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft" [0075.792] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3900048) returned 1 [0075.792] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc895324f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd6772beb, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MicrosoftEdge", cAlternateFileName="MICROS~2")) returned 1 [0075.792] wcscmp (_String1="MicrosoftEdge", _String2=".") returned 1 [0075.792] wcscmp (_String1="MicrosoftEdge", _String2="..") returned 1 [0075.792] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x38b6608 [0075.792] wcscpy (in: _Dest=0x38b6608, _Source="C:\\Users\\FD1HVy\\AppData\\Local" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local") returned="C:\\Users\\FD1HVy\\AppData\\Local" [0075.792] wcscat (in: _Dest=0x38b6608, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\" [0075.792] wcscat (in: _Dest=0x38b6608, _Source="MicrosoftEdge" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge" [0075.792] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b6608, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd54 [0075.793] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa9067e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfa9067e6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x190eac40, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0075.793] wcscmp (_String1="Mozilla", _String2=".") returned 1 [0075.793] wcscmp (_String1="Mozilla", _String2="..") returned 1 [0075.793] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x3900048 [0075.793] wcscpy (in: _Dest=0x3900048, _Source="C:\\Users\\FD1HVy\\AppData\\Local" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local") returned="C:\\Users\\FD1HVy\\AppData\\Local" [0075.793] wcscat (in: _Dest=0x3900048, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\" [0075.793] wcscat (in: _Dest=0x3900048, _Source="Mozilla" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla" [0075.793] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3900048) returned 1 [0075.793] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 1 [0075.793] wcscmp (_String1="Packages", _String2=".") returned 1 [0075.793] wcscmp (_String1="Packages", _String2="..") returned 1 [0075.793] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x3900048 [0075.793] wcscpy (in: _Dest=0x3900048, _Source="C:\\Users\\FD1HVy\\AppData\\Local" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local") returned="C:\\Users\\FD1HVy\\AppData\\Local" [0075.793] wcscat (in: _Dest=0x3900048, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\" [0075.793] wcscat (in: _Dest=0x3900048, _Source="Packages" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Packages") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Packages" [0075.793] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3900048) returned 1 [0075.793] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf9e1b08, ftCreationTime.dwHighDateTime=0x1d32734, ftLastAccessTime.dwLowDateTime=0xd2f40fba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xdf9e1b08, ftLastWriteTime.dwHighDateTime=0x1d32734, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PeerDistRepub", cAlternateFileName="PEERDI~1")) returned 1 [0075.793] wcscmp (_String1="PeerDistRepub", _String2=".") returned 1 [0075.793] wcscmp (_String1="PeerDistRepub", _String2="..") returned 1 [0075.793] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x38b6668 [0075.793] wcscpy (in: _Dest=0x38b6668, _Source="C:\\Users\\FD1HVy\\AppData\\Local" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local") returned="C:\\Users\\FD1HVy\\AppData\\Local" [0075.793] wcscat (in: _Dest=0x38b6668, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\" [0075.793] wcscat (in: _Dest=0x38b6668, _Source="PeerDistRepub" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\PeerDistRepub") returned="C:\\Users\\FD1HVy\\AppData\\Local\\PeerDistRepub" [0075.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b6668, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd58 [0075.794] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e09841, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2f421af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3e09841, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Publishers", cAlternateFileName="PUBLIS~1")) returned 1 [0075.794] wcscmp (_String1="Publishers", _String2=".") returned 1 [0075.794] wcscmp (_String1="Publishers", _String2="..") returned 1 [0075.794] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x38b6308 [0075.794] wcscpy (in: _Dest=0x38b6308, _Source="C:\\Users\\FD1HVy\\AppData\\Local" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local") returned="C:\\Users\\FD1HVy\\AppData\\Local" [0075.794] wcscat (in: _Dest=0x38b6308, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\" [0075.794] wcscat (in: _Dest=0x38b6308, _Source="Publishers" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Publishers") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Publishers" [0075.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b6308, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd5c [0075.795] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6f6a4d1, ftCreationTime.dwHighDateTime=0x1d5d815, ftLastAccessTime.dwLowDateTime=0xb6f6a4d1, ftLastAccessTime.dwHighDateTime=0x1d5d815, ftLastWriteTime.dwLowDateTime=0xb6f6a4d1, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0x1db5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Resmon.ResmonCfg", cAlternateFileName="RESMON~1.RES")) returned 1 [0075.795] wcscmp (_String1="Resmon.ResmonCfg", _String2=".") returned 1 [0075.795] wcscmp (_String1="Resmon.ResmonCfg", _String2="..") returned 1 [0075.795] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x38fcb88 [0075.795] wcscpy (in: _Dest=0x38fcb88, _Source="C:\\Users\\FD1HVy\\AppData\\Local" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local") returned="C:\\Users\\FD1HVy\\AppData\\Local" [0075.795] wcscat (in: _Dest=0x38fcb88, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\" [0075.795] wcscat (in: _Dest=0x38fcb88, _Source="Resmon.ResmonCfg" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Resmon.ResmonCfg") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Resmon.ResmonCfg" [0075.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fcb88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd60 [0075.796] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x91bf3c4e, ftLastAccessTime.dwHighDateTime=0x1d5e1e4, ftLastWriteTime.dwLowDateTime=0x91bf3c4e, ftLastWriteTime.dwHighDateTime=0x1d5e1e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0075.796] wcscmp (_String1="Temp", _String2=".") returned 1 [0075.796] wcscmp (_String1="Temp", _String2="..") returned 1 [0075.796] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x46) returned 0x5533f70 [0075.796] wcscpy (in: _Dest=0x5533f70, _Source="C:\\Users\\FD1HVy\\AppData\\Local" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local") returned="C:\\Users\\FD1HVy\\AppData\\Local" [0075.796] wcscat (in: _Dest=0x5533f70, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\" [0075.796] wcscat (in: _Dest=0x5533f70, _Source="Temp" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Temp") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp" [0075.796] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5533f70) returned 1 [0075.796] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0075.796] wcscmp (_String1="Temporary Internet Files", _String2=".") returned 1 [0075.796] wcscmp (_String1="Temporary Internet Files", _String2="..") returned 1 [0075.796] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6e) returned 0x5496cb0 [0075.796] wcscpy (in: _Dest=0x5496cb0, _Source="C:\\Users\\FD1HVy\\AppData\\Local" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local") returned="C:\\Users\\FD1HVy\\AppData\\Local" [0075.796] wcscat (in: _Dest=0x5496cb0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\" [0075.796] wcscat (in: _Dest=0x5496cb0, _Source="Temporary Internet Files" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Temporary Internet Files") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temporary Internet Files" [0075.796] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496cb0) returned 1 [0075.796] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cdbf8a7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd2fbd0ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3cdbf8a7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TileDataLayer", cAlternateFileName="TILEDA~1")) returned 1 [0075.796] wcscmp (_String1="TileDataLayer", _String2=".") returned 1 [0075.796] wcscmp (_String1="TileDataLayer", _String2="..") returned 1 [0075.796] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x543d4b8 [0075.796] wcscpy (in: _Dest=0x543d4b8, _Source="C:\\Users\\FD1HVy\\AppData\\Local" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local") returned="C:\\Users\\FD1HVy\\AppData\\Local" [0075.796] wcscat (in: _Dest=0x543d4b8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\" [0075.796] wcscat (in: _Dest=0x543d4b8, _Source="TileDataLayer" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer" [0075.796] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x543d4b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd64 [0075.797] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf56c97e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xd3023f2d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf56c97e4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UNP", cAlternateFileName="")) returned 1 [0075.797] wcscmp (_String1="UNP", _String2=".") returned 1 [0075.797] wcscmp (_String1="UNP", _String2="..") returned 1 [0075.797] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x5533f70 [0075.797] wcscpy (in: _Dest=0x5533f70, _Source="C:\\Users\\FD1HVy\\AppData\\Local" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local") returned="C:\\Users\\FD1HVy\\AppData\\Local" [0075.797] wcscat (in: _Dest=0x5533f70, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\" [0075.797] wcscat (in: _Dest=0x5533f70, _Source="UNP" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\UNP") returned="C:\\Users\\FD1HVy\\AppData\\Local\\UNP" [0075.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5533f70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd68 [0075.798] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a795684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd3024d82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a795684, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1 [0075.798] wcscmp (_String1="VirtualStore", _String2=".") returned 1 [0075.798] wcscmp (_String1="VirtualStore", _String2="..") returned 1 [0075.798] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x543d8d8 [0075.798] wcscpy (in: _Dest=0x543d8d8, _Source="C:\\Users\\FD1HVy\\AppData\\Local" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local") returned="C:\\Users\\FD1HVy\\AppData\\Local" [0075.798] wcscat (in: _Dest=0x543d8d8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\" [0075.798] wcscat (in: _Dest=0x543d8d8, _Source="VirtualStore" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore") returned="C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore" [0075.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x543d8d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd6c [0075.799] FindNextFileW (in: hFindFile=0x389e900, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a795684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd3024d82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a795684, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 0 [0075.799] FindClose (in: hFindFile=0x389e900 | out: hFindFile=0x389e900) returned 1 [0075.799] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393d3b0) returned 1 [0075.799] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5d58) returned 1 [0075.799] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5608) returned 1 Thread: id = 687 os_tid = 0x19e8 [0075.392] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x46) returned 0x5533e80 [0075.393] wcscpy (in: _Dest=0x5533e80, _Source="C:\\Users\\FD1HVy\\AppData\\LocalLow" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\LocalLow") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow" [0075.393] wcscat (in: _Dest=0x5533e80, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\LocalLow\\") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow\\" [0075.393] wcscat (in: _Dest=0x5533e80, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\LocalLow\\*") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow\\*" [0075.393] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5430750 [0075.393] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\LocalLow\\*", lpFindFileData=0x5430750 | out: lpFindFileData=0x5430750*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34f2b3d6, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb373310b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb373310b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e9c0 [0075.393] wcscmp (_String1=".", _String2=".") returned 0 [0075.393] FindNextFileW (in: hFindFile=0x389e9c0, lpFindFileData=0x5430750 | out: lpFindFileData=0x5430750*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34f2b3d6, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb373310b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb373310b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.393] wcscmp (_String1="..", _String2=".") returned 1 [0075.393] wcscmp (_String1="..", _String2="..") returned 0 [0075.393] FindNextFileW (in: hFindFile=0x389e9c0, lpFindFileData=0x5430750 | out: lpFindFileData=0x5430750*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7157dbce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7157dbce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7157dbce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0075.393] wcscmp (_String1="Adobe", _String2=".") returned 1 [0075.393] wcscmp (_String1="Adobe", _String2="..") returned 1 [0075.393] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x38ffee8 [0075.393] wcscpy (in: _Dest=0x38ffee8, _Source="C:\\Users\\FD1HVy\\AppData\\LocalLow" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\LocalLow") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow" [0075.393] wcscat (in: _Dest=0x38ffee8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\LocalLow\\") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow\\" [0075.393] wcscat (in: _Dest=0x38ffee8, _Source="Adobe" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe" [0075.781] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38ffee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xce8 [0075.782] FindNextFileW (in: hFindFile=0x389e9c0, lpFindFileData=0x5430750 | out: lpFindFileData=0x5430750*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xdfedb1f6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x63cde605, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x63cde605, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0075.782] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0075.782] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0075.782] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x38b6608 [0075.782] wcscpy (in: _Dest=0x38b6608, _Source="C:\\Users\\FD1HVy\\AppData\\LocalLow" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\LocalLow") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow" [0075.782] wcscat (in: _Dest=0x38b6608, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\LocalLow\\") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow\\" [0075.782] wcscat (in: _Dest=0x38b6608, _Source="Microsoft" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Microsoft") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Microsoft" [0075.782] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b6608) returned 1 [0075.782] FindNextFileW (in: hFindFile=0x389e9c0, lpFindFileData=0x5430750 | out: lpFindFileData=0x5430750*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfdd2edaa, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xaf813748, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0xaf813748, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0075.782] wcscmp (_String1="Mozilla", _String2=".") returned 1 [0075.782] wcscmp (_String1="Mozilla", _String2="..") returned 1 [0075.782] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x38b6608 [0075.782] wcscpy (in: _Dest=0x38b6608, _Source="C:\\Users\\FD1HVy\\AppData\\LocalLow" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\LocalLow") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow" [0075.782] wcscat (in: _Dest=0x38b6608, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\LocalLow\\") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow\\" [0075.782] wcscat (in: _Dest=0x38b6608, _Source="Mozilla" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Mozilla") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Mozilla" [0075.782] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b6608) returned 1 [0075.782] FindNextFileW (in: hFindFile=0x389e9c0, lpFindFileData=0x5430750 | out: lpFindFileData=0x5430750*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07402a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb07402a4, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb07402a4, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0075.782] wcscmp (_String1="Sun", _String2=".") returned 1 [0075.782] wcscmp (_String1="Sun", _String2="..") returned 1 [0075.782] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x38fff40 [0075.782] wcscpy (in: _Dest=0x38fff40, _Source="C:\\Users\\FD1HVy\\AppData\\LocalLow" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\LocalLow") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow" [0075.782] wcscat (in: _Dest=0x38fff40, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\LocalLow\\") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow\\" [0075.783] wcscat (in: _Dest=0x38fff40, _Source="Sun" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Sun") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Sun" [0075.783] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38fff40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd34 [0075.783] FindNextFileW (in: hFindFile=0x389e9c0, lpFindFileData=0x5430750 | out: lpFindFileData=0x5430750*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07402a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb07402a4, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb07402a4, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 0 [0075.784] FindClose (in: hFindFile=0x389e9c0 | out: hFindFile=0x389e9c0) returned 1 [0075.784] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5430750) returned 1 [0075.784] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5533e80) returned 1 [0075.784] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393fce8) returned 1 Thread: id = 688 os_tid = 0x19ec [0075.394] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x5533f20 [0075.394] wcscpy (in: _Dest=0x5533f20, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.394] wcscat (in: _Dest=0x5533f20, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.394] wcscat (in: _Dest=0x5533f20, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\*" [0075.394] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54309b8 [0075.394] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\*", lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x39dbebb0, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39dbebb0, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ee80 [0075.394] wcscmp (_String1=".", _String2=".") returned 0 [0075.394] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x39dbebb0, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x39dbebb0, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.394] wcscmp (_String1="..", _String2=".") returned 1 [0075.394] wcscmp (_String1="..", _String2="..") returned 0 [0075.394] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070c680, ftCreationTime.dwHighDateTime=0x1d5d3bc, ftLastAccessTime.dwLowDateTime=0xfdb59a90, ftLastAccessTime.dwHighDateTime=0x1d5d6f0, ftLastWriteTime.dwLowDateTime=0xfdb59a90, ftLastWriteTime.dwHighDateTime=0x1d5d6f0, nFileSizeHigh=0x0, nFileSizeLow=0x13bd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="-PIJHnObxa.mp4", cAlternateFileName="-PIJHN~1.MP4")) returned 1 [0075.394] wcscmp (_String1="-PIJHnObxa.mp4", _String2=".") returned -1 [0075.394] wcscmp (_String1="-PIJHnObxa.mp4", _String2="..") returned -1 [0075.394] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x38fcb20 [0075.394] wcscpy (in: _Dest=0x38fcb20, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.394] wcscat (in: _Dest=0x38fcb20, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.394] wcscat (in: _Dest=0x38fcb20, _Source="-PIJHnObxa.mp4" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\-PIJHnObxa.mp4") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\-PIJHnObxa.mp4" [0075.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fcb20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcec [0075.756] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19e93090, ftCreationTime.dwHighDateTime=0x1d5d0ad, ftLastAccessTime.dwLowDateTime=0x5904010, ftLastAccessTime.dwHighDateTime=0x1d5d54f, ftLastWriteTime.dwLowDateTime=0x5904010, ftLastWriteTime.dwHighDateTime=0x1d5d54f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="99ftgb5pOeGZKfxs_.gif", cAlternateFileName="99FTGB~1.GIF")) returned 1 [0075.756] wcscmp (_String1="99ftgb5pOeGZKfxs_.gif", _String2=".") returned 1 [0075.757] wcscmp (_String1="99ftgb5pOeGZKfxs_.gif", _String2="..") returned 1 [0075.757] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6c) returned 0x54974a8 [0075.757] wcscpy (in: _Dest=0x54974a8, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.757] wcscat (in: _Dest=0x54974a8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.757] wcscat (in: _Dest=0x54974a8, _Source="99ftgb5pOeGZKfxs_.gif" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\99ftgb5pOeGZKfxs_.gif") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\99ftgb5pOeGZKfxs_.gif" [0075.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54974a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x834 [0075.757] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf38e78f0, ftCreationTime.dwHighDateTime=0x1d5d3f0, ftLastAccessTime.dwLowDateTime=0xf9ba9840, ftLastAccessTime.dwHighDateTime=0x1d5d408, ftLastWriteTime.dwLowDateTime=0xf9ba9840, ftLastWriteTime.dwHighDateTime=0x1d5d408, nFileSizeHigh=0x0, nFileSizeLow=0x145d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aab5GVR.png", cAlternateFileName="")) returned 1 [0075.757] wcscmp (_String1="Aab5GVR.png", _String2=".") returned 1 [0075.757] wcscmp (_String1="Aab5GVR.png", _String2="..") returned 1 [0075.757] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x38b59a8 [0075.757] wcscpy (in: _Dest=0x38b59a8, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.757] wcscat (in: _Dest=0x38b59a8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.757] wcscat (in: _Dest=0x38b59a8, _Source="Aab5GVR.png" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Aab5GVR.png") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Aab5GVR.png" [0075.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b59a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b0 [0075.758] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7161656c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b7983c6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0075.758] wcscmp (_String1="Adobe", _String2=".") returned 1 [0075.758] wcscmp (_String1="Adobe", _String2="..") returned 1 [0075.758] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x38ffe90 [0075.758] wcscpy (in: _Dest=0x38ffe90, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.758] wcscat (in: _Dest=0x38ffe90, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.758] wcscat (in: _Dest=0x38ffe90, _Source="Adobe" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe" [0075.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38ffe90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ac [0075.759] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1560c90, ftCreationTime.dwHighDateTime=0x1d5d3b2, ftLastAccessTime.dwLowDateTime=0x91923230, ftLastAccessTime.dwHighDateTime=0x1d5d513, ftLastWriteTime.dwLowDateTime=0x91923230, ftLastWriteTime.dwHighDateTime=0x1d5d513, nFileSizeHigh=0x0, nFileSizeLow=0xde28, dwReserved0=0x0, dwReserved1=0x0, cFileName="BEhdate.mp4", cAlternateFileName="")) returned 1 [0075.759] wcscmp (_String1="BEhdate.mp4", _String2=".") returned 1 [0075.759] wcscmp (_String1="BEhdate.mp4", _String2="..") returned 1 [0075.759] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x38b5ac8 [0075.759] wcscpy (in: _Dest=0x38b5ac8, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.759] wcscat (in: _Dest=0x38b5ac8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.759] wcscat (in: _Dest=0x38b5ac8, _Source="BEhdate.mp4" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\BEhdate.mp4") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\BEhdate.mp4" [0075.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b5ac8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x590 [0075.760] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74c84f0, ftCreationTime.dwHighDateTime=0x1d5cb5d, ftLastAccessTime.dwLowDateTime=0x1dc8f5d0, ftLastAccessTime.dwHighDateTime=0x1d5cc5a, ftLastWriteTime.dwLowDateTime=0x1dc8f5d0, ftLastWriteTime.dwHighDateTime=0x1d5cc5a, nFileSizeHigh=0x0, nFileSizeLow=0x2ca5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BVw Kx kkPRD2Vat.bmp", cAlternateFileName="BVWKXK~1.BMP")) returned 1 [0075.760] wcscmp (_String1="BVw Kx kkPRD2Vat.bmp", _String2=".") returned 1 [0075.760] wcscmp (_String1="BVw Kx kkPRD2Vat.bmp", _String2="..") returned 1 [0075.760] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6a) returned 0x54973b8 [0075.760] wcscpy (in: _Dest=0x54973b8, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.760] wcscat (in: _Dest=0x54973b8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.760] wcscat (in: _Dest=0x54973b8, _Source="BVw Kx kkPRD2Vat.bmp" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\BVw Kx kkPRD2Vat.bmp") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\BVw Kx kkPRD2Vat.bmp" [0075.760] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54973b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c [0075.760] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dfa24e0, ftCreationTime.dwHighDateTime=0x1d5c7d4, ftLastAccessTime.dwLowDateTime=0x4d218f30, ftLastAccessTime.dwHighDateTime=0x1d5c8d2, ftLastWriteTime.dwLowDateTime=0x4d218f30, ftLastWriteTime.dwHighDateTime=0x1d5c8d2, nFileSizeHigh=0x0, nFileSizeLow=0xcfc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cEqV.mp3", cAlternateFileName="")) returned 1 [0075.761] wcscmp (_String1="cEqV.mp3", _String2=".") returned 1 [0075.761] wcscmp (_String1="cEqV.mp3", _String2="..") returned 1 [0075.761] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x38b5b88 [0075.761] wcscpy (in: _Dest=0x38b5b88, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.761] wcscat (in: _Dest=0x38b5b88, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.761] wcscat (in: _Dest=0x38b5b88, _Source="cEqV.mp3" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\cEqV.mp3") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\cEqV.mp3" [0075.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b5b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x584 [0075.761] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd90faf0, ftCreationTime.dwHighDateTime=0x1d5d4fc, ftLastAccessTime.dwLowDateTime=0x54c9a630, ftLastAccessTime.dwHighDateTime=0x1d5d1a8, ftLastWriteTime.dwLowDateTime=0x54c9a630, ftLastWriteTime.dwHighDateTime=0x1d5d1a8, nFileSizeHigh=0x0, nFileSizeLow=0x10023, dwReserved0=0x0, dwReserved1=0x0, cFileName="ekbflhqnblaZZXa.ods", cAlternateFileName="EKBFLH~1.ODS")) returned 1 [0075.761] wcscmp (_String1="ekbflhqnblaZZXa.ods", _String2=".") returned 1 [0075.761] wcscmp (_String1="ekbflhqnblaZZXa.ods", _String2="..") returned 1 [0075.761] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x68) returned 0x396df10 [0075.761] wcscpy (in: _Dest=0x396df10, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.761] wcscat (in: _Dest=0x396df10, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.761] wcscat (in: _Dest=0x396df10, _Source="ekbflhqnblaZZXa.ods" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\ekbflhqnblaZZXa.ods") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\ekbflhqnblaZZXa.ods" [0075.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396df10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x54c [0075.762] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bbf5460, ftCreationTime.dwHighDateTime=0x1d5d27a, ftLastAccessTime.dwLowDateTime=0x6c9cf750, ftLastAccessTime.dwHighDateTime=0x1d5d25f, ftLastWriteTime.dwLowDateTime=0x6c9cf750, ftLastWriteTime.dwHighDateTime=0x1d5d25f, nFileSizeHigh=0x0, nFileSizeLow=0xa8d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="eKVPy-9VMIEi JW.xlsx", cAlternateFileName="EKVPY-~1.XLS")) returned 1 [0075.762] wcscmp (_String1="eKVPy-9VMIEi JW.xlsx", _String2=".") returned 1 [0075.762] wcscmp (_String1="eKVPy-9VMIEi JW.xlsx", _String2="..") returned 1 [0075.762] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6a) returned 0x5497160 [0075.762] wcscpy (in: _Dest=0x5497160, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.762] wcscat (in: _Dest=0x5497160, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.762] wcscat (in: _Dest=0x5497160, _Source="eKVPy-9VMIEi JW.xlsx" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\eKVPy-9VMIEi JW.xlsx") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\eKVPy-9VMIEi JW.xlsx" [0075.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5497160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0075.763] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb3baf80, ftCreationTime.dwHighDateTime=0x1d5d7b0, ftLastAccessTime.dwLowDateTime=0x498063f0, ftLastAccessTime.dwHighDateTime=0x1d5c81f, ftLastWriteTime.dwLowDateTime=0x498063f0, ftLastWriteTime.dwHighDateTime=0x1d5c81f, nFileSizeHigh=0x0, nFileSizeLow=0xbf7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="fIxG.mp3", cAlternateFileName="")) returned 1 [0075.763] wcscmp (_String1="fIxG.mp3", _String2=".") returned 1 [0075.763] wcscmp (_String1="fIxG.mp3", _String2="..") returned 1 [0075.763] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x38b6188 [0075.763] wcscpy (in: _Dest=0x38b6188, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.763] wcscat (in: _Dest=0x38b6188, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.763] wcscat (in: _Dest=0x38b6188, _Source="fIxG.mp3" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\fIxG.mp3") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\fIxG.mp3" [0075.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b6188, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490 [0075.764] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffb40380, ftCreationTime.dwHighDateTime=0x1d5d11a, ftLastAccessTime.dwLowDateTime=0x4b026d0, ftLastAccessTime.dwHighDateTime=0x1d5c8fa, ftLastWriteTime.dwLowDateTime=0x4b026d0, ftLastWriteTime.dwHighDateTime=0x1d5c8fa, nFileSizeHigh=0x0, nFileSizeLow=0x18eed, dwReserved0=0x0, dwReserved1=0x0, cFileName="fLADy0S29O.gif", cAlternateFileName="FLADY0~1.GIF")) returned 1 [0075.764] wcscmp (_String1="fLADy0S29O.gif", _String2=".") returned 1 [0075.764] wcscmp (_String1="fLADy0S29O.gif", _String2="..") returned 1 [0075.764] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x38fcbf0 [0075.764] wcscpy (in: _Dest=0x38fcbf0, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.764] wcscat (in: _Dest=0x38fcbf0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.764] wcscat (in: _Dest=0x38fcbf0, _Source="fLADy0S29O.gif" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\fLADy0S29O.gif") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\fLADy0S29O.gif" [0075.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fcbf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x488 [0075.764] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45bf3f90, ftCreationTime.dwHighDateTime=0x1d5cdf9, ftLastAccessTime.dwLowDateTime=0xbc9ca580, ftLastAccessTime.dwHighDateTime=0x1d5d45c, ftLastWriteTime.dwLowDateTime=0xbc9ca580, ftLastWriteTime.dwHighDateTime=0x1d5d45c, nFileSizeHigh=0x0, nFileSizeLow=0xfc9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="gOZyzRovF2zpxf 3-.mkv", cAlternateFileName="GOZYZR~1.MKV")) returned 1 [0075.764] wcscmp (_String1="gOZyzRovF2zpxf 3-.mkv", _String2=".") returned 1 [0075.764] wcscmp (_String1="gOZyzRovF2zpxf 3-.mkv", _String2="..") returned 1 [0075.764] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6c) returned 0x54971d8 [0075.765] wcscpy (in: _Dest=0x54971d8, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.765] wcscat (in: _Dest=0x54971d8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.765] wcscat (in: _Dest=0x54971d8, _Source="gOZyzRovF2zpxf 3-.mkv" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\gOZyzRovF2zpxf 3-.mkv") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\gOZyzRovF2zpxf 3-.mkv" [0075.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54971d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x388 [0075.765] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe53a9b20, ftCreationTime.dwHighDateTime=0x1d5d180, ftLastAccessTime.dwLowDateTime=0x9b59b040, ftLastAccessTime.dwHighDateTime=0x1d5d013, ftLastWriteTime.dwLowDateTime=0x9b59b040, ftLastWriteTime.dwHighDateTime=0x1d5d013, nFileSizeHigh=0x0, nFileSizeLow=0x9ad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IfU Ay66B.mkv", cAlternateFileName="IFUAY6~1.MKV")) returned 1 [0075.765] wcscmp (_String1="IfU Ay66B.mkv", _String2=".") returned 1 [0075.765] wcscmp (_String1="IfU Ay66B.mkv", _String2="..") returned 1 [0075.765] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x38fd208 [0075.765] wcscpy (in: _Dest=0x38fd208, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.765] wcscat (in: _Dest=0x38fd208, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.765] wcscat (in: _Dest=0x38fd208, _Source="IfU Ay66B.mkv" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\IfU Ay66B.mkv") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\IfU Ay66B.mkv" [0075.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fd208, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a8 [0075.766] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e7c5580, ftCreationTime.dwHighDateTime=0x1d5d757, ftLastAccessTime.dwLowDateTime=0x7baba630, ftLastAccessTime.dwHighDateTime=0x1d5d249, ftLastWriteTime.dwLowDateTime=0x7baba630, ftLastWriteTime.dwHighDateTime=0x1d5d249, nFileSizeHigh=0x0, nFileSizeLow=0xb316, dwReserved0=0x0, dwReserved1=0x0, cFileName="Js5UIdrB.flv", cAlternateFileName="")) returned 1 [0075.766] wcscmp (_String1="Js5UIdrB.flv", _String2=".") returned 1 [0075.766] wcscmp (_String1="Js5UIdrB.flv", _String2="..") returned 1 [0075.766] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x38fd2d8 [0075.766] wcscpy (in: _Dest=0x38fd2d8, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.766] wcscat (in: _Dest=0x38fd2d8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.766] wcscat (in: _Dest=0x38fd2d8, _Source="Js5UIdrB.flv" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Js5UIdrB.flv") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Js5UIdrB.flv" [0075.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fd2d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414 [0075.767] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1759370, ftCreationTime.dwHighDateTime=0x1d5d2f9, ftLastAccessTime.dwLowDateTime=0xd6a5b2f0, ftLastAccessTime.dwHighDateTime=0x1d5cc6e, ftLastWriteTime.dwLowDateTime=0xd6a5b2f0, ftLastWriteTime.dwHighDateTime=0x1d5cc6e, nFileSizeHigh=0x0, nFileSizeLow=0x918d, dwReserved0=0x0, dwReserved1=0x0, cFileName="LNyQP4 UteiJh8ZnZVI.png", cAlternateFileName="LNYQP4~1.PNG")) returned 1 [0075.767] wcscmp (_String1="LNyQP4 UteiJh8ZnZVI.png", _String2=".") returned 1 [0075.767] wcscmp (_String1="LNyQP4 UteiJh8ZnZVI.png", _String2="..") returned 1 [0075.767] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5496e18 [0075.767] wcscpy (in: _Dest=0x5496e18, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.767] wcscat (in: _Dest=0x5496e18, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.767] wcscat (in: _Dest=0x5496e18, _Source="LNyQP4 UteiJh8ZnZVI.png" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\LNyQP4 UteiJh8ZnZVI.png") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\LNyQP4 UteiJh8ZnZVI.png" [0075.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5496e18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ac [0075.768] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cdcf0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd35c70fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe53cf090, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Macromedia", cAlternateFileName="MACROM~1")) returned 1 [0075.768] wcscmp (_String1="Macromedia", _String2=".") returned 1 [0075.768] wcscmp (_String1="Macromedia", _String2="..") returned 1 [0075.768] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x38b6248 [0075.768] wcscpy (in: _Dest=0x38b6248, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.768] wcscat (in: _Dest=0x38b6248, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.768] wcscat (in: _Dest=0x38b6248, _Source="Macromedia" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia" [0075.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b6248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcfc [0075.769] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0075.769] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0075.769] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0075.769] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x38b64e8 [0075.769] wcscpy (in: _Dest=0x38b64e8, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.769] wcscat (in: _Dest=0x38b64e8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.769] wcscat (in: _Dest=0x38b64e8, _Source="Microsoft" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft" [0075.769] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b64e8) returned 1 [0075.769] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0075.769] wcscmp (_String1="Mozilla", _String2=".") returned 1 [0075.769] wcscmp (_String1="Mozilla", _String2="..") returned 1 [0075.769] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x38ffe38 [0075.769] wcscpy (in: _Dest=0x38ffe38, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.769] wcscat (in: _Dest=0x38ffe38, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.769] wcscat (in: _Dest=0x38ffe38, _Source="Mozilla" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla" [0075.769] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ffe38) returned 1 [0075.769] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4a8f420, ftCreationTime.dwHighDateTime=0x1d5d726, ftLastAccessTime.dwLowDateTime=0x75738d60, ftLastAccessTime.dwHighDateTime=0x1d5d0db, ftLastWriteTime.dwLowDateTime=0x75738d60, ftLastWriteTime.dwHighDateTime=0x1d5d0db, nFileSizeHigh=0x0, nFileSizeLow=0x13c41, dwReserved0=0x0, dwReserved1=0x0, cFileName="PoTTHc0wj Mlp.mkv", cAlternateFileName="POTTHC~1.MKV")) returned 1 [0075.769] wcscmp (_String1="PoTTHc0wj Mlp.mkv", _String2=".") returned 1 [0075.769] wcscmp (_String1="PoTTHc0wj Mlp.mkv", _String2="..") returned 1 [0075.769] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x396dff0 [0075.769] wcscpy (in: _Dest=0x396dff0, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.769] wcscat (in: _Dest=0x396dff0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.769] wcscat (in: _Dest=0x396dff0, _Source="PoTTHc0wj Mlp.mkv" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\PoTTHc0wj Mlp.mkv") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\PoTTHc0wj Mlp.mkv" [0075.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396dff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd00 [0075.770] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf059d650, ftCreationTime.dwHighDateTime=0x1d5d7cb, ftLastAccessTime.dwLowDateTime=0x1ae794d0, ftLastAccessTime.dwHighDateTime=0x1d5cf9c, ftLastWriteTime.dwLowDateTime=0x1ae794d0, ftLastWriteTime.dwHighDateTime=0x1d5cf9c, nFileSizeHigh=0x0, nFileSizeLow=0x17f8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="qDrKhg38hlbWs0.bmp", cAlternateFileName="QDRKHG~1.BMP")) returned 1 [0075.770] wcscmp (_String1="qDrKhg38hlbWs0.bmp", _String2=".") returned 1 [0075.770] wcscmp (_String1="qDrKhg38hlbWs0.bmp", _String2="..") returned 1 [0075.770] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x396e0d0 [0075.770] wcscpy (in: _Dest=0x396e0d0, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.770] wcscat (in: _Dest=0x396e0d0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.770] wcscat (in: _Dest=0x396e0d0, _Source="qDrKhg38hlbWs0.bmp" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\qDrKhg38hlbWs0.bmp") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\qDrKhg38hlbWs0.bmp" [0075.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396e0d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd04 [0075.771] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x449bc120, ftCreationTime.dwHighDateTime=0x1d5d1bd, ftLastAccessTime.dwLowDateTime=0xcafae9f0, ftLastAccessTime.dwHighDateTime=0x1d5d6d4, ftLastWriteTime.dwLowDateTime=0xcafae9f0, ftLastWriteTime.dwHighDateTime=0x1d5d6d4, nFileSizeHigh=0x0, nFileSizeLow=0x1028a, dwReserved0=0x0, dwReserved1=0x0, cFileName="QXT68k2qiJPK M.ppt", cAlternateFileName="QXT68K~1.PPT")) returned 1 [0075.771] wcscmp (_String1="QXT68k2qiJPK M.ppt", _String2=".") returned 1 [0075.771] wcscmp (_String1="QXT68k2qiJPK M.ppt", _String2="..") returned 1 [0075.771] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x396e450 [0075.771] wcscpy (in: _Dest=0x396e450, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.771] wcscat (in: _Dest=0x396e450, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.771] wcscat (in: _Dest=0x396e450, _Source="QXT68k2qiJPK M.ppt" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\QXT68k2qiJPK M.ppt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\QXT68k2qiJPK M.ppt" [0075.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396e450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd08 [0075.772] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f6cf810, ftCreationTime.dwHighDateTime=0x1d5d306, ftLastAccessTime.dwLowDateTime=0xedb09640, ftLastAccessTime.dwHighDateTime=0x1d5d24f, ftLastWriteTime.dwLowDateTime=0xedb09640, ftLastWriteTime.dwHighDateTime=0x1d5d24f, nFileSizeHigh=0x0, nFileSizeLow=0x5b5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SejX7-sVJe.mp3", cAlternateFileName="SEJX7-~1.MP3")) returned 1 [0075.772] wcscmp (_String1="SejX7-sVJe.mp3", _String2=".") returned 1 [0075.772] wcscmp (_String1="SejX7-sVJe.mp3", _String2="..") returned 1 [0075.772] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x38fcf30 [0075.772] wcscpy (in: _Dest=0x38fcf30, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.772] wcscat (in: _Dest=0x38fcf30, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.772] wcscat (in: _Dest=0x38fcf30, _Source="SejX7-sVJe.mp3" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\SejX7-sVJe.mp3") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\SejX7-sVJe.mp3" [0075.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fcf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd0c [0075.772] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Skype", cAlternateFileName="")) returned 1 [0075.772] wcscmp (_String1="Skype", _String2=".") returned 1 [0075.773] wcscmp (_String1="Skype", _String2="..") returned 1 [0075.773] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x38ff650 [0075.773] wcscpy (in: _Dest=0x38ff650, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.773] wcscat (in: _Dest=0x38ff650, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.773] wcscat (in: _Dest=0x38ff650, _Source="Skype" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype" [0075.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38ff650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd10 [0075.773] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0075.773] wcscmp (_String1="Sun", _String2=".") returned 1 [0075.773] wcscmp (_String1="Sun", _String2="..") returned 1 [0075.773] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x5533fc0 [0075.773] wcscpy (in: _Dest=0x5533fc0, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.774] wcscat (in: _Dest=0x5533fc0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.774] wcscat (in: _Dest=0x5533fc0, _Source="Sun" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun" [0075.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5533fc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd14 [0075.774] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eb2780, ftCreationTime.dwHighDateTime=0x1d5d100, ftLastAccessTime.dwLowDateTime=0xc09a8590, ftLastAccessTime.dwHighDateTime=0x1d5d5a5, ftLastWriteTime.dwLowDateTime=0xc09a8590, ftLastWriteTime.dwHighDateTime=0x1d5d5a5, nFileSizeHigh=0x0, nFileSizeLow=0x11498, dwReserved0=0x0, dwReserved1=0x0, cFileName="SVygtGN2.bmp", cAlternateFileName="")) returned 1 [0075.774] wcscmp (_String1="SVygtGN2.bmp", _String2=".") returned 1 [0075.774] wcscmp (_String1="SVygtGN2.bmp", _String2="..") returned 1 [0075.774] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x38fca50 [0075.774] wcscpy (in: _Dest=0x38fca50, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.774] wcscat (in: _Dest=0x38fca50, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.774] wcscat (in: _Dest=0x38fca50, _Source="SVygtGN2.bmp" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\SVygtGN2.bmp") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\SVygtGN2.bmp" [0075.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fca50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd18 [0075.775] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae93c010, ftCreationTime.dwHighDateTime=0x1d5cdde, ftLastAccessTime.dwLowDateTime=0x1c0e89a0, ftLastAccessTime.dwHighDateTime=0x1d5d473, ftLastWriteTime.dwLowDateTime=0x1c0e89a0, ftLastWriteTime.dwHighDateTime=0x1d5d473, nFileSizeHigh=0x0, nFileSizeLow=0xf15a, dwReserved0=0x0, dwReserved1=0x0, cFileName="uAZLUFDQm.ppt", cAlternateFileName="UAZLUF~1.PPT")) returned 1 [0075.775] wcscmp (_String1="uAZLUFDQm.ppt", _String2=".") returned 1 [0075.775] wcscmp (_String1="uAZLUFDQm.ppt", _String2="..") returned 1 [0075.775] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x38fcf98 [0075.775] wcscpy (in: _Dest=0x38fcf98, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.775] wcscat (in: _Dest=0x38fcf98, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.775] wcscat (in: _Dest=0x38fcf98, _Source="uAZLUFDQm.ppt" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\uAZLUFDQm.ppt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\uAZLUFDQm.ppt" [0075.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fcf98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd1c [0075.776] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b516f0, ftCreationTime.dwHighDateTime=0x1d5d3d0, ftLastAccessTime.dwLowDateTime=0xad094ca0, ftLastAccessTime.dwHighDateTime=0x1d5d159, ftLastWriteTime.dwLowDateTime=0xad094ca0, ftLastWriteTime.dwHighDateTime=0x1d5d159, nFileSizeHigh=0x0, nFileSizeLow=0x15263, dwReserved0=0x0, dwReserved1=0x0, cFileName="ulSIcR0ydo9WK.ots", cAlternateFileName="ULSICR~1.OTS")) returned 1 [0075.776] wcscmp (_String1="ulSIcR0ydo9WK.ots", _String2=".") returned 1 [0075.776] wcscmp (_String1="ulSIcR0ydo9WK.ots", _String2="..") returned 1 [0075.776] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x396dea0 [0075.776] wcscpy (in: _Dest=0x396dea0, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.776] wcscat (in: _Dest=0x396dea0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.776] wcscat (in: _Dest=0x396dea0, _Source="ulSIcR0ydo9WK.ots" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\ulSIcR0ydo9WK.ots") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\ulSIcR0ydo9WK.ots" [0075.776] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396dea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd20 [0075.777] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab1382c0, ftCreationTime.dwHighDateTime=0x1d5d6cd, ftLastAccessTime.dwLowDateTime=0xa6319d10, ftLastAccessTime.dwHighDateTime=0x1d5cf6a, ftLastWriteTime.dwLowDateTime=0xa6319d10, ftLastWriteTime.dwHighDateTime=0x1d5cf6a, nFileSizeHigh=0x0, nFileSizeLow=0x8bc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="v XP9.flv", cAlternateFileName="VXP9~1.FLV")) returned 1 [0075.777] wcscmp (_String1="v XP9.flv", _String2=".") returned 1 [0075.777] wcscmp (_String1="v XP9.flv", _String2="..") returned 1 [0075.777] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x38b63c8 [0075.777] wcscpy (in: _Dest=0x38b63c8, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.777] wcscat (in: _Dest=0x38b63c8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.777] wcscat (in: _Dest=0x38b63c8, _Source="v XP9.flv" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\v XP9.flv") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\v XP9.flv" [0075.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b63c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd24 [0075.777] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3091f430, ftCreationTime.dwHighDateTime=0x1d5d571, ftLastAccessTime.dwLowDateTime=0xca2d0480, ftLastAccessTime.dwHighDateTime=0x1d5d414, ftLastWriteTime.dwLowDateTime=0xca2d0480, ftLastWriteTime.dwHighDateTime=0x1d5d414, nFileSizeHigh=0x0, nFileSizeLow=0x15ef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="whkgOt.avi", cAlternateFileName="")) returned 1 [0075.777] wcscmp (_String1="whkgOt.avi", _String2=".") returned 1 [0075.777] wcscmp (_String1="whkgOt.avi", _String2="..") returned 1 [0075.777] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x38b65a8 [0075.777] wcscpy (in: _Dest=0x38b65a8, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.778] wcscat (in: _Dest=0x38b65a8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.778] wcscat (in: _Dest=0x38b65a8, _Source="whkgOt.avi" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\whkgOt.avi") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\whkgOt.avi" [0075.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b65a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd28 [0075.778] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d232ed0, ftCreationTime.dwHighDateTime=0x1d5ca30, ftLastAccessTime.dwLowDateTime=0x21c91b10, ftLastAccessTime.dwHighDateTime=0x1d5d21d, ftLastWriteTime.dwLowDateTime=0x21c91b10, ftLastWriteTime.dwHighDateTime=0x1d5d21d, nFileSizeHigh=0x0, nFileSizeLow=0x3da4, dwReserved0=0x0, dwReserved1=0x0, cFileName="wstFzu.swf", cAlternateFileName="")) returned 1 [0075.778] wcscmp (_String1="wstFzu.swf", _String2=".") returned 1 [0075.778] wcscmp (_String1="wstFzu.swf", _String2="..") returned 1 [0075.778] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x38b64e8 [0075.778] wcscpy (in: _Dest=0x38b64e8, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.778] wcscat (in: _Dest=0x38b64e8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.778] wcscat (in: _Dest=0x38b64e8, _Source="wstFzu.swf" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\wstFzu.swf") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\wstFzu.swf" [0075.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b64e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd2c [0075.779] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7410b4a0, ftCreationTime.dwHighDateTime=0x1d5c86d, ftLastAccessTime.dwLowDateTime=0xb2a68e0, ftLastAccessTime.dwHighDateTime=0x1d5d0e3, ftLastWriteTime.dwLowDateTime=0xb2a68e0, ftLastWriteTime.dwHighDateTime=0x1d5d0e3, nFileSizeHigh=0x0, nFileSizeLow=0x17a15, dwReserved0=0x0, dwReserved1=0x0, cFileName="xqH-bfT3Sg.swf", cAlternateFileName="XQH-BF~1.SWF")) returned 1 [0075.779] wcscmp (_String1="xqH-bfT3Sg.swf", _String2=".") returned 1 [0075.779] wcscmp (_String1="xqH-bfT3Sg.swf", _String2="..") returned 1 [0075.779] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x38fc848 [0075.779] wcscpy (in: _Dest=0x38fc848, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.779] wcscat (in: _Dest=0x38fc848, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.779] wcscat (in: _Dest=0x38fc848, _Source="xqH-bfT3Sg.swf" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\xqH-bfT3Sg.swf") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\xqH-bfT3Sg.swf" [0075.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38fc848, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd30 [0075.780] FindNextFileW (in: hFindFile=0x389ee80, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7410b4a0, ftCreationTime.dwHighDateTime=0x1d5c86d, ftLastAccessTime.dwLowDateTime=0xb2a68e0, ftLastAccessTime.dwHighDateTime=0x1d5d0e3, ftLastWriteTime.dwLowDateTime=0xb2a68e0, ftLastWriteTime.dwHighDateTime=0x1d5d0e3, nFileSizeHigh=0x0, nFileSizeLow=0x17a15, dwReserved0=0x0, dwReserved1=0x0, cFileName="xqH-bfT3Sg.swf", cAlternateFileName="XQH-BF~1.SWF")) returned 0 [0075.780] FindClose (in: hFindFile=0x389ee80 | out: hFindFile=0x389ee80) returned 1 [0075.780] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54309b8) returned 1 [0075.780] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5533f20) returned 1 [0075.780] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5698) returned 1 Thread: id = 689 os_tid = 0x19f0 [0077.435] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x5532350 [0077.435] wcscpy (in: _Dest=0x5532350, _Source="C:\\Users\\Public\\AccountPictures" | out: _Dest="C:\\Users\\Public\\AccountPictures") returned="C:\\Users\\Public\\AccountPictures" [0077.435] wcscat (in: _Dest=0x5532350, _Source="\\" | out: _Dest="C:\\Users\\Public\\AccountPictures\\") returned="C:\\Users\\Public\\AccountPictures\\" [0077.435] wcscat (in: _Dest=0x5532350, _Source="*" | out: _Dest="C:\\Users\\Public\\AccountPictures\\*") returned="C:\\Users\\Public\\AccountPictures\\*" [0077.435] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542fb48 [0077.435] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\AccountPictures\\*", lpFindFileData=0x542fb48 | out: lpFindFileData=0x542fb48*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f40 [0081.581] wcscmp (_String1=".", _String2=".") returned 0 [0081.581] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x542fb48 | out: lpFindFileData=0x542fb48*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.581] wcscmp (_String1="..", _String2=".") returned 1 [0081.582] wcscmp (_String1="..", _String2="..") returned 0 [0081.582] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x542fb48 | out: lpFindFileData=0x542fb48*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xce317778, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0081.582] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0081.582] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0081.582] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x542fb48 | out: lpFindFileData=0x542fb48*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xce317778, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0081.582] FindClose (in: hFindFile=0x5444f40 | out: hFindFile=0x5444f40) returned 1 [0081.582] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542fb48) returned 1 [0081.582] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5532350) returned 1 [0081.582] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a57b8) returned 1 Thread: id = 690 os_tid = 0x19f4 [0077.436] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x34) returned 0x5445140 [0077.436] wcscpy (in: _Dest=0x5445140, _Source="C:\\Users\\Public\\Desktop" | out: _Dest="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0077.436] wcscat (in: _Dest=0x5445140, _Source="\\" | out: _Dest="C:\\Users\\Public\\Desktop\\") returned="C:\\Users\\Public\\Desktop\\" [0077.436] wcscat (in: _Dest=0x5445140, _Source="*" | out: _Dest="C:\\Users\\Public\\Desktop\\*") returned="C:\\Users\\Public\\Desktop\\*" [0077.436] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5430750 [0077.436] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*", lpFindFileData=0x5430750 | out: lpFindFileData=0x5430750*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f40 [0077.437] wcscmp (_String1=".", _String2=".") returned 0 [0077.437] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5430750 | out: lpFindFileData=0x5430750*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.437] wcscmp (_String1="..", _String2=".") returned 1 [0077.438] wcscmp (_String1="..", _String2="..") returned 0 [0077.438] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5430750 | out: lpFindFileData=0x5430750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38bb5c78, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38bb5c78, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38bb5c78, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x852, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat Reader DC.lnk", cAlternateFileName="ACROBA~1.LNK")) returned 1 [0077.438] wcscmp (_String1="Acrobat Reader DC.lnk", _String2=".") returned 1 [0077.438] wcscmp (_String1="Acrobat Reader DC.lnk", _String2="..") returned 1 [0077.438] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5430750 | out: lpFindFileData=0x5430750*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0077.438] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0077.438] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0077.438] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5430750 | out: lpFindFileData=0x5430750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4c3ce2c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c6308a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x91a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0077.438] wcscmp (_String1="Google Chrome.lnk", _String2=".") returned 1 [0077.438] wcscmp (_String1="Google Chrome.lnk", _String2="..") returned 1 [0077.438] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5430750 | out: lpFindFileData=0x5430750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef84fc3f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef84fc3f, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0077.438] wcscmp (_String1="Mozilla Firefox.lnk", _String2=".") returned 1 [0077.438] wcscmp (_String1="Mozilla Firefox.lnk", _String2="..") returned 1 [0077.438] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5430750 | out: lpFindFileData=0x5430750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef84fc3f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef84fc3f, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 0 [0077.438] FindClose (in: hFindFile=0x5444f40 | out: hFindFile=0x5444f40) returned 1 [0077.438] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5430750) returned 1 [0077.438] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445140) returned 1 [0077.438] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5531f88) returned 1 Thread: id = 691 os_tid = 0x19f8 [0077.437] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x38) returned 0x5445180 [0077.437] wcscpy (in: _Dest=0x5445180, _Source="C:\\Users\\Public\\Documents" | out: _Dest="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0077.437] wcscat (in: _Dest=0x5445180, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0077.437] wcscat (in: _Dest=0x5445180, _Source="*" | out: _Dest="C:\\Users\\Public\\Documents\\*") returned="C:\\Users\\Public\\Documents\\*" [0077.437] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54309b8 [0077.437] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*", lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f40 [0081.570] wcscmp (_String1=".", _String2=".") returned 0 [0081.570] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.570] wcscmp (_String1="..", _String2=".") returned 1 [0081.570] wcscmp (_String1="..", _String2="..") returned 0 [0081.570] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0081.570] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0081.570] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0081.570] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0081.570] wcscmp (_String1="My Music", _String2=".") returned 1 [0081.570] wcscmp (_String1="My Music", _String2="..") returned 1 [0081.570] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x46) returned 0x397dc28 [0081.570] wcscpy (in: _Dest=0x397dc28, _Source="C:\\Users\\Public\\Documents" | out: _Dest="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0081.570] wcscat (in: _Dest=0x397dc28, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0081.570] wcscat (in: _Dest=0x397dc28, _Source="My Music" | out: _Dest="C:\\Users\\Public\\Documents\\My Music") returned="C:\\Users\\Public\\Documents\\My Music" [0081.570] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x397dc28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d10 [0081.571] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0081.571] wcscmp (_String1="My Pictures", _String2=".") returned 1 [0081.571] wcscmp (_String1="My Pictures", _String2="..") returned 1 [0081.571] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x757eb80 [0081.571] wcscpy (in: _Dest=0x757eb80, _Source="C:\\Users\\Public\\Documents" | out: _Dest="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0081.571] wcscat (in: _Dest=0x757eb80, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0081.571] wcscat (in: _Dest=0x757eb80, _Source="My Pictures" | out: _Dest="C:\\Users\\Public\\Documents\\My Pictures") returned="C:\\Users\\Public\\Documents\\My Pictures" [0081.571] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x757eb80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d14 [0081.572] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0081.572] wcscmp (_String1="My Videos", _String2=".") returned 1 [0081.572] wcscmp (_String1="My Videos", _String2="..") returned 1 [0081.572] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x397dc78 [0081.572] wcscpy (in: _Dest=0x397dc78, _Source="C:\\Users\\Public\\Documents" | out: _Dest="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0081.572] wcscat (in: _Dest=0x397dc78, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0081.572] wcscat (in: _Dest=0x397dc78, _Source="My Videos" | out: _Dest="C:\\Users\\Public\\Documents\\My Videos") returned="C:\\Users\\Public\\Documents\\My Videos" [0081.572] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x397dc78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d18 [0081.572] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0081.572] FindClose (in: hFindFile=0x5444f40 | out: hFindFile=0x5444f40) returned 1 [0081.573] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54309b8) returned 1 [0081.573] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445180) returned 1 [0081.573] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389e700) returned 1 Thread: id = 692 os_tid = 0x19fc [0077.439] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x38) returned 0x5445140 [0077.439] wcscpy (in: _Dest=0x5445140, _Source="C:\\Users\\Public\\Downloads" | out: _Dest="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0077.439] wcscat (in: _Dest=0x5445140, _Source="\\" | out: _Dest="C:\\Users\\Public\\Downloads\\") returned="C:\\Users\\Public\\Downloads\\" [0077.439] wcscat (in: _Dest=0x5445140, _Source="*" | out: _Dest="C:\\Users\\Public\\Downloads\\*") returned="C:\\Users\\Public\\Downloads\\*" [0077.440] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5430750 [0077.440] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*", lpFindFileData=0x5430750 | out: lpFindFileData=0x5430750*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f40 [0081.580] wcscmp (_String1=".", _String2=".") returned 0 [0081.580] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5430750 | out: lpFindFileData=0x5430750*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.580] wcscmp (_String1="..", _String2=".") returned 1 [0081.580] wcscmp (_String1="..", _String2="..") returned 0 [0081.580] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5430750 | out: lpFindFileData=0x5430750*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0081.580] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0081.580] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0081.580] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5430750 | out: lpFindFileData=0x5430750*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0081.580] FindClose (in: hFindFile=0x5444f40 | out: hFindFile=0x5444f40) returned 1 [0081.580] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5430750) returned 1 [0081.580] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445140) returned 1 [0081.580] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389e740) returned 1 Thread: id = 693 os_tid = 0x1a00 [0077.440] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x38) returned 0x5445240 [0077.440] wcscpy (in: _Dest=0x5445240, _Source="C:\\Users\\Public\\Libraries" | out: _Dest="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0077.440] wcscat (in: _Dest=0x5445240, _Source="\\" | out: _Dest="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0077.440] wcscat (in: _Dest=0x5445240, _Source="*" | out: _Dest="C:\\Users\\Public\\Libraries\\*") returned="C:\\Users\\Public\\Libraries\\*" [0077.440] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5430c20 [0077.440] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*", lpFindFileData=0x5430c20 | out: lpFindFileData=0x5430c20*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb207547d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f40 [0081.578] wcscmp (_String1=".", _String2=".") returned 0 [0081.578] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5430c20 | out: lpFindFileData=0x5430c20*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb207547d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.578] wcscmp (_String1="..", _String2=".") returned 1 [0081.578] wcscmp (_String1="..", _String2="..") returned 0 [0081.578] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5430c20 | out: lpFindFileData=0x5430c20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0081.578] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0081.578] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0081.578] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5430c20 | out: lpFindFileData=0x5430c20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 1 [0081.578] wcscmp (_String1="RecordedTV.library-ms", _String2=".") returned 1 [0081.578] wcscmp (_String1="RecordedTV.library-ms", _String2="..") returned 1 [0081.578] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x541af40 [0081.578] wcscpy (in: _Dest=0x541af40, _Source="C:\\Users\\Public\\Libraries" | out: _Dest="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0081.578] wcscat (in: _Dest=0x541af40, _Source="\\" | out: _Dest="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0081.578] wcscat (in: _Dest=0x541af40, _Source="RecordedTV.library-ms" | out: _Dest="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms") returned="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" [0081.578] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x541af40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d1c [0081.579] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5430c20 | out: lpFindFileData=0x5430c20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 0 [0081.579] FindClose (in: hFindFile=0x5444f40 | out: hFindFile=0x5444f40) returned 1 [0081.579] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5430c20) returned 1 [0081.579] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445240) returned 1 [0081.579] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389e800) returned 1 Thread: id = 694 os_tid = 0x1a04 [0077.441] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x30) returned 0x5531f88 [0077.441] wcscpy (in: _Dest=0x5531f88, _Source="C:\\Users\\Public\\Music" | out: _Dest="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0077.441] wcscat (in: _Dest=0x5531f88, _Source="\\" | out: _Dest="C:\\Users\\Public\\Music\\") returned="C:\\Users\\Public\\Music\\" [0077.441] wcscat (in: _Dest=0x5531f88, _Source="*" | out: _Dest="C:\\Users\\Public\\Music\\*") returned="C:\\Users\\Public\\Music\\*" [0077.441] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5430e88 [0077.441] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*", lpFindFileData=0x5430e88 | out: lpFindFileData=0x5430e88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f40 [0081.577] wcscmp (_String1=".", _String2=".") returned 0 [0081.577] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5430e88 | out: lpFindFileData=0x5430e88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.577] wcscmp (_String1="..", _String2=".") returned 1 [0081.577] wcscmp (_String1="..", _String2="..") returned 0 [0081.577] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5430e88 | out: lpFindFileData=0x5430e88*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0081.577] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0081.577] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0081.577] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5430e88 | out: lpFindFileData=0x5430e88*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0081.577] FindClose (in: hFindFile=0x5444f40 | out: hFindFile=0x5444f40) returned 1 [0081.577] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5430e88) returned 1 [0081.577] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5531f88) returned 1 [0081.577] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5531f50) returned 1 Thread: id = 695 os_tid = 0x1a08 [0077.441] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x36) returned 0x5445280 [0077.441] wcscpy (in: _Dest=0x5445280, _Source="C:\\Users\\Public\\Pictures" | out: _Dest="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0077.442] wcscat (in: _Dest=0x5445280, _Source="\\" | out: _Dest="C:\\Users\\Public\\Pictures\\") returned="C:\\Users\\Public\\Pictures\\" [0077.442] wcscat (in: _Dest=0x5445280, _Source="*" | out: _Dest="C:\\Users\\Public\\Pictures\\*") returned="C:\\Users\\Public\\Pictures\\*" [0077.442] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542d260 [0077.442] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*", lpFindFileData=0x542d260 | out: lpFindFileData=0x542d260*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f40 [0081.575] wcscmp (_String1=".", _String2=".") returned 0 [0081.575] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x542d260 | out: lpFindFileData=0x542d260*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.575] wcscmp (_String1="..", _String2=".") returned 1 [0081.575] wcscmp (_String1="..", _String2="..") returned 0 [0081.575] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x542d260 | out: lpFindFileData=0x542d260*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0081.575] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0081.575] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0081.576] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x542d260 | out: lpFindFileData=0x542d260*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0081.576] FindClose (in: hFindFile=0x5444f40 | out: hFindFile=0x5444f40) returned 1 [0081.576] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542d260) returned 1 [0081.576] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445280) returned 1 [0081.576] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389e940) returned 1 Thread: id = 696 os_tid = 0x1a0c [0077.442] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x32) returned 0x5444ac0 [0077.442] wcscpy (in: _Dest=0x5444ac0, _Source="C:\\Users\\Public\\Videos" | out: _Dest="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0077.442] wcscat (in: _Dest=0x5444ac0, _Source="\\" | out: _Dest="C:\\Users\\Public\\Videos\\") returned="C:\\Users\\Public\\Videos\\" [0077.442] wcscat (in: _Dest=0x5444ac0, _Source="*" | out: _Dest="C:\\Users\\Public\\Videos\\*") returned="C:\\Users\\Public\\Videos\\*" [0077.442] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542d730 [0077.442] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*", lpFindFileData=0x542d730 | out: lpFindFileData=0x542d730*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f40 [0081.583] wcscmp (_String1=".", _String2=".") returned 0 [0081.583] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x542d730 | out: lpFindFileData=0x542d730*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.583] wcscmp (_String1="..", _String2=".") returned 1 [0081.583] wcscmp (_String1="..", _String2="..") returned 0 [0081.583] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x542d730 | out: lpFindFileData=0x542d730*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0081.583] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0081.583] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0081.583] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x542d730 | out: lpFindFileData=0x542d730*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0081.583] FindClose (in: hFindFile=0x5444f40 | out: hFindFile=0x5444f40) returned 1 [0081.583] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542d730) returned 1 [0081.583] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444ac0) returned 1 [0081.583] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5531ea8) returned 1 Thread: id = 697 os_tid = 0x1a10 [0077.443] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 0x20 [0081.420] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", dwFileAttributes=0x20) returned 1 [0081.420] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c94 [0081.420] GetFileSizeEx (in: hFile=0x1c94, lpFileSize=0x1adfff24 | out: lpFileSize=0x1adfff24*=1052672) returned 1 [0081.439] SetFilePointerEx (in: hFile=0x1c94, liDistanceToMove=0x100ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.439] ReadFile (in: hFile=0x1c94, lpBuffer=0x1adffea8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1adffea4, lpOverlapped=0x0 | out: lpBuffer=0x1adffea8*, lpNumberOfBytesRead=0x1adffea4*=0x4, lpOverlapped=0x0) returned 1 [0081.441] SetFilePointerEx (in: hFile=0x1c94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.441] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1d70 [0081.441] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1b68 [0081.441] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1b90 [0081.441] NtQuerySystemTime (in: CurrentTime=0x1adffe84 | out: CurrentTime=0x1adffe84*=132260136386066966) returned 0x0 [0081.441] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0xc4456ea [0081.441] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0xf8ef1460 [0081.441] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0x542e0963 [0081.441] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0xb19e2d50 [0081.441] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0xd0c797e1 [0081.441] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0x21a6a7ad [0081.441] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0x587b725e [0081.441] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0x217dc21e [0081.441] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0xb95f9aa8 [0081.441] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0xa835974a [0081.441] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0x9ec5afa5 [0081.441] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0x7caa4d2e [0081.441] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0x9af42082 [0081.441] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0x796e8008 [0081.441] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0xbf04eb5a [0081.441] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0xb98d88f1 [0081.441] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0x1407df25 [0081.441] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0xe0313069 [0081.441] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0x71845487 [0081.441] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0x5bed5df3 [0081.441] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0xc7a53d2 [0081.441] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0x1a8a19fd [0081.441] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0xf4eeb30f [0081.441] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0xdd6a0513 [0081.441] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0x2b76636a [0081.441] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0x60802ead [0081.441] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0x99b94f88 [0081.441] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0x8bc551e2 [0081.441] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0xe55d61e6 [0081.441] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0x5252fe58 [0081.441] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0x929c2539 [0081.442] RtlRandom (in: Seed=0x1adffe90 | out: Seed=0x1adffe90) returned 0xcd30f3ba Thread: id = 698 os_tid = 0x1a14 [0077.443] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 0x20 [0081.463] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", dwFileAttributes=0x20) returned 1 [0081.473] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ca0 [0081.473] GetFileSizeEx (in: hFile=0x1ca0, lpFileSize=0x1ae7fab0 | out: lpFileSize=0x1ae7fab0*=69632) returned 1 [0081.473] SetFilePointerEx (in: hFile=0x1ca0, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.473] ReadFile (in: hFile=0x1ca0, lpBuffer=0x1ae7fa34, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ae7fa30, lpOverlapped=0x0 | out: lpBuffer=0x1ae7fa34*, lpNumberOfBytesRead=0x1ae7fa30*=0x4, lpOverlapped=0x0) returned 1 [0081.475] SetFilePointerEx (in: hFile=0x1ca0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.475] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1de8 [0081.475] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1c80 [0081.475] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1ca8 [0081.475] NtQuerySystemTime (in: CurrentTime=0x1ae7fa10 | out: CurrentTime=0x1ae7fa10*=132260136386397745) returned 0x0 [0081.475] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0x61f0190d [0081.475] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0x6d0b5983 [0081.475] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0xe4d29c5f [0081.475] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0x9439b722 [0081.475] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0x440b2bb3 [0081.475] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0x32b6f366 [0081.475] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0xa9970485 [0081.475] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0xe95ff1aa [0081.475] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0x372d681b [0081.475] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0x7118f084 [0081.475] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0x2c3c71d6 [0081.475] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0xf84ffe30 [0081.475] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0x26dba08 [0081.475] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0x4e56730c [0081.475] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0x25515c3a [0081.475] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0xd726411d [0081.475] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0x7322770f [0081.475] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0xa2147925 [0081.475] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0x204e18a7 [0081.475] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0xe0070dc [0081.475] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0xae282422 [0081.475] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0x78ada6dd [0081.475] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0x3c447809 [0081.475] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0x4c1de418 [0081.475] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0xcb6b822e [0081.475] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0xe3af6203 [0081.475] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0x9ca1a2a9 [0081.475] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0xb614bb4d [0081.475] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0x86c2cfbe [0081.475] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0x3da0e4d0 [0081.476] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0x6bd3c67e [0081.476] RtlRandom (in: Seed=0x1ae7fa1c | out: Seed=0x1ae7fa1c) returned 0x5396a9fd Thread: id = 699 os_tid = 0x1a18 [0077.444] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 0x20 [0081.452] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0081.452] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c9c [0081.452] GetFileSizeEx (in: hFile=0x1c9c, lpFileSize=0x1aeff8c4 | out: lpFileSize=0x1aeff8c4*=69632) returned 1 [0081.462] SetFilePointerEx (in: hFile=0x1c9c, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.462] ReadFile (in: hFile=0x1c9c, lpBuffer=0x1aeff848, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1aeff844, lpOverlapped=0x0 | out: lpBuffer=0x1aeff848*, lpNumberOfBytesRead=0x1aeff844*=0x4, lpOverlapped=0x0) returned 1 [0081.463] SetFilePointerEx (in: hFile=0x1c9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.463] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1dc0 [0081.463] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1c08 [0081.463] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1c30 [0081.463] NtQuerySystemTime (in: CurrentTime=0x1aeff824 | out: CurrentTime=0x1aeff824*=132260136386223480) returned 0x0 [0081.463] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0xc08fa9ba [0081.464] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0xab277936 [0081.464] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0x5c4305 [0081.464] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0x7aac70c4 [0081.464] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0x3e0a7743 [0081.464] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0x5eff0bc9 [0081.464] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0xc37d62cc [0081.464] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0x6a7a48f5 [0081.464] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0x4e8875a1 [0081.464] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0xb0ae2335 [0081.464] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0xd522e0ae [0081.464] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0xb1138145 [0081.464] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0x2b498346 [0081.464] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0x2a2ea6ef [0081.464] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0xfb795b65 [0081.464] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0xd88e198e [0081.464] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0xc3262a4b [0081.464] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0xe8de57dd [0081.464] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0xf748d28c [0081.464] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0x89d1189e [0081.464] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0x9e0b22a5 [0081.464] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0x2c1a89a9 [0081.464] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0x15bce36f [0081.464] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0xd63e2e3d [0081.464] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0x5807db5a [0081.464] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0x26d98b13 [0081.464] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0xf6548db8 [0081.464] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0x5c77c6a5 [0081.464] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0x9b921ac6 [0081.464] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0xd818f499 [0081.464] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0x2f07555e [0081.464] RtlRandom (in: Seed=0x1aeff830 | out: Seed=0x1aeff830) returned 0x3ef4d174 Thread: id = 700 os_tid = 0x1a1c [0077.444] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 0x20 [0081.384] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0081.384] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c90 [0081.419] GetFileSizeEx (in: hFile=0x1c90, lpFileSize=0x1af7fc2c | out: lpFileSize=0x1af7fc2c*=1052672) returned 1 [0081.419] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0x100ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.419] ReadFile (in: hFile=0x1c90, lpBuffer=0x1af7fbb0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1af7fbac, lpOverlapped=0x0 | out: lpBuffer=0x1af7fbb0*, lpNumberOfBytesRead=0x1af7fbac*=0x4, lpOverlapped=0x0) returned 1 [0081.420] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.420] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1d48 [0081.420] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1b40 [0081.421] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1af0 [0081.421] NtQuerySystemTime (in: CurrentTime=0x1af7fb8c | out: CurrentTime=0x1af7fb8c*=132260136385754130) returned 0x0 [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0x6138cab6 [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0xf5a0388f [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0x97398ed8 [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0x5af1e5a0 [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0xc9374160 [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0xe313f0f0 [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0x17534dc7 [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0x64181fba [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0xfc0c4712 [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0xeac9df8b [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0x61e7de57 [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0x1dc0194 [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0x12946946 [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0x9de809b [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0x885e7b36 [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0xecdba54e [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0x1480d326 [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0x7e6ad134 [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0x5b09fed3 [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0x670cd4de [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0x76189382 [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0x74e6fd6a [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0xe169621d [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0xaa465c6a [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0x76c4c3b3 [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0x35582c14 [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0x8a609137 [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0xb88cde86 [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0x424142c8 [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0xf471d9f8 [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0x2bb973eb [0081.421] RtlRandom (in: Seed=0x1af7fb98 | out: Seed=0x1af7fb98) returned 0x890b01d7 Thread: id = 701 os_tid = 0x1a20 [0077.444] GetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 0x20 [0081.372] SetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx", dwFileAttributes=0x20) returned 1 [0081.382] CreateFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c8c [0081.382] GetFileSizeEx (in: hFile=0x1c8c, lpFileSize=0x1afffa6c | out: lpFileSize=0x1afffa6c*=1118208) returned 1 [0081.382] SetFilePointerEx (in: hFile=0x1c8c, liDistanceToMove=0x110ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.382] ReadFile (in: hFile=0x1c8c, lpBuffer=0x1afff9f0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1afff9ec, lpOverlapped=0x0 | out: lpBuffer=0x1afff9f0*, lpNumberOfBytesRead=0x1afff9ec*=0x4, lpOverlapped=0x0) returned 1 [0081.384] SetFilePointerEx (in: hFile=0x1c8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.384] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1d20 [0081.384] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1b18 [0081.384] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1ac8 [0081.384] NtQuerySystemTime (in: CurrentTime=0x1afff9cc | out: CurrentTime=0x1afff9cc*=132260136385442191) returned 0x0 [0081.384] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0x66eb0cb9 [0081.384] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0x4cdeafd5 [0081.384] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0x70529643 [0081.384] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0x796bfb99 [0081.384] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0x5ad9343a [0081.384] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0xc06d5f6 [0081.384] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0xd932e135 [0081.384] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0xa981c0ce [0081.384] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0x16d2085b [0081.385] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0xf3745249 [0081.385] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0xd8cb9aeb [0081.385] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0x1b67d555 [0081.385] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0xdaef77f1 [0081.385] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0xebb47466 [0081.385] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0xc0d0bd47 [0081.385] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0x237458b9 [0081.385] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0xe4b03172 [0081.385] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0xdb6812ca [0081.385] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0xca5c1aae [0081.385] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0x699ad009 [0081.385] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0xc801c569 [0081.385] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0x270b5f9f [0081.385] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0x56240ee1 [0081.385] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0x8996ba3b [0081.385] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0xb11b5990 [0081.385] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0x56be5184 [0081.385] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0xb4f1c24f [0081.385] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0x3d0f57f3 [0081.385] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0x89f0ef10 [0081.385] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0xe0146f0e [0081.385] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0xaf2e0496 [0081.385] RtlRandom (in: Seed=0x1afff9d8 | out: Seed=0x1afff9d8) returned 0x25355dbe Thread: id = 702 os_tid = 0x1a24 [0077.445] GetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 0x20 [0081.370] SetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx", dwFileAttributes=0x20) returned 1 [0081.371] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c88 [0081.371] GetFileSizeEx (in: hFile=0x1c88, lpFileSize=0x1b07f824 | out: lpFileSize=0x1b07f824*=69632) returned 1 [0081.371] SetFilePointerEx (in: hFile=0x1c88, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.371] ReadFile (in: hFile=0x1c88, lpBuffer=0x1b07f7a8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1b07f7a4, lpOverlapped=0x0 | out: lpBuffer=0x1b07f7a8*, lpNumberOfBytesRead=0x1b07f7a4*=0x4, lpOverlapped=0x0) returned 1 [0081.372] SetFilePointerEx (in: hFile=0x1c88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.372] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1820 [0081.372] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a17f8 [0081.372] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1aa0 [0081.372] NtQuerySystemTime (in: CurrentTime=0x1b07f784 | out: CurrentTime=0x1b07f784*=132260136385286197) returned 0x0 [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0x47c57a5a [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0x8ab14371 [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0x63e80d82 [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0x989e2c32 [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0xfa006660 [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0x9daf12b8 [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0x47143052 [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0x56109f50 [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0xbc7f565c [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0xffa3f085 [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0x51ee50fe [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0x224f1b90 [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0xd0270bf0 [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0x6fb72da5 [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0x502c97d4 [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0x1ad785f9 [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0xfe5a7b72 [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0xec1caa73 [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0x92812a87 [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0x23648492 [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0xc32341f7 [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0x5a462dae [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0xe9b1ff63 [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0x9191e24 [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0x1e5cee53 [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0x5bdfcb8a [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0x93cf6b1f [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0x65ec3f44 [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0x5eb36d4a [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0xc213dfdb [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0x7e1577b [0081.373] RtlRandom (in: Seed=0x1b07f790 | out: Seed=0x1b07f790) returned 0xd3f7e17e Thread: id = 703 os_tid = 0x1a28 [0077.445] GetFileAttributesW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 0x20 [0082.882] SetFileAttributesW (lpFileName="C:\\Logs\\System.evtx", dwFileAttributes=0x20) Thread: id = 704 os_tid = 0x1a2c [0077.446] GetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 0x20 [0081.440] SetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx", dwFileAttributes=0x20) returned 1 [0081.450] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1c98 [0081.451] GetFileSizeEx (in: hFile=0x1c98, lpFileSize=0x1b17fc14 | out: lpFileSize=0x1b17fc14*=69632) returned 1 [0081.451] SetFilePointerEx (in: hFile=0x1c98, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.451] ReadFile (in: hFile=0x1c98, lpBuffer=0x1b17fb98, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1b17fb94, lpOverlapped=0x0 | out: lpBuffer=0x1b17fb98*, lpNumberOfBytesRead=0x1b17fb94*=0x4, lpOverlapped=0x0) returned 1 [0081.452] SetFilePointerEx (in: hFile=0x1c98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.452] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1d98 [0081.452] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1bb8 [0081.452] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x73a1be0 [0081.452] NtQuerySystemTime (in: CurrentTime=0x1b17fb74 | out: CurrentTime=0x1b17fb74*=132260136386066966) returned 0x0 [0081.452] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0x9ea71deb [0081.453] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0x3d77e005 [0081.453] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0xd08516cd [0081.453] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0x391b2880 [0081.453] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0x2a5c2890 [0081.453] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0x6f518d84 [0081.453] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0x51707025 [0081.453] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0x28ed484 [0081.453] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0x8f016b45 [0081.453] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0x43b2059f [0081.453] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0xb8940674 [0081.453] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0x9de35577 [0081.453] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0x1ca0a731 [0081.453] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0x9dd0ebf3 [0081.453] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0xd8368685 [0081.453] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0xcc8e5a9f [0081.453] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0xd74be196 [0081.453] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0xcc2f951d [0081.453] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0x34e0b385 [0081.453] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0xe8a2fa75 [0081.453] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0x8f7ca6d1 [0081.453] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0xf3de93c7 [0081.453] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0x7758eb7c [0081.453] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0xc74ae36c [0081.453] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0x68eecd29 [0081.453] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0x250af9f8 [0081.453] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0x8428e44f [0081.453] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0xd4152879 [0081.453] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0xb0cc65ab [0081.453] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0x501da667 [0081.453] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0x93e5cdd2 [0081.453] RtlRandom (in: Seed=0x1b17fb80 | out: Seed=0x1b17fb80) returned 0x22d72f8e Thread: id = 705 os_tid = 0x1a30 [0077.446] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8e) returned 0x549fb58 [0077.446] wcscpy (in: _Dest=0x549fb58, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation" [0077.446] wcscat (in: _Dest=0x549fb58, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\" [0077.446] wcscat (in: _Dest=0x549fb58, _Source="*" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*" [0077.446] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542d998 [0077.446] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*", lpFindFileData=0x542d998 | out: lpFindFileData=0x542d998*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f40 [0077.447] wcscmp (_String1=".", _String2=".") returned 0 [0077.447] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x542d998 | out: lpFindFileData=0x542d998*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.447] wcscmp (_String1="..", _String2=".") returned 1 [0077.447] wcscmp (_String1="..", _String2="..") returned 0 [0077.447] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x542d998 | out: lpFindFileData=0x542d998*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0077.447] wcscmp (_String1="v3.0", _String2=".") returned 1 [0077.447] wcscmp (_String1="v3.0", _String2="..") returned 1 [0077.447] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x94) returned 0x54262c8 [0077.447] wcscpy (in: _Dest=0x54262c8, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation" [0077.447] wcscat (in: _Dest=0x54262c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\" [0077.447] wcscat (in: _Dest=0x54262c8, _Source="v3.0" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" [0080.927] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54262c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x127c [0080.927] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x542d998 | out: lpFindFileData=0x542d998*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a165b3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0080.927] wcscmp (_String1="v3.5", _String2=".") returned 1 [0080.927] wcscmp (_String1="v3.5", _String2="..") returned 1 [0080.927] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x94) returned 0x55c6898 [0080.927] wcscpy (in: _Dest=0x55c6898, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation" [0080.927] wcscat (in: _Dest=0x55c6898, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\" [0080.928] wcscat (in: _Dest=0x55c6898, _Source="v3.5" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" [0080.928] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55c6898, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c8 [0080.928] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x542d998 | out: lpFindFileData=0x542d998*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a165b3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0080.928] FindClose (in: hFindFile=0x5444f40 | out: hFindFile=0x5444f40) returned 1 [0080.929] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542d998) returned 1 [0080.929] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549fb58) returned 1 [0080.929] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a7bb8) returned 1 Thread: id = 706 os_tid = 0x1a34 [0077.448] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\-PIJHnObxa.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\-pijhnobxa.mp4")) returned 0x20 [0077.448] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\-PIJHnObxa.mp4", dwFileAttributes=0x20) returned 1 [0077.448] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\-PIJHnObxa.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\-pijhnobxa.mp4"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1248 [0077.449] GetFileSizeEx (in: hFile=0x1248, lpFileSize=0x1b27fd14 | out: lpFileSize=0x1b27fd14*=80855) returned 1 [0077.449] SetFilePointerEx (in: hFile=0x1248, liDistanceToMove=0x13bd3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.449] ReadFile (in: hFile=0x1248, lpBuffer=0x1b27fc98, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1b27fc94, lpOverlapped=0x0 | out: lpBuffer=0x1b27fc98*, lpNumberOfBytesRead=0x1b27fc94*=0x4, lpOverlapped=0x0) returned 1 [0077.449] SetFilePointerEx (in: hFile=0x1248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.449] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.449] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a00 [0077.449] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.449] NtQuerySystemTime (in: CurrentTime=0x1b27fc74 | out: CurrentTime=0x1b27fc74*=132260136346053973) returned 0x0 [0077.449] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0xa7bea668 [0077.449] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0x4e0bdf2e [0077.449] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0x2de93310 [0077.449] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0xf13cfce8 [0077.449] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0xae34f406 [0077.449] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0xa26619fd [0077.449] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0xc1d88931 [0077.449] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0xb65f4c1b [0077.449] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0xed99c569 [0077.449] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0xe3589eab [0077.449] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0x4f608f99 [0077.449] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0x24ff2121 [0077.449] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0x23d56bb7 [0077.449] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0x1c46c93c [0077.449] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0x958d2744 [0077.449] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0x1015bee1 [0077.449] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0xb348cab2 [0077.449] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0x5f15cd8e [0077.449] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0xb0fbfeff [0077.449] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0xd47ed21f [0077.449] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0xc12bf844 [0077.449] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0xcb604b68 [0077.449] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0x54a79839 [0077.449] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0x6c87b0d4 [0077.449] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0xca23a378 [0077.449] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0x56ee82ba [0077.450] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0xc479b6af [0077.450] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0x26c8d369 [0077.450] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0xac40cb5e [0077.450] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0xaeb17db1 [0077.450] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0xc5538274 [0077.450] RtlRandom (in: Seed=0x1b27fc80 | out: Seed=0x1b27fc80) returned 0x8f05a953 [0077.459] SetFilePointerEx (in: hFile=0x1248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.460] ReadFile (in: hFile=0x1248, lpBuffer=0x56240f8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1b27fc54, lpOverlapped=0x0 | out: lpBuffer=0x56240f8*, lpNumberOfBytesRead=0x1b27fc54*=0xc800, lpOverlapped=0x0) returned 1 [0077.460] SetFilePointerEx (in: hFile=0x1248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.460] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5650 [0077.460] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497688 [0077.460] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.460] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.461] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5630900 [0077.465] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.465] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.465] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.465] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497688) returned 1 [0077.465] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5650) returned 1 [0077.465] WriteFile (in: hFile=0x1248, lpBuffer=0x5630900*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1b27fc54, lpOverlapped=0x0 | out: lpBuffer=0x5630900*, lpNumberOfBytesWritten=0x1b27fc54*=0xc800, lpOverlapped=0x0) returned 1 [0077.468] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5630900) returned 1 [0077.468] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x56240f8) returned 1 [0077.468] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x29) returned 0x55302e0 [0077.468] SetFilePointerEx (in: hFile=0x1248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.468] WriteFile (in: hFile=0x1248, lpBuffer=0x388c6a0*, nNumberOfBytesToWrite=0x10d, lpNumberOfBytesWritten=0x1b27fcd4, lpOverlapped=0x0 | out: lpBuffer=0x388c6a0*, lpNumberOfBytesWritten=0x1b27fcd4*=0x10d, lpOverlapped=0x0) returned 1 [0077.469] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388c6a0) returned 1 [0077.469] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5530318) returned 1 [0077.469] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.469] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55302e0) returned 1 [0077.469] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559910) returned 1 [0077.469] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a00) returned 1 [0077.469] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ac8) returned 1 [0077.469] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559af0) returned 1 [0077.469] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9e) returned 0x54a1fb0 [0077.469] wcscpy (in: _Dest=0x54a1fb0, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\-PIJHnObxa.mp4" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\-PIJHnObxa.mp4") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\-PIJHnObxa.mp4" [0077.469] wcscat (in: _Dest=0x54a1fb0, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\-PIJHnObxa.mp4.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\-PIJHnObxa.mp4.mailto[knoocknoo@cock.li].a0a70" [0077.470] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\AppData\\Roaming\\-PIJHnObxa.mp4.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1b27fc8c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\AppData\\Roaming\\-PIJHnObxa.mp4.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.470] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb4) returned 0x3906220 Thread: id = 707 os_tid = 0x1a38 [0077.467] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\99ftgb5pOeGZKfxs_.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\99ftgb5poegzkfxs_.gif")) returned 0x20 [0077.471] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\99ftgb5pOeGZKfxs_.gif", dwFileAttributes=0x20) returned 1 [0077.471] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\99ftgb5pOeGZKfxs_.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\99ftgb5poegzkfxs_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x124c [0077.471] GetFileSizeEx (in: hFile=0x124c, lpFileSize=0x1b2ffcec | out: lpFileSize=0x1b2ffcec*=50080) returned 1 [0077.471] SetFilePointerEx (in: hFile=0x124c, liDistanceToMove=0xc39c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.471] ReadFile (in: hFile=0x124c, lpBuffer=0x1b2ffc70, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1b2ffc6c, lpOverlapped=0x0 | out: lpBuffer=0x1b2ffc70*, lpNumberOfBytesRead=0x1b2ffc6c*=0x4, lpOverlapped=0x0) returned 1 [0077.471] SetFilePointerEx (in: hFile=0x124c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.471] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.471] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a00 [0077.471] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.471] NtQuerySystemTime (in: CurrentTime=0x1b2ffc4c | out: CurrentTime=0x1b2ffc4c*=132260136346366368) returned 0x0 [0077.471] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0x76810c14 [0077.471] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0x1aefab48 [0077.471] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0x2e82c17b [0077.471] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0xcdda012e [0077.472] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0x514c9f8e [0077.472] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0xd42d02fd [0077.472] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0x6429cb06 [0077.472] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0xa8879345 [0077.472] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0x8ffe3ae [0077.472] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0x6dc3c71c [0077.472] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0x65fe19dd [0077.472] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0xa21d9543 [0077.472] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0xcef5323c [0077.472] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0xf8c714f3 [0077.472] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0x79017a79 [0077.472] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0x1e164309 [0077.472] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0xd451538c [0077.472] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0x26505cd4 [0077.472] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0x2fdf6fd6 [0077.472] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0x6bac52ac [0077.472] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0x961c7abb [0077.472] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0x61241f6a [0077.472] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0x87256e58 [0077.472] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0x32e55812 [0077.472] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0x3f3e2723 [0077.472] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0x81921811 [0077.472] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0x5be8c91c [0077.472] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0x606746aa [0077.472] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0xe420e343 [0077.472] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0x2ea831f8 [0077.472] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0x20dd78ff [0077.472] RtlRandom (in: Seed=0x1b2ffc58 | out: Seed=0x1b2ffc58) returned 0xd9d4991d [0077.481] ReadFile (in: hFile=0x124c, lpBuffer=0x56240f8, nNumberOfBytesToRead=0xc3a0, lpNumberOfBytesRead=0x1b2ffc48, lpOverlapped=0x0 | out: lpBuffer=0x56240f8*, lpNumberOfBytesRead=0x1b2ffc48*=0xc3a0, lpOverlapped=0x0) returned 1 [0077.483] SetFilePointerEx (in: hFile=0x124c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.483] WriteFile (in: hFile=0x124c, lpBuffer=0x5630900*, nNumberOfBytesToWrite=0xc3a0, lpNumberOfBytesWritten=0x1b2ffc44, lpOverlapped=0x0 | out: lpBuffer=0x5630900*, lpNumberOfBytesWritten=0x1b2ffc44*=0xc3a0, lpOverlapped=0x0) returned 1 [0077.486] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.486] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.486] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.486] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5630900) returned 1 [0077.486] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x56240f8) returned 1 [0077.486] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497688) returned 1 [0077.486] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5650) returned 1 [0077.486] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x37) returned 0x5444d00 [0077.486] SetFilePointerEx (in: hFile=0x124c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.486] WriteFile (in: hFile=0x124c, lpBuffer=0x388c6a0*, nNumberOfBytesToWrite=0x11b, lpNumberOfBytesWritten=0x1b2ffcac, lpOverlapped=0x0 | out: lpBuffer=0x388c6a0*, lpNumberOfBytesWritten=0x1b2ffcac*=0x11b, lpOverlapped=0x0) returned 1 [0077.488] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388c6a0) returned 1 [0077.488] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444d80) returned 1 [0077.488] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.488] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444d00) returned 1 [0077.488] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559910) returned 1 [0077.488] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a00) returned 1 [0077.488] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ac8) returned 1 [0077.488] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559af0) returned 1 [0077.488] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xac) returned 0x38a19d8 [0077.488] wcscpy (in: _Dest=0x38a19d8, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\99ftgb5pOeGZKfxs_.gif" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\99ftgb5pOeGZKfxs_.gif") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\99ftgb5pOeGZKfxs_.gif" [0077.488] wcscat (in: _Dest=0x38a19d8, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\99ftgb5pOeGZKfxs_.gif.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\99ftgb5pOeGZKfxs_.gif.mailto[knoocknoo@cock.li].a0a70" [0077.488] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\AppData\\Roaming\\99ftgb5pOeGZKfxs_.gif.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1b2ffc64, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\AppData\\Roaming\\99ftgb5pOeGZKfxs_.gif.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.488] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x55fd538 Thread: id = 708 os_tid = 0x1a3c [0077.488] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Aab5GVR.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\aab5gvr.png")) returned 0x20 [0077.488] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Aab5GVR.png", dwFileAttributes=0x20) returned 1 [0077.489] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Aab5GVR.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\aab5gvr.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1250 [0077.489] GetFileSizeEx (in: hFile=0x1250, lpFileSize=0x1b37fc88 | out: lpFileSize=0x1b37fc88*=83413) returned 1 [0077.489] SetFilePointerEx (in: hFile=0x1250, liDistanceToMove=0x145d1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.489] ReadFile (in: hFile=0x1250, lpBuffer=0x1b37fc0c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1b37fc08, lpOverlapped=0x0 | out: lpBuffer=0x1b37fc0c*, lpNumberOfBytesRead=0x1b37fc08*=0x4, lpOverlapped=0x0) returned 1 [0077.489] SetFilePointerEx (in: hFile=0x1250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.489] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.489] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a00 [0077.489] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.489] NtQuerySystemTime (in: CurrentTime=0x1b37fbe8 | out: CurrentTime=0x1b37fbe8*=132260136346523063) returned 0x0 [0077.489] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0x2e110fee [0077.489] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0xd6da810 [0077.489] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0xe239fbd2 [0077.489] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0x75bf2cdb [0077.489] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0x2052ced0 [0077.489] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0x5bd9ae7b [0077.489] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0xf39b7051 [0077.489] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0x1c8d2653 [0077.489] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0xa981a0bd [0077.489] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0xac43469e [0077.489] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0xcdc0815 [0077.489] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0x392e648a [0077.489] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0x110dd777 [0077.489] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0xd076ee8a [0077.490] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0x7e1715f9 [0077.490] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0x590a070c [0077.490] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0x923eaf0f [0077.490] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0x3c83bc59 [0077.490] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0x289ddcd2 [0077.490] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0xb9873443 [0077.490] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0x52c107df [0077.490] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0xe5ea6a67 [0077.490] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0x195d89b4 [0077.490] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0x967eeb45 [0077.490] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0x9b99f98 [0077.490] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0xcbdc1e30 [0077.490] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0xa8cf0999 [0077.490] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0x17f58b97 [0077.490] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0x29951cf9 [0077.490] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0x16ee8aa5 [0077.490] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0x2f2bfa26 [0077.490] RtlRandom (in: Seed=0x1b37fbf4 | out: Seed=0x1b37fbf4) returned 0x52344ec3 [0077.499] SetFilePointerEx (in: hFile=0x1250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.499] ReadFile (in: hFile=0x1250, lpBuffer=0x56240f8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1b37fbc8, lpOverlapped=0x0 | out: lpBuffer=0x56240f8*, lpNumberOfBytesRead=0x1b37fbc8*=0xc800, lpOverlapped=0x0) returned 1 [0077.499] SetFilePointerEx (in: hFile=0x1250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.499] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5650 [0077.499] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497688 [0077.499] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.499] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.500] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5630900 [0077.501] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.501] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.501] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.501] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497688) returned 1 [0077.501] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5650) returned 1 [0077.501] WriteFile (in: hFile=0x1250, lpBuffer=0x5630900*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1b37fbc8, lpOverlapped=0x0 | out: lpBuffer=0x5630900*, lpNumberOfBytesWritten=0x1b37fbc8*=0xc800, lpOverlapped=0x0) returned 1 [0077.503] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5630900) returned 1 [0077.503] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x56240f8) returned 1 [0077.503] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x23) returned 0x38a67c0 [0077.503] SetFilePointerEx (in: hFile=0x1250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.503] WriteFile (in: hFile=0x1250, lpBuffer=0x549c970*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x1b37fc48, lpOverlapped=0x0 | out: lpBuffer=0x549c970*, lpNumberOfBytesWritten=0x1b37fc48*=0x107, lpOverlapped=0x0) returned 1 [0077.505] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549c970) returned 1 [0077.505] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6820) returned 1 [0077.505] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.505] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a67c0) returned 1 [0077.505] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559910) returned 1 [0077.505] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a00) returned 1 [0077.505] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ac8) returned 1 [0077.505] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559af0) returned 1 [0077.505] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x98) returned 0x54269a8 [0077.505] wcscpy (in: _Dest=0x54269a8, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\Aab5GVR.png" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Aab5GVR.png") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Aab5GVR.png" [0077.505] wcscat (in: _Dest=0x54269a8, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Aab5GVR.png.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Aab5GVR.png.mailto[knoocknoo@cock.li].a0a70" [0077.505] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Aab5GVR.png.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1b37fc00, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\AppData\\Roaming\\Aab5GVR.png.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.505] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xae) returned 0x38a21c0 Thread: id = 709 os_tid = 0x1a40 [0077.504] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x38ffa18 [0077.504] wcscpy (in: _Dest=0x38ffa18, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe" [0077.504] wcscat (in: _Dest=0x38ffa18, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\" [0077.504] wcscat (in: _Dest=0x38ffa18, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\*" [0077.504] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542de68 [0077.505] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x542de68 | out: lpFindFileData=0x542de68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7161656c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b7983c6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0082.226] wcscmp (_String1=".", _String2=".") returned 0 [0082.226] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542de68 | out: lpFindFileData=0x542de68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7161656c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b7983c6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.226] wcscmp (_String1="..", _String2=".") returned 1 [0082.226] wcscmp (_String1="..", _String2="..") returned 0 [0082.226] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542de68 | out: lpFindFileData=0x542de68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x715a3e1e, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0082.226] wcscmp (_String1="Acrobat", _String2=".") returned 1 [0082.226] wcscmp (_String1="Acrobat", _String2="..") returned 1 [0082.226] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x541b078 [0082.226] wcscpy (in: _Dest=0x541b078, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe" [0082.226] wcscat (in: _Dest=0x541b078, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\" [0082.226] wcscat (in: _Dest=0x541b078, _Source="Acrobat" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat" [0082.226] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x541b078, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d40 [0082.227] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542de68 | out: lpFindFileData=0x542de68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe5380e4e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe5380e4e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0082.227] wcscmp (_String1="Flash Player", _String2=".") returned 1 [0082.227] wcscmp (_String1="Flash Player", _String2="..") returned 1 [0082.227] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x5ba7428 [0082.227] wcscpy (in: _Dest=0x5ba7428, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe" [0082.227] wcscat (in: _Dest=0x5ba7428, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\" [0082.227] wcscat (in: _Dest=0x5ba7428, _Source="Flash Player" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player" [0082.227] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba7428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d44 [0082.228] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542de68 | out: lpFindFileData=0x542de68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7161656c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7161656c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7161656c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Headlights", cAlternateFileName="HEADLI~1")) returned 1 [0082.228] wcscmp (_String1="Headlights", _String2=".") returned 1 [0082.228] wcscmp (_String1="Headlights", _String2="..") returned 1 [0082.228] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x5ba7498 [0082.228] wcscpy (in: _Dest=0x5ba7498, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe" [0082.228] wcscat (in: _Dest=0x5ba7498, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\" [0082.228] wcscat (in: _Dest=0x5ba7498, _Source="Headlights" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Headlights") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Headlights" [0082.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba7498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d48 [0082.229] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542de68 | out: lpFindFileData=0x542de68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715ca081, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715ca081, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x715ca081, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0082.229] wcscmp (_String1="Linguistics", _String2=".") returned 1 [0082.229] wcscmp (_String1="Linguistics", _String2="..") returned 1 [0082.229] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x5ba79d8 [0082.229] wcscpy (in: _Dest=0x5ba79d8, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe" [0082.229] wcscat (in: _Dest=0x5ba79d8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\" [0082.229] wcscat (in: _Dest=0x5ba79d8, _Source="Linguistics" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Linguistics") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Linguistics" [0082.229] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba79d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d4c [0082.229] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542de68 | out: lpFindFileData=0x542de68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715ca081, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7894b39b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7894b39b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 1 [0082.229] wcscmp (_String1="LogTransport2", _String2=".") returned 1 [0082.229] wcscmp (_String1="LogTransport2", _String2="..") returned 1 [0082.229] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x68) returned 0x5ba7578 [0082.229] wcscpy (in: _Dest=0x5ba7578, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe" [0082.229] wcscat (in: _Dest=0x5ba7578, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\" [0082.229] wcscat (in: _Dest=0x5ba7578, _Source="LogTransport2" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2" [0082.230] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba7578, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d50 [0082.230] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542de68 | out: lpFindFileData=0x542de68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b7983c6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b7983c6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b7983c6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sonar", cAlternateFileName="")) returned 1 [0082.230] wcscmp (_String1="Sonar", _String2=".") returned 1 [0082.230] wcscmp (_String1="Sonar", _String2="..") returned 1 [0082.230] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x7583aa0 [0082.230] wcscpy (in: _Dest=0x7583aa0, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe" [0082.230] wcscat (in: _Dest=0x7583aa0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\" [0082.230] wcscat (in: _Dest=0x7583aa0, _Source="Sonar" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar" [0082.230] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7583aa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d54 [0082.231] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542de68 | out: lpFindFileData=0x542de68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b7983c6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b7983c6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b7983c6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sonar", cAlternateFileName="")) returned 0 [0082.231] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0082.232] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542de68) returned 1 [0082.232] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ffa18) returned 1 [0082.232] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ffe90) returned 1 Thread: id = 710 os_tid = 0x1a44 [0077.506] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\BEhdate.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\behdate.mp4")) returned 0x20 [0077.506] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\BEhdate.mp4", dwFileAttributes=0x20) returned 1 [0077.506] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\BEhdate.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\behdate.mp4"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1254 [0077.506] GetFileSizeEx (in: hFile=0x1254, lpFileSize=0x1b47f7fc | out: lpFileSize=0x1b47f7fc*=56872) returned 1 [0077.506] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0xde24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.506] ReadFile (in: hFile=0x1254, lpBuffer=0x1b47f780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1b47f77c, lpOverlapped=0x0 | out: lpBuffer=0x1b47f780*, lpNumberOfBytesRead=0x1b47f77c*=0x4, lpOverlapped=0x0) returned 1 [0077.506] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.506] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.507] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a00 [0077.507] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.507] NtQuerySystemTime (in: CurrentTime=0x1b47f75c | out: CurrentTime=0x1b47f75c*=132260136346678867) returned 0x0 [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0xd5e4a811 [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0xff524443 [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0x9ad78458 [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0x7ee5d534 [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0x29d86c2 [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0x272c373f [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0xefb54343 [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0x94d282a2 [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0xd913c38 [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0x6e249e14 [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0x2c77e4b9 [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0xacb8d4d6 [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0x5f032b91 [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0x39ad9cbe [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0xb3d1657a [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0x18d610a [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0xdbdfb8da [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0x8222089b [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0x9a3cb7a0 [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0x93e30431 [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0xe13659c0 [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0xe04c463e [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0xd15ffd55 [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0x3f8ff539 [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0x54d0a892 [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0xa3516c30 [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0xd59b35ed [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0x469ca938 [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0x3ce06c86 [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0xcb1c44d7 [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0x35735ae9 [0077.507] RtlRandom (in: Seed=0x1b47f768 | out: Seed=0x1b47f768) returned 0x5f4f7f83 [0077.516] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.516] ReadFile (in: hFile=0x1254, lpBuffer=0x56240f8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1b47f73c, lpOverlapped=0x0 | out: lpBuffer=0x56240f8*, lpNumberOfBytesRead=0x1b47f73c*=0xc800, lpOverlapped=0x0) returned 1 [0077.516] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.517] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5650 [0077.517] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497688 [0077.517] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.517] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.518] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5630900 [0077.518] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.518] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.518] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.518] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497688) returned 1 [0077.518] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5650) returned 1 [0077.518] WriteFile (in: hFile=0x1254, lpBuffer=0x5630900*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1b47f73c, lpOverlapped=0x0 | out: lpBuffer=0x5630900*, lpNumberOfBytesWritten=0x1b47f73c*=0xc800, lpOverlapped=0x0) returned 1 [0077.523] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5630900) returned 1 [0077.523] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x56240f8) returned 1 [0077.523] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x23) returned 0x38a67c0 [0077.523] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.523] WriteFile (in: hFile=0x1254, lpBuffer=0x549c970*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x1b47f7bc, lpOverlapped=0x0 | out: lpBuffer=0x549c970*, lpNumberOfBytesWritten=0x1b47f7bc*=0x107, lpOverlapped=0x0) returned 1 [0077.525] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549c970) returned 1 [0077.525] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6820) returned 1 [0077.525] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.525] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a67c0) returned 1 [0077.525] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559910) returned 1 [0077.525] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a00) returned 1 [0077.525] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ac8) returned 1 [0077.525] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559af0) returned 1 [0077.525] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x98) returned 0x55c6d98 [0077.525] wcscpy (in: _Dest=0x55c6d98, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\BEhdate.mp4" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\BEhdate.mp4") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\BEhdate.mp4" [0077.525] wcscat (in: _Dest=0x55c6d98, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\BEhdate.mp4.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\BEhdate.mp4.mailto[knoocknoo@cock.li].a0a70" [0077.525] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\AppData\\Roaming\\BEhdate.mp4.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1b47f774, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\AppData\\Roaming\\BEhdate.mp4.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.525] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xae) returned 0x38a1cb8 Thread: id = 711 os_tid = 0x1a48 [0077.526] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\BVw Kx kkPRD2Vat.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\bvw kx kkprd2vat.bmp")) returned 0x20 [0077.526] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\BVw Kx kkPRD2Vat.bmp", dwFileAttributes=0x20) returned 1 [0077.526] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\BVw Kx kkPRD2Vat.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\bvw kx kkprd2vat.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1258 [0077.526] GetFileSizeEx (in: hFile=0x1258, lpFileSize=0x1b4ffd28 | out: lpFileSize=0x1b4ffd28*=11429) returned 1 [0077.526] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x2ca1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.526] ReadFile (in: hFile=0x1258, lpBuffer=0x1b4ffcac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1b4ffca8, lpOverlapped=0x0 | out: lpBuffer=0x1b4ffcac*, lpNumberOfBytesRead=0x1b4ffca8*=0x4, lpOverlapped=0x0) returned 1 [0077.526] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.526] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.526] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a00 [0077.526] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.527] NtQuerySystemTime (in: CurrentTime=0x1b4ffc88 | out: CurrentTime=0x1b4ffc88*=132260136346835508) returned 0x0 [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0xac492f83 [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0xd2849b66 [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0xad5d2c3d [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0xb81e79a5 [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0xab0b1a3a [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0x2973bf75 [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0x352e68a5 [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0x4c01ddca [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0xafcc4d94 [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0x203d78a1 [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0x9c3ca91f [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0xffe8d456 [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0x3e11ed7 [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0xe3e3713 [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0x33397da2 [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0x10c53f44 [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0xdbdee49b [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0xaae24ebb [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0x238006cc [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0x3b04ec1f [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0xc1b50990 [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0x1966e8b4 [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0x93550e12 [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0x756f2c66 [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0x437fadeb [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0x8a918275 [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0xcc76ea82 [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0x81f9a35d [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0xeee123e8 [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0x56b3cf68 [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0x583dfbe2 [0077.527] RtlRandom (in: Seed=0x1b4ffc94 | out: Seed=0x1b4ffc94) returned 0xdd63c895 [0077.537] ReadFile (in: hFile=0x1258, lpBuffer=0x56240f8, nNumberOfBytesToRead=0x2ca5, lpNumberOfBytesRead=0x1b4ffc84, lpOverlapped=0x0 | out: lpBuffer=0x56240f8*, lpNumberOfBytesRead=0x1b4ffc84*=0x2ca5, lpOverlapped=0x0) returned 1 [0077.537] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.537] WriteFile (in: hFile=0x1258, lpBuffer=0x5630900*, nNumberOfBytesToWrite=0x2ca5, lpNumberOfBytesWritten=0x1b4ffc80, lpOverlapped=0x0 | out: lpBuffer=0x5630900*, lpNumberOfBytesWritten=0x1b4ffc80*=0x2ca5, lpOverlapped=0x0) returned 1 [0077.538] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.538] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.539] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.539] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5630900) returned 1 [0077.539] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x56240f8) returned 1 [0077.539] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497688) returned 1 [0077.539] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5650) returned 1 [0077.539] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x35) returned 0x5444d00 [0077.539] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.539] WriteFile (in: hFile=0x1258, lpBuffer=0x388c6a0*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x1b4ffce8, lpOverlapped=0x0 | out: lpBuffer=0x388c6a0*, lpNumberOfBytesWritten=0x1b4ffce8*=0x119, lpOverlapped=0x0) returned 1 [0077.540] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388c6a0) returned 1 [0077.540] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445100) returned 1 [0077.540] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.540] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444d00) returned 1 [0077.540] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559910) returned 1 [0077.540] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a00) returned 1 [0077.540] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ac8) returned 1 [0077.540] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559af0) returned 1 [0077.540] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xaa) returned 0x38a1d70 [0077.540] wcscpy (in: _Dest=0x38a1d70, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\BVw Kx kkPRD2Vat.bmp" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\BVw Kx kkPRD2Vat.bmp") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\BVw Kx kkPRD2Vat.bmp" [0077.540] wcscat (in: _Dest=0x38a1d70, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\BVw Kx kkPRD2Vat.bmp.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\BVw Kx kkPRD2Vat.bmp.mailto[knoocknoo@cock.li].a0a70" [0077.540] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\AppData\\Roaming\\BVw Kx kkPRD2Vat.bmp.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1b4ffca0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\AppData\\Roaming\\BVw Kx kkPRD2Vat.bmp.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.540] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x3975c98 Thread: id = 712 os_tid = 0x1a4c [0077.538] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\cEqV.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ceqv.mp3")) returned 0x20 [0077.541] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\cEqV.mp3", dwFileAttributes=0x20) returned 1 [0077.541] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\cEqV.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ceqv.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x125c [0077.541] GetFileSizeEx (in: hFile=0x125c, lpFileSize=0x1b57f900 | out: lpFileSize=0x1b57f900*=53184) returned 1 [0077.541] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0xcfbc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.541] ReadFile (in: hFile=0x125c, lpBuffer=0x1b57f884, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1b57f880, lpOverlapped=0x0 | out: lpBuffer=0x1b57f884*, lpNumberOfBytesRead=0x1b57f880*=0x4, lpOverlapped=0x0) returned 1 [0077.541] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.541] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.541] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a00 [0077.541] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.541] NtQuerySystemTime (in: CurrentTime=0x1b57f860 | out: CurrentTime=0x1b57f860*=132260136346991586) returned 0x0 [0077.541] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0x4600f48d [0077.541] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0x2665f8af [0077.541] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0x2e87847b [0077.542] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0xb53f06ad [0077.542] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0x8b83e267 [0077.542] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0xb1a557c0 [0077.542] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0x74572cd9 [0077.542] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0xd4914b9c [0077.542] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0x12ae83ae [0077.542] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0xee441da4 [0077.542] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0xae5866e7 [0077.542] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0x49fb4d4f [0077.542] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0x9d568b63 [0077.542] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0x9a01e8b5 [0077.542] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0x6193a6eb [0077.542] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0x54a5fbc8 [0077.542] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0x518a6f5c [0077.542] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0xb8a5cba3 [0077.542] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0x77629bad [0077.542] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0xe3094bbb [0077.542] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0xb803e9e7 [0077.542] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0x3f21ab3d [0077.542] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0x65647a88 [0077.542] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0xeea7e7da [0077.542] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0xaca49d11 [0077.542] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0xd330a2a0 [0077.542] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0x42f4708b [0077.542] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0xa79c4df5 [0077.542] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0x8250df57 [0077.542] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0xba9b08cd [0077.542] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0x35f94e41 [0077.542] RtlRandom (in: Seed=0x1b57f86c | out: Seed=0x1b57f86c) returned 0x6e96ffa1 [0077.551] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.551] ReadFile (in: hFile=0x125c, lpBuffer=0x56240f8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1b57f840, lpOverlapped=0x0 | out: lpBuffer=0x56240f8*, lpNumberOfBytesRead=0x1b57f840*=0xc800, lpOverlapped=0x0) returned 1 [0077.551] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.551] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5650 [0077.552] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497688 [0077.552] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.552] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.552] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5630900 [0077.553] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.553] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.553] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.553] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497688) returned 1 [0077.553] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5650) returned 1 [0077.553] WriteFile (in: hFile=0x125c, lpBuffer=0x5630900*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1b57f840, lpOverlapped=0x0 | out: lpBuffer=0x5630900*, lpNumberOfBytesWritten=0x1b57f840*=0xc800, lpOverlapped=0x0) returned 1 [0077.555] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5630900) returned 1 [0077.555] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x56240f8) returned 1 [0077.555] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d) returned 0x5559a78 [0077.555] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.555] WriteFile (in: hFile=0x125c, lpBuffer=0x549bc50*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0x1b57f8c0, lpOverlapped=0x0 | out: lpBuffer=0x549bc50*, lpNumberOfBytesWritten=0x1b57f8c0*=0x101, lpOverlapped=0x0) returned 1 [0077.557] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549bc50) returned 1 [0077.557] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559fc8) returned 1 [0077.557] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ed8) returned 1 [0077.557] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.557] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559910) returned 1 [0077.557] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a00) returned 1 [0077.557] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ac8) returned 1 [0077.557] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559af0) returned 1 [0077.557] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x92) returned 0x55c6f78 [0077.557] wcscpy (in: _Dest=0x55c6f78, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\cEqV.mp3" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\cEqV.mp3") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\cEqV.mp3" [0077.557] wcscat (in: _Dest=0x55c6f78, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\cEqV.mp3.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\cEqV.mp3.mailto[knoocknoo@cock.li].a0a70" [0077.557] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\AppData\\Roaming\\cEqV.mp3.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1b57f878, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\AppData\\Roaming\\cEqV.mp3.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.557] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa8) returned 0x54df160 Thread: id = 713 os_tid = 0x1a50 [0077.557] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ekbflhqnblaZZXa.ods" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ekbflhqnblazzxa.ods")) returned 0x20 [0077.557] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ekbflhqnblaZZXa.ods", dwFileAttributes=0x20) returned 1 [0077.558] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ekbflhqnblaZZXa.ods" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ekbflhqnblazzxa.ods"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1260 [0077.558] GetFileSizeEx (in: hFile=0x1260, lpFileSize=0x1b5ff790 | out: lpFileSize=0x1b5ff790*=65571) returned 1 [0077.558] SetFilePointerEx (in: hFile=0x1260, liDistanceToMove=0x1001f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.558] ReadFile (in: hFile=0x1260, lpBuffer=0x1b5ff714, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1b5ff710, lpOverlapped=0x0 | out: lpBuffer=0x1b5ff714*, lpNumberOfBytesRead=0x1b5ff710*=0x4, lpOverlapped=0x0) returned 1 [0077.558] SetFilePointerEx (in: hFile=0x1260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.558] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.558] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a00 [0077.558] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.558] NtQuerySystemTime (in: CurrentTime=0x1b5ff6f0 | out: CurrentTime=0x1b5ff6f0*=132260136347147705) returned 0x0 [0077.558] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0x996c5d62 [0077.558] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0x4b403cec [0077.558] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0x95e0e5b5 [0077.558] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0xec787d35 [0077.558] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0x110eb48 [0077.558] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0x16bbac3 [0077.558] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0x14c8c982 [0077.558] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0x6e21059b [0077.558] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0x7b82270e [0077.558] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0x6b9a4cdf [0077.558] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0xd563fcb6 [0077.558] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0x174a48df [0077.558] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0x9cfe8b0 [0077.558] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0xb8f05033 [0077.558] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0xa943981a [0077.558] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0xd3ae74d5 [0077.558] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0x5ed569a2 [0077.558] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0x635eeca6 [0077.559] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0xc41113b4 [0077.559] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0xe95bcf89 [0077.559] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0x6c2982 [0077.559] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0xac81adfe [0077.559] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0x13e860d3 [0077.559] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0x8d251310 [0077.559] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0xeb8214e8 [0077.559] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0xde17249f [0077.559] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0x630cf1f4 [0077.559] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0x2ddd5571 [0077.559] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0x5b8157d1 [0077.559] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0x28646931 [0077.559] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0x8695cf25 [0077.559] RtlRandom (in: Seed=0x1b5ff6fc | out: Seed=0x1b5ff6fc) returned 0xcb3322b4 [0077.568] SetFilePointerEx (in: hFile=0x1260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.568] ReadFile (in: hFile=0x1260, lpBuffer=0x56240f8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1b5ff6d0, lpOverlapped=0x0 | out: lpBuffer=0x56240f8*, lpNumberOfBytesRead=0x1b5ff6d0*=0xc800, lpOverlapped=0x0) returned 1 [0077.568] SetFilePointerEx (in: hFile=0x1260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.568] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5650 [0077.568] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497688 [0077.568] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.568] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.569] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5630900 [0077.570] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.570] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.570] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.570] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497688) returned 1 [0077.570] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5650) returned 1 [0077.570] WriteFile (in: hFile=0x1260, lpBuffer=0x5630900*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1b5ff6d0, lpOverlapped=0x0 | out: lpBuffer=0x5630900*, lpNumberOfBytesWritten=0x1b5ff6d0*=0xc800, lpOverlapped=0x0) returned 1 [0077.572] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5630900) returned 1 [0077.572] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x56240f8) returned 1 [0077.572] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x33) returned 0x5444d00 [0077.572] SetFilePointerEx (in: hFile=0x1260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.572] WriteFile (in: hFile=0x1260, lpBuffer=0x388c6a0*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0x1b5ff750, lpOverlapped=0x0 | out: lpBuffer=0x388c6a0*, lpNumberOfBytesWritten=0x1b5ff750*=0x117, lpOverlapped=0x0) returned 1 [0077.573] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388c6a0) returned 1 [0077.573] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445100) returned 1 [0077.573] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.573] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444d00) returned 1 [0077.573] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559910) returned 1 [0077.573] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a00) returned 1 [0077.573] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ac8) returned 1 [0077.573] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559af0) returned 1 [0077.573] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa8) returned 0x54de240 [0077.573] wcscpy (in: _Dest=0x54de240, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\ekbflhqnblaZZXa.ods" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\ekbflhqnblaZZXa.ods") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\ekbflhqnblaZZXa.ods" [0077.573] wcscat (in: _Dest=0x54de240, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\ekbflhqnblaZZXa.ods.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\ekbflhqnblaZZXa.ods.mailto[knoocknoo@cock.li].a0a70" [0077.573] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ekbflhqnblaZZXa.ods.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1b5ff708, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\AppData\\Roaming\\ekbflhqnblaZZXa.ods.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.573] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x3975ef0 Thread: id = 714 os_tid = 0x1a54 [0077.571] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\eKVPy-9VMIEi JW.xlsx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ekvpy-9vmiei jw.xlsx")) returned 0x20 [0077.574] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\eKVPy-9VMIEi JW.xlsx", dwFileAttributes=0x20) returned 1 [0077.574] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\eKVPy-9VMIEi JW.xlsx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ekvpy-9vmiei jw.xlsx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1264 [0077.574] GetFileSizeEx (in: hFile=0x1264, lpFileSize=0x1b67fdfc | out: lpFileSize=0x1b67fdfc*=43217) returned 1 [0077.574] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0xa8cd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.574] ReadFile (in: hFile=0x1264, lpBuffer=0x1b67fd80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1b67fd7c, lpOverlapped=0x0 | out: lpBuffer=0x1b67fd80*, lpNumberOfBytesRead=0x1b67fd7c*=0x4, lpOverlapped=0x0) returned 1 [0077.574] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.574] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.574] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a00 [0077.574] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.574] NtQuerySystemTime (in: CurrentTime=0x1b67fd5c | out: CurrentTime=0x1b67fd5c*=132260136347304136) returned 0x0 [0077.574] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0xa1f8e68e [0077.574] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0xba61c8da [0077.575] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0x662f0c8 [0077.575] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0x7d758aa7 [0077.575] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0x260fde80 [0077.575] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0xac1ca233 [0077.575] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0xee707db4 [0077.575] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0x14b8503b [0077.575] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0xe27d8d9 [0077.575] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0x687cc46f [0077.575] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0x466dea0b [0077.575] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0x77723856 [0077.575] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0xfdf66634 [0077.575] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0x1a787555 [0077.575] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0x3e99cd0 [0077.575] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0x55e8d8fe [0077.575] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0x514fbbbc [0077.575] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0xf1e6e41e [0077.575] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0x47f5809 [0077.575] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0xeebcbdfa [0077.575] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0x8560a6a0 [0077.575] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0x5664d58b [0077.575] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0xbe860964 [0077.575] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0x6e265a68 [0077.575] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0xc91a664e [0077.575] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0x6b7d23d3 [0077.575] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0x7cb4f5ac [0077.575] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0xcf494ba0 [0077.575] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0x9fbdc6aa [0077.575] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0x4f402394 [0077.575] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0x6ccbf9a1 [0077.575] RtlRandom (in: Seed=0x1b67fd68 | out: Seed=0x1b67fd68) returned 0x9aa2dbd6 [0077.584] ReadFile (in: hFile=0x1264, lpBuffer=0x56240f8, nNumberOfBytesToRead=0xa8d1, lpNumberOfBytesRead=0x1b67fd58, lpOverlapped=0x0 | out: lpBuffer=0x56240f8*, lpNumberOfBytesRead=0x1b67fd58*=0xa8d1, lpOverlapped=0x0) returned 1 [0077.585] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.585] WriteFile (in: hFile=0x1264, lpBuffer=0x5630900*, nNumberOfBytesToWrite=0xa8d1, lpNumberOfBytesWritten=0x1b67fd54, lpOverlapped=0x0 | out: lpBuffer=0x5630900*, lpNumberOfBytesWritten=0x1b67fd54*=0xa8d1, lpOverlapped=0x0) returned 1 [0077.587] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.588] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.588] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.588] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5630900) returned 1 [0077.588] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x56240f8) returned 1 [0077.588] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497688) returned 1 [0077.588] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5650) returned 1 [0077.588] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x35) returned 0x5444d00 [0077.588] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.588] WriteFile (in: hFile=0x1264, lpBuffer=0x388c6a0*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x1b67fdbc, lpOverlapped=0x0 | out: lpBuffer=0x388c6a0*, lpNumberOfBytesWritten=0x1b67fdbc*=0x119, lpOverlapped=0x0) returned 1 [0077.589] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388c6a0) returned 1 [0077.589] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445100) returned 1 [0077.589] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.589] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444d00) returned 1 [0077.589] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559910) returned 1 [0077.589] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a00) returned 1 [0077.589] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ac8) returned 1 [0077.589] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559af0) returned 1 [0077.590] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xaa) returned 0x5446088 [0077.590] wcscpy (in: _Dest=0x5446088, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\eKVPy-9VMIEi JW.xlsx" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\eKVPy-9VMIEi JW.xlsx") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\eKVPy-9VMIEi JW.xlsx" [0077.590] wcscat (in: _Dest=0x5446088, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\eKVPy-9VMIEi JW.xlsx.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\eKVPy-9VMIEi JW.xlsx.mailto[knoocknoo@cock.li].a0a70" [0077.590] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\AppData\\Roaming\\eKVPy-9VMIEi JW.xlsx.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1b67fd74, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\AppData\\Roaming\\eKVPy-9VMIEi JW.xlsx.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.590] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x3975fb8 Thread: id = 715 os_tid = 0x1a58 [0077.587] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\fIxG.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\fixg.mp3")) returned 0x20 [0077.590] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\fIxG.mp3", dwFileAttributes=0x20) returned 1 [0077.590] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\fIxG.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\fixg.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1268 [0077.590] GetFileSizeEx (in: hFile=0x1268, lpFileSize=0x1b6ffb10 | out: lpFileSize=0x1b6ffb10*=49018) returned 1 [0077.590] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0xbf76, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.590] ReadFile (in: hFile=0x1268, lpBuffer=0x1b6ffa94, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1b6ffa90, lpOverlapped=0x0 | out: lpBuffer=0x1b6ffa94*, lpNumberOfBytesRead=0x1b6ffa90*=0x4, lpOverlapped=0x0) returned 1 [0077.591] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.591] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.591] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a00 [0077.591] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.591] NtQuerySystemTime (in: CurrentTime=0x1b6ffa70 | out: CurrentTime=0x1b6ffa70*=132260136347460216) returned 0x0 [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0xb1de52a4 [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0x502f6b4d [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0x96085a9e [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0x257aaf62 [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0xa55aa058 [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0x4e9c726c [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0x923f09f2 [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0x86aabdcb [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0x6a720ffa [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0x872475fc [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0xec86be2a [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0x963fbc6e [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0xde91b92d [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0xf4c3f38e [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0x9785d9ae [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0xec5e5e2d [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0xa4172e0b [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0x5ae189bd [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0x7fa8e266 [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0x961717f0 [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0x9e68dad8 [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0xeeadf699 [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0x6bdeecfd [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0xbf172b6c [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0xf08acaeb [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0x7d0c80dc [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0x65e3e2d9 [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0x6cd6db3 [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0xbbd3895a [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0x6da4b4d5 [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0xc06e6c5d [0077.591] RtlRandom (in: Seed=0x1b6ffa7c | out: Seed=0x1b6ffa7c) returned 0xa1d6052d [0077.601] ReadFile (in: hFile=0x1268, lpBuffer=0x56240f8, nNumberOfBytesToRead=0xbf7a, lpNumberOfBytesRead=0x1b6ffa6c, lpOverlapped=0x0 | out: lpBuffer=0x56240f8*, lpNumberOfBytesRead=0x1b6ffa6c*=0xbf7a, lpOverlapped=0x0) returned 1 [0077.603] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.603] WriteFile (in: hFile=0x1268, lpBuffer=0x5630900*, nNumberOfBytesToWrite=0xbf7a, lpNumberOfBytesWritten=0x1b6ffa68, lpOverlapped=0x0 | out: lpBuffer=0x5630900*, lpNumberOfBytesWritten=0x1b6ffa68*=0xbf7a, lpOverlapped=0x0) returned 1 [0077.604] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.604] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.604] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.604] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5630900) returned 1 [0077.604] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x56240f8) returned 1 [0077.604] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497688) returned 1 [0077.604] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5650) returned 1 [0077.604] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d) returned 0x5559a78 [0077.604] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.604] WriteFile (in: hFile=0x1268, lpBuffer=0x549bc50*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0x1b6ffad0, lpOverlapped=0x0 | out: lpBuffer=0x549bc50*, lpNumberOfBytesWritten=0x1b6ffad0*=0x101, lpOverlapped=0x0) returned 1 [0077.617] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549bc50) returned 1 [0077.617] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559fc8) returned 1 [0077.617] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ed8) returned 1 [0077.617] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.617] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559910) returned 1 [0077.617] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a00) returned 1 [0077.617] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ac8) returned 1 [0077.617] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559af0) returned 1 [0077.617] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x92) returned 0x55c64d8 [0077.617] wcscpy (in: _Dest=0x55c64d8, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\fIxG.mp3" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\fIxG.mp3") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\fIxG.mp3" [0077.617] wcscat (in: _Dest=0x55c64d8, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\fIxG.mp3.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\fIxG.mp3.mailto[knoocknoo@cock.li].a0a70" [0077.617] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\AppData\\Roaming\\fIxG.mp3.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1b6ffa88, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\AppData\\Roaming\\fIxG.mp3.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.617] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa8) returned 0x54df210 Thread: id = 716 os_tid = 0x1a5c [0077.606] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\fLADy0S29O.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\flady0s29o.gif")) returned 0x20 [0077.606] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\fLADy0S29O.gif", dwFileAttributes=0x20) returned 1 [0077.606] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\fLADy0S29O.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\flady0s29o.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x126c [0077.607] GetFileSizeEx (in: hFile=0x126c, lpFileSize=0x1b77f854 | out: lpFileSize=0x1b77f854*=102125) returned 1 [0077.607] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x18ee9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.607] ReadFile (in: hFile=0x126c, lpBuffer=0x1b77f7d8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1b77f7d4, lpOverlapped=0x0 | out: lpBuffer=0x1b77f7d8*, lpNumberOfBytesRead=0x1b77f7d4*=0x4, lpOverlapped=0x0) returned 1 [0077.607] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.607] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f28 [0077.607] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559dc0 [0077.607] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f50 [0077.607] NtQuerySystemTime (in: CurrentTime=0x1b77f7b4 | out: CurrentTime=0x1b77f7b4*=132260136347616513) returned 0x0 [0077.607] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0xa44185d2 [0077.607] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0xdc20f754 [0077.607] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0xa19c83ff [0077.607] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0x5ebdc28d [0077.607] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0x9d1acc65 [0077.607] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0x257c6002 [0077.607] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0x7fac5abc [0077.607] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0xf59c3895 [0077.607] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0xa5f2395c [0077.607] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0xb02af36c [0077.607] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0x6500d497 [0077.607] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0x74e535a0 [0077.607] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0xc66443d4 [0077.607] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0xaf6ac9b5 [0077.607] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0xb99816c8 [0077.607] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0x2621b591 [0077.607] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0xcb365057 [0077.607] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0x2a7b8f4e [0077.607] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0x37f2a833 [0077.607] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0x8a363fbe [0077.607] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0xdf185545 [0077.607] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0x7de2e2d6 [0077.607] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0x47d72c39 [0077.607] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0x68ae85e3 [0077.608] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0x2840b90a [0077.608] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0xf7f70e8e [0077.608] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0x6d38d04f [0077.608] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0x83961ad4 [0077.608] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0xec0d5e83 [0077.608] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0x3fed1b5f [0077.608] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0x63e750be [0077.608] RtlRandom (in: Seed=0x1b77f7c0 | out: Seed=0x1b77f7c0) returned 0x45c28226 [0077.618] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.618] ReadFile (in: hFile=0x126c, lpBuffer=0x56240f8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1b77f794, lpOverlapped=0x0 | out: lpBuffer=0x56240f8*, lpNumberOfBytesRead=0x1b77f794*=0xc800, lpOverlapped=0x0) returned 1 [0077.618] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.618] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5650 [0077.618] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497688 [0077.618] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559e38 [0077.618] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559e38) returned 1 [0077.619] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5630900 [0077.620] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f28 [0077.620] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f50 [0077.620] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559f50) returned 1 [0077.620] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497688) returned 1 [0077.620] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5650) returned 1 [0077.620] WriteFile (in: hFile=0x126c, lpBuffer=0x5630900*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1b77f794, lpOverlapped=0x0 | out: lpBuffer=0x5630900*, lpNumberOfBytesWritten=0x1b77f794*=0xc800, lpOverlapped=0x0) returned 1 [0077.622] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5630900) returned 1 [0077.622] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x56240f8) returned 1 [0077.622] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x29) returned 0x5530510 [0077.622] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.622] WriteFile (in: hFile=0x126c, lpBuffer=0x388c6a0*, nNumberOfBytesToWrite=0x10d, lpNumberOfBytesWritten=0x1b77f814, lpOverlapped=0x0 | out: lpBuffer=0x388c6a0*, lpNumberOfBytesWritten=0x1b77f814*=0x10d, lpOverlapped=0x0) returned 1 [0077.623] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388c6a0) returned 1 [0077.623] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55305f0) returned 1 [0077.623] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ed8) returned 1 [0077.623] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5530510) returned 1 [0077.624] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559f28) returned 1 [0077.624] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559dc0) returned 1 [0077.624] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559f78) returned 1 [0077.624] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559910) returned 1 [0077.624] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9e) returned 0x54a0df8 [0077.624] wcscpy (in: _Dest=0x54a0df8, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\fLADy0S29O.gif" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\fLADy0S29O.gif") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\fLADy0S29O.gif" [0077.624] wcscat (in: _Dest=0x54a0df8, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\fLADy0S29O.gif.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\fLADy0S29O.gif.mailto[knoocknoo@cock.li].a0a70" [0077.624] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\AppData\\Roaming\\fLADy0S29O.gif.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1b77f7cc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\AppData\\Roaming\\fLADy0S29O.gif.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.624] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb4) returned 0x5461ee8 Thread: id = 717 os_tid = 0x1a60 [0077.621] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\gOZyzRovF2zpxf 3-.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\gozyzrovf2zpxf 3-.mkv")) returned 0x20 [0077.622] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\gOZyzRovF2zpxf 3-.mkv", dwFileAttributes=0x20) returned 1 [0077.624] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\gOZyzRovF2zpxf 3-.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\gozyzrovf2zpxf 3-.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1270 [0077.624] GetFileSizeEx (in: hFile=0x1270, lpFileSize=0x1b7fff04 | out: lpFileSize=0x1b7fff04*=64671) returned 1 [0077.624] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0xfc9b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.624] ReadFile (in: hFile=0x1270, lpBuffer=0x1b7ffe88, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1b7ffe84, lpOverlapped=0x0 | out: lpBuffer=0x1b7ffe88*, lpNumberOfBytesRead=0x1b7ffe84*=0x4, lpOverlapped=0x0) returned 1 [0077.624] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.625] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.625] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a00 [0077.625] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.625] NtQuerySystemTime (in: CurrentTime=0x1b7ffe64 | out: CurrentTime=0x1b7ffe64*=132260136347772861) returned 0x0 [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0x1eca672b [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0x30e440f6 [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0xbdcf3541 [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0xebe44bb7 [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0xfc2f5142 [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0x7fbc161 [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0xb642263b [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0xcf3c2074 [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0xaa851c0e [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0x5d22f19b [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0x326c453 [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0x27daeda5 [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0xe8ba2edb [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0xf0f54fe1 [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0x67b25acd [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0xf9801fa6 [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0xcc034e9f [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0xe65b046c [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0x4949e65d [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0xa1448c4 [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0xc43bef27 [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0xe72d4d62 [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0x1edee823 [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0x999585d7 [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0xd101e3e0 [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0xfefe3e70 [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0xb4253ea6 [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0xa9b9555c [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0x579de6b5 [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0xdcabc467 [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0x32358351 [0077.625] RtlRandom (in: Seed=0x1b7ffe70 | out: Seed=0x1b7ffe70) returned 0x730df72d [0077.634] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.634] ReadFile (in: hFile=0x1270, lpBuffer=0x56240f8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1b7ffe44, lpOverlapped=0x0 | out: lpBuffer=0x56240f8*, lpNumberOfBytesRead=0x1b7ffe44*=0xc800, lpOverlapped=0x0) returned 1 [0077.635] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.635] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5650 [0077.635] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497688 [0077.635] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.635] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.636] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5630900 [0077.636] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.636] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.636] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.636] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497688) returned 1 [0077.636] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5650) returned 1 [0077.637] WriteFile (in: hFile=0x1270, lpBuffer=0x5630900*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1b7ffe44, lpOverlapped=0x0 | out: lpBuffer=0x5630900*, lpNumberOfBytesWritten=0x1b7ffe44*=0xc800, lpOverlapped=0x0) returned 1 [0077.638] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5630900) returned 1 [0077.639] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x56240f8) returned 1 [0077.639] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x37) returned 0x5444d00 [0077.639] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.639] WriteFile (in: hFile=0x1270, lpBuffer=0x388c6a0*, nNumberOfBytesToWrite=0x11b, lpNumberOfBytesWritten=0x1b7ffec4, lpOverlapped=0x0 | out: lpBuffer=0x388c6a0*, lpNumberOfBytesWritten=0x1b7ffec4*=0x11b, lpOverlapped=0x0) returned 1 [0077.640] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388c6a0) returned 1 [0077.640] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445100) returned 1 [0077.640] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.640] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444d00) returned 1 [0077.640] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559910) returned 1 [0077.640] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a00) returned 1 [0077.640] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ac8) returned 1 [0077.640] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559af0) returned 1 [0077.640] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xac) returned 0x54461f8 [0077.640] wcscpy (in: _Dest=0x54461f8, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\gOZyzRovF2zpxf 3-.mkv" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\gOZyzRovF2zpxf 3-.mkv") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\gOZyzRovF2zpxf 3-.mkv" [0077.640] wcscat (in: _Dest=0x54461f8, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\gOZyzRovF2zpxf 3-.mkv.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\gOZyzRovF2zpxf 3-.mkv.mailto[knoocknoo@cock.li].a0a70" [0077.640] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\AppData\\Roaming\\gOZyzRovF2zpxf 3-.mkv.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1b7ffe7c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\AppData\\Roaming\\gOZyzRovF2zpxf 3-.mkv.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.640] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x55fdd58 Thread: id = 718 os_tid = 0x1a64 [0077.638] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\IfU Ay66B.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ifu ay66b.mkv")) returned 0x20 [0077.641] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\IfU Ay66B.mkv", dwFileAttributes=0x20) returned 1 [0077.641] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\IfU Ay66B.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ifu ay66b.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1274 [0077.641] GetFileSizeEx (in: hFile=0x1274, lpFileSize=0x1b87fe40 | out: lpFileSize=0x1b87fe40*=39632) returned 1 [0077.641] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x9acc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.641] ReadFile (in: hFile=0x1274, lpBuffer=0x1b87fdc4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1b87fdc0, lpOverlapped=0x0 | out: lpBuffer=0x1b87fdc4*, lpNumberOfBytesRead=0x1b87fdc0*=0x4, lpOverlapped=0x0) returned 1 [0077.641] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.641] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.641] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a00 [0077.641] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.641] NtQuerySystemTime (in: CurrentTime=0x1b87fda0 | out: CurrentTime=0x1b87fda0*=132260136347928971) returned 0x0 [0077.641] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0xf6ea6a8d [0077.641] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0x93f323f5 [0077.641] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0xa7314cfc [0077.641] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0x4d16fc08 [0077.642] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0x9ad8947a [0077.642] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0xb10cfb47 [0077.642] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0xb009f081 [0077.642] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0x698b1142 [0077.642] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0xf4b70068 [0077.642] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0x4a2253f3 [0077.642] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0x611cb0be [0077.642] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0x760d9916 [0077.642] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0x1bc29c4f [0077.642] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0x60192b73 [0077.642] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0x40d0ddf2 [0077.642] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0x74a9490f [0077.642] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0xc91a8ffb [0077.642] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0x968f9491 [0077.642] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0x20c3178b [0077.642] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0xe4723ae5 [0077.642] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0xad8cd162 [0077.642] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0x92678ff6 [0077.642] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0x2b5fc643 [0077.642] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0x324197e7 [0077.642] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0x51fbb2 [0077.642] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0x52e368f2 [0077.642] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0xa478b5c0 [0077.642] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0x97942f33 [0077.642] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0x7b946226 [0077.642] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0xf5f94e90 [0077.642] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0x9fd53d46 [0077.642] RtlRandom (in: Seed=0x1b87fdac | out: Seed=0x1b87fdac) returned 0x5411fb6 [0077.651] ReadFile (in: hFile=0x1274, lpBuffer=0x56240f8, nNumberOfBytesToRead=0x9ad0, lpNumberOfBytesRead=0x1b87fd9c, lpOverlapped=0x0 | out: lpBuffer=0x56240f8*, lpNumberOfBytesRead=0x1b87fd9c*=0x9ad0, lpOverlapped=0x0) returned 1 [0077.652] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.652] WriteFile (in: hFile=0x1274, lpBuffer=0x5630900*, nNumberOfBytesToWrite=0x9ad0, lpNumberOfBytesWritten=0x1b87fd98, lpOverlapped=0x0 | out: lpBuffer=0x5630900*, lpNumberOfBytesWritten=0x1b87fd98*=0x9ad0, lpOverlapped=0x0) returned 1 [0077.654] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.654] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.654] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.654] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5630900) returned 1 [0077.654] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x56240f8) returned 1 [0077.654] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497688) returned 1 [0077.654] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5650) returned 1 [0077.654] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x27) returned 0x38a67c0 [0077.654] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.654] WriteFile (in: hFile=0x1274, lpBuffer=0x388c6a0*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x1b87fe00, lpOverlapped=0x0 | out: lpBuffer=0x388c6a0*, lpNumberOfBytesWritten=0x1b87fe00*=0x10b, lpOverlapped=0x0) returned 1 [0077.701] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388c6a0) returned 1 [0077.701] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6ac0) returned 1 [0077.701] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.701] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a67c0) returned 1 [0077.701] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559910) returned 1 [0077.701] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a00) returned 1 [0077.701] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ac8) returned 1 [0077.701] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559af0) returned 1 [0077.701] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9c) returned 0x54a0ea0 [0077.701] wcscpy (in: _Dest=0x54a0ea0, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\IfU Ay66B.mkv" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\IfU Ay66B.mkv") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\IfU Ay66B.mkv" [0077.701] wcscat (in: _Dest=0x54a0ea0, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\IfU Ay66B.mkv.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\IfU Ay66B.mkv.mailto[knoocknoo@cock.li].a0a70" [0077.701] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\AppData\\Roaming\\IfU Ay66B.mkv.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1b87fdb8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\AppData\\Roaming\\IfU Ay66B.mkv.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.702] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb2) returned 0x5461468 Thread: id = 719 os_tid = 0x1a68 [0077.653] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Js5UIdrB.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\js5uidrb.flv")) returned 0x20 [0077.702] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Js5UIdrB.flv", dwFileAttributes=0x20) returned 1 [0077.702] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Js5UIdrB.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\js5uidrb.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1278 [0077.702] GetFileSizeEx (in: hFile=0x1278, lpFileSize=0x1b8ffba0 | out: lpFileSize=0x1b8ffba0*=45846) returned 1 [0077.702] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0xb312, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.702] ReadFile (in: hFile=0x1278, lpBuffer=0x1b8ffb24, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1b8ffb20, lpOverlapped=0x0 | out: lpBuffer=0x1b8ffb24*, lpNumberOfBytesRead=0x1b8ffb20*=0x4, lpOverlapped=0x0) returned 1 [0077.702] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.703] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.703] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a00 [0077.703] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.703] NtQuerySystemTime (in: CurrentTime=0x1b8ffb00 | out: CurrentTime=0x1b8ffb00*=132260136348554322) returned 0x0 [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0x3875c534 [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0x6657173c [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0x5e33a23a [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0x94e0d25f [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0x5807fd6 [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0x5116d922 [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0xdb4a3298 [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0xa0400b7a [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0x52ba5af7 [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0xa07ed293 [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0x708e5453 [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0xbafead30 [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0xd1f5f638 [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0x82d44812 [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0x94790185 [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0x43fe0b94 [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0xd2fcc0fe [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0x25df7868 [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0xcdd10930 [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0x42494899 [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0x6370b762 [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0x8404bb14 [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0xff954b42 [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0x33346314 [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0xe6da2c01 [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0xfdccd972 [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0xe27f7b9e [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0xcd6b81f [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0xc2092f1f [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0xe806ffe7 [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0x4f9fe54 [0077.703] RtlRandom (in: Seed=0x1b8ffb0c | out: Seed=0x1b8ffb0c) returned 0x931c4051 [0077.712] ReadFile (in: hFile=0x1278, lpBuffer=0x56240f8, nNumberOfBytesToRead=0xb316, lpNumberOfBytesRead=0x1b8ffafc, lpOverlapped=0x0 | out: lpBuffer=0x56240f8*, lpNumberOfBytesRead=0x1b8ffafc*=0xb316, lpOverlapped=0x0) returned 1 [0077.714] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.714] WriteFile (in: hFile=0x1278, lpBuffer=0x5630900*, nNumberOfBytesToWrite=0xb316, lpNumberOfBytesWritten=0x1b8ffaf8, lpOverlapped=0x0 | out: lpBuffer=0x5630900*, lpNumberOfBytesWritten=0x1b8ffaf8*=0xb316, lpOverlapped=0x0) returned 1 [0077.715] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.715] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.715] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.715] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5630900) returned 1 [0077.715] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x56240f8) returned 1 [0077.716] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497688) returned 1 [0077.716] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5650) returned 1 [0077.716] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x25) returned 0x38a67c0 [0077.716] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.716] WriteFile (in: hFile=0x1278, lpBuffer=0x388c6a0*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x1b8ffb60, lpOverlapped=0x0 | out: lpBuffer=0x388c6a0*, lpNumberOfBytesWritten=0x1b8ffb60*=0x109, lpOverlapped=0x0) returned 1 [0077.717] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388c6a0) returned 1 [0077.717] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6ac0) returned 1 [0077.717] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.717] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a67c0) returned 1 [0077.717] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559910) returned 1 [0077.717] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a00) returned 1 [0077.717] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ac8) returned 1 [0077.717] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559af0) returned 1 [0077.717] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9a) returned 0x54a0f48 [0077.717] wcscpy (in: _Dest=0x54a0f48, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\Js5UIdrB.flv" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Js5UIdrB.flv") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Js5UIdrB.flv" [0077.717] wcscat (in: _Dest=0x54a0f48, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Js5UIdrB.flv.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Js5UIdrB.flv.mailto[knoocknoo@cock.li].a0a70" [0077.717] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Js5UIdrB.flv.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1b8ffb18, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\AppData\\Roaming\\Js5UIdrB.flv.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.717] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x5445ac8 Thread: id = 720 os_tid = 0x1a6c [0077.735] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\LNyQP4 UteiJh8ZnZVI.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\lnyqp4 uteijh8znzvi.png")) returned 0x20 [0077.735] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\LNyQP4 UteiJh8ZnZVI.png", dwFileAttributes=0x20) returned 1 [0077.735] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\LNyQP4 UteiJh8ZnZVI.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\lnyqp4 uteijh8znzvi.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x128c [0077.735] GetFileSizeEx (in: hFile=0x128c, lpFileSize=0x1b97feb0 | out: lpFileSize=0x1b97feb0*=37261) returned 1 [0077.735] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x9189, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.735] ReadFile (in: hFile=0x128c, lpBuffer=0x1b97fe34, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1b97fe30, lpOverlapped=0x0 | out: lpBuffer=0x1b97fe34*, lpNumberOfBytesRead=0x1b97fe30*=0x4, lpOverlapped=0x0) returned 1 [0077.735] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.736] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.736] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a00 [0077.736] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.736] NtQuerySystemTime (in: CurrentTime=0x1b97fe10 | out: CurrentTime=0x1b97fe10*=132260136348866402) returned 0x0 [0077.736] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0xeba92afa [0077.736] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0x408670e4 [0077.736] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0xaf2b676b [0077.736] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0xc03de62c [0077.736] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0xfcddbeaf [0077.736] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0x2c6564ef [0077.736] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0xab00b9e8 [0077.736] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0x60317e51 [0077.736] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0x902654d [0077.736] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0x6e9e7e87 [0077.736] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0x6342e16a [0077.736] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0x1e33cf9b [0077.736] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0xa6b38b1a [0077.736] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0x3a7c44b9 [0077.736] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0xd7f22c3d [0077.736] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0x93f9a5e8 [0077.736] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0x6aecea8a [0077.736] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0xf4694e51 [0077.736] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0x91dff320 [0077.737] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0x7f25aa5a [0077.737] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0x81b4ce1d [0077.737] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0x1650f877 [0077.737] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0x9c719f01 [0077.737] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0x7775bce8 [0077.737] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0x8b799408 [0077.737] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0x62a73e68 [0077.737] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0x4bd5b9b8 [0077.737] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0xbbeef672 [0077.737] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0xf19350af [0077.737] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0x72c34532 [0077.737] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0xa4c8ad62 [0077.737] RtlRandom (in: Seed=0x1b97fe1c | out: Seed=0x1b97fe1c) returned 0x984f1492 [0077.749] ReadFile (in: hFile=0x128c, lpBuffer=0x56240f8, nNumberOfBytesToRead=0x918d, lpNumberOfBytesRead=0x1b97fe0c, lpOverlapped=0x0 | out: lpBuffer=0x56240f8*, lpNumberOfBytesRead=0x1b97fe0c*=0x918d, lpOverlapped=0x0) returned 1 [0077.751] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.751] WriteFile (in: hFile=0x128c, lpBuffer=0x5630900*, nNumberOfBytesToWrite=0x918d, lpNumberOfBytesWritten=0x1b97fe08, lpOverlapped=0x0 | out: lpBuffer=0x5630900*, lpNumberOfBytesWritten=0x1b97fe08*=0x918d, lpOverlapped=0x0) returned 1 [0077.754] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.754] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.754] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.754] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5630900) returned 1 [0077.754] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x56240f8) returned 1 [0077.754] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497688) returned 1 [0077.754] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5650) returned 1 [0077.754] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3b) returned 0x38a5890 [0077.754] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.754] WriteFile (in: hFile=0x128c, lpBuffer=0x388c6a0*, nNumberOfBytesToWrite=0x11f, lpNumberOfBytesWritten=0x1b97fe70, lpOverlapped=0x0 | out: lpBuffer=0x388c6a0*, lpNumberOfBytesWritten=0x1b97fe70*=0x11f, lpOverlapped=0x0) returned 1 [0077.756] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388c6a0) returned 1 [0077.756] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5650) returned 1 [0077.756] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.756] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5890) returned 1 [0077.756] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559910) returned 1 [0077.756] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a00) returned 1 [0077.756] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ac8) returned 1 [0077.756] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559af0) returned 1 [0077.756] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x55c8168 [0077.756] wcscpy (in: _Dest=0x55c8168, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\LNyQP4 UteiJh8ZnZVI.png" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\LNyQP4 UteiJh8ZnZVI.png") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\LNyQP4 UteiJh8ZnZVI.png" [0077.756] wcscat (in: _Dest=0x55c8168, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\LNyQP4 UteiJh8ZnZVI.png.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\LNyQP4 UteiJh8ZnZVI.png.mailto[knoocknoo@cock.li].a0a70" [0077.756] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\AppData\\Roaming\\LNyQP4 UteiJh8ZnZVI.png.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1b97fe28, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\AppData\\Roaming\\LNyQP4 UteiJh8ZnZVI.png.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.756] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x55fdef8 Thread: id = 721 os_tid = 0x1a70 [0077.757] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x542b250 [0077.757] wcscpy (in: _Dest=0x542b250, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia" [0077.757] wcscat (in: _Dest=0x542b250, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\" [0077.757] wcscat (in: _Dest=0x542b250, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\*" [0077.757] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542e338 [0077.757] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\*", lpFindFileData=0x542e338 | out: lpFindFileData=0x542e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cdcf0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd35c70fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe53cf090, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0082.266] wcscmp (_String1=".", _String2=".") returned 0 [0082.266] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542e338 | out: lpFindFileData=0x542e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cdcf0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd35c70fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe53cf090, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.266] wcscmp (_String1="..", _String2=".") returned 1 [0082.266] wcscmp (_String1="..", _String2="..") returned 0 [0082.266] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542e338 | out: lpFindFileData=0x542e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cf090, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53ed8d1, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53ed8d1, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0082.266] wcscmp (_String1="Flash Player", _String2=".") returned 1 [0082.267] wcscmp (_String1="Flash Player", _String2="..") returned 1 [0082.267] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497250 [0082.267] wcscpy (in: _Dest=0x5497250, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia" [0082.267] wcscat (in: _Dest=0x5497250, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\" [0082.267] wcscat (in: _Dest=0x5497250, _Source="Flash Player" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player" [0082.267] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5497250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d88 [0082.267] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542e338 | out: lpFindFileData=0x542e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cf090, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53ed8d1, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53ed8d1, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 0 [0082.267] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0082.268] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542e338) returned 1 [0082.268] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542b250) returned 1 [0082.268] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b6248) returned 1 Thread: id = 722 os_tid = 0x1a74 [0077.758] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\PoTTHc0wj Mlp.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\potthc0wj mlp.mkv")) returned 0x20 [0077.758] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\PoTTHc0wj Mlp.mkv", dwFileAttributes=0x20) returned 1 [0077.758] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\PoTTHc0wj Mlp.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\potthc0wj mlp.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1290 [0077.758] GetFileSizeEx (in: hFile=0x1290, lpFileSize=0x1ba7fc34 | out: lpFileSize=0x1ba7fc34*=80961) returned 1 [0077.758] SetFilePointerEx (in: hFile=0x1290, liDistanceToMove=0x13c3d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.758] ReadFile (in: hFile=0x1290, lpBuffer=0x1ba7fbb8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ba7fbb4, lpOverlapped=0x0 | out: lpBuffer=0x1ba7fbb8*, lpNumberOfBytesRead=0x1ba7fbb4*=0x4, lpOverlapped=0x0) returned 1 [0077.759] SetFilePointerEx (in: hFile=0x1290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.759] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.759] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a00 [0077.759] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.759] NtQuerySystemTime (in: CurrentTime=0x1ba7fb94 | out: CurrentTime=0x1ba7fb94*=132260136349182576) returned 0x0 [0077.759] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0xdda60dee [0077.759] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0x3c6aa49f [0077.759] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0x3b069102 [0077.759] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0x68f3b6c5 [0077.759] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0x643bd390 [0077.759] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0xea43cdd5 [0077.759] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0xc514ba50 [0077.759] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0xa9194701 [0077.759] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0x18264a6 [0077.759] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0x74437c9c [0077.759] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0x64d6cf9b [0077.759] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0x171b1818 [0077.759] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0x97ced539 [0077.759] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0xe10d4887 [0077.759] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0x5af91fbf [0077.759] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0x9000fc7c [0077.759] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0x2396b7a8 [0077.759] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0x527b7989 [0077.759] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0x81c765c5 [0077.759] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0xc27256e8 [0077.759] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0x438b58b8 [0077.759] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0x654c9efb [0077.760] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0x8894ff38 [0077.760] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0xcefa1cd2 [0077.760] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0x81bf2765 [0077.760] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0x1283cc96 [0077.760] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0x211be934 [0077.760] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0x19415a08 [0077.760] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0xf1c4c7ec [0077.760] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0xe3e580b8 [0077.760] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0x661cc9d5 [0077.760] RtlRandom (in: Seed=0x1ba7fba0 | out: Seed=0x1ba7fba0) returned 0x928b9981 [0077.772] SetFilePointerEx (in: hFile=0x1290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.773] ReadFile (in: hFile=0x1290, lpBuffer=0x56240f8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1ba7fb74, lpOverlapped=0x0 | out: lpBuffer=0x56240f8*, lpNumberOfBytesRead=0x1ba7fb74*=0xc800, lpOverlapped=0x0) returned 1 [0077.773] SetFilePointerEx (in: hFile=0x1290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.773] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5650 [0077.773] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497688 [0077.773] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.773] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.774] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5630900 [0077.775] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.775] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.775] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.775] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497688) returned 1 [0077.775] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5650) returned 1 [0077.776] WriteFile (in: hFile=0x1290, lpBuffer=0x5630900*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1ba7fb74, lpOverlapped=0x0 | out: lpBuffer=0x5630900*, lpNumberOfBytesWritten=0x1ba7fb74*=0xc800, lpOverlapped=0x0) returned 1 [0077.778] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5630900) returned 1 [0077.778] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x56240f8) returned 1 [0077.778] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2f) returned 0x55306d0 [0077.778] SetFilePointerEx (in: hFile=0x1290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.778] WriteFile (in: hFile=0x1290, lpBuffer=0x388c6a0*, nNumberOfBytesToWrite=0x113, lpNumberOfBytesWritten=0x1ba7fbf4, lpOverlapped=0x0 | out: lpBuffer=0x388c6a0*, lpNumberOfBytesWritten=0x1ba7fbf4*=0x113, lpOverlapped=0x0) returned 1 [0077.779] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388c6a0) returned 1 [0077.779] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55300e8) returned 1 [0077.779] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.780] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55306d0) returned 1 [0077.780] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559910) returned 1 [0077.780] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a00) returned 1 [0077.780] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ac8) returned 1 [0077.780] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559af0) returned 1 [0077.780] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa4) returned 0x54df2c0 [0077.780] wcscpy (in: _Dest=0x54df2c0, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\PoTTHc0wj Mlp.mkv" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\PoTTHc0wj Mlp.mkv") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\PoTTHc0wj Mlp.mkv" [0077.780] wcscat (in: _Dest=0x54df2c0, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\PoTTHc0wj Mlp.mkv.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\PoTTHc0wj Mlp.mkv.mailto[knoocknoo@cock.li].a0a70" [0077.780] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\AppData\\Roaming\\PoTTHc0wj Mlp.mkv.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1ba7fbac, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\AppData\\Roaming\\PoTTHc0wj Mlp.mkv.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.780] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x3976080 Thread: id = 723 os_tid = 0x1a78 [0077.780] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\qDrKhg38hlbWs0.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\qdrkhg38hlbws0.bmp")) returned 0x20 [0077.780] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\qDrKhg38hlbWs0.bmp", dwFileAttributes=0x20) returned 1 [0077.781] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\qDrKhg38hlbWs0.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\qdrkhg38hlbws0.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1294 [0077.781] GetFileSizeEx (in: hFile=0x1294, lpFileSize=0x1baffc54 | out: lpFileSize=0x1baffc54*=98191) returned 1 [0077.781] SetFilePointerEx (in: hFile=0x1294, liDistanceToMove=0x17f8b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.781] ReadFile (in: hFile=0x1294, lpBuffer=0x1baffbd8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1baffbd4, lpOverlapped=0x0 | out: lpBuffer=0x1baffbd8*, lpNumberOfBytesRead=0x1baffbd4*=0x4, lpOverlapped=0x0) returned 1 [0077.781] SetFilePointerEx (in: hFile=0x1294, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.781] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.781] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a00 [0077.781] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.781] NtQuerySystemTime (in: CurrentTime=0x1baffbb4 | out: CurrentTime=0x1baffbb4*=132260136349335505) returned 0x0 [0077.781] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0x55e56b64 [0077.781] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0x35252dd4 [0077.781] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0xa7ddd4ec [0077.781] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0xb241199b [0077.782] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0xf606abd0 [0077.782] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0x25d4814e [0077.782] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0xd669a8db [0077.782] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0xbd5e037d [0077.782] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0x6817bffb [0077.782] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0x5146c7c [0077.782] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0xf7f0782e [0077.782] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0x546b06d4 [0077.782] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0x3ff90927 [0077.782] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0xfc3380bd [0077.782] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0x35ae4246 [0077.782] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0xe1f2a82b [0077.782] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0xc55fec5e [0077.782] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0x89839b59 [0077.782] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0x98988a29 [0077.782] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0xdfc2f265 [0077.782] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0xcb82d5ba [0077.782] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0x71824e64 [0077.782] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0xcd6cbd4f [0077.782] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0x9419f048 [0077.782] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0x236bd6cc [0077.782] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0x47346505 [0077.782] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0x73d37a02 [0077.782] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0x27115de [0077.782] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0xbffcedde [0077.782] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0x75912390 [0077.782] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0xd323d040 [0077.782] RtlRandom (in: Seed=0x1baffbc0 | out: Seed=0x1baffbc0) returned 0x1edaf8aa [0077.795] SetFilePointerEx (in: hFile=0x1294, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.795] ReadFile (in: hFile=0x1294, lpBuffer=0x56240f8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1baffb94, lpOverlapped=0x0 | out: lpBuffer=0x56240f8*, lpNumberOfBytesRead=0x1baffb94*=0xc800, lpOverlapped=0x0) returned 1 [0077.796] SetFilePointerEx (in: hFile=0x1294, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.796] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5650 [0077.796] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497688 [0077.796] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.796] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.797] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5630900 [0077.798] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559910 [0077.798] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559a78 [0077.798] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0077.798] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497688) returned 1 [0077.798] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5650) returned 1 [0077.798] WriteFile (in: hFile=0x1294, lpBuffer=0x5630900*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1baffb94, lpOverlapped=0x0 | out: lpBuffer=0x5630900*, lpNumberOfBytesWritten=0x1baffb94*=0xc800, lpOverlapped=0x0) returned 1 [0077.801] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5630900) returned 1 [0077.801] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x56240f8) returned 1 [0077.801] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x31) returned 0x5444d00 [0077.801] SetFilePointerEx (in: hFile=0x1294, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.801] WriteFile (in: hFile=0x1294, lpBuffer=0x388c6a0*, nNumberOfBytesToWrite=0x115, lpNumberOfBytesWritten=0x1baffc14, lpOverlapped=0x0 | out: lpBuffer=0x388c6a0*, lpNumberOfBytesWritten=0x1baffc14*=0x115, lpOverlapped=0x0) returned 1 [0081.205] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388c6a0) returned 1 [0091.758] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444bc0) returned 1 [0091.758] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a78) returned 1 [0091.758] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444d00) returned 1 [0091.758] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559910) returned 1 [0091.758] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559a00) returned 1 [0091.758] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ac8) returned 1 [0091.758] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559af0) returned 1 [0091.758] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa6) returned 0x388e070 [0091.758] wcscpy (in: _Dest=0x388e070, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\qDrKhg38hlbWs0.bmp" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\qDrKhg38hlbWs0.bmp") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\qDrKhg38hlbWs0.bmp" [0091.758] wcscat (in: _Dest=0x388e070, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\qDrKhg38hlbWs0.bmp.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\qDrKhg38hlbWs0.bmp.mailto[knoocknoo@cock.li].a0a70" [0091.759] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\AppData\\Roaming\\qDrKhg38hlbWs0.bmp.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1baffbcc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\AppData\\Roaming\\qDrKhg38hlbWs0.bmp.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0091.759] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x53e8d78 Thread: id = 724 os_tid = 0x1a7c [0077.803] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\QXT68k2qiJPK M.ppt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\qxt68k2qijpk m.ppt")) returned 0x20 [0077.803] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\QXT68k2qiJPK M.ppt", dwFileAttributes=0x20) returned 1 [0077.804] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\QXT68k2qiJPK M.ppt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\qxt68k2qijpk m.ppt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1298 [0077.804] GetFileSizeEx (in: hFile=0x1298, lpFileSize=0x1bb7fd20 | out: lpFileSize=0x1bb7fd20*=66186) returned 1 [0077.804] SetFilePointerEx (in: hFile=0x1298, liDistanceToMove=0x10286, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.804] ReadFile (in: hFile=0x1298, lpBuffer=0x1bb7fca4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1bb7fca0, lpOverlapped=0x0 | out: lpBuffer=0x1bb7fca4*, lpNumberOfBytesRead=0x1bb7fca0*=0x4, lpOverlapped=0x0) returned 1 [0077.804] SetFilePointerEx (in: hFile=0x1298, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.804] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f28 [0077.804] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559dc0 [0077.804] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f50 [0077.804] NtQuerySystemTime (in: CurrentTime=0x1bb7fc80 | out: CurrentTime=0x1bb7fc80*=132260136349648135) returned 0x0 [0077.804] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0x13814fed [0077.804] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0xa42181d4 [0077.804] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0xb64c5ab6 [0077.804] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0xab651845 [0077.804] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0x95fe82b2 [0077.804] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0x3736ade9 [0077.804] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0xd997a692 [0077.804] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0xc3eb88ed [0077.804] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0x6601091e [0077.804] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0x5c252831 [0077.805] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0x5102e6d2 [0077.805] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0xa015208b [0077.805] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0xdb413bd1 [0077.805] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0x4e7faeca [0077.805] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0xb7c479e2 [0077.805] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0x819534a0 [0077.805] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0x88fc0781 [0077.805] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0x915e43b0 [0077.805] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0x64dd772c [0077.805] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0xaf63381 [0077.805] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0xa8a4e05c [0077.805] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0x385b16c4 [0077.805] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0x5396480e [0077.805] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0x5a7d344e [0077.805] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0xd9fd2a9f [0077.805] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0xe7526c48 [0077.805] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0xc473a000 [0077.805] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0x7e10d70e [0077.805] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0xc7defbc [0077.805] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0xc5e5a734 [0077.805] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0x700575b0 [0077.805] RtlRandom (in: Seed=0x1bb7fc8c | out: Seed=0x1bb7fc8c) returned 0xcb29d6b0 [0077.818] SetFilePointerEx (in: hFile=0x1298, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.818] ReadFile (in: hFile=0x1298, lpBuffer=0x56240f8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1bb7fc60, lpOverlapped=0x0 | out: lpBuffer=0x56240f8*, lpNumberOfBytesRead=0x1bb7fc60*=0xc800, lpOverlapped=0x0) returned 1 [0077.819] SetFilePointerEx (in: hFile=0x1298, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.819] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5650 [0077.819] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497688 [0077.819] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559e38 [0077.819] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559e38) returned 1 [0077.820] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5630900 [0077.821] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f28 [0077.821] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f50 [0077.821] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559f50) returned 1 [0077.821] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497688) returned 1 [0077.821] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5650) returned 1 [0077.821] WriteFile (in: hFile=0x1298, lpBuffer=0x5630900*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1bb7fc60, lpOverlapped=0x0 | out: lpBuffer=0x5630900*, lpNumberOfBytesWritten=0x1bb7fc60*=0xc800, lpOverlapped=0x0) returned 1 [0077.848] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5630900) returned 1 [0077.848] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x56240f8) returned 1 [0077.848] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x31) returned 0x5444d40 [0077.848] SetFilePointerEx (in: hFile=0x1298, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.849] WriteFile (in: hFile=0x1298, lpBuffer=0x38b8d20*, nNumberOfBytesToWrite=0x115, lpNumberOfBytesWritten=0x1bb7fce0, lpOverlapped=0x0 | out: lpBuffer=0x38b8d20*, lpNumberOfBytesWritten=0x1bb7fce0*=0x115, lpOverlapped=0x0) returned 1 [0077.850] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b8d20) returned 1 [0077.850] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444c00) returned 1 [0077.850] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x555a040) returned 1 [0077.850] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444d40) returned 1 [0077.850] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559f28) returned 1 [0077.850] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559dc0) returned 1 [0077.850] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559f78) returned 1 [0077.850] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559fc8) returned 1 [0077.850] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa6) returned 0x54df370 [0077.850] wcscpy (in: _Dest=0x54df370, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\QXT68k2qiJPK M.ppt" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\QXT68k2qiJPK M.ppt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\QXT68k2qiJPK M.ppt" [0077.850] wcscat (in: _Dest=0x54df370, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\QXT68k2qiJPK M.ppt.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\QXT68k2qiJPK M.ppt.mailto[knoocknoo@cock.li].a0a70" [0077.850] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\AppData\\Roaming\\QXT68k2qiJPK M.ppt.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1bb7fc98, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\AppData\\Roaming\\QXT68k2qiJPK M.ppt.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.850] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x3974cf8 Thread: id = 725 os_tid = 0x1a80 [0077.823] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\SejX7-sVJe.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\sejx7-svje.mp3")) returned 0x20 [0077.823] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\SejX7-sVJe.mp3", dwFileAttributes=0x20) returned 1 [0077.824] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\SejX7-sVJe.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\sejx7-svje.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x129c [0077.824] GetFileSizeEx (in: hFile=0x129c, lpFileSize=0x1bbffef8 | out: lpFileSize=0x1bbffef8*=23390) returned 1 [0077.824] SetFilePointerEx (in: hFile=0x129c, liDistanceToMove=0x5b5a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.824] ReadFile (in: hFile=0x129c, lpBuffer=0x1bbffe7c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1bbffe78, lpOverlapped=0x0 | out: lpBuffer=0x1bbffe7c*, lpNumberOfBytesRead=0x1bbffe78*=0x4, lpOverlapped=0x0) returned 1 [0077.824] SetFilePointerEx (in: hFile=0x129c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.824] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f50 [0077.824] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559de8 [0077.824] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x555a018 [0077.824] NtQuerySystemTime (in: CurrentTime=0x1bbffe58 | out: CurrentTime=0x1bbffe58*=132260136349804261) returned 0x0 [0077.824] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0xa15707bd [0077.824] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0xf739909 [0077.825] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0x71ceeb39 [0077.825] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0x48e24f37 [0077.825] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0x1d6e2178 [0077.825] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0xc1dd75df [0077.825] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0x2bba03de [0077.825] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0x322974be [0077.825] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0xceeac96a [0077.825] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0xcc529ab3 [0077.825] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0x3a6791c4 [0077.825] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0x400638dc [0077.825] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0x45219a69 [0077.825] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0xb875f0ea [0077.825] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0x3dff621d [0077.825] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0x1e1f80bc [0077.825] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0x6885e0bd [0077.825] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0xb6b6f9b4 [0077.825] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0x3020b2b1 [0077.825] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0x2f5b742 [0077.825] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0xa5896965 [0077.825] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0xc43170ff [0077.825] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0xf1b011e2 [0077.825] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0x17a04447 [0077.825] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0x6dc0416e [0077.825] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0xf4ac3ed3 [0077.825] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0xcd889cae [0077.825] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0x4c1dbd5 [0077.825] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0x299552f [0077.825] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0x6a6b0e23 [0077.825] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0xba21347d [0077.825] RtlRandom (in: Seed=0x1bbffe64 | out: Seed=0x1bbffe64) returned 0xf7fd34f9 [0077.836] ReadFile (in: hFile=0x129c, lpBuffer=0x563d108, nNumberOfBytesToRead=0x5b5e, lpNumberOfBytesRead=0x1bbffe54, lpOverlapped=0x0 | out: lpBuffer=0x563d108*, lpNumberOfBytesRead=0x1bbffe54*=0x5b5e, lpOverlapped=0x0) returned 1 [0077.837] SetFilePointerEx (in: hFile=0x129c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.837] WriteFile (in: hFile=0x129c, lpBuffer=0x5649910*, nNumberOfBytesToWrite=0x5b5e, lpNumberOfBytesWritten=0x1bbffe50, lpOverlapped=0x0 | out: lpBuffer=0x5649910*, lpNumberOfBytesWritten=0x1bbffe50*=0x5b5e, lpOverlapped=0x0) returned 1 [0077.838] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x555a018 [0077.838] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559e10 [0077.839] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559e10) returned 1 [0077.839] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5649910) returned 1 [0077.839] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x563d108) returned 1 [0077.839] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497688) returned 1 [0077.839] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5650) returned 1 [0077.839] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x29) returned 0x5530740 [0077.839] SetFilePointerEx (in: hFile=0x129c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.839] WriteFile (in: hFile=0x129c, lpBuffer=0x38b8d20*, nNumberOfBytesToWrite=0x10d, lpNumberOfBytesWritten=0x1bbffeb8, lpOverlapped=0x0 | out: lpBuffer=0x38b8d20*, lpNumberOfBytesWritten=0x1bbffeb8*=0x10d, lpOverlapped=0x0) returned 1 [0077.840] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b8d20) returned 1 [0077.840] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55300e8) returned 1 [0077.840] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559e10) returned 1 [0077.840] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5530740) returned 1 [0077.840] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x555a018) returned 1 [0077.840] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559de8) returned 1 [0077.840] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x555a040) returned 1 [0077.840] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559d98) returned 1 [0077.841] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9e) returned 0x54a1d10 [0077.841] wcscpy (in: _Dest=0x54a1d10, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\SejX7-sVJe.mp3" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\SejX7-sVJe.mp3") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\SejX7-sVJe.mp3" [0077.841] wcscat (in: _Dest=0x54a1d10, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\SejX7-sVJe.mp3.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\SejX7-sVJe.mp3.mailto[knoocknoo@cock.li].a0a70" [0077.841] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\AppData\\Roaming\\SejX7-sVJe.mp3.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1bbffe70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\AppData\\Roaming\\SejX7-sVJe.mp3.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.841] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb4) returned 0x5461b28 Thread: id = 726 os_tid = 0x1a84 [0077.841] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x38ffa70 [0077.841] wcscpy (in: _Dest=0x38ffa70, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype" [0077.841] wcscat (in: _Dest=0x38ffa70, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\" [0077.841] wcscat (in: _Dest=0x38ffa70, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\*" [0077.841] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542e5a0 [0077.841] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\*", lpFindFileData=0x542e5a0 | out: lpFindFileData=0x542e5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0082.235] wcscmp (_String1=".", _String2=".") returned 0 [0082.235] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542e5a0 | out: lpFindFileData=0x542e5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.235] wcscmp (_String1="..", _String2=".") returned 1 [0082.235] wcscmp (_String1="..", _String2="..") returned 0 [0082.235] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542e5a0 | out: lpFindFileData=0x542e5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RootTools", cAlternateFileName="ROOTTO~1")) returned 1 [0082.235] wcscmp (_String1="RootTools", _String2=".") returned 1 [0082.235] wcscmp (_String1="RootTools", _String2="..") returned 1 [0082.235] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x541b0e0 [0082.235] wcscpy (in: _Dest=0x541b0e0, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype" [0082.235] wcscat (in: _Dest=0x541b0e0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\" [0082.236] wcscat (in: _Dest=0x541b0e0, _Source="RootTools" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools" [0082.236] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x541b0e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d58 [0082.236] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542e5a0 | out: lpFindFileData=0x542e5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RootTools", cAlternateFileName="ROOTTO~1")) returned 0 [0082.236] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0082.236] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542e5a0) returned 1 [0082.236] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ffa70) returned 1 [0082.236] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ff650) returned 1 Thread: id = 727 os_tid = 0x1a88 [0077.842] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x38ffac8 [0077.842] wcscpy (in: _Dest=0x38ffac8, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun" [0077.842] wcscat (in: _Dest=0x38ffac8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\" [0077.842] wcscat (in: _Dest=0x38ffac8, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\*" [0077.842] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542e808 [0077.842] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\*", lpFindFileData=0x542e808 | out: lpFindFileData=0x542e808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x75675c8 [0087.507] wcscmp (_String1=".", _String2=".") returned 0 [0087.507] FindNextFileW (hFindFile=0x75675c8, lpFindFileData=0x542e808) Thread: id = 728 os_tid = 0x1a8c [0077.842] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\SVygtGN2.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\svygtgn2.bmp")) returned 0x20 [0077.842] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\SVygtGN2.bmp", dwFileAttributes=0x20) returned 1 [0077.843] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\SVygtGN2.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\svygtgn2.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x12a0 [0077.843] GetFileSizeEx (in: hFile=0x12a0, lpFileSize=0x1bd7fe80 | out: lpFileSize=0x1bd7fe80*=70808) returned 1 [0077.843] SetFilePointerEx (in: hFile=0x12a0, liDistanceToMove=0x11494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.843] ReadFile (in: hFile=0x12a0, lpBuffer=0x1bd7fe04, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1bd7fe00, lpOverlapped=0x0 | out: lpBuffer=0x1bd7fe04*, lpNumberOfBytesRead=0x1bd7fe00*=0x4, lpOverlapped=0x0) returned 1 [0077.843] SetFilePointerEx (in: hFile=0x12a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.843] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f50 [0077.843] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559de8 [0077.843] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x555a018 [0077.843] NtQuerySystemTime (in: CurrentTime=0x1bd7fde0 | out: CurrentTime=0x1bd7fde0*=132260136349960364) returned 0x0 [0077.843] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0xab20177b [0077.843] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0x6027ae72 [0077.843] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0x5d360490 [0077.843] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0x99b532a1 [0077.843] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0x1f910c75 [0077.843] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0x51d7b703 [0077.843] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0x45f876e5 [0077.843] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0xea968a63 [0077.843] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0x7679de38 [0077.843] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0xf13be847 [0077.843] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0x2e6dba8c [0077.843] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0xf6f106e8 [0077.843] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0x3afd4d63 [0077.843] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0xa5179928 [0077.843] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0xaf301e48 [0077.843] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0x2bd4b6de [0077.843] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0xbcd633f6 [0077.843] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0xd1febc99 [0077.844] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0x5b76e958 [0077.844] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0xb0fcc039 [0077.844] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0x40756823 [0077.844] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0xeb693e7 [0077.844] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0x2af66ef8 [0077.844] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0xf87f2485 [0077.844] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0x890157ec [0077.844] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0xa6133da7 [0077.844] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0x7c90fdd7 [0077.844] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0x7d2efd76 [0077.844] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0xb770da02 [0077.844] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0xfaed423d [0077.844] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0xeb3e6191 [0077.844] RtlRandom (in: Seed=0x1bd7fdec | out: Seed=0x1bd7fdec) returned 0x6c7ac8d5 [0077.855] SetFilePointerEx (in: hFile=0x12a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.855] ReadFile (in: hFile=0x12a0, lpBuffer=0x56240f8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1bd7fdc0, lpOverlapped=0x0 | out: lpBuffer=0x56240f8*, lpNumberOfBytesRead=0x1bd7fdc0*=0xc800, lpOverlapped=0x0) returned 1 [0077.856] SetFilePointerEx (in: hFile=0x12a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.856] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5650 [0077.856] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497688 [0077.856] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559e38 [0077.856] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559e38) returned 1 [0077.857] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5630900 [0077.857] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f50 [0077.857] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559fc8 [0077.857] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559fc8) returned 1 [0077.857] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497688) returned 1 [0077.857] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5650) returned 1 [0077.857] WriteFile (in: hFile=0x12a0, lpBuffer=0x5630900*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1bd7fdc0, lpOverlapped=0x0 | out: lpBuffer=0x5630900*, lpNumberOfBytesWritten=0x1bd7fdc0*=0xc800, lpOverlapped=0x0) returned 1 [0077.859] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5630900) returned 1 [0077.859] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x56240f8) returned 1 [0077.860] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x25) returned 0x38a67c0 [0077.860] SetFilePointerEx (in: hFile=0x12a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.860] WriteFile (in: hFile=0x12a0, lpBuffer=0x38b8d20*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x1bd7fe40, lpOverlapped=0x0 | out: lpBuffer=0x38b8d20*, lpNumberOfBytesWritten=0x1bd7fe40*=0x109, lpOverlapped=0x0) returned 1 [0077.861] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b8d20) returned 1 [0077.861] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6670) returned 1 [0077.861] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x555a040) returned 1 [0077.861] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a67c0) returned 1 [0077.861] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559f50) returned 1 [0077.861] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559de8) returned 1 [0077.861] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559f28) returned 1 [0077.861] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559f78) returned 1 [0077.861] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9a) returned 0x54a1db8 [0077.861] wcscpy (in: _Dest=0x54a1db8, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\SVygtGN2.bmp" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\SVygtGN2.bmp") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\SVygtGN2.bmp" [0077.861] wcscat (in: _Dest=0x54a1db8, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\SVygtGN2.bmp.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\SVygtGN2.bmp.mailto[knoocknoo@cock.li].a0a70" [0077.861] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\AppData\\Roaming\\SVygtGN2.bmp.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1bd7fdf8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\AppData\\Roaming\\SVygtGN2.bmp.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.861] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x55c8220 Thread: id = 729 os_tid = 0x1a90 [0077.859] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\uAZLUFDQm.ppt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\uazlufdqm.ppt")) returned 0x20 [0077.862] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\uAZLUFDQm.ppt", dwFileAttributes=0x20) returned 1 [0077.862] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\uAZLUFDQm.ppt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\uazlufdqm.ppt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x12a4 [0077.862] GetFileSizeEx (in: hFile=0x12a4, lpFileSize=0x1bdffd7c | out: lpFileSize=0x1bdffd7c*=61786) returned 1 [0077.862] SetFilePointerEx (in: hFile=0x12a4, liDistanceToMove=0xf156, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.862] ReadFile (in: hFile=0x12a4, lpBuffer=0x1bdffd00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1bdffcfc, lpOverlapped=0x0 | out: lpBuffer=0x1bdffd00*, lpNumberOfBytesRead=0x1bdffcfc*=0x4, lpOverlapped=0x0) returned 1 [0077.862] SetFilePointerEx (in: hFile=0x12a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.862] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f28 [0077.862] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559dc0 [0077.862] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f50 [0077.862] NtQuerySystemTime (in: CurrentTime=0x1bdffcdc | out: CurrentTime=0x1bdffcdc*=132260136350272586) returned 0x0 [0077.862] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0x7601938f [0077.862] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0x1b2a1d22 [0077.862] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0xd16dd78c [0077.862] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0x9d14777e [0077.862] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0xf3e5b84e [0077.862] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0xbe643927 [0077.863] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0x5168f255 [0077.863] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0x726cb7fe [0077.863] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0xf02f041b [0077.863] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0xa0991963 [0077.863] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0xc029d74d [0077.863] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0x21b1cf29 [0077.863] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0xc22923a9 [0077.863] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0x1be643de [0077.863] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0x3e35ea22 [0077.863] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0xce09d6c9 [0077.863] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0xf7f1690b [0077.863] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0xb7d9286 [0077.863] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0x67142534 [0077.863] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0x3efbb7de [0077.863] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0x7a712500 [0077.863] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0xb246d009 [0077.863] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0xf1b3774f [0077.863] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0x33cef06f [0077.863] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0x86ae8842 [0077.863] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0xd4f52fd [0077.863] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0x20950b9a [0077.863] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0x77756a6e [0077.863] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0xea8be97e [0077.863] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0xf8e52cb2 [0077.863] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0x778400a [0077.863] RtlRandom (in: Seed=0x1bdffce8 | out: Seed=0x1bdffce8) returned 0x4decc81c [0077.872] SetFilePointerEx (in: hFile=0x12a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.872] ReadFile (in: hFile=0x12a4, lpBuffer=0x56240f8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1bdffcbc, lpOverlapped=0x0 | out: lpBuffer=0x56240f8*, lpNumberOfBytesRead=0x1bdffcbc*=0xc800, lpOverlapped=0x0) returned 1 [0077.872] SetFilePointerEx (in: hFile=0x12a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.872] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5650 [0077.872] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497688 [0077.872] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559e38 [0077.872] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559e38) returned 1 [0077.873] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5630900 [0077.874] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f28 [0077.874] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f50 [0077.874] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559f50) returned 1 [0077.874] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497688) returned 1 [0077.874] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5650) returned 1 [0077.874] WriteFile (in: hFile=0x12a4, lpBuffer=0x5630900*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1bdffcbc, lpOverlapped=0x0 | out: lpBuffer=0x5630900*, lpNumberOfBytesWritten=0x1bdffcbc*=0xc800, lpOverlapped=0x0) returned 1 [0077.889] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5630900) returned 1 [0077.889] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x56240f8) returned 1 [0077.889] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x27) returned 0x38a67c0 [0077.889] SetFilePointerEx (in: hFile=0x12a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.889] WriteFile (in: hFile=0x12a4, lpBuffer=0x38b8d20*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x1bdffd3c, lpOverlapped=0x0 | out: lpBuffer=0x38b8d20*, lpNumberOfBytesWritten=0x1bdffd3c*=0x10b, lpOverlapped=0x0) returned 1 [0077.891] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b8d20) returned 1 [0077.891] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6670) returned 1 [0077.891] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559e10) returned 1 [0077.891] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a67c0) returned 1 [0077.891] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559f28) returned 1 [0077.891] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559dc0) returned 1 [0077.891] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559f78) returned 1 [0077.891] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559fc8) returned 1 [0077.891] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9c) returned 0x54a1e60 [0077.891] wcscpy (in: _Dest=0x54a1e60, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\uAZLUFDQm.ppt" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\uAZLUFDQm.ppt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\uAZLUFDQm.ppt" [0077.891] wcscat (in: _Dest=0x54a1e60, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\uAZLUFDQm.ppt.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\uAZLUFDQm.ppt.mailto[knoocknoo@cock.li].a0a70" [0077.891] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\AppData\\Roaming\\uAZLUFDQm.ppt.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1bdffcf4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\AppData\\Roaming\\uAZLUFDQm.ppt.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.891] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb2) returned 0x5461be8 Thread: id = 730 os_tid = 0x1a94 [0077.875] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ulSIcR0ydo9WK.ots" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ulsicr0ydo9wk.ots")) returned 0x20 [0077.875] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ulSIcR0ydo9WK.ots", dwFileAttributes=0x20) returned 1 [0077.875] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ulSIcR0ydo9WK.ots" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ulsicr0ydo9wk.ots"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x12a8 [0077.876] GetFileSizeEx (in: hFile=0x12a8, lpFileSize=0x1be7fc3c | out: lpFileSize=0x1be7fc3c*=86627) returned 1 [0077.876] SetFilePointerEx (in: hFile=0x12a8, liDistanceToMove=0x1525f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.876] ReadFile (in: hFile=0x12a8, lpBuffer=0x1be7fbc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1be7fbbc, lpOverlapped=0x0 | out: lpBuffer=0x1be7fbc0*, lpNumberOfBytesRead=0x1be7fbbc*=0x4, lpOverlapped=0x0) returned 1 [0077.876] SetFilePointerEx (in: hFile=0x12a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.876] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f50 [0077.876] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559de8 [0077.876] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x555a018 [0077.876] NtQuerySystemTime (in: CurrentTime=0x1be7fb9c | out: CurrentTime=0x1be7fb9c*=132260136350272586) returned 0x0 [0077.876] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0xd2ff1c4c [0077.876] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0x1e3279ad [0077.876] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0x74f7e48d [0077.876] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0x7de62c6d [0077.876] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0x6bde08a [0077.876] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0x12fc6b92 [0077.876] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0x16622546 [0077.876] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0x3bce1464 [0077.876] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0xeb4f65e6 [0077.876] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0x8e68dc8c [0077.876] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0x824bb9d2 [0077.876] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0xfd738f56 [0077.876] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0xd1dcdf76 [0077.876] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0x17ddd468 [0077.876] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0x44b9bd91 [0077.876] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0xd86b9431 [0077.876] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0x7abc4b2e [0077.876] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0xffc24a63 [0077.876] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0x36479b46 [0077.877] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0x13ea545a [0077.877] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0x399057e6 [0077.877] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0x1d88dbb3 [0077.877] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0x3112a95c [0077.877] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0x6a1b5f5 [0077.878] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0x5c4c8108 [0077.878] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0x4abe3fdc [0077.878] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0x2519f97d [0077.878] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0xa88d4894 [0077.878] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0x8b2ace87 [0077.878] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0xbbcc8028 [0077.878] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0x341a11b9 [0077.878] RtlRandom (in: Seed=0x1be7fba8 | out: Seed=0x1be7fba8) returned 0x6bd3b996 [0077.886] SetFilePointerEx (in: hFile=0x12a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.887] ReadFile (in: hFile=0x12a8, lpBuffer=0x563d108, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1be7fb7c, lpOverlapped=0x0 | out: lpBuffer=0x563d108*, lpNumberOfBytesRead=0x1be7fb7c*=0xc800, lpOverlapped=0x0) returned 1 [0077.887] SetFilePointerEx (in: hFile=0x12a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.887] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5650 [0077.887] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497688 [0077.887] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559eb0 [0077.887] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559eb0) returned 1 [0077.888] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5649910 [0077.889] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x555a018 [0077.889] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559e10 [0077.889] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559e10) returned 1 [0077.889] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497688) returned 1 [0077.889] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5650) returned 1 [0077.889] WriteFile (in: hFile=0x12a8, lpBuffer=0x5649910*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1be7fb7c, lpOverlapped=0x0 | out: lpBuffer=0x5649910*, lpNumberOfBytesWritten=0x1be7fb7c*=0xc800, lpOverlapped=0x0) returned 1 [0077.893] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5649910) returned 1 [0077.893] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x563d108) returned 1 [0077.893] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2f) returned 0x5530900 [0077.893] SetFilePointerEx (in: hFile=0x12a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.893] WriteFile (in: hFile=0x12a8, lpBuffer=0x38b8d20*, nNumberOfBytesToWrite=0x113, lpNumberOfBytesWritten=0x1be7fbfc, lpOverlapped=0x0 | out: lpBuffer=0x38b8d20*, lpNumberOfBytesWritten=0x1be7fbfc*=0x113, lpOverlapped=0x0) returned 1 [0077.894] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b8d20) returned 1 [0077.894] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55307e8) returned 1 [0077.895] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559dc0) returned 1 [0077.895] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5530900) returned 1 [0077.895] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x555a018) returned 1 [0077.895] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559de8) returned 1 [0077.895] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x555a040) returned 1 [0077.895] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559d98) returned 1 [0077.895] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa4) returned 0x54debe0 [0077.895] wcscpy (in: _Dest=0x54debe0, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\ulSIcR0ydo9WK.ots" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\ulSIcR0ydo9WK.ots") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\ulSIcR0ydo9WK.ots" [0077.895] wcscat (in: _Dest=0x54debe0, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\ulSIcR0ydo9WK.ots.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\ulSIcR0ydo9WK.ots.mailto[knoocknoo@cock.li].a0a70" [0077.895] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ulSIcR0ydo9WK.ots.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1be7fbb4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\AppData\\Roaming\\ulSIcR0ydo9WK.ots.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.895] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x3974dc0 Thread: id = 731 os_tid = 0x1a98 [0077.896] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\v XP9.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\v xp9.flv")) returned 0x20 [0077.896] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\v XP9.flv", dwFileAttributes=0x20) returned 1 [0077.896] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\v XP9.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\v xp9.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x12ac [0077.896] GetFileSizeEx (in: hFile=0x12ac, lpFileSize=0x1beff7ec | out: lpFileSize=0x1beff7ec*=35779) returned 1 [0077.896] SetFilePointerEx (in: hFile=0x12ac, liDistanceToMove=0x8bbf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.896] ReadFile (in: hFile=0x12ac, lpBuffer=0x1beff770, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1beff76c, lpOverlapped=0x0 | out: lpBuffer=0x1beff770*, lpNumberOfBytesRead=0x1beff76c*=0x4, lpOverlapped=0x0) returned 1 [0077.896] SetFilePointerEx (in: hFile=0x12ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.896] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f28 [0077.896] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559dc0 [0077.897] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f50 [0077.897] NtQuerySystemTime (in: CurrentTime=0x1beff74c | out: CurrentTime=0x1beff74c*=132260136350585126) returned 0x0 [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0xa3b79ecd [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0xdc68c52c [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0x21b20b4b [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0xa0074468 [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0x97fc6d3b [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0xda346a02 [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0xcaabe7f [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0x884c571f [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0x9c12ce1f [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0xafdb1187 [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0xd15b93ca [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0x38dfe4c6 [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0x4f58ecb1 [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0x877ef32e [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0x9796590b [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0xea462ca0 [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0xbbe5db14 [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0x2f5d4a7b [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0xe3dc35cc [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0xc6a7a252 [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0x7fac31be [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0x49dab2a2 [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0xb516df5b [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0x32db20c1 [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0x51be7191 [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0xd8c446b8 [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0xc762f46e [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0xa77e7844 [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0xc6f67bcb [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0x9b252912 [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0x57281f8e [0077.897] RtlRandom (in: Seed=0x1beff758 | out: Seed=0x1beff758) returned 0xbaa3de67 [0077.906] ReadFile (in: hFile=0x12ac, lpBuffer=0x56240f8, nNumberOfBytesToRead=0x8bc3, lpNumberOfBytesRead=0x1beff748, lpOverlapped=0x0 | out: lpBuffer=0x56240f8*, lpNumberOfBytesRead=0x1beff748*=0x8bc3, lpOverlapped=0x0) returned 1 [0077.907] SetFilePointerEx (in: hFile=0x12ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.907] WriteFile (in: hFile=0x12ac, lpBuffer=0x5630900*, nNumberOfBytesToWrite=0x8bc3, lpNumberOfBytesWritten=0x1beff744, lpOverlapped=0x0 | out: lpBuffer=0x5630900*, lpNumberOfBytesWritten=0x1beff744*=0x8bc3, lpOverlapped=0x0) returned 1 [0078.236] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9778 [0078.237] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c97a0 [0078.237] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c97a0) returned 1 [0078.237] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5630900) returned 1 [0078.237] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x56240f8) returned 1 [0078.243] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497688) returned 1 [0078.243] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5650) returned 1 [0078.243] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1f) returned 0x55c9688 [0078.243] SetFilePointerEx (in: hFile=0x12ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.243] WriteFile (in: hFile=0x12ac, lpBuffer=0x549c1c8*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x1beff7ac, lpOverlapped=0x0 | out: lpBuffer=0x549c1c8*, lpNumberOfBytesWritten=0x1beff7ac*=0x103, lpOverlapped=0x0) returned 1 [0078.244] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549c1c8) returned 1 [0078.244] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c96b0) returned 1 [0078.244] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c96d8) returned 1 [0078.244] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9688) returned 1 [0078.244] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9778) returned 1 [0078.244] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559dc0) returned 1 [0078.244] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559f78) returned 1 [0078.244] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559fc8) returned 1 [0078.244] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x94) returned 0x55c6758 [0078.244] wcscpy (in: _Dest=0x55c6758, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\v XP9.flv" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\v XP9.flv") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\v XP9.flv" [0078.244] wcscat (in: _Dest=0x55c6758, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\v XP9.flv.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\v XP9.flv.mailto[knoocknoo@cock.li].a0a70" [0078.244] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\AppData\\Roaming\\v XP9.flv.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1beff764, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\AppData\\Roaming\\v XP9.flv.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0078.245] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xaa) returned 0x55c7e88 Thread: id = 732 os_tid = 0x1a9c [0077.909] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\whkgOt.avi" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\whkgot.avi")) returned 0x20 [0077.909] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\whkgOt.avi", dwFileAttributes=0x20) returned 1 [0077.909] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\whkgOt.avi" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\whkgot.avi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x12b0 [0077.909] GetFileSizeEx (in: hFile=0x12b0, lpFileSize=0x1bf7fb78 | out: lpFileSize=0x1bf7fb78*=89848) returned 1 [0077.909] SetFilePointerEx (in: hFile=0x12b0, liDistanceToMove=0x15ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.909] ReadFile (in: hFile=0x12b0, lpBuffer=0x1bf7fafc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1bf7faf8, lpOverlapped=0x0 | out: lpBuffer=0x1bf7fafc*, lpNumberOfBytesRead=0x1bf7faf8*=0x4, lpOverlapped=0x0) returned 1 [0077.910] SetFilePointerEx (in: hFile=0x12b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.910] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f28 [0077.910] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559de8 [0077.910] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f50 [0077.910] NtQuerySystemTime (in: CurrentTime=0x1bf7fad8 | out: CurrentTime=0x1bf7fad8*=132260136350741484) returned 0x0 [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0xc75fec40 [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0x4068c4ac [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0x17466670 [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0xd5de702 [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0xcc8ea0cf [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0xa1c4c3a1 [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0xb0ff1ff8 [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0x5740753c [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0x955ea82d [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0xa295888e [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0x9f651aaa [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0xefd72781 [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0x3af09e64 [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0x2e10df14 [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0xac3f55cd [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0xc38e587d [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0xb56c5496 [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0x868f1c58 [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0x340e5e5b [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0x6439b1a0 [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0x24dc3c2d [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0x557a2859 [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0xcccda7bf [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0x94e5c25c [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0x40a86fc3 [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0x822bc674 [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0x17402da8 [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0x9bc23e3e [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0xc16add3d [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0x96534f7c [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0x366391d7 [0077.910] RtlRandom (in: Seed=0x1bf7fae4 | out: Seed=0x1bf7fae4) returned 0x105535ef [0077.919] SetFilePointerEx (in: hFile=0x12b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.919] ReadFile (in: hFile=0x12b0, lpBuffer=0x563d108, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1bf7fab8, lpOverlapped=0x0 | out: lpBuffer=0x563d108*, lpNumberOfBytesRead=0x1bf7fab8*=0xc800, lpOverlapped=0x0) returned 1 [0077.920] SetFilePointerEx (in: hFile=0x12b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.920] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5698 [0077.920] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5496878 [0077.920] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559e38 [0077.920] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559e38) returned 1 [0077.921] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5649910 [0077.921] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f28 [0077.921] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f50 [0077.921] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559f50) returned 1 [0077.921] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496878) returned 1 [0077.921] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5698) returned 1 [0077.921] WriteFile (in: hFile=0x12b0, lpBuffer=0x5649910*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1bf7fab8, lpOverlapped=0x0 | out: lpBuffer=0x5649910*, lpNumberOfBytesWritten=0x1bf7fab8*=0xc800, lpOverlapped=0x0) returned 1 [0078.233] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5649910) returned 1 [0078.233] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x563d108) returned 1 [0078.233] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x21) returned 0x38a67c0 [0078.233] SetFilePointerEx (in: hFile=0x12b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.233] WriteFile (in: hFile=0x12b0, lpBuffer=0x549c1c8*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x1bf7fb38, lpOverlapped=0x0 | out: lpBuffer=0x549c1c8*, lpNumberOfBytesWritten=0x1bf7fb38*=0x105, lpOverlapped=0x0) returned 1 [0078.234] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549c1c8) returned 1 [0078.234] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a67f0) returned 1 [0078.234] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9688) returned 1 [0078.234] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a67c0) returned 1 [0078.235] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559f28) returned 1 [0078.235] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559de8) returned 1 [0078.235] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x555a018) returned 1 [0078.235] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x555a040) returned 1 [0078.235] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x96) returned 0x55c66b8 [0078.235] wcscpy (in: _Dest=0x55c66b8, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\whkgOt.avi" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\whkgOt.avi") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\whkgOt.avi" [0078.235] wcscat (in: _Dest=0x55c66b8, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\whkgOt.avi.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\whkgOt.avi.mailto[knoocknoo@cock.li].a0a70" [0078.235] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\AppData\\Roaming\\whkgOt.avi.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1bf7faf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\AppData\\Roaming\\whkgOt.avi.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0078.235] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xac) returned 0x55c7dd0 Thread: id = 733 os_tid = 0x1aa0 [0077.922] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\wstFzu.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\wstfzu.swf")) returned 0x20 [0077.922] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\wstFzu.swf", dwFileAttributes=0x20) returned 1 [0077.922] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\wstFzu.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\wstfzu.swf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x12b4 [0077.922] GetFileSizeEx (in: hFile=0x12b4, lpFileSize=0x1bfff748 | out: lpFileSize=0x1bfff748*=15780) returned 1 [0077.922] SetFilePointerEx (in: hFile=0x12b4, liDistanceToMove=0x3da0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.922] ReadFile (in: hFile=0x12b4, lpBuffer=0x1bfff6cc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1bfff6c8, lpOverlapped=0x0 | out: lpBuffer=0x1bfff6cc*, lpNumberOfBytesRead=0x1bfff6c8*=0x4, lpOverlapped=0x0) returned 1 [0077.922] SetFilePointerEx (in: hFile=0x12b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f50 [0077.923] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559e10 [0077.923] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559d98 [0077.923] NtQuerySystemTime (in: CurrentTime=0x1bfff6a8 | out: CurrentTime=0x1bfff6a8*=132260136350741484) returned 0x0 [0077.923] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0x8f368522 [0077.923] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0xf58ef3dd [0077.923] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0xd88d3c86 [0077.923] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0xd20a4a8a [0077.923] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0xeec4eaff [0077.923] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0xf4914291 [0077.923] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0x10b9ea34 [0077.923] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0x79d2691d [0077.923] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0x3261bbe0 [0077.923] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0x8ada53a [0077.923] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0x99c1b588 [0077.923] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0x38205932 [0077.923] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0xae804ec1 [0077.923] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0x3012d7ac [0077.923] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0x5867332e [0077.923] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0xfd7d5715 [0077.923] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0x7cd86647 [0077.923] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0xee0b824 [0077.923] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0xc0c8cd61 [0077.924] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0x938da22e [0077.924] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0x8e799b1c [0077.924] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0xb1c3afe0 [0077.924] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0x11cfbb2e [0077.924] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0x568c857d [0077.924] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0xa2b19719 [0077.924] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0xa99b970d [0077.924] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0xdae43170 [0077.924] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0x68871902 [0077.924] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0x2b093fe6 [0077.924] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0xa9e19dd3 [0077.924] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0xd6c451b5 [0077.924] RtlRandom (in: Seed=0x1bfff6b4 | out: Seed=0x1bfff6b4) returned 0x7b265ab2 [0077.935] ReadFile (in: hFile=0x12b4, lpBuffer=0x5656118, nNumberOfBytesToRead=0x3da4, lpNumberOfBytesRead=0x1bfff6a4, lpOverlapped=0x0 | out: lpBuffer=0x5656118*, lpNumberOfBytesRead=0x1bfff6a4*=0x3da4, lpOverlapped=0x0) returned 1 [0077.935] SetFilePointerEx (in: hFile=0x12b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.935] WriteFile (in: hFile=0x12b4, lpBuffer=0x5af0048*, nNumberOfBytesToWrite=0x3da4, lpNumberOfBytesWritten=0x1bfff6a0, lpOverlapped=0x0 | out: lpBuffer=0x5af0048*, lpNumberOfBytesWritten=0x1bfff6a0*=0x3da4, lpOverlapped=0x0) returned 1 [0078.223] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9778 [0078.223] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c97a0 [0078.223] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c97a0) returned 1 [0078.223] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5af0048) returned 1 [0078.227] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5656118) returned 1 [0078.229] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496878) returned 1 [0078.229] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5698) returned 1 [0078.229] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x21) returned 0x38a67c0 [0078.229] SetFilePointerEx (in: hFile=0x12b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.229] WriteFile (in: hFile=0x12b4, lpBuffer=0x549c1c8*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x1bfff708, lpOverlapped=0x0 | out: lpBuffer=0x549c1c8*, lpNumberOfBytesWritten=0x1bfff708*=0x105, lpOverlapped=0x0) returned 1 [0078.231] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549c1c8) returned 1 [0078.231] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a67f0) returned 1 [0078.231] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9688) returned 1 [0078.231] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a67c0) returned 1 [0078.231] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9778) returned 1 [0078.231] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559e10) returned 1 [0078.231] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559e38) returned 1 [0078.231] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559e60) returned 1 [0078.231] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x96) returned 0x55c6618 [0078.231] wcscpy (in: _Dest=0x55c6618, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\wstFzu.swf" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\wstFzu.swf") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\wstFzu.swf" [0078.231] wcscat (in: _Dest=0x55c6618, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\wstFzu.swf.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\wstFzu.swf.mailto[knoocknoo@cock.li].a0a70" [0078.231] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\AppData\\Roaming\\wstFzu.swf.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1bfff6c0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\AppData\\Roaming\\wstFzu.swf.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0078.231] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xac) returned 0x55c7d18 Thread: id = 734 os_tid = 0x1aa4 [0077.936] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\xqH-bfT3Sg.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xqh-bft3sg.swf")) returned 0x20 [0077.936] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\xqH-bfT3Sg.swf", dwFileAttributes=0x20) returned 1 [0077.936] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\xqH-bfT3Sg.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xqh-bft3sg.swf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x12b8 [0077.936] GetFileSizeEx (in: hFile=0x12b8, lpFileSize=0x1c07f990 | out: lpFileSize=0x1c07f990*=96789) returned 1 [0077.936] SetFilePointerEx (in: hFile=0x12b8, liDistanceToMove=0x17a11, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.936] ReadFile (in: hFile=0x12b8, lpBuffer=0x1c07f914, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1c07f910, lpOverlapped=0x0 | out: lpBuffer=0x1c07f914*, lpNumberOfBytesRead=0x1c07f910*=0x4, lpOverlapped=0x0) returned 1 [0077.936] SetFilePointerEx (in: hFile=0x12b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.936] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f50 [0077.936] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559e88 [0077.937] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559d98 [0077.937] NtQuerySystemTime (in: CurrentTime=0x1c07f8f0 | out: CurrentTime=0x1c07f8f0*=132260136350905747) returned 0x0 [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0x85569e8b [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0xc895edcf [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0x75d5daee [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0x336db293 [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0x84bd1f8a [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0x6f05f724 [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0x2f0f955b [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0x8a1acf32 [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0x7fce4b3a [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0x6078a5ae [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0xad885c14 [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0x143f7771 [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0xe8fa5747 [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0x54a15f77 [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0x26112216 [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0x697477c [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0x74894a14 [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0xc6f1c345 [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0x5ca75ead [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0xaedf4e6f [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0xcfd98d42 [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0x75157760 [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0x81a34df4 [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0x365061cb [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0xd9589198 [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0x744a04f7 [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0xe01fdb29 [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0x7e9ec56d [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0xeaeeed64 [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0x241196ca [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0x2f53f691 [0077.937] RtlRandom (in: Seed=0x1c07f8fc | out: Seed=0x1c07f8fc) returned 0xe40ec414 [0077.947] SetFilePointerEx (in: hFile=0x12b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.947] ReadFile (in: hFile=0x12b8, lpBuffer=0x5afc850, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1c07f8d0, lpOverlapped=0x0 | out: lpBuffer=0x5afc850*, lpNumberOfBytesRead=0x1c07f8d0*=0xc800, lpOverlapped=0x0) returned 1 [0077.947] SetFilePointerEx (in: hFile=0x12b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.947] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0077.947] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x54968f0 [0077.948] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f50 [0077.948] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559f50) returned 1 [0077.948] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5b09058 [0077.953] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f50 [0077.953] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559d98 [0077.953] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559d98) returned 1 [0077.953] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54968f0) returned 1 [0077.953] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0077.953] WriteFile (in: hFile=0x12b8, lpBuffer=0x5b09058*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1c07f8d0, lpOverlapped=0x0 | out: lpBuffer=0x5b09058*, lpNumberOfBytesWritten=0x1c07f8d0*=0xc800, lpOverlapped=0x0) returned 1 [0078.217] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5b09058) returned 1 [0078.217] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5afc850) returned 1 [0078.222] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x29) returned 0x5531508 [0078.222] SetFilePointerEx (in: hFile=0x12b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.222] WriteFile (in: hFile=0x12b8, lpBuffer=0x5406298*, nNumberOfBytesToWrite=0x10d, lpNumberOfBytesWritten=0x1c07f950, lpOverlapped=0x0 | out: lpBuffer=0x5406298*, lpNumberOfBytesWritten=0x1c07f950*=0x10d, lpOverlapped=0x0) returned 1 [0078.224] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5406298) returned 1 [0078.226] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5531540) returned 1 [0078.226] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9688) returned 1 [0078.226] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5531508) returned 1 [0078.226] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559f50) returned 1 [0078.226] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559e88) returned 1 [0078.226] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559eb0) returned 1 [0078.226] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559ed8) returned 1 [0078.227] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9e) returned 0x54a1338 [0078.227] wcscpy (in: _Dest=0x54a1338, _Source="C:\\Users\\FD1HVy\\AppData\\Roaming\\xqH-bfT3Sg.swf" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\xqH-bfT3Sg.swf") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\xqH-bfT3Sg.swf" [0078.227] wcscat (in: _Dest=0x54a1338, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\xqH-bfT3Sg.swf.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\xqH-bfT3Sg.swf.mailto[knoocknoo@cock.li].a0a70" [0078.227] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\AppData\\Roaming\\xqH-bfT3Sg.swf.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1c07f908, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\AppData\\Roaming\\xqH-bfT3Sg.swf.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0078.227] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb4) returned 0x5b16d90 Thread: id = 735 os_tid = 0x1aa8 [0077.953] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x5497928 [0077.953] wcscpy (in: _Dest=0x5497928, _Source="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe" [0077.953] wcscat (in: _Dest=0x5497928, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\" [0077.953] wcscat (in: _Dest=0x5497928, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\*") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\*" [0077.953] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542ea70 [0077.953] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\*", lpFindFileData=0x542ea70 | out: lpFindFileData=0x542ea70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7157dbce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7157dbce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7157dbce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0082.217] wcscmp (_String1=".", _String2=".") returned 0 [0082.217] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ea70 | out: lpFindFileData=0x542ea70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7157dbce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7157dbce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7157dbce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.217] wcscmp (_String1="..", _String2=".") returned 1 [0082.217] wcscmp (_String1="..", _String2="..") returned 0 [0082.217] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ea70 | out: lpFindFileData=0x542ea70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7157dbce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7157dbce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7157dbce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0082.217] wcscmp (_String1="Acrobat", _String2=".") returned 1 [0082.217] wcscmp (_String1="Acrobat", _String2="..") returned 1 [0082.217] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x541afa8 [0082.217] wcscpy (in: _Dest=0x541afa8, _Source="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe" [0082.218] wcscat (in: _Dest=0x541afa8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\" [0082.218] wcscat (in: _Dest=0x541afa8, _Source="Acrobat" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Acrobat") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Acrobat" [0082.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x541afa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d34 [0082.218] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ea70 | out: lpFindFileData=0x542ea70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7157dbce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x523a5f8d, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x523a5f8d, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0082.218] wcscmp (_String1="Linguistics", _String2=".") returned 1 [0082.218] wcscmp (_String1="Linguistics", _String2="..") returned 1 [0082.218] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x5ba73b8 [0082.218] wcscpy (in: _Dest=0x5ba73b8, _Source="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe" [0082.218] wcscat (in: _Dest=0x5ba73b8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\" [0082.218] wcscat (in: _Dest=0x5ba73b8, _Source="Linguistics" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Linguistics") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Linguistics" [0082.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba73b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d38 [0082.219] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x542ea70 | out: lpFindFileData=0x542ea70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7157dbce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x523a5f8d, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x523a5f8d, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 0 [0082.219] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0082.219] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542ea70) returned 1 [0082.219] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497928) returned 1 [0082.219] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ffee8) returned 1 Thread: id = 736 os_tid = 0x1aac [0077.956] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x38ffb20 [0077.956] wcscpy (in: _Dest=0x38ffb20, _Source="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Sun" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Sun") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Sun" [0077.956] wcscat (in: _Dest=0x38ffb20, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Sun\\") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Sun\\" [0077.956] wcscat (in: _Dest=0x38ffb20, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Sun\\*") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Sun\\*" [0077.956] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542f1a8 [0077.956] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\LocalLow\\Sun\\*", lpFindFileData=0x542f1a8 | out: lpFindFileData=0x542f1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07402a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb07402a4, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb07402a4, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7567608 [0087.510] wcscmp (_String1=".", _String2=".") returned 0 [0087.510] FindNextFileW (hFindFile=0x7567608, lpFindFileData=0x542f1a8) Thread: id = 737 os_tid = 0x1ab0 [0077.957] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x5497b68 [0077.957] wcscpy (in: _Dest=0x5497b68, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\ActiveSync" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\ActiveSync") returned="C:\\Users\\FD1HVy\\AppData\\Local\\ActiveSync" [0077.957] wcscat (in: _Dest=0x5497b68, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\ActiveSync\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\ActiveSync\\" [0077.957] wcscat (in: _Dest=0x5497b68, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\ActiveSync\\*") returned="C:\\Users\\FD1HVy\\AppData\\Local\\ActiveSync\\*" [0077.957] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d0cf8 [0077.957] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ActiveSync\\*", lpFindFileData=0x53d0cf8 | out: lpFindFileData=0x53d0cf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa96a60b1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4462fde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa96a60b1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0082.222] wcscmp (_String1=".", _String2=".") returned 0 [0082.222] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53d0cf8 | out: lpFindFileData=0x53d0cf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa96a60b1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4462fde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa96a60b1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.222] wcscmp (_String1="..", _String2=".") returned 1 [0082.222] wcscmp (_String1="..", _String2="..") returned 0 [0082.222] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53d0cf8 | out: lpFindFileData=0x53d0cf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa96a60b1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4462fde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa96a60b1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0082.222] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0082.222] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d0cf8) returned 1 [0082.222] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497b68) returned 1 [0082.223] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b6548) returned 1 Thread: id = 738 os_tid = 0x1ab4 [0077.957] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x38ffb78 [0077.958] wcscpy (in: _Dest=0x38ffb78, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe" [0077.958] wcscat (in: _Dest=0x38ffb78, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\" [0077.958] wcscat (in: _Dest=0x38ffb78, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\*") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\*" [0077.958] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d0f60 [0077.958] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\*", lpFindFileData=0x53d0f60 | out: lpFindFileData=0x53d0f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0082.241] wcscmp (_String1=".", _String2=".") returned 0 [0082.241] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53d0f60 | out: lpFindFileData=0x53d0f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.241] wcscmp (_String1="..", _String2=".") returned 1 [0082.241] wcscmp (_String1="..", _String2="..") returned 0 [0082.241] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53d0f60 | out: lpFindFileData=0x53d0f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x715a3e1e, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0082.241] wcscmp (_String1="Acrobat", _String2=".") returned 1 [0082.241] wcscmp (_String1="Acrobat", _String2="..") returned 1 [0082.241] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x7583500 [0082.241] wcscpy (in: _Dest=0x7583500, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe" [0082.241] wcscat (in: _Dest=0x7583500, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\" [0082.241] wcscat (in: _Dest=0x7583500, _Source="Acrobat" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat" [0082.241] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7583500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d5c [0082.242] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53d0f60 | out: lpFindFileData=0x53d0f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroCef", cAlternateFileName="")) returned 1 [0082.242] wcscmp (_String1="AcroCef", _String2=".") returned 1 [0082.242] wcscmp (_String1="AcroCef", _String2="..") returned 1 [0082.242] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x7583560 [0082.242] wcscpy (in: _Dest=0x7583560, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe" [0082.242] wcscat (in: _Dest=0x7583560, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\" [0082.242] wcscat (in: _Dest=0x7583560, _Source="AcroCef" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef" [0082.242] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7583560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d60 [0082.242] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53d0f60 | out: lpFindFileData=0x53d0f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73de0392, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73de0392, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1 [0082.242] wcscmp (_String1="Color", _String2=".") returned 1 [0082.243] wcscmp (_String1="Color", _String2="..") returned 1 [0082.243] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x75835c0 [0082.243] wcscpy (in: _Dest=0x75835c0, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe" [0082.243] wcscat (in: _Dest=0x75835c0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\" [0082.243] wcscat (in: _Dest=0x75835c0, _Source="Color" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color" [0082.243] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x75835c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d64 [0082.243] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53d0f60 | out: lpFindFileData=0x53d0f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73de0392, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73de0392, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 0 [0082.243] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0082.244] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d0f60) returned 1 [0082.244] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ffb78) returned 1 [0082.244] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5533e80) returned 1 Thread: id = 739 os_tid = 0x1ab8 [0077.958] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x5468cc0 [0077.958] wcscpy (in: _Dest=0x5468cc0, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\Application Data" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Application Data") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Application Data" [0077.959] wcscat (in: _Dest=0x5468cc0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Application Data\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Application Data\\" [0077.959] wcscat (in: _Dest=0x5468cc0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Application Data\\*") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Application Data\\*" [0077.959] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d11c8 [0077.959] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Application Data\\*", lpFindFileData=0x53d11c8 | out: lpFindFileData=0x53d11c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0082.212] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d11c8) returned 1 [0082.212] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5468cc0) returned 1 [0082.212] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38fc640) returned 1 Thread: id = 740 os_tid = 0x1abc [0077.959] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x5533ca0 [0077.959] wcscpy (in: _Dest=0x5533ca0, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\CEF" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\CEF") returned="C:\\Users\\FD1HVy\\AppData\\Local\\CEF" [0077.959] wcscat (in: _Dest=0x5533ca0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\CEF\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\CEF\\" [0077.959] wcscat (in: _Dest=0x5533ca0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\CEF\\*") returned="C:\\Users\\FD1HVy\\AppData\\Local\\CEF\\*" [0077.959] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d1698 [0077.959] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\CEF\\*", lpFindFileData=0x53d1698 | out: lpFindFileData=0x53d1698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0082.264] wcscmp (_String1=".", _String2=".") returned 0 [0082.264] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53d1698 | out: lpFindFileData=0x53d1698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.264] wcscmp (_String1="..", _String2=".") returned 1 [0082.264] wcscmp (_String1="..", _String2="..") returned 0 [0082.264] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53d1698 | out: lpFindFileData=0x53d1698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 1 [0082.264] wcscmp (_String1="User Data", _String2=".") returned 1 [0082.264] wcscmp (_String1="User Data", _String2="..") returned 1 [0082.264] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x7583680 [0082.264] wcscpy (in: _Dest=0x7583680, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\CEF" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\CEF") returned="C:\\Users\\FD1HVy\\AppData\\Local\\CEF" [0082.264] wcscat (in: _Dest=0x7583680, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\CEF\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\CEF\\" [0082.264] wcscat (in: _Dest=0x7583680, _Source="User Data" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\CEF\\User Data") returned="C:\\Users\\FD1HVy\\AppData\\Local\\CEF\\User Data" [0082.264] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7583680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d84 [0082.265] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53d1698 | out: lpFindFileData=0x53d1698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 0 [0082.265] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0082.265] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d1698) returned 1 [0082.265] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5533ca0) returned 1 [0082.265] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5533ed0) returned 1 Thread: id = 741 os_tid = 0x1ac0 [0077.960] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x38ffc28 [0077.960] wcscpy (in: _Dest=0x38ffc28, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\Comms" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Comms") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Comms" [0077.960] wcscat (in: _Dest=0x38ffc28, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\" [0077.960] wcscat (in: _Dest=0x38ffc28, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\*") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\*" [0077.960] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d1900 [0077.960] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\*", lpFindFileData=0x53d1900 | out: lpFindFileData=0x53d1900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a165bd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc46ec579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x476c0de7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0082.261] wcscmp (_String1=".", _String2=".") returned 0 [0082.261] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53d1900 | out: lpFindFileData=0x53d1900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a165bd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc46ec579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x476c0de7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.261] wcscmp (_String1="..", _String2=".") returned 1 [0082.261] wcscmp (_String1="..", _String2="..") returned 0 [0082.261] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53d1900 | out: lpFindFileData=0x53d1900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x476c0de7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xda8906a2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xda8906a2, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0082.261] wcscmp (_String1="Temp", _String2=".") returned 1 [0082.261] wcscmp (_String1="Temp", _String2="..") returned 1 [0082.261] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x7583680 [0082.261] wcscpy (in: _Dest=0x7583680, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\Comms" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Comms") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Comms" [0082.261] wcscat (in: _Dest=0x7583680, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\" [0082.261] wcscat (in: _Dest=0x7583680, _Source="Temp" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\Temp") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\Temp" [0082.261] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7583680) returned 1 [0082.261] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53d1900 | out: lpFindFileData=0x53d1900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4713d6be, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x6d619041, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6d619041, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unistore", cAlternateFileName="")) returned 1 [0082.261] wcscmp (_String1="Unistore", _String2=".") returned 1 [0082.261] wcscmp (_String1="Unistore", _String2="..") returned 1 [0082.261] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x541ada0 [0082.261] wcscpy (in: _Dest=0x541ada0, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\Comms" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Comms") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Comms" [0082.261] wcscat (in: _Dest=0x541ada0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\" [0082.261] wcscat (in: _Dest=0x541ada0, _Source="Unistore" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\Unistore") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\Unistore" [0082.262] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x541ada0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d7c [0082.262] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53d1900 | out: lpFindFileData=0x53d1900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a3c828, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc12eebd3, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xc12eebd3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnistoreDB", cAlternateFileName="UNISTO~1")) returned 1 [0082.262] wcscmp (_String1="UnistoreDB", _String2=".") returned 1 [0082.262] wcscmp (_String1="UnistoreDB", _String2="..") returned 1 [0082.262] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x541ae08 [0082.262] wcscpy (in: _Dest=0x541ae08, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\Comms" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Comms") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Comms" [0082.262] wcscat (in: _Dest=0x541ae08, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\" [0082.262] wcscat (in: _Dest=0x541ae08, _Source="UnistoreDB" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB" [0082.262] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x541ae08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d80 [0082.263] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53d1900 | out: lpFindFileData=0x53d1900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a3c828, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc12eebd3, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xc12eebd3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnistoreDB", cAlternateFileName="UNISTO~1")) returned 0 [0082.263] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0082.263] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d1900) returned 1 [0082.263] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ffc28) returned 1 [0082.263] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5533f20) returned 1 Thread: id = 742 os_tid = 0x1ac4 [0077.960] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x72) returned 0x38d06a0 [0077.960] wcscpy (in: _Dest=0x38d06a0, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform") returned="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform" [0077.960] wcscat (in: _Dest=0x38d06a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\" [0077.960] wcscat (in: _Dest=0x38d06a0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\*") returned="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\*" [0077.960] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d1b68 [0077.960] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\*", lpFindFileData=0x53d1b68 | out: lpFindFileData=0x53d1b68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc58b9bba, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc58b9bba, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc58b9bba, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444c00 [0077.961] wcscmp (_String1=".", _String2=".") returned 0 [0077.961] FindNextFileW (in: hFindFile=0x5444c00, lpFindFileData=0x53d1b68 | out: lpFindFileData=0x53d1b68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc58b9bba, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc58b9bba, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc58b9bba, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.961] wcscmp (_String1="..", _String2=".") returned 1 [0077.961] wcscmp (_String1="..", _String2="..") returned 0 [0077.961] FindNextFileW (in: hFindFile=0x5444c00, lpFindFileData=0x53d1b68 | out: lpFindFileData=0x53d1b68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc58b9bba, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc58b9bba, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x435d76fd, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x5f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="CDPGlobalSettings.cdp", cAlternateFileName="CDPGLO~1.CDP")) returned 1 [0077.961] wcscmp (_String1="CDPGlobalSettings.cdp", _String2=".") returned 1 [0077.961] wcscmp (_String1="CDPGlobalSettings.cdp", _String2="..") returned 1 [0077.961] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9a) returned 0x54a17d0 [0077.961] wcscpy (in: _Dest=0x54a17d0, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform") returned="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform" [0077.961] wcscat (in: _Dest=0x54a17d0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\" [0077.961] wcscat (in: _Dest=0x54a17d0, _Source="CDPGlobalSettings.cdp" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\CDPGlobalSettings.cdp") returned="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\CDPGlobalSettings.cdp" [0080.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54a17d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c0 [0080.917] FindNextFileW (in: hFindFile=0x5444c00, lpFindFileData=0x53d1b68 | out: lpFindFileData=0x53d1b68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc58b9bba, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc58b9bba, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x435d76fd, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x5f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="CDPGlobalSettings.cdp", cAlternateFileName="CDPGLO~1.CDP")) returned 0 [0080.917] FindClose (in: hFindFile=0x5444c00 | out: hFindFile=0x5444c00) returned 1 [0080.917] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d1b68) returned 1 [0080.917] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38d06a0) returned 1 [0080.917] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497430) returned 1 Thread: id = 743 os_tid = 0x1ac8 [0077.961] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x541b8e0 [0077.961] wcscpy (in: _Dest=0x541b8e0, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\Google" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Google") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Google" [0077.961] wcscat (in: _Dest=0x541b8e0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\" [0077.962] wcscat (in: _Dest=0x541b8e0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\*") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\*" [0077.962] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53ce1a8 [0077.962] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\*", lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a3bd622, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x7e3bdb64, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0082.258] wcscmp (_String1=".", _String2=".") returned 0 [0082.258] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a3bd622, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x7e3bdb64, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.258] wcscmp (_String1="..", _String2=".") returned 1 [0082.258] wcscmp (_String1="..", _String2="..") returned 0 [0082.258] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4aa60657, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x4aa60657, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chrome", cAlternateFileName="")) returned 1 [0082.258] wcscmp (_String1="Chrome", _String2=".") returned 1 [0082.258] wcscmp (_String1="Chrome", _String2="..") returned 1 [0082.258] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x7583620 [0082.258] wcscpy (in: _Dest=0x7583620, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\Google" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Google") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Google" [0082.258] wcscat (in: _Dest=0x7583620, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\" [0082.258] wcscat (in: _Dest=0x7583620, _Source="Chrome" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome" [0082.258] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7583620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d74 [0082.259] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xadb6a93, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xadb6a93, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1 [0082.259] wcscmp (_String1="CrashReports", _String2=".") returned 1 [0082.259] wcscmp (_String1="CrashReports", _String2="..") returned 1 [0082.259] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x5ba75e8 [0082.259] wcscpy (in: _Dest=0x5ba75e8, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\Google" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Google") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Google" [0082.259] wcscat (in: _Dest=0x5ba75e8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\" [0082.259] wcscat (in: _Dest=0x5ba75e8, _Source="CrashReports" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\CrashReports") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\CrashReports" [0082.259] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba75e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d78 [0082.260] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xadb6a93, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xadb6a93, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 0 [0082.260] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0082.260] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ce1a8) returned 1 [0082.260] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541b8e0) returned 1 [0082.260] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ffe38) returned 1 Thread: id = 744 os_tid = 0x1acc [0077.962] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x541b200 [0077.962] wcscpy (in: _Dest=0x541b200, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\History" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\History") returned="C:\\Users\\FD1HVy\\AppData\\Local\\History" [0077.962] wcscat (in: _Dest=0x541b200, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\History\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\History\\" [0077.962] wcscat (in: _Dest=0x541b200, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\History\\*") returned="C:\\Users\\FD1HVy\\AppData\\Local\\History\\*" [0077.962] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53cf280 [0077.962] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\History\\*", lpFindFileData=0x53cf280 | out: lpFindFileData=0x53cf280*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0082.213] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53cf280) returned 1 [0082.213] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541b200) returned 1 [0082.213] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38fff98) returned 1 Thread: id = 745 os_tid = 0x1ad0 [0077.963] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x542b730 [0077.963] wcscpy (in: _Dest=0x542b730, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge" [0077.963] wcscat (in: _Dest=0x542b730, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\" [0077.963] wcscat (in: _Dest=0x542b730, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\*") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\*" [0077.963] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53cf750 [0077.963] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\*", lpFindFileData=0x53cf750 | out: lpFindFileData=0x53cf750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc895324f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd6772beb, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444c40 [0077.963] wcscmp (_String1=".", _String2=".") returned 0 [0077.963] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cf750 | out: lpFindFileData=0x53cf750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc895324f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd6772beb, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.963] wcscmp (_String1="..", _String2=".") returned 1 [0077.963] wcscmp (_String1="..", _String2="..") returned 0 [0077.963] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cf750 | out: lpFindFileData=0x53cf750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x92addfb1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92addfb1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedCacheContainers", cAlternateFileName="SHARED~1")) returned 1 [0077.963] wcscmp (_String1="SharedCacheContainers", _String2=".") returned 1 [0077.963] wcscmp (_String1="SharedCacheContainers", _String2="..") returned 1 [0077.963] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x84) returned 0x549d7a8 [0077.963] wcscpy (in: _Dest=0x549d7a8, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge" [0077.963] wcscat (in: _Dest=0x549d7a8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\" [0077.963] wcscat (in: _Dest=0x549d7a8, _Source="SharedCacheContainers" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers" [0080.914] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x549d7a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c4 [0080.914] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cf750 | out: lpFindFileData=0x53cf750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6771884, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd6771884, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd678d991, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 1 [0080.914] wcscmp (_String1="User", _String2=".") returned 1 [0080.914] wcscmp (_String1="User", _String2="..") returned 1 [0080.914] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x5ba7d58 [0080.914] wcscpy (in: _Dest=0x5ba7d58, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge" [0080.914] wcscat (in: _Dest=0x5ba7d58, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\" [0080.914] wcscat (in: _Dest=0x5ba7d58, _Source="User" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\User") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\User" [0080.914] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba7d58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b8 [0080.915] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cf750 | out: lpFindFileData=0x53cf750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6771884, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd6771884, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd678d991, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 0 [0080.915] FindClose (in: hFindFile=0x5444c40 | out: hFindFile=0x5444c40) returned 1 [0080.915] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53cf750) returned 1 [0080.915] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542b730) returned 1 [0080.915] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b6608) returned 1 Thread: id = 746 os_tid = 0x1ad4 [0077.966] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x542b938 [0077.966] wcscpy (in: _Dest=0x542b938, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\PeerDistRepub" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\PeerDistRepub") returned="C:\\Users\\FD1HVy\\AppData\\Local\\PeerDistRepub" [0077.966] wcscat (in: _Dest=0x542b938, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\PeerDistRepub\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\PeerDistRepub\\" [0077.966] wcscat (in: _Dest=0x542b938, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\PeerDistRepub\\*") returned="C:\\Users\\FD1HVy\\AppData\\Local\\PeerDistRepub\\*" [0077.966] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53cf9b8 [0077.966] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\PeerDistRepub\\*", lpFindFileData=0x53cf9b8 | out: lpFindFileData=0x53cf9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf9e1b08, ftCreationTime.dwHighDateTime=0x1d32734, ftLastAccessTime.dwLowDateTime=0xd2f40fba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xdf9e1b08, ftLastWriteTime.dwHighDateTime=0x1d32734, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0082.257] wcscmp (_String1=".", _String2=".") returned 0 [0082.257] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53cf9b8 | out: lpFindFileData=0x53cf9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf9e1b08, ftCreationTime.dwHighDateTime=0x1d32734, ftLastAccessTime.dwLowDateTime=0xd2f40fba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xdf9e1b08, ftLastWriteTime.dwHighDateTime=0x1d32734, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.257] wcscmp (_String1="..", _String2=".") returned 1 [0082.257] wcscmp (_String1="..", _String2="..") returned 0 [0082.257] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53cf9b8 | out: lpFindFileData=0x53cf9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf9e1b08, ftCreationTime.dwHighDateTime=0x1d32734, ftLastAccessTime.dwLowDateTime=0xd2f40fba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xdf9e1b08, ftLastWriteTime.dwHighDateTime=0x1d32734, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0082.257] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0082.257] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53cf9b8) returned 1 [0082.257] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542b938) returned 1 [0082.257] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b6668) returned 1 Thread: id = 747 os_tid = 0x1ad8 [0077.966] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x5497e68 [0077.966] wcscpy (in: _Dest=0x5497e68, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\Publishers" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Publishers") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Publishers" [0077.966] wcscat (in: _Dest=0x5497e68, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Publishers\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Publishers\\" [0077.966] wcscat (in: _Dest=0x5497e68, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Publishers\\*") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Publishers\\*" [0077.966] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53cfe88 [0077.966] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Publishers\\*", lpFindFileData=0x53cfe88 | out: lpFindFileData=0x53cfe88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e09841, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2f421af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3e09841, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0082.251] wcscmp (_String1=".", _String2=".") returned 0 [0082.251] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53cfe88 | out: lpFindFileData=0x53cfe88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e09841, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2f421af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3e09841, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.251] wcscmp (_String1="..", _String2=".") returned 1 [0082.251] wcscmp (_String1="..", _String2="..") returned 0 [0082.251] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53cfe88 | out: lpFindFileData=0x53cfe88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e09841, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdb1a72e3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdb1a72e3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8wekyb3d8bbwe", cAlternateFileName="8WEKYB~1")) returned 1 [0082.251] wcscmp (_String1="8wekyb3d8bbwe", _String2=".") returned 1 [0082.252] wcscmp (_String1="8wekyb3d8bbwe", _String2="..") returned 1 [0082.252] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6e) returned 0x54968f0 [0082.252] wcscpy (in: _Dest=0x54968f0, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\Publishers" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Publishers") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Publishers" [0082.252] wcscat (in: _Dest=0x54968f0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Publishers\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Publishers\\" [0082.252] wcscat (in: _Dest=0x54968f0, _Source="8wekyb3d8bbwe" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\Publishers\\8wekyb3d8bbwe") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Publishers\\8wekyb3d8bbwe" [0082.252] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54968f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d70 [0082.252] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53cfe88 | out: lpFindFileData=0x53cfe88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e09841, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdb1a72e3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdb1a72e3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8wekyb3d8bbwe", cAlternateFileName="8WEKYB~1")) returned 0 [0082.252] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0082.253] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53cfe88) returned 1 [0082.253] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497e68) returned 1 [0082.253] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b6308) returned 1 Thread: id = 748 os_tid = 0x1adc [0077.967] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Resmon.ResmonCfg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\resmon.resmoncfg")) returned 0x20 [0082.249] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Resmon.ResmonCfg", dwFileAttributes=0x20) returned 1 [0082.249] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Resmon.ResmonCfg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\resmon.resmoncfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d3c [0082.250] GetFileSizeEx (in: hFile=0x1d3c, lpFileSize=0x1c77fdc8 | out: lpFileSize=0x1c77fdc8*=7605) returned 1 [0082.250] SetFilePointerEx (in: hFile=0x1d3c, liDistanceToMove=0x1db1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.250] ReadFile (in: hFile=0x1d3c, lpBuffer=0x1c77fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1c77fd48, lpOverlapped=0x0 | out: lpBuffer=0x1c77fd4c*, lpNumberOfBytesRead=0x1c77fd48*=0x4, lpOverlapped=0x0) returned 1 [0082.251] SetFilePointerEx (in: hFile=0x1d3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.251] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 749 os_tid = 0x1ae0 [0077.967] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x541aac8 [0077.967] wcscpy (in: _Dest=0x541aac8, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer" [0077.967] wcscat (in: _Dest=0x541aac8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\" [0077.967] wcscat (in: _Dest=0x541aac8, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\*") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\*" [0077.967] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d0358 [0077.967] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\*", lpFindFileData=0x53d0358 | out: lpFindFileData=0x53d0358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cdbf8a7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd2fbd0ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3cdbf8a7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444d40 [0077.968] wcscmp (_String1=".", _String2=".") returned 0 [0077.968] FindNextFileW (in: hFindFile=0x5444d40, lpFindFileData=0x53d0358 | out: lpFindFileData=0x53d0358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cdbf8a7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd2fbd0ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3cdbf8a7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.968] wcscmp (_String1="..", _String2=".") returned 1 [0077.968] wcscmp (_String1="..", _String2="..") returned 0 [0077.968] FindNextFileW (in: hFindFile=0x5444d40, lpFindFileData=0x53d0358 | out: lpFindFileData=0x53d0358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cdbf8a7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x8e73b662, ftLastAccessTime.dwHighDateTime=0x1d5d80d, ftLastWriteTime.dwLowDateTime=0x8e73b662, ftLastWriteTime.dwHighDateTime=0x1d5d80d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database", cAlternateFileName="")) returned 1 [0077.968] wcscmp (_String1="Database", _String2=".") returned 1 [0077.968] wcscmp (_String1="Database", _String2="..") returned 1 [0077.968] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6a) returned 0x5496968 [0077.968] wcscpy (in: _Dest=0x5496968, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer" [0077.968] wcscat (in: _Dest=0x5496968, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\" [0077.968] wcscat (in: _Dest=0x5496968, _Source="Database" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database" [0080.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5496968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b4 [0080.912] FindNextFileW (in: hFindFile=0x5444d40, lpFindFileData=0x53d0358 | out: lpFindFileData=0x53d0358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cdbf8a7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x8e73b662, ftLastAccessTime.dwHighDateTime=0x1d5d80d, ftLastWriteTime.dwLowDateTime=0x8e73b662, ftLastWriteTime.dwHighDateTime=0x1d5d80d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database", cAlternateFileName="")) returned 0 [0080.912] FindClose (in: hFindFile=0x5444d40 | out: hFindFile=0x5444d40) returned 1 [0080.913] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d0358) returned 1 [0080.913] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541aac8) returned 1 [0080.913] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x543d4b8) returned 1 Thread: id = 750 os_tid = 0x1ae4 [0077.968] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x5533cf0 [0077.968] wcscpy (in: _Dest=0x5533cf0, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\UNP" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\UNP") returned="C:\\Users\\FD1HVy\\AppData\\Local\\UNP" [0077.968] wcscat (in: _Dest=0x5533cf0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\UNP\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\UNP\\" [0077.968] wcscat (in: _Dest=0x5533cf0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\UNP\\*") returned="C:\\Users\\FD1HVy\\AppData\\Local\\UNP\\*" [0077.969] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f5868 [0077.969] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\UNP\\*", lpFindFileData=0x53f5868 | out: lpFindFileData=0x53f5868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf56c97e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xd3023f2d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf56c97e4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0082.247] wcscmp (_String1=".", _String2=".") returned 0 [0082.247] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53f5868 | out: lpFindFileData=0x53f5868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf56c97e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xd3023f2d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf56c97e4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.247] wcscmp (_String1="..", _String2=".") returned 1 [0082.247] wcscmp (_String1="..", _String2="..") returned 0 [0082.247] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53f5868 | out: lpFindFileData=0x53f5868*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xf56c97e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xf56c97e4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xf56c97e4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".{91be532c-f9f1-406a-9858-43697c6f437a}_uxlock", cAlternateFileName="{91BE5~1")) returned 1 [0082.247] wcscmp (_String1=".{91be532c-f9f1-406a-9858-43697c6f437a}_uxlock", _String2=".") returned 1 [0082.247] wcscmp (_String1=".{91be532c-f9f1-406a-9858-43697c6f437a}_uxlock", _String2="..") returned 1 [0082.247] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa2) returned 0x54deb30 [0082.247] wcscpy (in: _Dest=0x54deb30, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\UNP" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\UNP") returned="C:\\Users\\FD1HVy\\AppData\\Local\\UNP" [0082.247] wcscat (in: _Dest=0x54deb30, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\UNP\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\UNP\\" [0082.247] wcscat (in: _Dest=0x54deb30, _Source=".{91be532c-f9f1-406a-9858-43697c6f437a}_uxlock" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\UNP\\.{91be532c-f9f1-406a-9858-43697c6f437a}_uxlock") returned="C:\\Users\\FD1HVy\\AppData\\Local\\UNP\\.{91be532c-f9f1-406a-9858-43697c6f437a}_uxlock" [0082.247] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54deb30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d68 [0082.248] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53f5868 | out: lpFindFileData=0x53f5868*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xf56c97e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xf56c97e4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xf56c97e4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".{91be532c-f9f1-406a-9858-43697c6f437a}_uxlock", cAlternateFileName="{91BE5~1")) returned 0 [0082.248] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0082.248] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f5868) returned 1 [0082.248] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5533cf0) returned 1 [0082.248] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5533f70) returned 1 Thread: id = 751 os_tid = 0x1ae8 [0077.969] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x541ae08 [0077.969] wcscpy (in: _Dest=0x541ae08, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore") returned="C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore" [0077.969] wcscat (in: _Dest=0x541ae08, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\" [0077.969] wcscat (in: _Dest=0x541ae08, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\*") returned="C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\*" [0077.969] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f5d38 [0077.969] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\*", lpFindFileData=0x53f5d38 | out: lpFindFileData=0x53f5d38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a795684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd3024d82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a795684, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0082.246] wcscmp (_String1=".", _String2=".") returned 0 [0082.246] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53f5d38 | out: lpFindFileData=0x53f5d38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a795684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd3024d82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a795684, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.246] wcscmp (_String1="..", _String2=".") returned 1 [0082.246] wcscmp (_String1="..", _String2="..") returned 0 [0082.246] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x53f5d38 | out: lpFindFileData=0x53f5d38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a795684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd3024d82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a795684, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0082.246] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0082.246] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f5d38) returned 1 [0082.246] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541ae08) returned 1 [0082.246] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x543d8d8) returned 1 Thread: id = 752 os_tid = 0x1aec [0077.970] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0082.108] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0082.108] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.108] GetLastError () returned 0x5 [0082.108] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0082.108] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39758b0) returned 1 Thread: id = 753 os_tid = 0x1af0 [0077.971] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0084.653] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0084.653] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.653] GetLastError () returned 0x5 [0084.653] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0084.653] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3975e28) returned 1 Thread: id = 754 os_tid = 0x1af4 [0077.971] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb8) returned 0x5b16f10 [0077.971] wcscpy (in: _Dest=0x5b16f10, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0077.971] wcscat (in: _Dest=0x5b16f10, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0077.971] wcscat (in: _Dest=0x5b16f10, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*" [0077.971] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f36b8 [0077.971] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x53f36b8 | out: lpFindFileData=0x53f36b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ef09035, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab5edb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7ef09035, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ee00 [0084.651] wcscmp (_String1=".", _String2=".") returned 0 [0084.651] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53f36b8 | out: lpFindFileData=0x53f36b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ef09035, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab5edb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7ef09035, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.651] wcscmp (_String1="..", _String2=".") returned 1 [0084.651] wcscmp (_String1="..", _String2="..") returned 0 [0084.651] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53f36b8 | out: lpFindFileData=0x53f36b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ef09035, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7ef554ec, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7ef554ec, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2f26, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1 [0084.651] wcscmp (_String1="CodeIntegrity.cat", _String2=".") returned 1 [0084.651] wcscmp (_String1="CodeIntegrity.cat", _String2="..") returned 1 [0084.651] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x3934c68 [0084.651] wcscpy (in: _Dest=0x3934c68, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0084.651] wcscat (in: _Dest=0x3934c68, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0084.651] wcscat (in: _Dest=0x3934c68, _Source="CodeIntegrity.cat" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" [0084.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3934c68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0 [0084.652] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53f36b8 | out: lpFindFileData=0x53f36b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ef09035, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7ef554ec, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7ef554ec, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2f26, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 0 [0084.652] FindClose (in: hFindFile=0x389ee00 | out: hFindFile=0x389ee00) returned 1 [0084.652] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f36b8) returned 1 [0084.652] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5b16f10) returned 1 [0084.652] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3904a20) returned 1 Thread: id = 755 os_tid = 0x1af8 [0077.972] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0084.649] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0084.650] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.650] GetLastError () returned 0x5 [0084.650] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0084.650] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3975bd0) returned 1 Thread: id = 756 os_tid = 0x1afc [0077.972] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xac) returned 0x55c8390 [0077.972] wcscpy (in: _Dest=0x55c8390, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0077.972] wcscat (in: _Dest=0x55c8390, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0077.972] wcscat (in: _Dest=0x55c8390, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\*" [0077.972] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f6ba8 [0077.972] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f2d055d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6bff9c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f8f31a9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444d80 [0077.973] wcscmp (_String1=".", _String2=".") returned 0 [0077.973] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f2d055d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6bff9c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f8f31a9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.974] wcscmp (_String1="..", _String2=".") returned 1 [0077.974] wcscmp (_String1="..", _String2="..") returned 0 [0077.974] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f2d055d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f2d055d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f2d055d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.scale-100.png", cAlternateFileName="")) returned 1 [0077.974] wcscmp (_String1="GetStartedAppList.scale-100.png", _String2=".") returned 1 [0077.974] wcscmp (_String1="GetStartedAppList.scale-100.png", _String2="..") returned 1 [0077.974] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x396f2f8 [0077.974] wcscpy (in: _Dest=0x396f2f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0077.974] wcscat (in: _Dest=0x396f2f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0077.974] wcscat (in: _Dest=0x396f2f8, _Source="GetStartedAppList.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-100.png" [0080.876] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396f2f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12cc [0080.876] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f2f67b6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f2f67b6, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f2f67b6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.scale-100_contrast-black.png", cAlternateFileName="")) returned 1 [0080.876] wcscmp (_String1="GetStartedAppList.scale-100_contrast-black.png", _String2=".") returned 1 [0080.876] wcscmp (_String1="GetStartedAppList.scale-100_contrast-black.png", _String2="..") returned 1 [0080.876] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x5ba9430 [0080.876] wcscpy (in: _Dest=0x5ba9430, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0080.876] wcscat (in: _Dest=0x5ba9430, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0080.876] wcscat (in: _Dest=0x5ba9430, _Source="GetStartedAppList.scale-100_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-100_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-100_contrast-black.png" [0080.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba9430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x183c [0080.877] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f2f67b6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f2f67b6, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f2f67b6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.scale-100_contrast-white.png", cAlternateFileName="")) returned 1 [0080.877] wcscmp (_String1="GetStartedAppList.scale-100_contrast-white.png", _String2=".") returned 1 [0080.877] wcscmp (_String1="GetStartedAppList.scale-100_contrast-white.png", _String2="..") returned 1 [0080.877] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x5ba9548 [0080.877] wcscpy (in: _Dest=0x5ba9548, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0080.877] wcscat (in: _Dest=0x5ba9548, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0080.877] wcscat (in: _Dest=0x5ba9548, _Source="GetStartedAppList.scale-100_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-100_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-100_contrast-white.png" [0080.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba9548, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1840 [0080.878] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f31ca10, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f31ca10, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f31ca10, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-16.png", cAlternateFileName="")) returned 1 [0080.878] wcscmp (_String1="GetStartedAppList.targetsize-16.png", _String2=".") returned 1 [0080.878] wcscmp (_String1="GetStartedAppList.targetsize-16.png", _String2="..") returned 1 [0080.878] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x72861d0 [0080.878] wcscpy (in: _Dest=0x72861d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0080.878] wcscat (in: _Dest=0x72861d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0080.878] wcscat (in: _Dest=0x72861d0, _Source="GetStartedAppList.targetsize-16.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16.png" [0080.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x72861d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1844 [0080.879] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f31ca10, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f31ca10, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f31ca10, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-16_altform-unplated.png", cAlternateFileName="")) returned 1 [0080.879] wcscmp (_String1="GetStartedAppList.targetsize-16_altform-unplated.png", _String2=".") returned 1 [0080.879] wcscmp (_String1="GetStartedAppList.targetsize-16_altform-unplated.png", _String2="..") returned 1 [0080.879] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x75843f0 [0080.879] wcscpy (in: _Dest=0x75843f0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0080.879] wcscat (in: _Dest=0x75843f0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0080.879] wcscat (in: _Dest=0x75843f0, _Source="GetStartedAppList.targetsize-16_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_altform-unplated.png" [0080.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x75843f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1848 [0080.880] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f342c6e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f342c6e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f342c6e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-16_altform-unplated_contrast-black.png", cAlternateFileName="")) returned 1 [0080.880] wcscmp (_String1="GetStartedAppList.targetsize-16_altform-unplated_contrast-black.png", _String2=".") returned 1 [0080.880] wcscmp (_String1="GetStartedAppList.targetsize-16_altform-unplated_contrast-black.png", _String2="..") returned 1 [0080.880] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x130) returned 0x397e748 [0080.880] wcscpy (in: _Dest=0x397e748, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0080.880] wcscat (in: _Dest=0x397e748, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0080.880] wcscat (in: _Dest=0x397e748, _Source="GetStartedAppList.targetsize-16_altform-unplated_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_altform-unplated_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_altform-unplated_contrast-black.png" [0080.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x397e748, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x184c [0080.881] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f342c6e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f342c6e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f342c6e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x113, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-16_altform-unplated_contrast-white.png", cAlternateFileName="")) returned 1 [0080.881] wcscmp (_String1="GetStartedAppList.targetsize-16_altform-unplated_contrast-white.png", _String2=".") returned 1 [0080.881] wcscmp (_String1="GetStartedAppList.targetsize-16_altform-unplated_contrast-white.png", _String2="..") returned 1 [0080.881] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x130) returned 0x5ba1970 [0080.881] wcscpy (in: _Dest=0x5ba1970, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0080.881] wcscat (in: _Dest=0x5ba1970, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0080.881] wcscat (in: _Dest=0x5ba1970, _Source="GetStartedAppList.targetsize-16_altform-unplated_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_altform-unplated_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_altform-unplated_contrast-white.png" [0080.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba1970, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1850 [0080.881] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f368ec7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f368ec7, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f368ec7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-16_contrast-black.png", cAlternateFileName="")) returned 1 [0080.881] wcscmp (_String1="GetStartedAppList.targetsize-16_contrast-black.png", _String2=".") returned 1 [0080.882] wcscmp (_String1="GetStartedAppList.targetsize-16_contrast-black.png", _String2="..") returned 1 [0080.882] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x5ba9660 [0080.882] wcscpy (in: _Dest=0x5ba9660, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0080.882] wcscat (in: _Dest=0x5ba9660, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0080.882] wcscat (in: _Dest=0x5ba9660, _Source="GetStartedAppList.targetsize-16_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_contrast-black.png" [0080.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba9660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1854 [0080.882] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f368ec7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f368ec7, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f368ec7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x113, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-16_contrast-white.png", cAlternateFileName="")) returned 1 [0080.882] wcscmp (_String1="GetStartedAppList.targetsize-16_contrast-white.png", _String2=".") returned 1 [0080.882] wcscmp (_String1="GetStartedAppList.targetsize-16_contrast-white.png", _String2="..") returned 1 [0080.882] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x5baa6c8 [0080.882] wcscpy (in: _Dest=0x5baa6c8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0080.882] wcscat (in: _Dest=0x5baa6c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0080.882] wcscat (in: _Dest=0x5baa6c8, _Source="GetStartedAppList.targetsize-16_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_contrast-white.png" [0080.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5baa6c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1858 [0080.883] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f38f120, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f38f120, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f38f120, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x135, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-20.png", cAlternateFileName="")) returned 1 [0080.883] wcscmp (_String1="GetStartedAppList.targetsize-20.png", _String2=".") returned 1 [0080.883] wcscmp (_String1="GetStartedAppList.targetsize-20.png", _String2="..") returned 1 [0080.883] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x72862c8 [0080.883] wcscpy (in: _Dest=0x72862c8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0080.883] wcscat (in: _Dest=0x72862c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0080.883] wcscat (in: _Dest=0x72862c8, _Source="GetStartedAppList.targetsize-20.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20.png" [0080.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x72862c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x185c [0080.884] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f38f120, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f38f120, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f38f120, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x135, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-20_altform-unplated.png", cAlternateFileName="")) returned 1 [0080.884] wcscmp (_String1="GetStartedAppList.targetsize-20_altform-unplated.png", _String2=".") returned 1 [0080.884] wcscmp (_String1="GetStartedAppList.targetsize-20_altform-unplated.png", _String2="..") returned 1 [0080.884] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x7584518 [0080.884] wcscpy (in: _Dest=0x7584518, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0080.884] wcscat (in: _Dest=0x7584518, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0080.884] wcscat (in: _Dest=0x7584518, _Source="GetStartedAppList.targetsize-20_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_altform-unplated.png" [0080.884] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7584518, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1860 [0080.887] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f3b537e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f3b537e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f3b537e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x135, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-20_altform-unplated_contrast-black.png", cAlternateFileName="")) returned 1 [0080.887] wcscmp (_String1="GetStartedAppList.targetsize-20_altform-unplated_contrast-black.png", _String2=".") returned 1 [0080.887] wcscmp (_String1="GetStartedAppList.targetsize-20_altform-unplated_contrast-black.png", _String2="..") returned 1 [0080.887] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x130) returned 0x5ba1be0 [0080.887] wcscpy (in: _Dest=0x5ba1be0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0080.887] wcscat (in: _Dest=0x5ba1be0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0080.887] wcscat (in: _Dest=0x5ba1be0, _Source="GetStartedAppList.targetsize-20_altform-unplated_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_altform-unplated_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_altform-unplated_contrast-black.png" [0080.887] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba1be0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1864 [0080.888] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f3b537e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f3b537e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f3b537e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-20_altform-unplated_contrast-white.png", cAlternateFileName="")) returned 1 [0080.888] wcscmp (_String1="GetStartedAppList.targetsize-20_altform-unplated_contrast-white.png", _String2=".") returned 1 [0080.888] wcscmp (_String1="GetStartedAppList.targetsize-20_altform-unplated_contrast-white.png", _String2="..") returned 1 [0080.888] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x130) returned 0x5ba1aa8 [0080.888] wcscpy (in: _Dest=0x5ba1aa8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0080.888] wcscat (in: _Dest=0x5ba1aa8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0080.888] wcscat (in: _Dest=0x5ba1aa8, _Source="GetStartedAppList.targetsize-20_altform-unplated_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_altform-unplated_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_altform-unplated_contrast-white.png" [0080.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba1aa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1868 [0080.889] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f3b537e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f3b537e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f3b537e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x135, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-20_contrast-black.png", cAlternateFileName="")) returned 1 [0080.889] wcscmp (_String1="GetStartedAppList.targetsize-20_contrast-black.png", _String2=".") returned 1 [0080.889] wcscmp (_String1="GetStartedAppList.targetsize-20_contrast-black.png", _String2="..") returned 1 [0080.889] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x5baab28 [0080.889] wcscpy (in: _Dest=0x5baab28, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0080.889] wcscat (in: _Dest=0x5baab28, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0080.889] wcscat (in: _Dest=0x5baab28, _Source="GetStartedAppList.targetsize-20_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_contrast-black.png" [0080.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5baab28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x186c [0080.890] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f433724, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f433724, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f433724, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-20_contrast-white.png", cAlternateFileName="")) returned 1 [0080.890] wcscmp (_String1="GetStartedAppList.targetsize-20_contrast-white.png", _String2=".") returned 1 [0080.890] wcscmp (_String1="GetStartedAppList.targetsize-20_contrast-white.png", _String2="..") returned 1 [0080.890] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x5ba9890 [0080.890] wcscpy (in: _Dest=0x5ba9890, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0080.890] wcscat (in: _Dest=0x5ba9890, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0080.890] wcscat (in: _Dest=0x5ba9890, _Source="GetStartedAppList.targetsize-20_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_contrast-white.png" [0080.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba9890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1870 [0080.891] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f4599a7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f4599a7, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f4599a7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-24.png", cAlternateFileName="")) returned 1 [0080.891] wcscmp (_String1="GetStartedAppList.targetsize-24.png", _String2=".") returned 1 [0080.891] wcscmp (_String1="GetStartedAppList.targetsize-24.png", _String2="..") returned 1 [0080.891] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x72863c0 [0080.891] wcscpy (in: _Dest=0x72863c0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0080.891] wcscat (in: _Dest=0x72863c0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0080.891] wcscat (in: _Dest=0x72863c0, _Source="GetStartedAppList.targetsize-24.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24.png" [0080.891] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x72863c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1874 [0080.891] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f4599a7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f4599a7, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f4599a7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-24_altform-unplated.png", cAlternateFileName="")) returned 1 [0080.892] wcscmp (_String1="GetStartedAppList.targetsize-24_altform-unplated.png", _String2=".") returned 1 [0080.892] wcscmp (_String1="GetStartedAppList.targetsize-24_altform-unplated.png", _String2="..") returned 1 [0080.892] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x75842c8 [0080.892] wcscpy (in: _Dest=0x75842c8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0080.892] wcscat (in: _Dest=0x75842c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0080.892] wcscat (in: _Dest=0x75842c8, _Source="GetStartedAppList.targetsize-24_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_altform-unplated.png" [0080.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x75842c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1878 [0080.892] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f4599a7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f4599a7, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f4599a7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-24_altform-unplated_contrast-black.png", cAlternateFileName="")) returned 1 [0080.892] wcscmp (_String1="GetStartedAppList.targetsize-24_altform-unplated_contrast-black.png", _String2=".") returned 1 [0080.892] wcscmp (_String1="GetStartedAppList.targetsize-24_altform-unplated_contrast-black.png", _String2="..") returned 1 [0080.892] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x130) returned 0x5ba1e50 [0080.892] wcscpy (in: _Dest=0x5ba1e50, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0080.892] wcscat (in: _Dest=0x5ba1e50, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0080.892] wcscat (in: _Dest=0x5ba1e50, _Source="GetStartedAppList.targetsize-24_altform-unplated_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_altform-unplated_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_altform-unplated_contrast-black.png" [0080.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba1e50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x187c [0080.893] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f4d3c2c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f4d3c2c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f4d3c2c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x18a, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-24_altform-unplated_contrast-white.png", cAlternateFileName="")) returned 1 [0080.893] wcscmp (_String1="GetStartedAppList.targetsize-24_altform-unplated_contrast-white.png", _String2=".") returned 1 [0080.893] wcscmp (_String1="GetStartedAppList.targetsize-24_altform-unplated_contrast-white.png", _String2="..") returned 1 [0080.893] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x130) returned 0x5ba1f88 [0080.893] wcscpy (in: _Dest=0x5ba1f88, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0080.893] wcscat (in: _Dest=0x5ba1f88, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0080.893] wcscat (in: _Dest=0x5ba1f88, _Source="GetStartedAppList.targetsize-24_altform-unplated_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_altform-unplated_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_altform-unplated_contrast-white.png" [0080.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba1f88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1880 [0080.894] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f4f9e85, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f4f9e85, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f4f9e85, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-24_contrast-black.png", cAlternateFileName="")) returned 1 [0080.895] wcscmp (_String1="GetStartedAppList.targetsize-24_contrast-black.png", _String2=".") returned 1 [0080.895] wcscmp (_String1="GetStartedAppList.targetsize-24_contrast-black.png", _String2="..") returned 1 [0080.895] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x5baa7e0 [0080.895] wcscpy (in: _Dest=0x5baa7e0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0080.895] wcscat (in: _Dest=0x5baa7e0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0080.895] wcscat (in: _Dest=0x5baa7e0, _Source="GetStartedAppList.targetsize-24_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_contrast-black.png" [0080.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5baa7e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1884 [0080.896] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f4f9e85, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f4f9e85, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f4f9e85, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x18a, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-24_contrast-white.png", cAlternateFileName="")) returned 1 [0080.896] wcscmp (_String1="GetStartedAppList.targetsize-24_contrast-white.png", _String2=".") returned 1 [0080.896] wcscmp (_String1="GetStartedAppList.targetsize-24_contrast-white.png", _String2="..") returned 1 [0080.896] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x5baaa10 [0080.896] wcscpy (in: _Dest=0x5baaa10, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0080.896] wcscat (in: _Dest=0x5baaa10, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0080.896] wcscat (in: _Dest=0x5baaa10, _Source="GetStartedAppList.targetsize-24_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_contrast-white.png" [0080.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5baaa10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1888 [0080.897] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f4f9e85, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f4f9e85, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f4f9e85, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xba1, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-256.png", cAlternateFileName="")) returned 1 [0080.897] wcscmp (_String1="GetStartedAppList.targetsize-256.png", _String2=".") returned 1 [0080.897] wcscmp (_String1="GetStartedAppList.targetsize-256.png", _String2="..") returned 1 [0080.897] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba25f8 [0080.897] wcscpy (in: _Dest=0x5ba25f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0080.897] wcscat (in: _Dest=0x5ba25f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0080.897] wcscat (in: _Dest=0x5ba25f8, _Source="GetStartedAppList.targetsize-256.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256.png" [0080.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba25f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x188c [0080.898] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f5251df, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f529f5c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f529f5c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xba1, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-256_altform-unplated.png", cAlternateFileName="")) returned 1 [0080.898] wcscmp (_String1="GetStartedAppList.targetsize-256_altform-unplated.png", _String2=".") returned 1 [0080.898] wcscmp (_String1="GetStartedAppList.targetsize-256_altform-unplated.png", _String2="..") returned 1 [0080.898] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x114) returned 0x7584890 [0080.898] wcscpy (in: _Dest=0x7584890, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0080.898] wcscat (in: _Dest=0x7584890, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0080.898] wcscat (in: _Dest=0x7584890, _Source="GetStartedAppList.targetsize-256_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_altform-unplated.png" [0080.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7584890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1890 [0080.898] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f52c2d5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f52c2d5, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f52c2d5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xba1, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-256_altform-unplated_contrast-black.png", cAlternateFileName="")) returned 1 [0080.898] wcscmp (_String1="GetStartedAppList.targetsize-256_altform-unplated_contrast-black.png", _String2=".") returned 1 [0080.898] wcscmp (_String1="GetStartedAppList.targetsize-256_altform-unplated_contrast-black.png", _String2="..") returned 1 [0080.898] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x132) returned 0x397e880 [0080.899] wcscpy (in: _Dest=0x397e880, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0080.899] wcscat (in: _Dest=0x397e880, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0080.899] wcscat (in: _Dest=0x397e880, _Source="GetStartedAppList.targetsize-256_altform-unplated_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_altform-unplated_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_altform-unplated_contrast-black.png" [0080.899] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x397e880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1894 [0080.899] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f52c2d5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f52c2d5, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f52c2d5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xbdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-256_altform-unplated_contrast-white.png", cAlternateFileName="")) returned 1 [0080.899] wcscmp (_String1="GetStartedAppList.targetsize-256_altform-unplated_contrast-white.png", _String2=".") returned 1 [0080.899] wcscmp (_String1="GetStartedAppList.targetsize-256_altform-unplated_contrast-white.png", _String2="..") returned 1 [0080.899] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x132) returned 0x397e9c0 [0080.899] wcscpy (in: _Dest=0x397e9c0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0080.899] wcscat (in: _Dest=0x397e9c0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0080.899] wcscat (in: _Dest=0x397e9c0, _Source="GetStartedAppList.targetsize-256_altform-unplated_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_altform-unplated_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_altform-unplated_contrast-white.png" [0080.899] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x397e9c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1898 [0080.900] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f52c2d5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f52c2d5, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f52c2d5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xba1, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-256_contrast-black.png", cAlternateFileName="")) returned 1 [0080.900] wcscmp (_String1="GetStartedAppList.targetsize-256_contrast-black.png", _String2=".") returned 1 [0080.900] wcscmp (_String1="GetStartedAppList.targetsize-256_contrast-black.png", _String2="..") returned 1 [0080.900] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x110) returned 0x5ba99a8 [0080.900] wcscpy (in: _Dest=0x5ba99a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0080.900] wcscat (in: _Dest=0x5ba99a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0080.900] wcscat (in: _Dest=0x5ba99a8, _Source="GetStartedAppList.targetsize-256_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_contrast-black.png" [0080.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba99a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x189c [0080.901] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f52c2d5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f552554, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f552554, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xbdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-256_contrast-white.png", cAlternateFileName="")) returned 1 [0080.901] wcscmp (_String1="GetStartedAppList.targetsize-256_contrast-white.png", _String2=".") returned 1 [0080.901] wcscmp (_String1="GetStartedAppList.targetsize-256_contrast-white.png", _String2="..") returned 1 [0080.901] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x110) returned 0x5ba9ac0 [0080.901] wcscpy (in: _Dest=0x5ba9ac0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0080.901] wcscat (in: _Dest=0x5ba9ac0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0080.901] wcscat (in: _Dest=0x5ba9ac0, _Source="GetStartedAppList.targetsize-256_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_contrast-white.png" [0080.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba9ac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a0 [0080.902] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f552554, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f552554, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f552554, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-30.png", cAlternateFileName="")) returned 1 [0080.902] wcscmp (_String1="GetStartedAppList.targetsize-30.png", _String2=".") returned 1 [0080.902] wcscmp (_String1="GetStartedAppList.targetsize-30.png", _String2="..") returned 1 [0080.902] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x72864b8 [0080.902] wcscpy (in: _Dest=0x72864b8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0080.902] wcscat (in: _Dest=0x72864b8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0080.902] wcscat (in: _Dest=0x72864b8, _Source="GetStartedAppList.targetsize-30.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30.png" [0080.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x72864b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a4 [0080.903] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f552554, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f552554, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f552554, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-30_altform-unplated.png", cAlternateFileName="")) returned 1 [0080.903] wcscmp (_String1="GetStartedAppList.targetsize-30_altform-unplated.png", _String2=".") returned 1 [0080.903] wcscmp (_String1="GetStartedAppList.targetsize-30_altform-unplated.png", _String2="..") returned 1 [0080.903] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x7585670 [0080.903] wcscpy (in: _Dest=0x7585670, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0080.903] wcscat (in: _Dest=0x7585670, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0080.903] wcscat (in: _Dest=0x7585670, _Source="GetStartedAppList.targetsize-30_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_altform-unplated.png" [0080.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7585670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a8 [0080.903] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f552554, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f552554, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f552554, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-30_altform-unplated_contrast-black.png", cAlternateFileName="")) returned 1 [0080.903] wcscmp (_String1="GetStartedAppList.targetsize-30_altform-unplated_contrast-black.png", _String2=".") returned 1 [0080.903] wcscmp (_String1="GetStartedAppList.targetsize-30_altform-unplated_contrast-black.png", _String2="..") returned 1 [0080.903] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x130) returned 0x7586688 [0080.904] wcscpy (in: _Dest=0x7586688, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0080.904] wcscat (in: _Dest=0x7586688, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0080.904] wcscat (in: _Dest=0x7586688, _Source="GetStartedAppList.targetsize-30_altform-unplated_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_altform-unplated_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_altform-unplated_contrast-black.png" [0080.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7586688, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18ac [0080.904] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f5787ad, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f5787ad, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f5787ad, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x113, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-30_altform-unplated_contrast-white.png", cAlternateFileName="")) returned 1 [0080.904] wcscmp (_String1="GetStartedAppList.targetsize-30_altform-unplated_contrast-white.png", _String2=".") returned 1 [0080.904] wcscmp (_String1="GetStartedAppList.targetsize-30_altform-unplated_contrast-white.png", _String2="..") returned 1 [0080.904] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x130) returned 0x7586ca0 [0080.904] wcscpy (in: _Dest=0x7586ca0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0080.904] wcscat (in: _Dest=0x7586ca0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0080.904] wcscat (in: _Dest=0x7586ca0, _Source="GetStartedAppList.targetsize-30_altform-unplated_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_altform-unplated_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_altform-unplated_contrast-white.png" [0080.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7586ca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b0 [0080.905] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f5787ad, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f5787ad, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f5787ad, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-30_contrast-black.png", cAlternateFileName="")) returned 1 [0080.905] wcscmp (_String1="GetStartedAppList.targetsize-30_contrast-black.png", _String2=".") returned 1 [0080.905] wcscmp (_String1="GetStartedAppList.targetsize-30_contrast-black.png", _String2="..") returned 1 [0080.905] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x7589ad8 [0089.227] wcscpy (in: _Dest=0x7589ad8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.227] wcscat (in: _Dest=0x7589ad8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.227] wcscat (in: _Dest=0x7589ad8, _Source="GetStartedAppList.targetsize-30_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_contrast-black.png" [0089.227] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7589ad8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c0 [0089.228] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f5787ad, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f5787ad, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f5787ad, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x113, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-30_contrast-white.png", cAlternateFileName="")) returned 1 [0089.228] wcscmp (_String1="GetStartedAppList.targetsize-30_contrast-white.png", _String2=".") returned 1 [0089.228] wcscmp (_String1="GetStartedAppList.targetsize-30_contrast-white.png", _String2="..") returned 1 [0089.228] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x7588ed0 [0089.228] wcscpy (in: _Dest=0x7588ed0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.228] wcscat (in: _Dest=0x7588ed0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.228] wcscat (in: _Dest=0x7588ed0, _Source="GetStartedAppList.targetsize-30_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_contrast-white.png" [0089.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7588ed0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20a8 [0089.228] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f5787ad, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f5787ad, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f5787ad, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x177, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-32.png", cAlternateFileName="")) returned 1 [0089.228] wcscmp (_String1="GetStartedAppList.targetsize-32.png", _String2=".") returned 1 [0089.229] wcscmp (_String1="GetStartedAppList.targetsize-32.png", _String2="..") returned 1 [0089.229] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x393e610 [0089.229] wcscpy (in: _Dest=0x393e610, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.229] wcscat (in: _Dest=0x393e610, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.229] wcscat (in: _Dest=0x393e610, _Source="GetStartedAppList.targetsize-32.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32.png" [0089.229] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x393e610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1768 [0089.229] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f59ea0b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f59ea0b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f59ea0b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x177, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-32_altform-unplated.png", cAlternateFileName="")) returned 1 [0089.229] wcscmp (_String1="GetStartedAppList.targetsize-32_altform-unplated.png", _String2=".") returned 1 [0089.229] wcscmp (_String1="GetStartedAppList.targetsize-32_altform-unplated.png", _String2="..") returned 1 [0089.229] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x75859e8 [0089.229] wcscpy (in: _Dest=0x75859e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.229] wcscat (in: _Dest=0x75859e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.229] wcscat (in: _Dest=0x75859e8, _Source="GetStartedAppList.targetsize-32_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_altform-unplated.png" [0089.230] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x75859e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1378 [0089.230] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f59ea0b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f5f1c49, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f5f1c49, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x177, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-32_altform-unplated_contrast-black.png", cAlternateFileName="")) returned 1 [0089.230] wcscmp (_String1="GetStartedAppList.targetsize-32_altform-unplated_contrast-black.png", _String2=".") returned 1 [0089.230] wcscmp (_String1="GetStartedAppList.targetsize-32_altform-unplated_contrast-black.png", _String2="..") returned 1 [0089.230] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x130) returned 0x74e0fc8 [0089.230] wcscpy (in: _Dest=0x74e0fc8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.230] wcscat (in: _Dest=0x74e0fc8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.230] wcscat (in: _Dest=0x74e0fc8, _Source="GetStartedAppList.targetsize-32_altform-unplated_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_altform-unplated_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_altform-unplated_contrast-black.png" [0089.230] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e0fc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16fc [0089.231] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f5f1c49, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f5f1c49, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f5f1c49, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-32_altform-unplated_contrast-white.png", cAlternateFileName="")) returned 1 [0089.231] wcscmp (_String1="GetStartedAppList.targetsize-32_altform-unplated_contrast-white.png", _String2=".") returned 1 [0089.231] wcscmp (_String1="GetStartedAppList.targetsize-32_altform-unplated_contrast-white.png", _String2="..") returned 1 [0089.231] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x130) returned 0x74e04d0 [0089.231] wcscpy (in: _Dest=0x74e04d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.231] wcscat (in: _Dest=0x74e04d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.231] wcscat (in: _Dest=0x74e04d0, _Source="GetStartedAppList.targetsize-32_altform-unplated_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_altform-unplated_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_altform-unplated_contrast-white.png" [0089.231] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e04d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16f8 [0089.232] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f617ecd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f617ecd, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f617ecd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x177, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-32_contrast-black.png", cAlternateFileName="")) returned 1 [0089.232] wcscmp (_String1="GetStartedAppList.targetsize-32_contrast-black.png", _String2=".") returned 1 [0089.232] wcscmp (_String1="GetStartedAppList.targetsize-32_contrast-black.png", _String2="..") returned 1 [0089.232] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x7589e20 [0089.232] wcscpy (in: _Dest=0x7589e20, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.232] wcscat (in: _Dest=0x7589e20, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.232] wcscat (in: _Dest=0x7589e20, _Source="GetStartedAppList.targetsize-32_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_contrast-black.png" [0089.232] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7589e20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13bc [0089.233] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f617ecd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f617ecd, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f617ecd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-32_contrast-white.png", cAlternateFileName="")) returned 1 [0089.233] wcscmp (_String1="GetStartedAppList.targetsize-32_contrast-white.png", _String2=".") returned 1 [0089.233] wcscmp (_String1="GetStartedAppList.targetsize-32_contrast-white.png", _String2="..") returned 1 [0089.233] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x7589100 [0089.233] wcscpy (in: _Dest=0x7589100, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.233] wcscat (in: _Dest=0x7589100, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.233] wcscat (in: _Dest=0x7589100, _Source="GetStartedAppList.targetsize-32_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_contrast-white.png" [0089.233] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7589100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16f4 [0089.234] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f617ecd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f617ecd, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f617ecd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-36.png", cAlternateFileName="")) returned 1 [0089.235] wcscmp (_String1="GetStartedAppList.targetsize-36.png", _String2=".") returned 1 [0089.235] wcscmp (_String1="GetStartedAppList.targetsize-36.png", _String2="..") returned 1 [0089.235] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x393e518 [0089.235] wcscpy (in: _Dest=0x393e518, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.235] wcscat (in: _Dest=0x393e518, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.235] wcscat (in: _Dest=0x393e518, _Source="GetStartedAppList.targetsize-36.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36.png" [0089.235] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x393e518, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16f0 [0089.235] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f63e12b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f63e12b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f63e12b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-36_altform-unplated.png", cAlternateFileName="")) returned 1 [0089.236] wcscmp (_String1="GetStartedAppList.targetsize-36_altform-unplated.png", _String2=".") returned 1 [0089.236] wcscmp (_String1="GetStartedAppList.targetsize-36_altform-unplated.png", _String2="..") returned 1 [0089.236] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x7585b10 [0089.236] wcscpy (in: _Dest=0x7585b10, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.236] wcscat (in: _Dest=0x7585b10, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.236] wcscat (in: _Dest=0x7585b10, _Source="GetStartedAppList.targetsize-36_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_altform-unplated.png" [0089.236] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7585b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16ec [0089.236] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f63e12b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f63e12b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f63e12b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-36_altform-unplated_contrast-black.png", cAlternateFileName="")) returned 1 [0089.236] wcscmp (_String1="GetStartedAppList.targetsize-36_altform-unplated_contrast-black.png", _String2=".") returned 1 [0089.236] wcscmp (_String1="GetStartedAppList.targetsize-36_altform-unplated_contrast-black.png", _String2="..") returned 1 [0089.237] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x130) returned 0x74df8a0 [0089.237] wcscpy (in: _Dest=0x74df8a0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.237] wcscat (in: _Dest=0x74df8a0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.237] wcscat (in: _Dest=0x74df8a0, _Source="GetStartedAppList.targetsize-36_altform-unplated_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_altform-unplated_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_altform-unplated_contrast-black.png" [0089.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74df8a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16e8 [0089.237] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f63e12b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f63e12b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f63e12b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-36_altform-unplated_contrast-white.png", cAlternateFileName="")) returned 1 [0089.237] wcscmp (_String1="GetStartedAppList.targetsize-36_altform-unplated_contrast-white.png", _String2=".") returned 1 [0089.237] wcscmp (_String1="GetStartedAppList.targetsize-36_altform-unplated_contrast-white.png", _String2="..") returned 1 [0089.237] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x130) returned 0x74dfb10 [0089.237] wcscpy (in: _Dest=0x74dfb10, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.237] wcscat (in: _Dest=0x74dfb10, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.237] wcscat (in: _Dest=0x74dfb10, _Source="GetStartedAppList.targetsize-36_altform-unplated_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_altform-unplated_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_altform-unplated_contrast-white.png" [0089.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74dfb10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16e4 [0089.238] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f63e12b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f63e12b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f63e12b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-36_contrast-black.png", cAlternateFileName="")) returned 1 [0089.238] wcscmp (_String1="GetStartedAppList.targetsize-36_contrast-black.png", _String2=".") returned 1 [0089.238] wcscmp (_String1="GetStartedAppList.targetsize-36_contrast-black.png", _String2="..") returned 1 [0089.238] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x7588ca0 [0089.238] wcscpy (in: _Dest=0x7588ca0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.238] wcscat (in: _Dest=0x7588ca0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.238] wcscat (in: _Dest=0x7588ca0, _Source="GetStartedAppList.targetsize-36_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_contrast-black.png" [0089.238] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7588ca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16e0 [0089.239] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f664388, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f664388, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f664388, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-36_contrast-white.png", cAlternateFileName="")) returned 1 [0089.239] wcscmp (_String1="GetStartedAppList.targetsize-36_contrast-white.png", _String2=".") returned 1 [0089.239] wcscmp (_String1="GetStartedAppList.targetsize-36_contrast-white.png", _String2="..") returned 1 [0089.239] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x7589bf0 [0089.239] wcscpy (in: _Dest=0x7589bf0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.239] wcscat (in: _Dest=0x7589bf0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.239] wcscat (in: _Dest=0x7589bf0, _Source="GetStartedAppList.targetsize-36_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_contrast-white.png" [0089.239] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7589bf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16dc [0089.240] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f68a5dd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f68a5dd, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f68a5dd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-40.png", cAlternateFileName="")) returned 1 [0089.240] wcscmp (_String1="GetStartedAppList.targetsize-40.png", _String2=".") returned 1 [0089.240] wcscmp (_String1="GetStartedAppList.targetsize-40.png", _String2="..") returned 1 [0089.240] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x393e708 [0089.240] wcscpy (in: _Dest=0x393e708, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.240] wcscat (in: _Dest=0x393e708, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.240] wcscat (in: _Dest=0x393e708, _Source="GetStartedAppList.targetsize-40.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40.png" [0089.240] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x393e708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d8 [0089.241] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f68a5dd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f6b083b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f6b083b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-40_altform-unplated.png", cAlternateFileName="")) returned 1 [0089.241] wcscmp (_String1="GetStartedAppList.targetsize-40_altform-unplated.png", _String2=".") returned 1 [0089.241] wcscmp (_String1="GetStartedAppList.targetsize-40_altform-unplated.png", _String2="..") returned 1 [0089.241] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x7585c38 [0089.241] wcscpy (in: _Dest=0x7585c38, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.241] wcscat (in: _Dest=0x7585c38, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.241] wcscat (in: _Dest=0x7585c38, _Source="GetStartedAppList.targetsize-40_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_altform-unplated.png" [0089.241] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7585c38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d4 [0089.242] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f6b083b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f6b083b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f6b083b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-40_altform-unplated_contrast-black.png", cAlternateFileName="")) returned 1 [0089.242] wcscmp (_String1="GetStartedAppList.targetsize-40_altform-unplated_contrast-black.png", _String2=".") returned 1 [0089.242] wcscmp (_String1="GetStartedAppList.targetsize-40_altform-unplated_contrast-black.png", _String2="..") returned 1 [0089.242] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x130) returned 0x74df9d8 [0089.242] wcscpy (in: _Dest=0x74df9d8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.242] wcscat (in: _Dest=0x74df9d8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.242] wcscat (in: _Dest=0x74df9d8, _Source="GetStartedAppList.targetsize-40_altform-unplated_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_altform-unplated_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_altform-unplated_contrast-black.png" [0089.242] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74df9d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d0 [0089.242] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f6b083b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f6b083b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f6b083b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-40_altform-unplated_contrast-white.png", cAlternateFileName="")) returned 1 [0089.242] wcscmp (_String1="GetStartedAppList.targetsize-40_altform-unplated_contrast-white.png", _String2=".") returned 1 [0089.242] wcscmp (_String1="GetStartedAppList.targetsize-40_altform-unplated_contrast-white.png", _String2="..") returned 1 [0089.242] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x130) returned 0x74df630 [0089.243] wcscpy (in: _Dest=0x74df630, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.243] wcscat (in: _Dest=0x74df630, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.243] wcscat (in: _Dest=0x74df630, _Source="GetStartedAppList.targetsize-40_altform-unplated_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_altform-unplated_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_altform-unplated_contrast-white.png" [0089.243] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74df630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16cc [0089.243] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f6b083b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f6b083b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f6b083b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-40_contrast-black.png", cAlternateFileName="")) returned 1 [0089.243] wcscmp (_String1="GetStartedAppList.targetsize-40_contrast-black.png", _String2=".") returned 1 [0089.243] wcscmp (_String1="GetStartedAppList.targetsize-40_contrast-black.png", _String2="..") returned 1 [0089.243] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x7589330 [0089.243] wcscpy (in: _Dest=0x7589330, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.243] wcscat (in: _Dest=0x7589330, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.244] wcscat (in: _Dest=0x7589330, _Source="GetStartedAppList.targetsize-40_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_contrast-black.png" [0089.244] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7589330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c8 [0089.244] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f6d6a94, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f6d6a94, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f6d6a94, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-40_contrast-white.png", cAlternateFileName="")) returned 1 [0089.244] wcscmp (_String1="GetStartedAppList.targetsize-40_contrast-white.png", _String2=".") returned 1 [0089.244] wcscmp (_String1="GetStartedAppList.targetsize-40_contrast-white.png", _String2="..") returned 1 [0089.244] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x7589678 [0089.244] wcscpy (in: _Dest=0x7589678, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.244] wcscat (in: _Dest=0x7589678, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.244] wcscat (in: _Dest=0x7589678, _Source="GetStartedAppList.targetsize-40_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_contrast-white.png" [0089.244] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7589678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c4 [0089.245] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f6d6a94, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f6d6a94, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f6d6a94, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-48.png", cAlternateFileName="")) returned 1 [0089.245] wcscmp (_String1="GetStartedAppList.targetsize-48.png", _String2=".") returned 1 [0089.245] wcscmp (_String1="GetStartedAppList.targetsize-48.png", _String2="..") returned 1 [0089.245] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x393f3a0 [0089.245] wcscpy (in: _Dest=0x393f3a0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.245] wcscat (in: _Dest=0x393f3a0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.245] wcscat (in: _Dest=0x393f3a0, _Source="GetStartedAppList.targetsize-48.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48.png" [0089.245] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x393f3a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c0 [0089.246] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f6d6a94, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f6d6a94, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f6d6a94, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-48_altform-unplated.png", cAlternateFileName="")) returned 1 [0089.246] wcscmp (_String1="GetStartedAppList.targetsize-48_altform-unplated.png", _String2=".") returned 1 [0089.246] wcscmp (_String1="GetStartedAppList.targetsize-48_altform-unplated.png", _String2="..") returned 1 [0089.246] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x7585d60 [0089.246] wcscpy (in: _Dest=0x7585d60, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.246] wcscat (in: _Dest=0x7585d60, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.246] wcscat (in: _Dest=0x7585d60, _Source="GetStartedAppList.targetsize-48_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_altform-unplated.png" [0089.246] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7585d60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c0 [0089.247] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f6fccee, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f6fccee, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f6fccee, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-48_altform-unplated_contrast-black.png", cAlternateFileName="")) returned 1 [0089.247] wcscmp (_String1="GetStartedAppList.targetsize-48_altform-unplated_contrast-black.png", _String2=".") returned 1 [0089.247] wcscmp (_String1="GetStartedAppList.targetsize-48_altform-unplated_contrast-black.png", _String2="..") returned 1 [0089.247] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x130) returned 0x74df768 [0089.247] wcscpy (in: _Dest=0x74df768, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.247] wcscat (in: _Dest=0x74df768, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.247] wcscat (in: _Dest=0x74df768, _Source="GetStartedAppList.targetsize-48_altform-unplated_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_altform-unplated_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_altform-unplated_contrast-black.png" [0089.247] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74df768, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16bc [0089.248] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f6fccee, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f6fccee, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f6fccee, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x23b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-48_altform-unplated_contrast-white.png", cAlternateFileName="")) returned 1 [0089.248] wcscmp (_String1="GetStartedAppList.targetsize-48_altform-unplated_contrast-white.png", _String2=".") returned 1 [0089.248] wcscmp (_String1="GetStartedAppList.targetsize-48_altform-unplated_contrast-white.png", _String2="..") returned 1 [0089.248] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x130) returned 0x74e0d58 [0089.248] wcscpy (in: _Dest=0x74e0d58, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.248] wcscat (in: _Dest=0x74e0d58, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.248] wcscat (in: _Dest=0x74e0d58, _Source="GetStartedAppList.targetsize-48_altform-unplated_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_altform-unplated_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_altform-unplated_contrast-white.png" [0089.248] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e0d58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b8 [0089.249] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f6fccee, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f6fccee, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f6fccee, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-48_contrast-black.png", cAlternateFileName="")) returned 1 [0089.249] wcscmp (_String1="GetStartedAppList.targetsize-48_contrast-black.png", _String2=".") returned 1 [0089.249] wcscmp (_String1="GetStartedAppList.targetsize-48_contrast-black.png", _String2="..") returned 1 [0089.249] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x7588db8 [0089.249] wcscpy (in: _Dest=0x7588db8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.249] wcscat (in: _Dest=0x7588db8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.249] wcscat (in: _Dest=0x7588db8, _Source="GetStartedAppList.targetsize-48_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_contrast-black.png" [0089.249] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7588db8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c4 [0089.250] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f6fccee, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f6fccee, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f6fccee, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x23b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-48_contrast-white.png", cAlternateFileName="")) returned 1 [0089.250] wcscmp (_String1="GetStartedAppList.targetsize-48_contrast-white.png", _String2=".") returned 1 [0089.250] wcscmp (_String1="GetStartedAppList.targetsize-48_contrast-white.png", _String2="..") returned 1 [0089.250] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x758a050 [0089.250] wcscpy (in: _Dest=0x758a050, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.250] wcscat (in: _Dest=0x758a050, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.250] wcscat (in: _Dest=0x758a050, _Source="GetStartedAppList.targetsize-48_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_contrast-white.png" [0089.250] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x758a050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b4 [0089.251] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f722f4b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f74f7c1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f74f7c1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-60.png", cAlternateFileName="")) returned 1 [0089.251] wcscmp (_String1="GetStartedAppList.targetsize-60.png", _String2=".") returned 1 [0089.251] wcscmp (_String1="GetStartedAppList.targetsize-60.png", _String2="..") returned 1 [0089.251] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x393f498 [0089.251] wcscpy (in: _Dest=0x393f498, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.251] wcscat (in: _Dest=0x393f498, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.251] wcscat (in: _Dest=0x393f498, _Source="GetStartedAppList.targetsize-60.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60.png" [0089.251] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x393f498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b0 [0089.252] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f74f7c1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f74f7c1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f74f7c1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-60_altform-unplated.png", cAlternateFileName="")) returned 1 [0089.252] wcscmp (_String1="GetStartedAppList.targetsize-60_altform-unplated.png", _String2=".") returned 1 [0089.252] wcscmp (_String1="GetStartedAppList.targetsize-60_altform-unplated.png", _String2="..") returned 1 [0089.252] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x7585e88 [0089.252] wcscpy (in: _Dest=0x7585e88, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.252] wcscat (in: _Dest=0x7585e88, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.252] wcscat (in: _Dest=0x7585e88, _Source="GetStartedAppList.targetsize-60_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_altform-unplated.png" [0089.252] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7585e88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16ac [0089.253] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f74f7c1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f74f7c1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f74f7c1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-60_altform-unplated_contrast-black.png", cAlternateFileName="")) returned 1 [0089.254] wcscmp (_String1="GetStartedAppList.targetsize-60_altform-unplated_contrast-black.png", _String2=".") returned 1 [0089.254] wcscmp (_String1="GetStartedAppList.targetsize-60_altform-unplated_contrast-black.png", _String2="..") returned 1 [0089.254] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x130) returned 0x74dfc48 [0089.254] wcscpy (in: _Dest=0x74dfc48, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.254] wcscat (in: _Dest=0x74dfc48, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.254] wcscat (in: _Dest=0x74dfc48, _Source="GetStartedAppList.targetsize-60_altform-unplated_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_altform-unplated_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_altform-unplated_contrast-black.png" [0089.254] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74dfc48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16a8 [0089.254] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f775a1a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f775a1a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f775a1a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-60_altform-unplated_contrast-white.png", cAlternateFileName="")) returned 1 [0089.254] wcscmp (_String1="GetStartedAppList.targetsize-60_altform-unplated_contrast-white.png", _String2=".") returned 1 [0089.254] wcscmp (_String1="GetStartedAppList.targetsize-60_altform-unplated_contrast-white.png", _String2="..") returned 1 [0089.254] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x130) returned 0x74e0878 [0089.254] wcscpy (in: _Dest=0x74e0878, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.255] wcscat (in: _Dest=0x74e0878, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.255] wcscat (in: _Dest=0x74e0878, _Source="GetStartedAppList.targetsize-60_altform-unplated_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_altform-unplated_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_altform-unplated_contrast-white.png" [0089.255] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e0878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16a4 [0089.255] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f775a1a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f775a1a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f775a1a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-60_contrast-black.png", cAlternateFileName="")) returned 1 [0089.255] wcscmp (_String1="GetStartedAppList.targetsize-60_contrast-black.png", _String2=".") returned 1 [0089.255] wcscmp (_String1="GetStartedAppList.targetsize-60_contrast-black.png", _String2="..") returned 1 [0089.255] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x7588958 [0089.255] wcscpy (in: _Dest=0x7588958, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.255] wcscat (in: _Dest=0x7588958, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.255] wcscat (in: _Dest=0x7588958, _Source="GetStartedAppList.targetsize-60_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_contrast-black.png" [0089.256] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7588958, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c8 [0089.256] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f775a1a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f775a1a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f775a1a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-60_contrast-white.png", cAlternateFileName="")) returned 1 [0089.256] wcscmp (_String1="GetStartedAppList.targetsize-60_contrast-white.png", _String2=".") returned 1 [0089.256] wcscmp (_String1="GetStartedAppList.targetsize-60_contrast-white.png", _String2="..") returned 1 [0089.256] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x7589790 [0089.256] wcscpy (in: _Dest=0x7589790, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.256] wcscat (in: _Dest=0x7589790, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.256] wcscat (in: _Dest=0x7589790, _Source="GetStartedAppList.targetsize-60_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_contrast-white.png" [0089.256] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7589790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16a0 [0089.257] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f79bc78, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f79bc78, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f79bc78, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-64.png", cAlternateFileName="")) returned 1 [0089.257] wcscmp (_String1="GetStartedAppList.targetsize-64.png", _String2=".") returned 1 [0089.257] wcscmp (_String1="GetStartedAppList.targetsize-64.png", _String2="..") returned 1 [0089.257] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x393d690 [0089.257] wcscpy (in: _Dest=0x393d690, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.257] wcscat (in: _Dest=0x393d690, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.257] wcscat (in: _Dest=0x393d690, _Source="GetStartedAppList.targetsize-64.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64.png" [0089.257] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x393d690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x169c [0089.258] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f79bc78, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f79bc78, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f79bc78, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-64_altform-unplated.png", cAlternateFileName="")) returned 1 [0089.258] wcscmp (_String1="GetStartedAppList.targetsize-64_altform-unplated.png", _String2=".") returned 1 [0089.258] wcscmp (_String1="GetStartedAppList.targetsize-64_altform-unplated.png", _String2="..") returned 1 [0089.258] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x7585fb0 [0089.258] wcscpy (in: _Dest=0x7585fb0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.258] wcscat (in: _Dest=0x7585fb0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.258] wcscat (in: _Dest=0x7585fb0, _Source="GetStartedAppList.targetsize-64_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_altform-unplated.png" [0089.258] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7585fb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1698 [0089.259] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f79bc78, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f79bc78, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f79bc78, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-64_altform-unplated_contrast-black.png", cAlternateFileName="")) returned 1 [0089.259] wcscmp (_String1="GetStartedAppList.targetsize-64_altform-unplated_contrast-black.png", _String2=".") returned 1 [0089.259] wcscmp (_String1="GetStartedAppList.targetsize-64_altform-unplated_contrast-black.png", _String2="..") returned 1 [0089.259] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x130) returned 0x74e0260 [0089.259] wcscpy (in: _Dest=0x74e0260, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.259] wcscat (in: _Dest=0x74e0260, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.259] wcscat (in: _Dest=0x74e0260, _Source="GetStartedAppList.targetsize-64_altform-unplated_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_altform-unplated_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_altform-unplated_contrast-black.png" [0089.259] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e0260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1694 [0089.260] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f7c1ed1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f7c1ed1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f7c1ed1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-64_altform-unplated_contrast-white.png", cAlternateFileName="")) returned 1 [0089.260] wcscmp (_String1="GetStartedAppList.targetsize-64_altform-unplated_contrast-white.png", _String2=".") returned 1 [0089.260] wcscmp (_String1="GetStartedAppList.targetsize-64_altform-unplated_contrast-white.png", _String2="..") returned 1 [0089.260] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x130) returned 0x74dfd80 [0089.260] wcscpy (in: _Dest=0x74dfd80, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.260] wcscat (in: _Dest=0x74dfd80, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.260] wcscat (in: _Dest=0x74dfd80, _Source="GetStartedAppList.targetsize-64_altform-unplated_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_altform-unplated_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_altform-unplated_contrast-white.png" [0089.260] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74dfd80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1690 [0089.261] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f7c1ed1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f7c1ed1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f7c1ed1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-64_contrast-black.png", cAlternateFileName="")) returned 1 [0089.261] wcscmp (_String1="GetStartedAppList.targetsize-64_contrast-black.png", _String2=".") returned 1 [0089.261] wcscmp (_String1="GetStartedAppList.targetsize-64_contrast-black.png", _String2="..") returned 1 [0089.261] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x7588a70 [0089.261] wcscpy (in: _Dest=0x7588a70, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.261] wcscat (in: _Dest=0x7588a70, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.261] wcscat (in: _Dest=0x7588a70, _Source="GetStartedAppList.targetsize-64_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_contrast-black.png" [0089.261] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7588a70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13cc [0089.261] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f7c1ed1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f7c1ed1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f7c1ed1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-64_contrast-white.png", cAlternateFileName="")) returned 1 [0089.262] wcscmp (_String1="GetStartedAppList.targetsize-64_contrast-white.png", _String2=".") returned 1 [0089.262] wcscmp (_String1="GetStartedAppList.targetsize-64_contrast-white.png", _String2="..") returned 1 [0089.262] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x75881b0 [0089.262] wcscpy (in: _Dest=0x75881b0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.262] wcscat (in: _Dest=0x75881b0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.262] wcscat (in: _Dest=0x75881b0, _Source="GetStartedAppList.targetsize-64_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_contrast-white.png" [0089.262] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x75881b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x168c [0089.262] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f7c1ed1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f7c1ed1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f7c1ed1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x20d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-72.png", cAlternateFileName="")) returned 1 [0089.262] wcscmp (_String1="GetStartedAppList.targetsize-72.png", _String2=".") returned 1 [0089.262] wcscmp (_String1="GetStartedAppList.targetsize-72.png", _String2="..") returned 1 [0089.263] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x54500d0 [0089.263] wcscpy (in: _Dest=0x54500d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.263] wcscat (in: _Dest=0x54500d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.263] wcscat (in: _Dest=0x54500d0, _Source="GetStartedAppList.targetsize-72.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72.png" [0089.263] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54500d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1688 [0089.263] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f7e812b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f7e812b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f7e812b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x20d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-72_altform-unplated.png", cAlternateFileName="")) returned 1 [0089.263] wcscmp (_String1="GetStartedAppList.targetsize-72_altform-unplated.png", _String2=".") returned 1 [0089.263] wcscmp (_String1="GetStartedAppList.targetsize-72_altform-unplated.png", _String2="..") returned 1 [0089.263] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x75841a0 [0089.263] wcscpy (in: _Dest=0x75841a0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0089.263] wcscat (in: _Dest=0x75841a0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0089.263] wcscat (in: _Dest=0x75841a0, _Source="GetStartedAppList.targetsize-72_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72_altform-unplated.png" [0089.264] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x75841a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1684 [0089.264] FindNextFileW (in: hFindFile=0x5444d80, lpFindFileData=0x53f6ba8 | out: lpFindFileData=0x53f6ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f7e812b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f7e812b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f7e812b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x20d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-72_altform-unplated_contrast-black.png", cAlternateFileName="")) returned 1 [0091.941] wcscmp (_String1="GetStartedAppList.targetsize-72_altform-unplated_contrast-black.png", _String2=".") returned 1 [0091.941] wcscmp (_String1="GetStartedAppList.targetsize-72_altform-unplated_contrast-black.png", _String2="..") returned 1 [0091.941] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x130) returned 0x5ba9378 [0091.941] wcscpy (in: _Dest=0x5ba9378, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets" [0091.941] wcscat (in: _Dest=0x5ba9378, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\" [0091.941] wcscat (in: _Dest=0x5ba9378, _Source="GetStartedAppList.targetsize-72_altform-unplated_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72_altform-unplated_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72_altform-unplated_contrast-black.png" Thread: id = 757 os_tid = 0x1b00 [0077.975] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xae) returned 0x55c8448 [0077.975] wcscpy (in: _Dest=0x55c8448, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content" [0077.975] wcscat (in: _Dest=0x55c8448, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\" [0077.975] wcscat (in: _Dest=0x55c8448, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\*" [0077.975] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f31e8 [0077.975] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\*", lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f8f31a9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c0da4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ee00 [0084.643] wcscmp (_String1=".", _String2=".") returned 0 [0084.643] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f8f31a9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c0da4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.643] wcscmp (_String1="..", _String2=".") returned 1 [0084.643] wcscmp (_String1="..", _String2="..") returned 0 [0084.643] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f8f31a9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c1a05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f919407, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop", cAlternateFileName="")) returned 1 [0084.643] wcscmp (_String1="desktop", _String2=".") returned 1 [0084.643] wcscmp (_String1="desktop", _String2="..") returned 1 [0084.643] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x53fa578 [0084.643] wcscpy (in: _Dest=0x53fa578, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content" [0084.643] wcscat (in: _Dest=0x53fa578, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\" [0084.643] wcscat (in: _Dest=0x53fa578, _Source="desktop" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop" [0084.643] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53fa578, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf94 [0084.644] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9658ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c2a52, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9658ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="holoLens", cAlternateFileName="")) returned 1 [0084.644] wcscmp (_String1="holoLens", _String2=".") returned 1 [0084.644] wcscmp (_String1="holoLens", _String2="..") returned 1 [0084.644] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x53fa000 [0084.644] wcscpy (in: _Dest=0x53fa000, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content" [0084.644] wcscat (in: _Dest=0x53fa000, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\" [0084.644] wcscat (in: _Dest=0x53fa000, _Source="holoLens" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\holoLens") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\holoLens" [0084.644] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53fa000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf90 [0084.645] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9658ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c3363, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9658ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0084.645] wcscmp (_String1="images", _String2=".") returned 1 [0084.645] wcscmp (_String1="images", _String2="..") returned 1 [0084.645] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb8) returned 0x5b16c10 [0084.645] wcscpy (in: _Dest=0x5b16c10, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content" [0084.645] wcscat (in: _Dest=0x5b16c10, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\" [0084.645] wcscat (in: _Dest=0x5b16c10, _Source="images" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\images") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\images" [0084.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5b16c10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8c [0084.646] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c4278, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mobile", cAlternateFileName="")) returned 1 [0084.646] wcscmp (_String1="mobile", _String2=".") returned 1 [0084.646] wcscmp (_String1="mobile", _String2="..") returned 1 [0084.646] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb8) returned 0x5b163d0 [0084.646] wcscpy (in: _Dest=0x5b163d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content" [0084.646] wcscat (in: _Dest=0x5b163d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\" [0084.646] wcscat (in: _Dest=0x5b163d0, _Source="mobile" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\mobile") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\mobile" [0084.647] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5b163d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc8c [0084.647] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c57e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9fe269, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="surfaceHub", cAlternateFileName="SURFAC~1")) returned 1 [0084.647] wcscmp (_String1="surfaceHub", _String2=".") returned 1 [0084.647] wcscmp (_String1="surfaceHub", _String2="..") returned 1 [0084.647] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x53f8f98 [0084.647] wcscpy (in: _Dest=0x53f8f98, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content" [0084.647] wcscat (in: _Dest=0x53f8f98, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\" [0084.648] wcscat (in: _Dest=0x53f8f98, _Source="surfaceHub" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\surfaceHub") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\surfaceHub" [0084.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53f8f98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf70 [0084.648] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c57e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9fe269, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="surfaceHub", cAlternateFileName="SURFAC~1")) returned 0 [0084.648] FindClose (in: hFindFile=0x389ee00 | out: hFindFile=0x389ee00) returned 1 [0084.649] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f31e8) returned 1 [0084.649] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c8448) returned 1 [0084.649] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5446870) returned 1 Thread: id = 758 os_tid = 0x1b04 [0077.975] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Microsoft.CPub.BackgroundTasks.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\microsoft.cpub.backgroundtasks.winmd")) returned 0x20 [0084.636] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Microsoft.CPub.BackgroundTasks.winmd", dwFileAttributes=0x20) returned 0 [0084.636] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Microsoft.CPub.BackgroundTasks.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\microsoft.cpub.backgroundtasks.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.636] GetLastError () returned 0x5 [0084.636] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Microsoft.CPub.BackgroundTasks.winmd", dwFileAttributes=0x20) returned 0 [0084.637] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396ed58) returned 1 Thread: id = 759 os_tid = 0x1b08 [0077.976] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Microsoft.CPub.SkuInterop.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\microsoft.cpub.skuinterop.winmd")) returned 0x20 [0084.635] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Microsoft.CPub.SkuInterop.winmd", dwFileAttributes=0x20) returned 0 [0084.635] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Microsoft.CPub.SkuInterop.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\microsoft.cpub.skuinterop.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.635] GetLastError () returned 0x5 [0084.635] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Microsoft.CPub.SkuInterop.winmd", dwFileAttributes=0x20) returned 0 [0084.635] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f1178) returned 1 Thread: id = 760 os_tid = 0x1b0c [0077.976] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x396e8a8 [0077.976] wcscpy (in: _Dest=0x396e8a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0077.976] wcscat (in: _Dest=0x396e8a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0077.976] wcscat (in: _Dest=0x396e8a8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0077.976] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f42c0 [0077.976] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x53f42c0 | out: lpFindFileData=0x53f42c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbad69af3, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbad69af3, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad69af3, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ee00 [0084.633] wcscmp (_String1=".", _String2=".") returned 0 [0084.633] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53f42c0 | out: lpFindFileData=0x53f42c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbad69af3, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbad69af3, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad69af3, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.633] wcscmp (_String1="..", _String2=".") returned 1 [0084.633] wcscmp (_String1="..", _String2="..") returned 0 [0084.633] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53f42c0 | out: lpFindFileData=0x53f42c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbad69af3, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbad69af3, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad69af3, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0084.633] FindClose (in: hFindFile=0x389ee00 | out: hFindFile=0x389ee00) returned 1 [0084.633] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f42c0) returned 1 [0084.633] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396e8a8) returned 1 [0084.633] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f1260) returned 1 Thread: id = 761 os_tid = 0x1b10 [0077.977] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb2) returned 0x5b16c10 [0077.977] wcscpy (in: _Dest=0x5b16c10, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources" [0077.977] wcscat (in: _Dest=0x5b16c10, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\" [0077.977] wcscat (in: _Dest=0x5b16c10, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\*" [0077.977] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f4528 [0077.977] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\*", lpFindFileData=0x53f4528 | out: lpFindFileData=0x53f4528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fa4ee54, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c7513, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fa750b2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ee00 [0084.628] wcscmp (_String1=".", _String2=".") returned 0 [0084.628] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53f4528 | out: lpFindFileData=0x53f4528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fa4ee54, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c7513, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fa750b2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.628] wcscmp (_String1="..", _String2=".") returned 1 [0084.629] wcscmp (_String1="..", _String2="..") returned 0 [0084.629] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53f4528 | out: lpFindFileData=0x53f4528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa4ee54, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fa750b2, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fa750b2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2e018, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetSMDL2.ttf", cAlternateFileName="")) returned 1 [0084.629] wcscmp (_String1="GetSMDL2.ttf", _String2=".") returned 1 [0084.629] wcscmp (_String1="GetSMDL2.ttf", _String2="..") returned 1 [0084.629] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x39706d0 [0084.629] wcscpy (in: _Dest=0x39706d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources" [0084.629] wcscat (in: _Dest=0x39706d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\" [0084.629] wcscat (in: _Dest=0x39706d0, _Source="GetSMDL2.ttf" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\GetSMDL2.ttf") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\GetSMDL2.ttf" [0084.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x39706d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa4 [0084.630] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53f4528 | out: lpFindFileData=0x53f4528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fa750b2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab78e843, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fac1569, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TopicPage", cAlternateFileName="TOPICP~1")) returned 1 [0084.630] wcscmp (_String1="TopicPage", _String2=".") returned 1 [0084.630] wcscmp (_String1="TopicPage", _String2="..") returned 1 [0084.630] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x3971980 [0084.630] wcscpy (in: _Dest=0x3971980, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources" [0084.630] wcscat (in: _Dest=0x3971980, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\" [0084.630] wcscat (in: _Dest=0x3971980, _Source="TopicPage" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage" [0084.630] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3971980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410 [0084.631] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53f4528 | out: lpFindFileData=0x53f4528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fa750b2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab78e843, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fac1569, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TopicPage", cAlternateFileName="TOPICP~1")) returned 0 [0084.631] FindClose (in: hFindFile=0x389ee00 | out: hFindFile=0x389ee00) returned 1 [0084.631] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f4528) returned 1 [0084.631] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5b16c10) returned 1 [0084.631] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5446928) returned 1 Thread: id = 762 os_tid = 0x1b14 [0077.977] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\resources.pri")) returned 0x20 [0084.641] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0084.642] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.642] GetLastError () returned 0x5 [0084.642] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0084.642] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39050e0) returned 1 Thread: id = 763 os_tid = 0x1b18 [0077.978] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\StoreRatingPromotion.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\storeratingpromotion.winmd")) returned 0x20 [0084.655] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\StoreRatingPromotion.winmd", dwFileAttributes=0x20) returned 0 [0084.655] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\StoreRatingPromotion.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\storeratingpromotion.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.655] GetLastError () returned 0x5 [0084.655] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\StoreRatingPromotion.winmd", dwFileAttributes=0x20) returned 0 [0084.655] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3973910) returned 1 Thread: id = 764 os_tid = 0x1b1c [0077.978] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb4) returned 0x5b16cd0 [0077.978] wcscpy (in: _Dest=0x5b16cd0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources" [0077.978] wcscat (in: _Dest=0x5b16cd0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\" [0077.978] wcscat (in: _Dest=0x5b16cd0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\*" [0077.978] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f49f8 [0077.978] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x53f49f8 | out: lpFindFileData=0x53f49f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f0140b4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab5ed36f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f2aa2da, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ee00 [0084.638] wcscmp (_String1=".", _String2=".") returned 0 [0084.638] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53f49f8 | out: lpFindFileData=0x53f49f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f0140b4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab5ed36f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f2aa2da, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.638] wcscmp (_String1="..", _String2=".") returned 1 [0084.639] wcscmp (_String1="..", _String2="..") returned 0 [0084.639] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53f49f8 | out: lpFindFileData=0x53f49f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f0140b4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f11f133, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f11f133, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2985, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.rsrc", cAlternateFileName="")) returned 1 [0084.639] wcscmp (_String1="0.rsrc", _String2=".") returned 1 [0084.639] wcscmp (_String1="0.rsrc", _String2="..") returned 1 [0084.639] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53fa4b0 [0084.639] wcscpy (in: _Dest=0x53fa4b0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources" [0084.639] wcscat (in: _Dest=0x53fa4b0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\" [0084.639] wcscat (in: _Dest=0x53fa4b0, _Source="0.rsrc" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc" [0084.639] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53fa4b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf9c [0084.639] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53f49f8 | out: lpFindFileData=0x53f49f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f2aa2da, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f2aa2da, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f2aa2da, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xa3, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.txt", cAlternateFileName="")) returned 1 [0084.639] wcscmp (_String1="index.txt", _String2=".") returned 1 [0084.640] wcscmp (_String1="index.txt", _String2="..") returned 1 [0084.640] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x39707a0 [0084.640] wcscpy (in: _Dest=0x39707a0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources" [0084.640] wcscat (in: _Dest=0x39707a0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\" [0084.640] wcscat (in: _Dest=0x39707a0, _Source="index.txt" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt" [0084.640] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x39707a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf98 [0084.640] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53f49f8 | out: lpFindFileData=0x53f49f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f2aa2da, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f2aa2da, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f2aa2da, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xa3, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.txt", cAlternateFileName="")) returned 0 [0084.640] FindClose (in: hFindFile=0x389ee00 | out: hFindFile=0x389ee00) returned 1 [0084.641] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f49f8) returned 1 [0084.641] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5b16cd0) returned 1 [0084.641] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54469e0) returned 1 Thread: id = 765 os_tid = 0x1b20 [0077.979] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0082.106] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0082.107] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.107] GetLastError () returned 0x5 [0082.107] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0082.107] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393db68) returned 1 Thread: id = 766 os_tid = 0x1b24 [0077.980] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0084.013] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0084.013] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.013] GetLastError () returned 0x5 [0084.013] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0084.013] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393e610) returned 1 Thread: id = 767 os_tid = 0x1b28 [0077.980] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0084.014] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0084.014] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.014] GetLastError () returned 0x5 [0084.014] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0084.014] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393f1b0) returned 1 Thread: id = 768 os_tid = 0x1b2c [0077.981] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x54f1a88 [0077.981] wcscpy (in: _Dest=0x54f1a88, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0077.981] wcscat (in: _Dest=0x54f1a88, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0077.981] wcscat (in: _Dest=0x54f1a88, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\*" [0077.981] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f4ec8 [0077.981] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29a95021, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab9559ab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x29c3c6c4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444dc0 [0077.982] wcscmp (_String1=".", _String2=".") returned 0 [0077.982] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29a95021, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab9559ab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x29c3c6c4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.982] wcscmp (_String1="..", _String2=".") returned 1 [0077.982] wcscmp (_String1="..", _String2="..") returned 0 [0077.982] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29a95021, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29a95021, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29a95021, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BadgeLogo.scale-150.png", cAlternateFileName="")) returned 1 [0077.982] wcscmp (_String1="BadgeLogo.scale-150.png", _String2=".") returned 1 [0077.982] wcscmp (_String1="BadgeLogo.scale-150.png", _String2="..") returned 1 [0077.982] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x549c0b0 [0077.983] wcscpy (in: _Dest=0x549c0b0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0077.983] wcscat (in: _Dest=0x549c0b0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0077.983] wcscat (in: _Dest=0x549c0b0, _Source="BadgeLogo.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\BadgeLogo.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\BadgeLogo.scale-150.png" [0080.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549c0b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12d0 [0080.838] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29a95021, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29a95021, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29a95021, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x323, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logo.scale-150.png", cAlternateFileName="")) returned 1 [0080.838] wcscmp (_String1="Logo.scale-150.png", _String2=".") returned 1 [0080.838] wcscmp (_String1="Logo.scale-150.png", _String2="..") returned 1 [0080.838] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x7582f78 [0080.838] wcscpy (in: _Dest=0x7582f78, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.838] wcscat (in: _Dest=0x7582f78, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.838] wcscat (in: _Dest=0x7582f78, _Source="Logo.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\Logo.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\Logo.scale-150.png" [0080.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7582f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17ac [0080.839] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29a95021, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29abb27f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29abb27f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.scale-150.png", cAlternateFileName="")) returned 1 [0080.839] wcscmp (_String1="SmallLogo.scale-150.png", _String2=".") returned 1 [0080.839] wcscmp (_String1="SmallLogo.scale-150.png", _String2="..") returned 1 [0080.839] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x5ba90e8 [0080.839] wcscpy (in: _Dest=0x5ba90e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.839] wcscat (in: _Dest=0x5ba90e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.839] wcscat (in: _Dest=0x5ba90e8, _Source="SmallLogo.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\SmallLogo.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\SmallLogo.scale-150.png" [0080.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba90e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17b0 [0080.839] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29abb27f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29abb27f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29abb27f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square71x71Logo.scale-150.png", cAlternateFileName="")) returned 1 [0080.840] wcscmp (_String1="Square71x71Logo.scale-150.png", _String2=".") returned 1 [0080.840] wcscmp (_String1="Square71x71Logo.scale-150.png", _String2="..") returned 1 [0080.840] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x54bd2a8 [0080.840] wcscpy (in: _Dest=0x54bd2a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.840] wcscat (in: _Dest=0x54bd2a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.840] wcscat (in: _Dest=0x54bd2a8, _Source="Square71x71Logo.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\Square71x71Logo.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\Square71x71Logo.scale-150.png" [0080.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bd2a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17b4 [0080.840] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29abb27f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29abb27f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29abb27f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x49a, dwReserved0=0x0, dwReserved1=0x0, cFileName="starttile.dualsim1.sad.scale-150.png", cAlternateFileName="")) returned 1 [0080.840] wcscmp (_String1="starttile.dualsim1.sad.scale-150.png", _String2=".") returned 1 [0080.840] wcscmp (_String1="starttile.dualsim1.sad.scale-150.png", _String2="..") returned 1 [0080.841] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x120) returned 0x54bd958 [0080.841] wcscpy (in: _Dest=0x54bd958, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.841] wcscat (in: _Dest=0x54bd958, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.841] wcscat (in: _Dest=0x54bd958, _Source="starttile.dualsim1.sad.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.sad.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.sad.scale-150.png" [0080.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bd958, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17b8 [0080.841] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29ae14d8, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29ae14d8, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29ae14d8, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x321, dwReserved0=0x0, dwReserved1=0x0, cFileName="starttile.dualsim1.sad.small.scale-150.png", cAlternateFileName="")) returned 1 [0080.841] wcscmp (_String1="starttile.dualsim1.sad.small.scale-150.png", _String2=".") returned 1 [0080.841] wcscmp (_String1="starttile.dualsim1.sad.small.scale-150.png", _String2="..") returned 1 [0080.841] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12c) returned 0x54bda80 [0080.841] wcscpy (in: _Dest=0x54bda80, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.841] wcscat (in: _Dest=0x54bda80, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.841] wcscat (in: _Dest=0x54bda80, _Source="starttile.dualsim1.sad.small.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.sad.small.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.sad.small.scale-150.png" [0080.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bda80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17bc [0080.842] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29ae14d8, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29ae14d8, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29ae14d8, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x339, dwReserved0=0x0, dwReserved1=0x0, cFileName="starttile.dualsim1.scale-150.png", cAlternateFileName="")) returned 1 [0080.842] wcscmp (_String1="starttile.dualsim1.scale-150.png", _String2=".") returned 1 [0080.842] wcscmp (_String1="starttile.dualsim1.scale-150.png", _String2="..") returned 1 [0080.842] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x118) returned 0x54bca90 [0080.842] wcscpy (in: _Dest=0x54bca90, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.842] wcscat (in: _Dest=0x54bca90, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.842] wcscat (in: _Dest=0x54bca90, _Source="starttile.dualsim1.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.scale-150.png" [0080.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bca90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17c0 [0080.843] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29ae14d8, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29ae14d8, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29ae14d8, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x49d, dwReserved0=0x0, dwReserved1=0x0, cFileName="starttile.dualsim1.smile.scale-150.png", cAlternateFileName="")) returned 1 [0080.843] wcscmp (_String1="starttile.dualsim1.smile.scale-150.png", _String2=".") returned 1 [0080.843] wcscmp (_String1="starttile.dualsim1.smile.scale-150.png", _String2="..") returned 1 [0080.843] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x124) returned 0x5ba1d18 [0080.843] wcscpy (in: _Dest=0x5ba1d18, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.843] wcscat (in: _Dest=0x5ba1d18, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.843] wcscat (in: _Dest=0x5ba1d18, _Source="starttile.dualsim1.smile.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.smile.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.smile.scale-150.png" [0080.843] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba1d18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17c4 [0080.844] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29ae14d8, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29ae14d8, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29ae14d8, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x316, dwReserved0=0x0, dwReserved1=0x0, cFileName="starttile.dualsim1.smile.small.scale-150.png", cAlternateFileName="")) returned 1 [0080.844] wcscmp (_String1="starttile.dualsim1.smile.small.scale-150.png", _String2=".") returned 1 [0080.844] wcscmp (_String1="starttile.dualsim1.smile.small.scale-150.png", _String2="..") returned 1 [0080.844] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x130) returned 0x54bdbb8 [0080.844] wcscpy (in: _Dest=0x54bdbb8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.844] wcscat (in: _Dest=0x54bdbb8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.844] wcscat (in: _Dest=0x54bdbb8, _Source="starttile.dualsim1.smile.small.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.smile.small.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.smile.small.scale-150.png" [0080.844] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bdbb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17c8 [0080.845] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29ae14d8, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29b07732, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29b07732, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x50f, dwReserved0=0x0, dwReserved1=0x0, cFileName="starttile.dualsim1.surprise.scale-150.png", cAlternateFileName="")) returned 1 [0080.845] wcscmp (_String1="starttile.dualsim1.surprise.scale-150.png", _String2=".") returned 1 [0080.845] wcscmp (_String1="starttile.dualsim1.surprise.scale-150.png", _String2="..") returned 1 [0080.845] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12a) returned 0x54bdcf0 [0080.845] wcscpy (in: _Dest=0x54bdcf0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.845] wcscat (in: _Dest=0x54bdcf0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.845] wcscat (in: _Dest=0x54bdcf0, _Source="starttile.dualsim1.surprise.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.surprise.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.surprise.scale-150.png" [0080.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bdcf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17cc [0080.845] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29b07732, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29b31612, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29b31612, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x35d, dwReserved0=0x0, dwReserved1=0x0, cFileName="starttile.dualsim1.surprise.small.scale-150.png", cAlternateFileName="")) returned 1 [0080.845] wcscmp (_String1="starttile.dualsim1.surprise.small.scale-150.png", _String2=".") returned 1 [0080.845] wcscmp (_String1="starttile.dualsim1.surprise.small.scale-150.png", _String2="..") returned 1 [0080.845] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x136) returned 0x54bde28 [0080.846] wcscpy (in: _Dest=0x54bde28, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.846] wcscat (in: _Dest=0x54bde28, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.846] wcscat (in: _Dest=0x54bde28, _Source="starttile.dualsim1.surprise.small.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.surprise.small.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.surprise.small.scale-150.png" [0080.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bde28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17d0 [0080.846] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29b31612, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29b31612, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29b31612, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="starttile.dualsim1.wink.scale-150.png", cAlternateFileName="")) returned 1 [0080.846] wcscmp (_String1="starttile.dualsim1.wink.scale-150.png", _String2=".") returned 1 [0080.846] wcscmp (_String1="starttile.dualsim1.wink.scale-150.png", _String2="..") returned 1 [0080.846] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x122) returned 0x5ba1220 [0080.846] wcscpy (in: _Dest=0x5ba1220, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.846] wcscat (in: _Dest=0x5ba1220, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.846] wcscat (in: _Dest=0x5ba1220, _Source="starttile.dualsim1.wink.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.wink.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.wink.scale-150.png" [0080.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba1220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17d4 [0080.848] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29b31612, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29b31612, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29b31612, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x337, dwReserved0=0x0, dwReserved1=0x0, cFileName="starttile.dualsim1.wink.small.scale-150.png", cAlternateFileName="")) returned 1 [0080.848] wcscmp (_String1="starttile.dualsim1.wink.small.scale-150.png", _String2=".") returned 1 [0080.848] wcscmp (_String1="starttile.dualsim1.wink.small.scale-150.png", _String2="..") returned 1 [0080.848] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12e) returned 0x397dff0 [0080.848] wcscpy (in: _Dest=0x397dff0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.848] wcscat (in: _Dest=0x397dff0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.848] wcscat (in: _Dest=0x397dff0, _Source="starttile.dualsim1.wink.small.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.wink.small.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.wink.small.scale-150.png" [0080.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x397dff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17d8 [0080.848] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29b31612, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29b31612, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29b31612, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x527, dwReserved0=0x0, dwReserved1=0x0, cFileName="starttile.dualsim2.sad.scale-150.png", cAlternateFileName="")) returned 1 [0080.848] wcscmp (_String1="starttile.dualsim2.sad.scale-150.png", _String2=".") returned 1 [0080.848] wcscmp (_String1="starttile.dualsim2.sad.scale-150.png", _String2="..") returned 1 [0080.848] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x120) returned 0x54bcce0 [0080.848] wcscpy (in: _Dest=0x54bcce0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.849] wcscat (in: _Dest=0x54bcce0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.849] wcscat (in: _Dest=0x54bcce0, _Source="starttile.dualsim2.sad.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.sad.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.sad.scale-150.png" [0080.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bcce0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17dc [0080.849] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29b57874, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29b57874, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29b57874, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x378, dwReserved0=0x0, dwReserved1=0x0, cFileName="starttile.dualsim2.sad.small.scale-150.png", cAlternateFileName="")) returned 1 [0080.849] wcscmp (_String1="starttile.dualsim2.sad.small.scale-150.png", _String2=".") returned 1 [0080.849] wcscmp (_String1="starttile.dualsim2.sad.small.scale-150.png", _String2="..") returned 1 [0080.849] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12c) returned 0x397e128 [0080.849] wcscpy (in: _Dest=0x397e128, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.849] wcscat (in: _Dest=0x397e128, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.849] wcscat (in: _Dest=0x397e128, _Source="starttile.dualsim2.sad.small.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.sad.small.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.sad.small.scale-150.png" [0080.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x397e128, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17e0 [0080.850] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29b57874, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29b7dafc, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29b7dafc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="starttile.dualsim2.scale-150.png", cAlternateFileName="")) returned 1 [0080.850] wcscmp (_String1="starttile.dualsim2.scale-150.png", _String2=".") returned 1 [0080.850] wcscmp (_String1="starttile.dualsim2.scale-150.png", _String2="..") returned 1 [0080.850] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x118) returned 0x54bc840 [0080.850] wcscpy (in: _Dest=0x54bc840, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.850] wcscat (in: _Dest=0x54bc840, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.850] wcscat (in: _Dest=0x54bc840, _Source="starttile.dualsim2.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.scale-150.png" [0080.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bc840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17e4 [0080.851] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29b7dafc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29ba3d5a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29ba3d5a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x533, dwReserved0=0x0, dwReserved1=0x0, cFileName="starttile.dualsim2.smile.scale-150.png", cAlternateFileName="")) returned 1 [0080.851] wcscmp (_String1="starttile.dualsim2.smile.scale-150.png", _String2=".") returned 1 [0080.851] wcscmp (_String1="starttile.dualsim2.smile.scale-150.png", _String2="..") returned 1 [0080.851] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x124) returned 0x5ba1700 [0080.851] wcscpy (in: _Dest=0x5ba1700, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.851] wcscat (in: _Dest=0x5ba1700, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.851] wcscat (in: _Dest=0x5ba1700, _Source="starttile.dualsim2.smile.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.smile.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.smile.scale-150.png" [0080.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba1700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17e8 [0080.852] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29ba3d5a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29ba3d5a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29ba3d5a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x397, dwReserved0=0x0, dwReserved1=0x0, cFileName="starttile.dualsim2.smile.small.scale-150.png", cAlternateFileName="")) returned 1 [0080.852] wcscmp (_String1="starttile.dualsim2.smile.small.scale-150.png", _String2=".") returned 1 [0080.852] wcscmp (_String1="starttile.dualsim2.smile.small.scale-150.png", _String2="..") returned 1 [0080.852] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x130) returned 0x397e260 [0080.852] wcscpy (in: _Dest=0x397e260, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.852] wcscat (in: _Dest=0x397e260, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.852] wcscat (in: _Dest=0x397e260, _Source="starttile.dualsim2.smile.small.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.smile.small.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.smile.small.scale-150.png" [0080.852] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x397e260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17ec [0080.853] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29ba3d5a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29ba3d5a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29ba3d5a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x593, dwReserved0=0x0, dwReserved1=0x0, cFileName="starttile.dualsim2.surprise.scale-150.png", cAlternateFileName="")) returned 1 [0080.853] wcscmp (_String1="starttile.dualsim2.surprise.scale-150.png", _String2=".") returned 1 [0080.853] wcscmp (_String1="starttile.dualsim2.surprise.scale-150.png", _String2="..") returned 1 [0080.853] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12a) returned 0x397e398 [0080.853] wcscpy (in: _Dest=0x397e398, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.853] wcscat (in: _Dest=0x397e398, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.853] wcscat (in: _Dest=0x397e398, _Source="starttile.dualsim2.surprise.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.surprise.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.surprise.scale-150.png" [0080.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x397e398, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17f0 [0080.853] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29ba3d5a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29ba3d5a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29ba3d5a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="starttile.dualsim2.surprise.small.scale-150.png", cAlternateFileName="")) returned 1 [0080.853] wcscmp (_String1="starttile.dualsim2.surprise.small.scale-150.png", _String2=".") returned 1 [0080.853] wcscmp (_String1="starttile.dualsim2.surprise.small.scale-150.png", _String2="..") returned 1 [0080.853] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x136) returned 0x397e4d0 [0080.854] wcscpy (in: _Dest=0x397e4d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.854] wcscat (in: _Dest=0x397e4d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.854] wcscat (in: _Dest=0x397e4d0, _Source="starttile.dualsim2.surprise.small.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.surprise.small.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.surprise.small.scale-150.png" [0080.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x397e4d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17f4 [0080.854] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29ba3d5a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29ba3d5a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29ba3d5a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x58e, dwReserved0=0x0, dwReserved1=0x0, cFileName="starttile.dualsim2.wink.scale-150.png", cAlternateFileName="")) returned 1 [0080.854] wcscmp (_String1="starttile.dualsim2.wink.scale-150.png", _String2=".") returned 1 [0080.854] wcscmp (_String1="starttile.dualsim2.wink.scale-150.png", _String2="..") returned 1 [0080.854] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x122) returned 0x5ba1838 [0080.854] wcscpy (in: _Dest=0x5ba1838, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.854] wcscat (in: _Dest=0x5ba1838, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.854] wcscat (in: _Dest=0x5ba1838, _Source="starttile.dualsim2.wink.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.wink.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.wink.scale-150.png" [0080.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba1838, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17f8 [0080.855] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29ba3d5a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29ba3d5a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29ba3d5a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="starttile.dualsim2.wink.small.scale-150.png", cAlternateFileName="")) returned 1 [0080.855] wcscmp (_String1="starttile.dualsim2.wink.small.scale-150.png", _String2=".") returned 1 [0080.855] wcscmp (_String1="starttile.dualsim2.wink.small.scale-150.png", _String2="..") returned 1 [0080.855] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12e) returned 0x397e610 [0080.855] wcscpy (in: _Dest=0x397e610, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.855] wcscat (in: _Dest=0x397e610, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.855] wcscat (in: _Dest=0x397e610, _Source="starttile.dualsim2.wink.small.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.wink.small.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.wink.small.scale-150.png" [0080.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x397e610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17fc [0080.856] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29ba3d5a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29bc9fb3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29bc9fb3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="starttile.sad.scale-150.png", cAlternateFileName="")) returned 1 [0080.856] wcscmp (_String1="starttile.sad.scale-150.png", _String2=".") returned 1 [0080.856] wcscmp (_String1="starttile.sad.scale-150.png", _String2="..") returned 1 [0080.856] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x5baa498 [0080.856] wcscpy (in: _Dest=0x5baa498, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.856] wcscat (in: _Dest=0x5baa498, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.856] wcscat (in: _Dest=0x5baa498, _Source="starttile.sad.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.sad.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.sad.scale-150.png" [0080.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5baa498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1804 [0080.857] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29bc9fb3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29bf020d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29bf020d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2da, dwReserved0=0x0, dwReserved1=0x0, cFileName="starttile.sad.small.scale-150.png", cAlternateFileName="")) returned 1 [0080.857] wcscmp (_String1="starttile.sad.small.scale-150.png", _String2=".") returned 1 [0080.857] wcscmp (_String1="starttile.sad.small.scale-150.png", _String2="..") returned 1 [0080.857] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11a) returned 0x54bce08 [0080.857] wcscpy (in: _Dest=0x54bce08, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.857] wcscat (in: _Dest=0x54bce08, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.857] wcscat (in: _Dest=0x54bce08, _Source="starttile.sad.small.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.sad.small.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.sad.small.scale-150.png" [0080.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bce08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1808 [0080.858] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29bf020d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29bf020d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29bf020d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="starttile.scale-150.png", cAlternateFileName="")) returned 1 [0080.858] wcscmp (_String1="starttile.scale-150.png", _String2=".") returned 1 [0080.858] wcscmp (_String1="starttile.scale-150.png", _String2="..") returned 1 [0080.858] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x5baac40 [0080.858] wcscpy (in: _Dest=0x5baac40, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.858] wcscat (in: _Dest=0x5baac40, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.858] wcscat (in: _Dest=0x5baac40, _Source="starttile.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.scale-150.png" [0080.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5baac40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x180c [0080.859] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29bf020d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29bf020d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29bf020d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x0, dwReserved1=0x0, cFileName="starttile.smile.scale-150.png", cAlternateFileName="")) returned 1 [0080.859] wcscmp (_String1="starttile.smile.scale-150.png", _String2=".") returned 1 [0080.859] wcscmp (_String1="starttile.smile.scale-150.png", _String2="..") returned 1 [0080.859] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x54bd3d0 [0080.859] wcscpy (in: _Dest=0x54bd3d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.859] wcscat (in: _Dest=0x54bd3d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.859] wcscat (in: _Dest=0x54bd3d0, _Source="starttile.smile.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.smile.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.smile.scale-150.png" [0080.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bd3d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1810 [0080.859] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29bf020d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29bf020d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29bf020d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="starttile.smile.small.scale-150.png", cAlternateFileName="")) returned 1 [0080.859] wcscmp (_String1="starttile.smile.small.scale-150.png", _String2=".") returned 1 [0080.859] wcscmp (_String1="starttile.smile.small.scale-150.png", _String2="..") returned 1 [0080.859] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11e) returned 0x54bd4f8 [0080.859] wcscpy (in: _Dest=0x54bd4f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.859] wcscat (in: _Dest=0x54bd4f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.859] wcscat (in: _Dest=0x54bd4f8, _Source="starttile.smile.small.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.smile.small.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.smile.small.scale-150.png" [0080.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bd4f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1814 [0080.860] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29bf020d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29bf020d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29bf020d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="starttile.surprise.scale-150.png", cAlternateFileName="")) returned 1 [0080.860] wcscmp (_String1="starttile.surprise.scale-150.png", _String2=".") returned 1 [0080.860] wcscmp (_String1="starttile.surprise.scale-150.png", _String2="..") returned 1 [0080.860] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x118) returned 0x54bd620 [0080.860] wcscpy (in: _Dest=0x54bd620, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.860] wcscat (in: _Dest=0x54bd620, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.860] wcscat (in: _Dest=0x54bd620, _Source="starttile.surprise.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.surprise.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.surprise.scale-150.png" [0080.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bd620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1818 [0080.861] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29bf020d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29c1646b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29c1646b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x30f, dwReserved0=0x0, dwReserved1=0x0, cFileName="starttile.surprise.small.scale-150.png", cAlternateFileName="")) returned 1 [0080.861] wcscmp (_String1="starttile.surprise.small.scale-150.png", _String2=".") returned 1 [0080.861] wcscmp (_String1="starttile.surprise.small.scale-150.png", _String2="..") returned 1 [0080.861] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x124) returned 0x5ba15c8 [0080.861] wcscpy (in: _Dest=0x5ba15c8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.861] wcscat (in: _Dest=0x5ba15c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.861] wcscat (in: _Dest=0x5ba15c8, _Source="starttile.surprise.small.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.surprise.small.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.surprise.small.scale-150.png" [0080.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba15c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x181c [0080.862] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29c1646b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29c1646b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29c1646b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="starttile.wink.scale-150.png", cAlternateFileName="")) returned 1 [0080.862] wcscmp (_String1="starttile.wink.scale-150.png", _String2=".") returned 1 [0080.862] wcscmp (_String1="starttile.wink.scale-150.png", _String2="..") returned 1 [0080.862] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x110) returned 0x5ba9778 [0080.862] wcscpy (in: _Dest=0x5ba9778, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.862] wcscat (in: _Dest=0x5ba9778, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.862] wcscat (in: _Dest=0x5ba9778, _Source="starttile.wink.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.wink.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.wink.scale-150.png" [0080.862] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba9778, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1820 [0080.863] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29c1646b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29c1646b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29c1646b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x30f, dwReserved0=0x0, dwReserved1=0x0, cFileName="starttile.wink.small.scale-150.png", cAlternateFileName="")) returned 1 [0080.863] wcscmp (_String1="starttile.wink.small.scale-150.png", _String2=".") returned 1 [0080.863] wcscmp (_String1="starttile.wink.small.scale-150.png", _String2="..") returned 1 [0080.863] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11c) returned 0x7584768 [0080.869] wcscpy (in: _Dest=0x7584768, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.869] wcscat (in: _Dest=0x7584768, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.869] wcscat (in: _Dest=0x7584768, _Source="starttile.wink.small.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.wink.small.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.wink.small.scale-150.png" [0080.869] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7584768, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1824 [0080.870] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29c1646b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29c1646b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29c1646b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.scale-150.png", cAlternateFileName="")) returned 1 [0080.870] wcscmp (_String1="StoreLogo.scale-150.png", _String2=".") returned 1 [0080.870] wcscmp (_String1="StoreLogo.scale-150.png", _String2="..") returned 1 [0080.870] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x5baa5b0 [0080.870] wcscpy (in: _Dest=0x5baa5b0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.870] wcscat (in: _Dest=0x5baa5b0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.870] wcscat (in: _Dest=0x5baa5b0, _Source="StoreLogo.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\StoreLogo.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\StoreLogo.scale-150.png" [0080.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5baa5b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1828 [0080.871] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29c3c6c4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29c3c6c4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29c3c6c4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toast.dualsim1.scale-150.png", cAlternateFileName="")) returned 1 [0080.871] wcscmp (_String1="toast.dualsim1.scale-150.png", _String2=".") returned 1 [0080.871] wcscmp (_String1="toast.dualsim1.scale-150.png", _String2="..") returned 1 [0080.871] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x110) returned 0x5baa8f8 [0080.871] wcscpy (in: _Dest=0x5baa8f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.871] wcscat (in: _Dest=0x5baa8f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.871] wcscat (in: _Dest=0x5baa8f8, _Source="toast.dualsim1.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\toast.dualsim1.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\toast.dualsim1.scale-150.png" [0080.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5baa8f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x182c [0080.872] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29c3c6c4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29c3c6c4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29c3c6c4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1df, dwReserved0=0x0, dwReserved1=0x0, cFileName="toast.dualsim2.scale-150.png", cAlternateFileName="")) returned 1 [0080.872] wcscmp (_String1="toast.dualsim2.scale-150.png", _String2=".") returned 1 [0080.872] wcscmp (_String1="toast.dualsim2.scale-150.png", _String2="..") returned 1 [0080.872] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x110) returned 0x5ba9200 [0080.872] wcscpy (in: _Dest=0x5ba9200, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.872] wcscat (in: _Dest=0x5ba9200, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.872] wcscat (in: _Dest=0x5ba9200, _Source="toast.dualsim2.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\toast.dualsim2.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\toast.dualsim2.scale-150.png" [0080.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba9200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1830 [0080.872] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29c3c6c4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29c3c6c4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29c3c6c4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x0, cFileName="toast.scale-150.png", cAlternateFileName="")) returned 1 [0080.872] wcscmp (_String1="toast.scale-150.png", _String2=".") returned 1 [0080.872] wcscmp (_String1="toast.scale-150.png", _String2="..") returned 1 [0080.872] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfe) returned 0x7582840 [0080.873] wcscpy (in: _Dest=0x7582840, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.873] wcscat (in: _Dest=0x7582840, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.873] wcscat (in: _Dest=0x7582840, _Source="toast.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\toast.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\toast.scale-150.png" [0080.873] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7582840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1834 [0080.873] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29c3c6c4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29c3c6c4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29c3c6c4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x687, dwReserved0=0x0, dwReserved1=0x0, cFileName="WideLogo.scale-150.png", cAlternateFileName="")) returned 1 [0080.873] wcscmp (_String1="WideLogo.scale-150.png", _String2=".") returned 1 [0080.873] wcscmp (_String1="WideLogo.scale-150.png", _String2="..") returned 1 [0080.873] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x104) returned 0x5ba9bd8 [0080.873] wcscpy (in: _Dest=0x5ba9bd8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets" [0080.873] wcscat (in: _Dest=0x5ba9bd8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\" [0080.873] wcscat (in: _Dest=0x5ba9bd8, _Source="WideLogo.scale-150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\WideLogo.scale-150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\WideLogo.scale-150.png" [0080.873] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba9bd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1838 [0080.874] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29c3c6c4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29c3c6c4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29c3c6c4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x687, dwReserved0=0x0, dwReserved1=0x0, cFileName="WideLogo.scale-150.png", cAlternateFileName="")) returned 0 [0080.874] FindClose (in: hFindFile=0x5444dc0 | out: hFindFile=0x5444dc0) returned 1 [0080.875] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f4ec8) returned 1 [0080.875] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f1a88) returned 1 [0080.875] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3934568) returned 1 Thread: id = 769 os_tid = 0x1b30 [0077.983] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x110) returned 0x38b8d20 [0077.983] wcscpy (in: _Dest=0x38b8d20, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\microsoft.system.package.metadata" [0077.983] wcscat (in: _Dest=0x38b8d20, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0077.983] wcscat (in: _Dest=0x38b8d20, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0077.983] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f5600 [0077.983] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x53f5600 | out: lpFindFileData=0x53f5600*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbd8c685e, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbd8c685e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8c685e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ee40 [0084.252] wcscmp (_String1=".", _String2=".") returned 0 [0084.253] FindNextFileW (in: hFindFile=0x389ee40, lpFindFileData=0x53f5600 | out: lpFindFileData=0x53f5600*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbd8c685e, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbd8c685e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8c685e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.253] wcscmp (_String1="..", _String2=".") returned 1 [0084.253] wcscmp (_String1="..", _String2="..") returned 0 [0084.253] FindNextFileW (in: hFindFile=0x389ee40, lpFindFileData=0x53f5600 | out: lpFindFileData=0x53f5600*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbd8c685e, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbd8c685e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8c685e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0084.253] FindClose (in: hFindFile=0x389ee40 | out: hFindFile=0x389ee40) returned 1 [0084.253] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f5600) returned 1 [0084.253] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b8d20) returned 1 [0084.253] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3979a78) returned 1 Thread: id = 770 os_tid = 0x1b34 [0077.984] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\resources.pri")) returned 0x20 [0084.015] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0084.016] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.016] GetLastError () returned 0x5 [0084.016] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0084.016] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396fd48) returned 1 Thread: id = 771 os_tid = 0x1b38 [0077.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0077.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp", dwFileAttributes=0x20) returned 0 [0077.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0077.986] GetLastError () returned 0x5 [0077.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp", dwFileAttributes=0x20) returned 0 [0077.986] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396df80) returned 1 Thread: id = 772 os_tid = 0x1b3c [0077.987] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0082.110] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0082.111] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.111] GetLastError () returned 0x5 [0082.111] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0082.111] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393eec8) returned 1 Thread: id = 773 os_tid = 0x1b40 [0077.987] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0082.520] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0082.556] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.569] GetLastError () returned 0x5 [0082.569] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0082.584] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393e708) returned 1 Thread: id = 774 os_tid = 0x1b44 [0077.988] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0082.570] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0082.584] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.599] GetLastError () returned 0x5 [0082.599] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0082.599] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393f3a0) returned 1 Thread: id = 775 os_tid = 0x1b48 [0077.988] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x54f1c58 [0077.988] wcscpy (in: _Dest=0x54f1c58, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0077.988] wcscat (in: _Dest=0x54f1c58, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0077.988] wcscat (in: _Dest=0x54f1c58, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\*" [0077.988] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5463a68 [0077.988] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x5463a68 | out: lpFindFileData=0x5463a68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68f5da18, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaae3d897, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x68f83c76, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444e00 [0077.989] wcscmp (_String1=".", _String2=".") returned 0 [0077.989] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x5463a68 | out: lpFindFileData=0x5463a68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68f5da18, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaae3d897, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x68f83c76, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.989] wcscmp (_String1="..", _String2=".") returned 1 [0077.989] wcscmp (_String1="..", _String2="..") returned 0 [0077.989] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x5463a68 | out: lpFindFileData=0x5463a68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68f5da18, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68f5da18, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68f5da18, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x318, dwReserved0=0x0, dwReserved1=0x0, cFileName="Base1MedTileThin.scale-100.png", cAlternateFileName="")) returned 1 [0077.989] wcscmp (_String1="Base1MedTileThin.scale-100.png", _String2=".") returned 1 [0077.989] wcscmp (_String1="Base1MedTileThin.scale-100.png", _String2="..") returned 1 [0077.989] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x116) returned 0x546ee88 [0077.990] wcscpy (in: _Dest=0x546ee88, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0077.990] wcscat (in: _Dest=0x546ee88, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0077.990] wcscat (in: _Dest=0x546ee88, _Source="Base1MedTileThin.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base1MedTileThin.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base1MedTileThin.scale-100.png" [0080.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x546ee88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12e0 [0080.822] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x5463a68 | out: lpFindFileData=0x5463a68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68f5da18, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68f5da18, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68f5da18, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="Base1SmallTileThin.scale-100.png", cAlternateFileName="")) returned 1 [0080.823] wcscmp (_String1="Base1SmallTileThin.scale-100.png", _String2=".") returned 1 [0080.823] wcscmp (_String1="Base1SmallTileThin.scale-100.png", _String2="..") returned 1 [0080.823] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11a) returned 0x55ca328 [0080.823] wcscpy (in: _Dest=0x55ca328, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0080.823] wcscat (in: _Dest=0x55ca328, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0080.823] wcscat (in: _Dest=0x55ca328, _Source="Base1SmallTileThin.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base1SmallTileThin.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base1SmallTileThin.scale-100.png" [0080.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55ca328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1770 [0080.823] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x5463a68 | out: lpFindFileData=0x5463a68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68f5da18, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68f5da18, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68f5da18, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x389, dwReserved0=0x0, dwReserved1=0x0, cFileName="Base2MedTileThin.scale-100.png", cAlternateFileName="")) returned 1 [0080.823] wcscmp (_String1="Base2MedTileThin.scale-100.png", _String2=".") returned 1 [0080.823] wcscmp (_String1="Base2MedTileThin.scale-100.png", _String2="..") returned 1 [0080.823] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x116) returned 0x54bc968 [0080.823] wcscpy (in: _Dest=0x54bc968, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0080.823] wcscat (in: _Dest=0x54bc968, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0080.823] wcscat (in: _Dest=0x54bc968, _Source="Base2MedTileThin.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base2MedTileThin.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base2MedTileThin.scale-100.png" [0080.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bc968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1774 [0080.824] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x5463a68 | out: lpFindFileData=0x5463a68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68f5da18, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68f5da18, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68f5da18, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x0, dwReserved1=0x0, cFileName="Base2SmallTileThin.scale-100.png", cAlternateFileName="")) returned 1 [0080.824] wcscmp (_String1="Base2SmallTileThin.scale-100.png", _String2=".") returned 1 [0080.824] wcscmp (_String1="Base2SmallTileThin.scale-100.png", _String2="..") returned 1 [0080.824] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11a) returned 0x55ca450 [0080.824] wcscpy (in: _Dest=0x55ca450, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0080.824] wcscat (in: _Dest=0x55ca450, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0080.824] wcscat (in: _Dest=0x55ca450, _Source="Base2SmallTileThin.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base2SmallTileThin.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base2SmallTileThin.scale-100.png" [0080.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55ca450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1778 [0080.825] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x5463a68 | out: lpFindFileData=0x5463a68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68f5da18, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68f5da18, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68f5da18, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BaseAppList.scale-100.png", cAlternateFileName="")) returned 1 [0080.825] wcscmp (_String1="BaseAppList.scale-100.png", _String2=".") returned 1 [0080.825] wcscmp (_String1="BaseAppList.scale-100.png", _String2="..") returned 1 [0080.825] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10c) returned 0x5baad58 [0080.825] wcscpy (in: _Dest=0x5baad58, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0080.825] wcscat (in: _Dest=0x5baad58, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0080.825] wcscat (in: _Dest=0x5baad58, _Source="BaseAppList.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseAppList.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseAppList.scale-100.png" [0080.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5baad58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x177c [0080.826] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x5463a68 | out: lpFindFileData=0x5463a68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68f5da18, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68f5da18, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68f5da18, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x366, dwReserved0=0x0, dwReserved1=0x0, cFileName="BaseMedTile.scale-100.png", cAlternateFileName="")) returned 1 [0080.826] wcscmp (_String1="BaseMedTile.scale-100.png", _String2=".") returned 1 [0080.826] wcscmp (_String1="BaseMedTile.scale-100.png", _String2="..") returned 1 [0080.826] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10c) returned 0x5baae70 [0080.826] wcscpy (in: _Dest=0x5baae70, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0080.826] wcscat (in: _Dest=0x5baae70, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0080.826] wcscat (in: _Dest=0x5baae70, _Source="BaseMedTile.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseMedTile.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseMedTile.scale-100.png" [0080.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5baae70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1780 [0080.827] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x5463a68 | out: lpFindFileData=0x5463a68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68f5da18, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68f5da18, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68f5da18, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BaseMedTileThin.scale-100.png", cAlternateFileName="")) returned 1 [0080.827] wcscmp (_String1="BaseMedTileThin.scale-100.png", _String2=".") returned 1 [0080.827] wcscmp (_String1="BaseMedTileThin.scale-100.png", _String2="..") returned 1 [0080.827] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x114) returned 0x54bd058 [0080.827] wcscpy (in: _Dest=0x54bd058, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0080.827] wcscat (in: _Dest=0x54bd058, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0080.827] wcscat (in: _Dest=0x54bd058, _Source="BaseMedTileThin.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseMedTileThin.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseMedTileThin.scale-100.png" [0080.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bd058, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1784 [0080.827] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x5463a68 | out: lpFindFileData=0x5463a68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68f5da18, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68f5da18, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68f5da18, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x0, dwReserved1=0x0, cFileName="BaseSmallTile.scale-100.png", cAlternateFileName="")) returned 1 [0080.827] wcscmp (_String1="BaseSmallTile.scale-100.png", _String2=".") returned 1 [0080.827] wcscmp (_String1="BaseSmallTile.scale-100.png", _String2="..") returned 1 [0080.828] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x110) returned 0x5ba9318 [0080.828] wcscpy (in: _Dest=0x5ba9318, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0080.828] wcscat (in: _Dest=0x5ba9318, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0080.828] wcscat (in: _Dest=0x5ba9318, _Source="BaseSmallTile.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseSmallTile.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseSmallTile.scale-100.png" [0080.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba9318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1788 [0080.828] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x5463a68 | out: lpFindFileData=0x5463a68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68f5da18, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68f5da18, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68f5da18, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x234, dwReserved0=0x0, dwReserved1=0x0, cFileName="BaseSmallTileThin.scale-100.png", cAlternateFileName="")) returned 1 [0080.828] wcscmp (_String1="BaseSmallTileThin.scale-100.png", _String2=".") returned 1 [0080.828] wcscmp (_String1="BaseSmallTileThin.scale-100.png", _String2="..") returned 1 [0080.828] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x118) returned 0x54bd180 [0080.828] wcscpy (in: _Dest=0x54bd180, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0080.829] wcscat (in: _Dest=0x54bd180, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0080.829] wcscat (in: _Dest=0x54bd180, _Source="BaseSmallTileThin.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseSmallTileThin.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseSmallTileThin.scale-100.png" [0080.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bd180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x178c [0080.829] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x5463a68 | out: lpFindFileData=0x5463a68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68f5da18, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68f5da18, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68f5da18, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BaseVoicemail1MedTileThin.scale-100.png", cAlternateFileName="")) returned 1 [0080.829] wcscmp (_String1="BaseVoicemail1MedTileThin.scale-100.png", _String2=".") returned 1 [0080.829] wcscmp (_String1="BaseVoicemail1MedTileThin.scale-100.png", _String2="..") returned 1 [0080.829] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x128) returned 0x5ba10e8 [0080.829] wcscpy (in: _Dest=0x5ba10e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0080.829] wcscat (in: _Dest=0x5ba10e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0080.829] wcscat (in: _Dest=0x5ba10e8, _Source="BaseVoicemail1MedTileThin.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail1MedTileThin.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail1MedTileThin.scale-100.png" [0080.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba10e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1790 [0080.830] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x5463a68 | out: lpFindFileData=0x5463a68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68f5da18, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68f5da18, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68f5da18, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BaseVoicemail1SmallTileThin.scale-100.png", cAlternateFileName="")) returned 1 [0080.830] wcscmp (_String1="BaseVoicemail1SmallTileThin.scale-100.png", _String2=".") returned 1 [0080.830] wcscmp (_String1="BaseVoicemail1SmallTileThin.scale-100.png", _String2="..") returned 1 [0080.830] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12c) returned 0x55ca578 [0080.830] wcscpy (in: _Dest=0x55ca578, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0080.830] wcscat (in: _Dest=0x55ca578, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0080.830] wcscat (in: _Dest=0x55ca578, _Source="BaseVoicemail1SmallTileThin.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail1SmallTileThin.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail1SmallTileThin.scale-100.png" [0080.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55ca578, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1794 [0080.831] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x5463a68 | out: lpFindFileData=0x5463a68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68f5da18, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68f5da18, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68f83c76, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x3eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BaseVoicemail2MedTileThin.scale-100.png", cAlternateFileName="")) returned 1 [0080.831] wcscmp (_String1="BaseVoicemail2MedTileThin.scale-100.png", _String2=".") returned 1 [0080.831] wcscmp (_String1="BaseVoicemail2MedTileThin.scale-100.png", _String2="..") returned 1 [0080.831] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x128) returned 0x5ba1358 [0080.831] wcscpy (in: _Dest=0x5ba1358, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0080.831] wcscat (in: _Dest=0x5ba1358, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0080.831] wcscat (in: _Dest=0x5ba1358, _Source="BaseVoicemail2MedTileThin.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail2MedTileThin.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail2MedTileThin.scale-100.png" [0080.831] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba1358, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1798 [0080.832] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x5463a68 | out: lpFindFileData=0x5463a68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68f83c76, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68f83c76, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68f83c76, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BaseVoicemail2SmallTileThin.scale-100.png", cAlternateFileName="")) returned 1 [0080.832] wcscmp (_String1="BaseVoicemail2SmallTileThin.scale-100.png", _String2=".") returned 1 [0080.832] wcscmp (_String1="BaseVoicemail2SmallTileThin.scale-100.png", _String2="..") returned 1 [0080.832] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12c) returned 0x55ca6b0 [0080.832] wcscpy (in: _Dest=0x55ca6b0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0080.832] wcscat (in: _Dest=0x55ca6b0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0080.832] wcscat (in: _Dest=0x55ca6b0, _Source="BaseVoicemail2SmallTileThin.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail2SmallTileThin.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail2SmallTileThin.scale-100.png" [0080.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55ca6b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x179c [0080.833] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x5463a68 | out: lpFindFileData=0x5463a68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68f83c76, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68f83c76, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68f83c76, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x349, dwReserved0=0x0, dwReserved1=0x0, cFileName="BaseVoicemailMedTileThin.scale-100.png", cAlternateFileName="")) returned 1 [0080.833] wcscmp (_String1="BaseVoicemailMedTileThin.scale-100.png", _String2=".") returned 1 [0080.833] wcscmp (_String1="BaseVoicemailMedTileThin.scale-100.png", _String2="..") returned 1 [0080.833] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x126) returned 0x5ba1490 [0080.833] wcscpy (in: _Dest=0x5ba1490, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0080.833] wcscat (in: _Dest=0x5ba1490, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0080.833] wcscat (in: _Dest=0x5ba1490, _Source="BaseVoicemailMedTileThin.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemailMedTileThin.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemailMedTileThin.scale-100.png" [0080.833] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba1490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17a0 [0080.833] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x5463a68 | out: lpFindFileData=0x5463a68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68f83c76, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68f83c76, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68f83c76, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x234, dwReserved0=0x0, dwReserved1=0x0, cFileName="BaseVoicemailSmallTileThin.scale-100.png", cAlternateFileName="")) returned 1 [0080.834] wcscmp (_String1="BaseVoicemailSmallTileThin.scale-100.png", _String2=".") returned 1 [0080.834] wcscmp (_String1="BaseVoicemailSmallTileThin.scale-100.png", _String2="..") returned 1 [0080.834] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12a) returned 0x54bd820 [0080.834] wcscpy (in: _Dest=0x54bd820, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0080.834] wcscat (in: _Dest=0x54bd820, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0080.834] wcscat (in: _Dest=0x54bd820, _Source="BaseVoicemailSmallTileThin.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemailSmallTileThin.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemailSmallTileThin.scale-100.png" [0080.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bd820, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17a4 [0080.834] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x5463a68 | out: lpFindFileData=0x5463a68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68f83c76, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68f83c76, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68f83c76, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x3dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BaseWideTile.scale-100.png", cAlternateFileName="")) returned 1 [0080.834] wcscmp (_String1="BaseWideTile.scale-100.png", _String2=".") returned 1 [0080.834] wcscmp (_String1="BaseWideTile.scale-100.png", _String2="..") returned 1 [0080.834] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x5baa038 [0080.834] wcscpy (in: _Dest=0x5baa038, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0080.834] wcscat (in: _Dest=0x5baa038, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0080.834] wcscat (in: _Dest=0x5baa038, _Source="BaseWideTile.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseWideTile.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseWideTile.scale-100.png" [0080.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5baa038, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17a8 [0080.835] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x5463a68 | out: lpFindFileData=0x5463a68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68f83c76, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68f83c76, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68f83c76, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x3dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BaseWideTile.scale-100.png", cAlternateFileName="")) returned 0 [0080.835] FindClose (in: hFindFile=0x5444e00 | out: hFindFile=0x5444e00) returned 1 [0080.836] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5463a68) returned 1 [0080.836] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f1c58) returned 1 [0080.836] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3934648) returned 1 Thread: id = 776 os_tid = 0x1b4c [0077.990] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x54706a8 [0077.990] wcscpy (in: _Dest=0x54706a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata" [0077.990] wcscat (in: _Dest=0x54706a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0077.990] wcscat (in: _Dest=0x54706a8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0077.990] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5461ff0 [0077.990] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x5461ff0 | out: lpFindFileData=0x5461ff0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x61f43dfb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaae3e4bd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ed40 [0085.996] wcscmp (_String1=".", _String2=".") returned 0 [0085.996] FindNextFileW (in: hFindFile=0x389ed40, lpFindFileData=0x5461ff0 | out: lpFindFileData=0x5461ff0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x61f43dfb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaae3e4bd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.996] wcscmp (_String1="..", _String2=".") returned 1 [0085.996] wcscmp (_String1="..", _String2="..") returned 0 [0085.996] FindNextFileW (in: hFindFile=0x389ed40, lpFindFileData=0x5461ff0 | out: lpFindFileData=0x5461ff0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x61f43dfb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaae3e4bd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0085.996] FindClose (in: hFindFile=0x389ed40 | out: hFindFile=0x389ed40) returned 1 [0085.996] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5461ff0) returned 1 [0085.996] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54706a8) returned 1 [0085.997] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3979b90) returned 1 Thread: id = 777 os_tid = 0x1b50 [0077.991] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri")) returned 0x20 [0082.587] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0083.908] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.908] GetLastError () returned 0x5 [0083.908] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0083.908] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396ff28) returned 1 Thread: id = 778 os_tid = 0x1b54 [0077.991] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\-AXGVk.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\-axgvk.mp4")) returned 0x20 [0077.991] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\-AXGVk.mp4", dwFileAttributes=0x20) returned 1 [0077.992] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\-AXGVk.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\-axgvk.mp4"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x12d4 [0077.992] GetFileSizeEx (in: hFile=0x12d4, lpFileSize=0x1d67fa28 | out: lpFileSize=0x1d67fa28*=75750) returned 1 [0077.992] SetFilePointerEx (in: hFile=0x12d4, liDistanceToMove=0x127e2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.992] ReadFile (in: hFile=0x12d4, lpBuffer=0x1d67f9ac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d67f9a8, lpOverlapped=0x0 | out: lpBuffer=0x1d67f9ac*, lpNumberOfBytesRead=0x1d67f9a8*=0x4, lpOverlapped=0x0) returned 1 [0077.992] SetFilePointerEx (in: hFile=0x12d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.992] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559d98 [0077.992] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4ec8 [0077.992] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5030 [0077.992] NtQuerySystemTime (in: CurrentTime=0x1d67f988 | out: CurrentTime=0x1d67f988*=132260136351522814) returned 0x0 [0077.992] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0x7faa5ac3 [0077.992] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0x47c38f47 [0077.992] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0xe56ea75a [0077.992] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0x7816c240 [0077.992] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0xc80ef124 [0077.992] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0xbba8f6eb [0077.992] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0x5670cdad [0077.992] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0x9dade9bf [0077.992] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0x11fcda44 [0077.992] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0x512e5a14 [0077.992] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0x50b2cab7 [0077.992] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0x8f6cc5ff [0077.992] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0x96ce4c5f [0077.992] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0x384d8c6c [0077.992] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0xd8c2e42c [0077.992] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0x888ae4c [0077.992] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0x4c83a5bb [0077.992] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0x94ab1f98 [0077.992] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0x348c1d96 [0077.992] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0x42f74c27 [0077.992] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0xb9ae179a [0077.993] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0x76fbad06 [0077.993] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0xf3e79edd [0077.993] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0x5265cb3f [0077.993] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0x4b7796c5 [0077.993] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0xa8abb3b3 [0077.993] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0xb9263ead [0077.993] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0x7601619d [0077.993] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0x4b07ba8d [0077.993] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0x78ff80b4 [0077.993] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0xd13cc10a [0077.993] RtlRandom (in: Seed=0x1d67f994 | out: Seed=0x1d67f994) returned 0xe7206dbd [0078.002] SetFilePointerEx (in: hFile=0x12d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.002] ReadFile (in: hFile=0x12d4, lpBuffer=0x5b17868, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1d67f968, lpOverlapped=0x0 | out: lpBuffer=0x5b17868*, lpNumberOfBytesRead=0x1d67f968*=0xc800, lpOverlapped=0x0) returned 1 [0078.003] SetFilePointerEx (in: hFile=0x12d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.003] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5b60 [0078.003] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5496a58 [0078.003] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5030 [0078.003] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5030) returned 1 [0078.004] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5b24070 [0078.008] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5030 [0078.008] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5058 [0078.008] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5058) returned 1 [0078.008] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496a58) returned 1 [0078.008] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5b60) returned 1 [0078.008] WriteFile (in: hFile=0x12d4, lpBuffer=0x5b24070*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1d67f968, lpOverlapped=0x0 | out: lpBuffer=0x5b24070*, lpNumberOfBytesWritten=0x1d67f968*=0xc800, lpOverlapped=0x0) returned 1 [0078.143] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5b24070) returned 1 [0078.143] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5b17868) returned 1 [0078.143] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x21) returned 0x38a67c0 [0078.143] SetFilePointerEx (in: hFile=0x12d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.143] WriteFile (in: hFile=0x12d4, lpBuffer=0x549c858*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x1d67f9e8, lpOverlapped=0x0 | out: lpBuffer=0x549c858*, lpNumberOfBytesWritten=0x1d67f9e8*=0x105, lpOverlapped=0x0) returned 1 [0078.203] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549c858) returned 1 [0078.203] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6670) returned 1 [0078.203] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9598) returned 1 [0078.203] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a67c0) returned 1 [0078.204] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5030) returned 1 [0078.204] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4ec8) returned 1 [0078.204] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4fb8) returned 1 [0078.204] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4fe0) returned 1 [0078.204] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x84) returned 0x549d958 [0078.204] wcscpy (in: _Dest=0x549d958, _Source="C:\\Users\\FD1HVy\\Videos\\-AXGVk.mp4" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\-AXGVk.mp4") returned="C:\\Users\\FD1HVy\\Videos\\-AXGVk.mp4" [0078.204] wcscat (in: _Dest=0x549d958, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\-AXGVk.mp4.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\Videos\\-AXGVk.mp4.mailto[knoocknoo@cock.li].a0a70" [0078.204] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\Videos\\-AXGVk.mp4.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1d67f9a0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\Videos\\-AXGVk.mp4.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0078.204] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9a) returned 0x54a1680 Thread: id = 779 os_tid = 0x1b58 [0078.009] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dyKrMrvMr3I6DDt1.swf" (normalized: "c:\\users\\fd1hvy\\videos\\dykrmrvmr3i6ddt1.swf")) returned 0x20 [0078.009] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dyKrMrvMr3I6DDt1.swf", dwFileAttributes=0x20) returned 1 [0078.009] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dyKrMrvMr3I6DDt1.swf" (normalized: "c:\\users\\fd1hvy\\videos\\dykrmrvmr3i6ddt1.swf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x12d8 [0078.009] GetFileSizeEx (in: hFile=0x12d8, lpFileSize=0x1d6ffb48 | out: lpFileSize=0x1d6ffb48*=11587) returned 1 [0078.009] SetFilePointerEx (in: hFile=0x12d8, liDistanceToMove=0x2d3f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.009] ReadFile (in: hFile=0x12d8, lpBuffer=0x1d6ffacc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d6ffac8, lpOverlapped=0x0 | out: lpBuffer=0x1d6ffacc*, lpNumberOfBytesRead=0x1d6ffac8*=0x4, lpOverlapped=0x0) returned 1 [0078.009] SetFilePointerEx (in: hFile=0x12d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.009] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5058 [0078.009] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a50a8 [0078.009] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a50d0 [0078.009] NtQuerySystemTime (in: CurrentTime=0x1d6ffaa8 | out: CurrentTime=0x1d6ffaa8*=132260136351679041) returned 0x0 [0078.009] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0x3e664dc4 [0078.009] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0x52d03ab8 [0078.010] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0xcb89f4db [0078.010] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0xe55e936c [0078.010] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0xdc274ec0 [0078.010] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0x40dc5a0f [0078.010] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0x5fcf5907 [0078.010] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0xa1c7adbe [0078.010] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0x690fb2e [0078.010] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0xc9a832f1 [0078.010] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0xb6684213 [0078.010] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0x9c6b4e19 [0078.010] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0xd62ee388 [0078.010] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0x3d6cf98b [0078.010] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0xce9d40a2 [0078.010] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0xd2c5525e [0078.010] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0xaf4d643f [0078.010] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0xbed086fa [0078.010] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0xf4b21291 [0078.010] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0x78e50d88 [0078.010] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0xb9518955 [0078.010] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0xf339452a [0078.010] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0x37038a9e [0078.010] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0x41eca94d [0078.010] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0xda28d509 [0078.010] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0x1516e21d [0078.010] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0xb5749e7a [0078.010] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0xe6a009a1 [0078.010] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0x5ff5611f [0078.010] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0x80ef6087 [0078.010] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0xa3c82004 [0078.010] RtlRandom (in: Seed=0x1d6ffab4 | out: Seed=0x1d6ffab4) returned 0x35d045f2 [0078.020] ReadFile (in: hFile=0x12d8, lpBuffer=0x5b30878, nNumberOfBytesToRead=0x2d43, lpNumberOfBytesRead=0x1d6ffaa4, lpOverlapped=0x0 | out: lpBuffer=0x5b30878*, lpNumberOfBytesRead=0x1d6ffaa4*=0x2d43, lpOverlapped=0x0) returned 1 [0078.021] SetFilePointerEx (in: hFile=0x12d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.021] WriteFile (in: hFile=0x12d8, lpBuffer=0x5b3d080*, nNumberOfBytesToWrite=0x2d43, lpNumberOfBytesWritten=0x1d6ffaa0, lpOverlapped=0x0 | out: lpBuffer=0x5b3d080*, lpNumberOfBytesWritten=0x1d6ffaa0*=0x2d43, lpOverlapped=0x0) returned 1 [0078.158] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c93e0 [0078.158] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9408 [0078.158] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9408) returned 1 [0078.158] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5b3d080) returned 1 [0078.159] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5b30878) returned 1 [0078.159] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496a58) returned 1 [0078.159] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5b60) returned 1 [0078.159] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x35) returned 0x54452c0 [0078.159] SetFilePointerEx (in: hFile=0x12d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.159] WriteFile (in: hFile=0x12d8, lpBuffer=0x5406298*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x1d6ffb08, lpOverlapped=0x0 | out: lpBuffer=0x5406298*, lpNumberOfBytesWritten=0x1d6ffb08*=0x119, lpOverlapped=0x0) returned 1 [0078.205] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5406298) returned 1 [0078.205] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bc7108) returned 1 [0078.206] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c92a0) returned 1 [0078.206] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54452c0) returned 1 [0078.206] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c93e0) returned 1 [0078.206] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a50a8) returned 1 [0078.206] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559d98) returned 1 [0078.206] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389c0e0) returned 1 [0078.206] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x98) returned 0x55c6e38 [0078.206] wcscpy (in: _Dest=0x55c6e38, _Source="C:\\Users\\FD1HVy\\Videos\\dyKrMrvMr3I6DDt1.swf" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\dyKrMrvMr3I6DDt1.swf") returned="C:\\Users\\FD1HVy\\Videos\\dyKrMrvMr3I6DDt1.swf" [0078.206] wcscat (in: _Dest=0x55c6e38, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\dyKrMrvMr3I6DDt1.swf.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\Videos\\dyKrMrvMr3I6DDt1.swf.mailto[knoocknoo@cock.li].a0a70" [0078.206] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\Videos\\dyKrMrvMr3I6DDt1.swf.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1d6ffac0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\Videos\\dyKrMrvMr3I6DDt1.swf.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0078.206] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xae) returned 0x55c7980 Thread: id = 780 os_tid = 0x1b5c [0078.022] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dYrp6RPEfNrynZ9.flv" (normalized: "c:\\users\\fd1hvy\\videos\\dyrp6rpefnrynz9.flv")) returned 0x20 [0078.022] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dYrp6RPEfNrynZ9.flv", dwFileAttributes=0x20) returned 1 [0078.022] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dYrp6RPEfNrynZ9.flv" (normalized: "c:\\users\\fd1hvy\\videos\\dyrp6rpefnrynz9.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x12dc [0078.022] GetFileSizeEx (in: hFile=0x12dc, lpFileSize=0x1d77fe78 | out: lpFileSize=0x1d77fe78*=33486) returned 1 [0078.022] SetFilePointerEx (in: hFile=0x12dc, liDistanceToMove=0x82ca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.022] ReadFile (in: hFile=0x12dc, lpBuffer=0x1d77fdfc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d77fdf8, lpOverlapped=0x0 | out: lpBuffer=0x1d77fdfc*, lpNumberOfBytesRead=0x1d77fdf8*=0x4, lpOverlapped=0x0) returned 1 [0078.022] SetFilePointerEx (in: hFile=0x12dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.022] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5058 [0078.022] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a50d0 [0078.022] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9750 [0078.022] NtQuerySystemTime (in: CurrentTime=0x1d77fdd8 | out: CurrentTime=0x1d77fdd8*=132260136351835458) returned 0x0 [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0x1371007e [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0x1caf3376 [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0xd86eace8 [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0x38870915 [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0x71a3ec02 [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0x245e4c4b [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0xc5ef0f0d [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0x10d904eb [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0x60d7e8c0 [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0xb18ef46a [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0xd683b8e2 [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0x10e9a22e [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0xbbd0cc6e [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0xb3a4a052 [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0x6d4e553d [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0xf5ef8c4f [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0x4d66c1c2 [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0x178cca77 [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0xfe013fb1 [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0x4149b32d [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0x99ef4327 [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0x86ddfc31 [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0xca8daebd [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0xd7a38165 [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0xb5d01d9a [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0x23215b59 [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0xbc31c99c [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0x4beaf808 [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0x46f545ab [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0xe161dca1 [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0x56ce9387 [0078.023] RtlRandom (in: Seed=0x1d77fde4 | out: Seed=0x1d77fde4) returned 0xdff302eb [0078.035] ReadFile (in: hFile=0x12dc, lpBuffer=0x5b49888, nNumberOfBytesToRead=0x82ce, lpNumberOfBytesRead=0x1d77fdd4, lpOverlapped=0x0 | out: lpBuffer=0x5b49888*, lpNumberOfBytesRead=0x1d77fdd4*=0x82ce, lpOverlapped=0x0) returned 1 [0078.036] SetFilePointerEx (in: hFile=0x12dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.036] WriteFile (in: hFile=0x12dc, lpBuffer=0x5b56090*, nNumberOfBytesToWrite=0x82ce, lpNumberOfBytesWritten=0x1d77fdd0, lpOverlapped=0x0 | out: lpBuffer=0x5b56090*, lpNumberOfBytesWritten=0x1d77fdd0*=0x82ce, lpOverlapped=0x0) returned 1 [0078.160] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9200 [0078.160] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9318 [0078.160] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9318) returned 1 [0078.160] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5b56090) returned 1 [0078.160] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5b49888) returned 1 [0078.160] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496ad0) returned 1 [0078.161] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5890) returned 1 [0078.161] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x33) returned 0x5bc75c8 [0078.161] SetFilePointerEx (in: hFile=0x12dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.161] WriteFile (in: hFile=0x12dc, lpBuffer=0x54063c0*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0x1d77fe38, lpOverlapped=0x0 | out: lpBuffer=0x54063c0*, lpNumberOfBytesWritten=0x1d77fe38*=0x117, lpOverlapped=0x0) returned 1 [0078.208] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54063c0) returned 1 [0078.208] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bc7148) returned 1 [0078.208] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c92c8) returned 1 [0078.208] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bc75c8) returned 1 [0078.208] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9200) returned 1 [0078.208] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a50d0) returned 1 [0078.208] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c97f0) returned 1 [0078.208] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9818) returned 1 [0078.208] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x96) returned 0x55c6ed8 [0078.208] wcscpy (in: _Dest=0x55c6ed8, _Source="C:\\Users\\FD1HVy\\Videos\\dYrp6RPEfNrynZ9.flv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\dYrp6RPEfNrynZ9.flv") returned="C:\\Users\\FD1HVy\\Videos\\dYrp6RPEfNrynZ9.flv" [0078.208] wcscat (in: _Dest=0x55c6ed8, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\dYrp6RPEfNrynZ9.flv.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\Videos\\dYrp6RPEfNrynZ9.flv.mailto[knoocknoo@cock.li].a0a70" [0078.208] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\Videos\\dYrp6RPEfNrynZ9.flv.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1d77fdf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\Videos\\dYrp6RPEfNrynZ9.flv.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0078.208] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xac) returned 0x55c7a38 Thread: id = 781 os_tid = 0x1b60 [0078.037] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x541b258 [0078.037] wcscpy (in: _Dest=0x541b258, _Source="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi" [0078.037] wcscat (in: _Dest=0x541b258, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\" [0078.037] wcscat (in: _Dest=0x541b258, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\*") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\*" [0078.037] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54641a0 [0078.037] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\*", lpFindFileData=0x54641a0 | out: lpFindFileData=0x54641a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46190940, ftCreationTime.dwHighDateTime=0x1d5cb91, ftLastAccessTime.dwLowDateTime=0xe666b640, ftLastAccessTime.dwHighDateTime=0x1d5cd26, ftLastWriteTime.dwLowDateTime=0xe666b640, ftLastWriteTime.dwHighDateTime=0x1d5cd26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444e80 [0078.037] wcscmp (_String1=".", _String2=".") returned 0 [0078.037] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x54641a0 | out: lpFindFileData=0x54641a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46190940, ftCreationTime.dwHighDateTime=0x1d5cb91, ftLastAccessTime.dwLowDateTime=0xe666b640, ftLastAccessTime.dwHighDateTime=0x1d5cd26, ftLastWriteTime.dwLowDateTime=0xe666b640, ftLastWriteTime.dwHighDateTime=0x1d5cd26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.037] wcscmp (_String1="..", _String2=".") returned 1 [0078.037] wcscmp (_String1="..", _String2="..") returned 0 [0078.037] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x54641a0 | out: lpFindFileData=0x54641a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f8fe320, ftCreationTime.dwHighDateTime=0x1d5d399, ftLastAccessTime.dwLowDateTime=0xaee79dd0, ftLastAccessTime.dwHighDateTime=0x1d5cc5c, ftLastWriteTime.dwLowDateTime=0xaee79dd0, ftLastWriteTime.dwHighDateTime=0x1d5cc5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bxovOAyqYLs8jk", cAlternateFileName="BXOVOA~1")) returned 1 [0078.037] wcscmp (_String1="bxovOAyqYLs8jk", _String2=".") returned 1 [0078.037] wcscmp (_String1="bxovOAyqYLs8jk", _String2="..") returned 1 [0078.037] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x54680f0 [0078.037] wcscpy (in: _Dest=0x54680f0, _Source="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi" [0078.037] wcscat (in: _Dest=0x54680f0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\" [0078.037] wcscat (in: _Dest=0x54680f0, _Source="bxovOAyqYLs8jk" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk" [0080.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54680f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1378 [0080.814] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x54641a0 | out: lpFindFileData=0x54641a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa49d07b0, ftCreationTime.dwHighDateTime=0x1d5ced8, ftLastAccessTime.dwLowDateTime=0x72b0adf0, ftLastAccessTime.dwHighDateTime=0x1d5d5eb, ftLastWriteTime.dwLowDateTime=0x72b0adf0, ftLastWriteTime.dwHighDateTime=0x1d5d5eb, nFileSizeHigh=0x0, nFileSizeLow=0x15b8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="j1UAx9SN6m.mp4", cAlternateFileName="J1UAX9~1.MP4")) returned 1 [0080.814] wcscmp (_String1="j1UAx9SN6m.mp4", _String2=".") returned 1 [0080.814] wcscmp (_String1="j1UAx9SN6m.mp4", _String2="..") returned 1 [0080.814] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x5ba7c78 [0080.814] wcscpy (in: _Dest=0x5ba7c78, _Source="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi" [0080.815] wcscat (in: _Dest=0x5ba7c78, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\" [0080.815] wcscat (in: _Dest=0x5ba7c78, _Source="j1UAx9SN6m.mp4" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\j1UAx9SN6m.mp4") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\j1UAx9SN6m.mp4" [0080.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba7c78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1758 [0080.815] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x54641a0 | out: lpFindFileData=0x54641a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd142ffb0, ftCreationTime.dwHighDateTime=0x1d5cf2b, ftLastAccessTime.dwLowDateTime=0xbd8835b0, ftLastAccessTime.dwHighDateTime=0x1d5d617, ftLastWriteTime.dwLowDateTime=0xbd8835b0, ftLastWriteTime.dwHighDateTime=0x1d5d617, nFileSizeHigh=0x0, nFileSizeLow=0xf46, dwReserved0=0x0, dwReserved1=0x0, cFileName="m3gmDSfSPqv.mkv", cAlternateFileName="M3GMDS~1.MKV")) returned 1 [0080.815] wcscmp (_String1="m3gmDSfSPqv.mkv", _String2=".") returned 1 [0080.815] wcscmp (_String1="m3gmDSfSPqv.mkv", _String2="..") returned 1 [0080.816] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x5ba7ce8 [0080.816] wcscpy (in: _Dest=0x5ba7ce8, _Source="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi" [0080.816] wcscat (in: _Dest=0x5ba7ce8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\" [0080.816] wcscat (in: _Dest=0x5ba7ce8, _Source="m3gmDSfSPqv.mkv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\m3gmDSfSPqv.mkv") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\m3gmDSfSPqv.mkv" [0080.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba7ce8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x175c [0080.816] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x54641a0 | out: lpFindFileData=0x54641a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5728d90, ftCreationTime.dwHighDateTime=0x1d5d103, ftLastAccessTime.dwLowDateTime=0x2970aa60, ftLastAccessTime.dwHighDateTime=0x1d5d333, ftLastWriteTime.dwLowDateTime=0x2970aa60, ftLastWriteTime.dwHighDateTime=0x1d5d333, nFileSizeHigh=0x0, nFileSizeLow=0x10f5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MWfD9AasOya.flv", cAlternateFileName="MWFD9A~1.FLV")) returned 1 [0080.816] wcscmp (_String1="MWfD9AasOya.flv", _String2=".") returned 1 [0080.816] wcscmp (_String1="MWfD9AasOya.flv", _String2="..") returned 1 [0080.816] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x5ba77a8 [0080.816] wcscpy (in: _Dest=0x5ba77a8, _Source="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi" [0080.817] wcscat (in: _Dest=0x5ba77a8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\" [0080.817] wcscat (in: _Dest=0x5ba77a8, _Source="MWfD9AasOya.flv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\MWfD9AasOya.flv") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\MWfD9AasOya.flv" [0080.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba77a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1760 [0080.817] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x54641a0 | out: lpFindFileData=0x54641a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b077210, ftCreationTime.dwHighDateTime=0x1d5ceae, ftLastAccessTime.dwLowDateTime=0x39977820, ftLastAccessTime.dwHighDateTime=0x1d5c829, ftLastWriteTime.dwLowDateTime=0x39977820, ftLastWriteTime.dwHighDateTime=0x1d5c829, nFileSizeHigh=0x0, nFileSizeLow=0x1369f, dwReserved0=0x0, dwReserved1=0x0, cFileName="nMiOK6zeTStn.mkv", cAlternateFileName="NMIOK6~1.MKV")) returned 1 [0080.817] wcscmp (_String1="nMiOK6zeTStn.mkv", _String2=".") returned 1 [0080.817] wcscmp (_String1="nMiOK6zeTStn.mkv", _String2="..") returned 1 [0080.817] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x68) returned 0x5ba71f8 [0080.817] wcscpy (in: _Dest=0x5ba71f8, _Source="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi" [0080.817] wcscat (in: _Dest=0x5ba71f8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\" [0080.817] wcscat (in: _Dest=0x5ba71f8, _Source="nMiOK6zeTStn.mkv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\nMiOK6zeTStn.mkv") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\nMiOK6zeTStn.mkv" [0080.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba71f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1764 [0080.818] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x54641a0 | out: lpFindFileData=0x54641a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3171ed0, ftCreationTime.dwHighDateTime=0x1d5cfac, ftLastAccessTime.dwLowDateTime=0xe8e7800, ftLastAccessTime.dwHighDateTime=0x1d5c7ba, ftLastWriteTime.dwLowDateTime=0xe8e7800, ftLastWriteTime.dwHighDateTime=0x1d5c7ba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oh5", cAlternateFileName="")) returned 1 [0080.818] wcscmp (_String1="Oh5", _String2=".") returned 1 [0080.818] wcscmp (_String1="Oh5", _String2="..") returned 1 [0080.818] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x757e6b0 [0080.818] wcscpy (in: _Dest=0x757e6b0, _Source="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi" [0080.818] wcscat (in: _Dest=0x757e6b0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\" [0080.818] wcscat (in: _Dest=0x757e6b0, _Source="Oh5" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5" [0080.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x757e6b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1768 [0080.819] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x54641a0 | out: lpFindFileData=0x54641a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50347a60, ftCreationTime.dwHighDateTime=0x1d5ca18, ftLastAccessTime.dwLowDateTime=0xfe2252a0, ftLastAccessTime.dwHighDateTime=0x1d5d41d, ftLastWriteTime.dwLowDateTime=0xfe2252a0, ftLastWriteTime.dwHighDateTime=0x1d5d41d, nFileSizeHigh=0x0, nFileSizeLow=0x16c7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WocACWczdEi.avi", cAlternateFileName="WOCACW~1.AVI")) returned 1 [0080.819] wcscmp (_String1="WocACWczdEi.avi", _String2=".") returned 1 [0080.819] wcscmp (_String1="WocACWczdEi.avi", _String2="..") returned 1 [0080.819] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x5ba7658 [0080.819] wcscpy (in: _Dest=0x5ba7658, _Source="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi" [0080.819] wcscat (in: _Dest=0x5ba7658, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\" [0080.819] wcscat (in: _Dest=0x5ba7658, _Source="WocACWczdEi.avi" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\WocACWczdEi.avi") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\WocACWczdEi.avi" [0080.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba7658, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x176c [0080.820] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x54641a0 | out: lpFindFileData=0x54641a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50347a60, ftCreationTime.dwHighDateTime=0x1d5ca18, ftLastAccessTime.dwLowDateTime=0xfe2252a0, ftLastAccessTime.dwHighDateTime=0x1d5d41d, ftLastWriteTime.dwLowDateTime=0xfe2252a0, ftLastWriteTime.dwHighDateTime=0x1d5d41d, nFileSizeHigh=0x0, nFileSizeLow=0x16c7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WocACWczdEi.avi", cAlternateFileName="WOCACW~1.AVI")) returned 0 [0080.820] FindClose (in: hFindFile=0x5444e80 | out: hFindFile=0x5444e80) returned 1 [0080.820] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54641a0) returned 1 [0080.820] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541b258) returned 1 [0080.820] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5532800) returned 1 Thread: id = 782 os_tid = 0x1b64 [0078.038] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\iLYC1Kq.swf" (normalized: "c:\\users\\fd1hvy\\videos\\ilyc1kq.swf")) returned 0x20 [0078.038] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\iLYC1Kq.swf", dwFileAttributes=0x20) returned 1 [0078.038] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\iLYC1Kq.swf" (normalized: "c:\\users\\fd1hvy\\videos\\ilyc1kq.swf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x12e4 [0078.038] GetFileSizeEx (in: hFile=0x12e4, lpFileSize=0x1d87f918 | out: lpFileSize=0x1d87f918*=50887) returned 1 [0078.038] SetFilePointerEx (in: hFile=0x12e4, liDistanceToMove=0xc6c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.038] ReadFile (in: hFile=0x12e4, lpBuffer=0x1d87f89c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d87f898, lpOverlapped=0x0 | out: lpBuffer=0x1d87f89c*, lpNumberOfBytesRead=0x1d87f898*=0x4, lpOverlapped=0x0) returned 1 [0078.038] SetFilePointerEx (in: hFile=0x12e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.038] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9840 [0078.038] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9660 [0078.038] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9868 [0078.039] NtQuerySystemTime (in: CurrentTime=0x1d87f878 | out: CurrentTime=0x1d87f878*=132260136351991697) returned 0x0 [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0xe50e58b3 [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0xf0bc9616 [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0x67931feb [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0xcf982bb8 [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0xe97d80a8 [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0xc40bce1 [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0xcfe17a64 [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0xff8d2e82 [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0x5514929a [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0x6a324b59 [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0x9653713c [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0x1bfbc52 [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0x476db348 [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0x2956762c [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0xd9aac8c9 [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0x410bcb5f [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0xdfb068c5 [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0xc959cb02 [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0xe4dbfc3f [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0x22e8bc37 [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0xe35ceafa [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0xb02721a0 [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0xd5c0be0d [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0x2b1ca0 [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0xb69b12cd [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0xfa237b8e [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0x9fa767ac [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0x640d613e [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0xde26ce8b [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0x6ef5fbf6 [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0xc4bf389a [0078.039] RtlRandom (in: Seed=0x1d87f884 | out: Seed=0x1d87f884) returned 0xcdc2073e [0078.050] ReadFile (in: hFile=0x12e4, lpBuffer=0x5b62898, nNumberOfBytesToRead=0xc6c7, lpNumberOfBytesRead=0x1d87f874, lpOverlapped=0x0 | out: lpBuffer=0x5b62898*, lpNumberOfBytesRead=0x1d87f874*=0xc6c7, lpOverlapped=0x0) returned 1 [0078.051] SetFilePointerEx (in: hFile=0x12e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.051] WriteFile (in: hFile=0x12e4, lpBuffer=0x5b6f0a0*, nNumberOfBytesToWrite=0xc6c7, lpNumberOfBytesWritten=0x1d87f870, lpOverlapped=0x0 | out: lpBuffer=0x5b6f0a0*, lpNumberOfBytesWritten=0x1d87f870*=0xc6c7, lpOverlapped=0x0) returned 1 [0078.162] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9408 [0078.162] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9430 [0078.162] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9430) returned 1 [0078.162] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5b6f0a0) returned 1 [0078.187] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5b62898) returned 1 [0078.193] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496b48) returned 1 [0078.193] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0078.193] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x23) returned 0x38a67f0 [0078.193] SetFilePointerEx (in: hFile=0x12e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.193] WriteFile (in: hFile=0x12e4, lpBuffer=0x549c1c8*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x1d87f8d8, lpOverlapped=0x0 | out: lpBuffer=0x549c1c8*, lpNumberOfBytesWritten=0x1d87f8d8*=0x107, lpOverlapped=0x0) returned 1 [0078.209] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549c1c8) returned 1 [0078.209] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6820) returned 1 [0078.210] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9228) returned 1 [0078.210] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a67f0) returned 1 [0078.210] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9408) returned 1 [0078.210] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9660) returned 1 [0078.210] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9638) returned 1 [0078.210] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9890) returned 1 [0078.210] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x86) returned 0x549d9e8 [0078.210] wcscpy (in: _Dest=0x549d9e8, _Source="C:\\Users\\FD1HVy\\Videos\\iLYC1Kq.swf" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\iLYC1Kq.swf") returned="C:\\Users\\FD1HVy\\Videos\\iLYC1Kq.swf" [0078.210] wcscat (in: _Dest=0x549d9e8, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\iLYC1Kq.swf.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\Videos\\iLYC1Kq.swf.mailto[knoocknoo@cock.li].a0a70" [0078.210] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\Videos\\iLYC1Kq.swf.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1d87f890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\Videos\\iLYC1Kq.swf.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0078.210] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9c) returned 0x54a19c8 Thread: id = 783 os_tid = 0x1b68 [0078.052] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\JAMR22Wfa.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\jamr22wfa.mp4")) returned 0x20 [0078.053] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\JAMR22Wfa.mp4", dwFileAttributes=0x20) returned 1 [0078.053] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\JAMR22Wfa.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\jamr22wfa.mp4"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x12e8 [0078.053] GetFileSizeEx (in: hFile=0x12e8, lpFileSize=0x1d8ffd74 | out: lpFileSize=0x1d8ffd74*=50407) returned 1 [0078.053] SetFilePointerEx (in: hFile=0x12e8, liDistanceToMove=0xc4e3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.053] ReadFile (in: hFile=0x12e8, lpBuffer=0x1d8ffcf8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d8ffcf4, lpOverlapped=0x0 | out: lpBuffer=0x1d8ffcf8*, lpNumberOfBytesRead=0x1d8ffcf4*=0x4, lpOverlapped=0x0) returned 1 [0078.053] SetFilePointerEx (in: hFile=0x12e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.053] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9840 [0078.053] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9688 [0078.053] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9868 [0078.053] NtQuerySystemTime (in: CurrentTime=0x1d8ffcd4 | out: CurrentTime=0x1d8ffcd4*=132260136352147779) returned 0x0 [0078.053] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0xaa29f124 [0078.053] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0x4a199296 [0078.053] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0xabd08751 [0078.053] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0xb87277c2 [0078.053] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0xfdbdfd4d [0078.053] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0x3767f154 [0078.053] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0x7f0362e5 [0078.053] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0x53e0030a [0078.053] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0x6a02c5e1 [0078.053] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0x6a632d60 [0078.053] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0x9c6c3742 [0078.053] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0xeb6e5b07 [0078.053] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0xe856a1cd [0078.053] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0xdb615490 [0078.053] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0xedf9252f [0078.054] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0xcc11d0ca [0078.054] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0xf64ee5ce [0078.054] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0x6e2d672b [0078.054] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0x9e78abbc [0078.054] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0xe3a4393f [0078.054] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0xd8dd4867 [0078.054] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0xea2aec99 [0078.054] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0xd99c1086 [0078.054] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0xae5ad399 [0078.054] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0xa70a814b [0078.054] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0x206b5d9c [0078.054] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0x2beab652 [0078.054] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0x4b57c3e3 [0078.054] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0xf14fc6bb [0078.054] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0x5a056a63 [0078.054] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0xf179ea13 [0078.054] RtlRandom (in: Seed=0x1d8ffce0 | out: Seed=0x1d8ffce0) returned 0xc8d0671e [0078.064] ReadFile (in: hFile=0x12e8, lpBuffer=0x5b7b8a8, nNumberOfBytesToRead=0xc4e7, lpNumberOfBytesRead=0x1d8ffcd0, lpOverlapped=0x0 | out: lpBuffer=0x5b7b8a8*, lpNumberOfBytesRead=0x1d8ffcd0*=0xc4e7, lpOverlapped=0x0) returned 1 [0078.066] SetFilePointerEx (in: hFile=0x12e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.066] WriteFile (in: hFile=0x12e8, lpBuffer=0x5b880b0*, nNumberOfBytesToWrite=0xc4e7, lpNumberOfBytesWritten=0x1d8ffccc, lpOverlapped=0x0 | out: lpBuffer=0x5b880b0*, lpNumberOfBytesWritten=0x1d8ffccc*=0xc4e7, lpOverlapped=0x0) returned 1 [0078.194] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9430 [0078.194] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9458 [0078.194] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9458) returned 1 [0078.194] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5b880b0) returned 1 [0078.195] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5b7b8a8) returned 1 [0078.195] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496bc0) returned 1 [0078.195] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a59b0) returned 1 [0078.195] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x27) returned 0x38a6850 [0078.195] SetFilePointerEx (in: hFile=0x12e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.195] WriteFile (in: hFile=0x12e8, lpBuffer=0x55c98c0*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x1d8ffd34, lpOverlapped=0x0 | out: lpBuffer=0x55c98c0*, lpNumberOfBytesWritten=0x1d8ffd34*=0x10b, lpOverlapped=0x0) returned 1 [0078.212] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c98c0) returned 1 [0078.212] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6880) returned 1 [0078.212] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9250) returned 1 [0078.212] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6850) returned 1 [0078.212] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9430) returned 1 [0078.212] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9688) returned 1 [0078.212] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c96b0) returned 1 [0078.212] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c95e8) returned 1 [0078.212] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8a) returned 0x549f1d8 [0078.212] wcscpy (in: _Dest=0x549f1d8, _Source="C:\\Users\\FD1HVy\\Videos\\JAMR22Wfa.mp4" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\JAMR22Wfa.mp4") returned="C:\\Users\\FD1HVy\\Videos\\JAMR22Wfa.mp4" [0078.213] wcscat (in: _Dest=0x549f1d8, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\JAMR22Wfa.mp4.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\Videos\\JAMR22Wfa.mp4.mailto[knoocknoo@cock.li].a0a70" [0078.213] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\Videos\\JAMR22Wfa.mp4.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1d8ffcec, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\Videos\\JAMR22Wfa.mp4.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0078.213] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa0) returned 0x54a0ca8 Thread: id = 784 os_tid = 0x1b6c [0078.067] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SNKrcMAU.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\snkrcmau.mkv")) returned 0x20 [0078.067] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SNKrcMAU.mkv", dwFileAttributes=0x20) returned 1 [0078.067] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SNKrcMAU.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\snkrcmau.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x12ec [0078.067] GetFileSizeEx (in: hFile=0x12ec, lpFileSize=0x1d97fe4c | out: lpFileSize=0x1d97fe4c*=38218) returned 1 [0078.068] SetFilePointerEx (in: hFile=0x12ec, liDistanceToMove=0x9546, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.068] ReadFile (in: hFile=0x12ec, lpBuffer=0x1d97fdd0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d97fdcc, lpOverlapped=0x0 | out: lpBuffer=0x1d97fdd0*, lpNumberOfBytesRead=0x1d97fdcc*=0x4, lpOverlapped=0x0) returned 1 [0078.068] SetFilePointerEx (in: hFile=0x12ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.068] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9868 [0078.068] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c96d8 [0078.068] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9610 [0078.068] NtQuerySystemTime (in: CurrentTime=0x1d97fdac | out: CurrentTime=0x1d97fdac*=132260136352304294) returned 0x0 [0078.068] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0x9e949133 [0078.068] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0xa56cc9c6 [0078.068] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0xdf55cfef [0078.068] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0x1803d71f [0078.068] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0x9acd86e8 [0078.068] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0xc5d80c88 [0078.068] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0x161ed2a0 [0078.068] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0x317ab05a [0078.068] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0x402f67b9 [0078.068] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0x1ec1aa6a [0078.068] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0xdbf0e12c [0078.068] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0x2e49c23c [0078.068] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0xe5005d57 [0078.068] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0x23c738ce [0078.068] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0x317f99 [0078.068] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0x97150ae2 [0078.068] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0x92a2a19e [0078.068] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0xa5882226 [0078.068] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0x874f20e9 [0078.068] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0xd124768d [0078.068] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0x2af40c2 [0078.068] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0xb6b9cc74 [0078.068] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0x4be59edd [0078.068] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0x3a58fe5f [0078.068] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0xd677ceac [0078.068] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0xc29d7cc6 [0078.068] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0xe0969d86 [0078.068] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0xa07863c9 [0078.068] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0x7c62527d [0078.069] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0xc4ac52c3 [0078.069] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0xf00d884 [0078.069] RtlRandom (in: Seed=0x1d97fdb8 | out: Seed=0x1d97fdb8) returned 0xf8ec7b0d [0078.079] ReadFile (in: hFile=0x12ec, lpBuffer=0x5b948b8, nNumberOfBytesToRead=0x954a, lpNumberOfBytesRead=0x1d97fda8, lpOverlapped=0x0 | out: lpBuffer=0x5b948b8*, lpNumberOfBytesRead=0x1d97fda8*=0x954a, lpOverlapped=0x0) returned 1 [0078.080] SetFilePointerEx (in: hFile=0x12ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.080] WriteFile (in: hFile=0x12ec, lpBuffer=0x5ba10c0*, nNumberOfBytesToWrite=0x954a, lpNumberOfBytesWritten=0x1d97fda4, lpOverlapped=0x0 | out: lpBuffer=0x5ba10c0*, lpNumberOfBytesWritten=0x1d97fda4*=0x954a, lpOverlapped=0x0) returned 1 [0078.196] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9458 [0078.196] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9480 [0078.196] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9480) returned 1 [0078.196] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba10c0) returned 1 [0078.196] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5b948b8) returned 1 [0078.201] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496c38) returned 1 [0078.201] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5a88) returned 1 [0078.201] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x25) returned 0x38a68b0 [0078.201] SetFilePointerEx (in: hFile=0x12ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.201] WriteFile (in: hFile=0x12ec, lpBuffer=0x5b17868*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x1d97fe0c, lpOverlapped=0x0 | out: lpBuffer=0x5b17868*, lpNumberOfBytesWritten=0x1d97fe0c*=0x109, lpOverlapped=0x0) returned 1 [0078.213] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5b17868) returned 1 [0078.213] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a68e0) returned 1 [0078.213] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9278) returned 1 [0078.213] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a68b0) returned 1 [0078.213] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9458) returned 1 [0078.213] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c96d8) returned 1 [0078.213] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9750) returned 1 [0078.213] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9700) returned 1 [0078.213] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x88) returned 0x549d178 [0078.214] wcscpy (in: _Dest=0x549d178, _Source="C:\\Users\\FD1HVy\\Videos\\SNKrcMAU.mkv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SNKrcMAU.mkv") returned="C:\\Users\\FD1HVy\\Videos\\SNKrcMAU.mkv" [0078.214] wcscat (in: _Dest=0x549d178, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SNKrcMAU.mkv.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\Videos\\SNKrcMAU.mkv.mailto[knoocknoo@cock.li].a0a70" [0078.214] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\Videos\\SNKrcMAU.mkv.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1d97fdc4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\Videos\\SNKrcMAU.mkv.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0078.214] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9e) returned 0x54a0ff0 Thread: id = 785 os_tid = 0x1b70 [0078.081] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\YAw1mXxnf1gDdzqF5w4N.flv" (normalized: "c:\\users\\fd1hvy\\videos\\yaw1mxxnf1gddzqf5w4n.flv")) returned 0x20 [0078.081] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\YAw1mXxnf1gDdzqF5w4N.flv", dwFileAttributes=0x20) returned 1 [0078.081] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\YAw1mXxnf1gDdzqF5w4N.flv" (normalized: "c:\\users\\fd1hvy\\videos\\yaw1mxxnf1gddzqf5w4n.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x12f0 [0078.081] GetFileSizeEx (in: hFile=0x12f0, lpFileSize=0x1d9fff3c | out: lpFileSize=0x1d9fff3c*=81198) returned 1 [0078.081] SetFilePointerEx (in: hFile=0x12f0, liDistanceToMove=0x13d2a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.082] ReadFile (in: hFile=0x12f0, lpBuffer=0x1d9ffec0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d9ffebc, lpOverlapped=0x0 | out: lpBuffer=0x1d9ffec0*, lpNumberOfBytesRead=0x1d9ffebc*=0x4, lpOverlapped=0x0) returned 1 [0078.082] SetFilePointerEx (in: hFile=0x12f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.082] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9868 [0078.082] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9728 [0078.082] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9610 [0078.082] NtQuerySystemTime (in: CurrentTime=0x1d9ffe9c | out: CurrentTime=0x1d9ffe9c*=132260136352481411) returned 0x0 [0078.082] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0x48119967 [0078.082] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0xec93ca13 [0078.082] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0xc5762991 [0078.082] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0x18728e0f [0078.082] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0xcb240610 [0078.082] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0x260f5af4 [0078.082] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0x37c73978 [0078.082] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0xa4b0e0f9 [0078.082] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0x3998cc92 [0078.082] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0x10c9fc1a [0078.082] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0xe620844e [0078.082] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0x64c69ebe [0078.082] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0x9960bd26 [0078.082] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0xd8841f67 [0078.082] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0x38c22dd2 [0078.082] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0x9ff4e8a4 [0078.082] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0x321074e0 [0078.082] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0xe081d41d [0078.082] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0x2b673f2d [0078.082] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0xcbefbc05 [0078.082] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0x79c631d [0078.082] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0xbcc04cf4 [0078.082] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0x756ac975 [0078.082] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0x65ecaf25 [0078.082] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0xa9e25eab [0078.082] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0xde7e5da0 [0078.082] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0xc1d85528 [0078.082] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0x82c228e1 [0078.082] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0x3537c342 [0078.082] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0xc6a273ea [0078.083] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0xbd946450 [0078.083] RtlRandom (in: Seed=0x1d9ffea8 | out: Seed=0x1d9ffea8) returned 0x61f00512 [0078.094] SetFilePointerEx (in: hFile=0x12f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.095] ReadFile (in: hFile=0x12f0, lpBuffer=0x5bad8c8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1d9ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x5bad8c8*, lpNumberOfBytesRead=0x1d9ffe7c*=0xc800, lpOverlapped=0x0) returned 1 [0078.095] SetFilePointerEx (in: hFile=0x12f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.095] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5ad0 [0078.095] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5496cb0 [0078.095] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c97a0 [0078.095] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c97a0) returned 1 [0078.097] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5bba0d0 [0078.102] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c97a0 [0078.102] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9840 [0078.102] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9840) returned 1 [0078.102] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496cb0) returned 1 [0078.102] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5ad0) returned 1 [0078.102] WriteFile (in: hFile=0x12f0, lpBuffer=0x5bba0d0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1d9ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x5bba0d0*, lpNumberOfBytesWritten=0x1d9ffe7c*=0xc800, lpOverlapped=0x0) returned 1 [0078.202] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bba0d0) returned 1 [0078.202] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bad8c8) returned 1 [0078.202] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3d) returned 0x38a5890 [0078.202] SetFilePointerEx (in: hFile=0x12f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.202] WriteFile (in: hFile=0x12f0, lpBuffer=0x5b17980*, nNumberOfBytesToWrite=0x121, lpNumberOfBytesWritten=0x1d9ffefc, lpOverlapped=0x0 | out: lpBuffer=0x5b17980*, lpNumberOfBytesWritten=0x1d9ffefc*=0x121, lpOverlapped=0x0) returned 1 [0078.215] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5b17980) returned 1 [0078.215] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a59b0) returned 1 [0078.215] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c92f0) returned 1 [0078.215] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5890) returned 1 [0078.215] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c97a0) returned 1 [0078.215] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9728) returned 1 [0078.215] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c97c8) returned 1 [0078.215] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9778) returned 1 [0078.215] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa0) returned 0x54a1290 [0078.215] wcscpy (in: _Dest=0x54a1290, _Source="C:\\Users\\FD1HVy\\Videos\\YAw1mXxnf1gDdzqF5w4N.flv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\YAw1mXxnf1gDdzqF5w4N.flv") returned="C:\\Users\\FD1HVy\\Videos\\YAw1mXxnf1gDdzqF5w4N.flv" [0078.215] wcscat (in: _Dest=0x54a1290, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\YAw1mXxnf1gDdzqF5w4N.flv.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\Videos\\YAw1mXxnf1gDdzqF5w4N.flv.mailto[knoocknoo@cock.li].a0a70" [0078.215] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\Videos\\YAw1mXxnf1gDdzqF5w4N.flv.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x1d9ffeb4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\Videos\\YAw1mXxnf1gDdzqF5w4N.flv.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0078.215] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb6) returned 0x5b16b50 Thread: id = 786 os_tid = 0x1b74 [0078.103] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\everywhere.search-ms")) returned 0x23 [0082.115] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", dwFileAttributes=0x20) returned 1 [0089.638] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\everywhere.search-ms"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x74c [0089.638] GetFileSizeEx (in: hFile=0x74c, lpFileSize=0x1da7fefc | out: lpFileSize=0x1da7fefc*=248) returned 1 [0089.638] SetFilePointerEx (in: hFile=0x74c, liDistanceToMove=0xf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.638] ReadFile (in: hFile=0x74c, lpBuffer=0x1da7fe80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1da7fe7c, lpOverlapped=0x0 | out: lpBuffer=0x1da7fe80*, lpNumberOfBytesRead=0x1da7fe7c*=0x4, lpOverlapped=0x0) returned 1 [0089.641] SetFilePointerEx (in: hFile=0x74c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.641] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080a60 [0089.641] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0809c0 [0089.641] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080718 [0089.641] NtQuerySystemTime (in: CurrentTime=0x1da7fe5c | out: CurrentTime=0x1da7fe5c*=132260136468067519) returned 0x0 [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0x462fc1f [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0x43287a87 [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0x4dfb1d8a [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0x52bfc5fc [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0x561c5e58 [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0xe26d1611 [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0x7f20dc17 [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0x20fb0d8f [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0x43262ade [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0xd41fec71 [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0x33e57639 [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0x6ffeb3ab [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0xe785a6a6 [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0x3e19325f [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0xd5e87d2a [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0x64894a71 [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0x72667dd [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0x7f7a6a4c [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0x357ed4d6 [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0x29d09b74 [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0x64359bb7 [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0xea418b04 [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0x55775951 [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0xee65718f [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0xe1baf525 [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0x29cd3a61 [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0x74c5e1c [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0xfea889ae [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0xcbb4369 [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0x4329a217 [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0x17651cc2 [0089.641] RtlRandom (in: Seed=0x1da7fe68 | out: Seed=0x1da7fe68) returned 0x4e2d35c4 [0091.464] ReadFile (in: hFile=0x74c, lpBuffer=0x70f59e0, nNumberOfBytesToRead=0xf8, lpNumberOfBytesRead=0x1da7fe58, lpOverlapped=0x0 | out: lpBuffer=0x70f59e0*, lpNumberOfBytesRead=0x1da7fe58*=0xf8, lpOverlapped=0x0) returned 1 [0091.464] SetFilePointerEx (in: hFile=0x74c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.464] WriteFile (hFile=0x74c, lpBuffer=0x71021e8, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x1da7fe54, lpOverlapped=0x0) Thread: id = 787 os_tid = 0x1b78 [0078.106] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\indexed locations.search-ms")) returned 0x23 [0082.272] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", dwFileAttributes=0x20) returned 1 [0089.655] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\indexed locations.search-ms"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x7b8 [0089.665] GetFileSizeEx (in: hFile=0x7b8, lpFileSize=0x1daffbb0 | out: lpFileSize=0x1daffbb0*=248) returned 1 [0089.665] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0xf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.665] ReadFile (in: hFile=0x7b8, lpBuffer=0x1daffb34, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1daffb30, lpOverlapped=0x0 | out: lpBuffer=0x1daffb34*, lpNumberOfBytesRead=0x1daffb30*=0x4, lpOverlapped=0x0) returned 1 [0089.666] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.666] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080a60 [0089.666] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080a10 [0089.666] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080718 [0089.666] NtQuerySystemTime (in: CurrentTime=0x1daffb10 | out: CurrentTime=0x1daffb10*=132260136468212429) returned 0x0 [0089.666] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0x29079887 [0089.666] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0xb2296498 [0089.666] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0x74fb85d1 [0089.666] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0xf6bf73c2 [0089.666] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0xb6f957d [0089.666] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0xf79505a5 [0089.666] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0x57c310ba [0089.666] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0x79ec2025 [0089.666] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0xd0633873 [0089.667] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0xfe89fed2 [0089.667] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0xe4788c9b [0089.667] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0x3c2d01b5 [0089.667] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0x3532546f [0089.667] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0xd805633b [0089.667] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0x64917c52 [0089.667] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0x26e55f95 [0089.667] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0x5ffc0a9e [0089.667] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0x390c8c92 [0089.667] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0x276369cc [0089.667] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0xfe777d8a [0089.667] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0x7d767fb1 [0089.667] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0xe682c240 [0089.667] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0xa5c89f73 [0089.667] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0x35982f6f [0089.667] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0x1e43b178 [0089.667] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0x47bf2e29 [0089.667] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0x78067668 [0089.667] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0xb56dcc31 [0089.667] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0x746afce1 [0089.667] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0x47a9a1c7 [0089.667] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0xb1fc330 [0089.667] RtlRandom (in: Seed=0x1daffb1c | out: Seed=0x1daffb1c) returned 0x646209b3 [0091.460] ReadFile (in: hFile=0x7b8, lpBuffer=0x74798b8, nNumberOfBytesToRead=0xf8, lpNumberOfBytesRead=0x1daffb0c, lpOverlapped=0x0 | out: lpBuffer=0x74798b8*, lpNumberOfBytesRead=0x1daffb0c*=0xf8, lpOverlapped=0x0) returned 1 [0091.461] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.461] WriteFile (hFile=0x7b8, lpBuffer=0x74860c0, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x1daffb08, lpOverlapped=0x0) Thread: id = 788 os_tid = 0x1b7c [0078.106] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms")) returned 0x20 [0082.220] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", dwFileAttributes=0x20) returned 1 [0082.220] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d30 [0082.221] GetFileSizeEx (in: hFile=0x1d30, lpFileSize=0x1db7fe90 | out: lpFileSize=0x1db7fe90*=855) returned 1 [0082.221] SetFilePointerEx (in: hFile=0x1d30, liDistanceToMove=0x353, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.221] ReadFile (in: hFile=0x1d30, lpBuffer=0x1db7fe14, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1db7fe10, lpOverlapped=0x0 | out: lpBuffer=0x1db7fe14*, lpNumberOfBytesRead=0x1db7fe10*=0x4, lpOverlapped=0x0) returned 1 [0082.223] SetFilePointerEx (in: hFile=0x1d30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.223] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 789 os_tid = 0x1b80 [0078.108] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\-09CD4P-xMTV.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\-09cd4p-xmtv.bmp")) returned 0x20 [0078.108] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\-09CD4P-xMTV.bmp", dwFileAttributes=0x20) returned 1 [0078.108] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\-09CD4P-xMTV.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\-09cd4p-xmtv.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x12f4 [0078.108] GetFileSizeEx (in: hFile=0x12f4, lpFileSize=0x1dbffe30 | out: lpFileSize=0x1dbffe30*=59798) returned 1 [0078.108] SetFilePointerEx (in: hFile=0x12f4, liDistanceToMove=0xe992, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.108] ReadFile (in: hFile=0x12f4, lpBuffer=0x1dbffdb4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1dbffdb0, lpOverlapped=0x0 | out: lpBuffer=0x1dbffdb4*, lpNumberOfBytesRead=0x1dbffdb0*=0x4, lpOverlapped=0x0) returned 1 [0078.108] SetFilePointerEx (in: hFile=0x12f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.108] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9868 [0078.108] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9840 [0078.108] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9610 [0078.108] NtQuerySystemTime (in: CurrentTime=0x1dbffd90 | out: CurrentTime=0x1dbffd90*=132260136352628666) returned 0x0 [0078.108] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0xd022b8b6 [0078.108] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0x3a1e3a00 [0078.108] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0x4b95eedd [0078.109] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0x517b660a [0078.109] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0xbd7e00e8 [0078.109] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0xbee54786 [0078.109] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0x849ba9f8 [0078.109] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0x3d9a5488 [0078.109] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0x25943b8d [0078.109] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0x1522920d [0078.109] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0x2efbee4d [0078.109] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0x8fab0d8e [0078.109] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0x8cab99a8 [0078.109] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0x29989aad [0078.109] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0xa2b4650d [0078.109] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0x6f6d6084 [0078.109] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0x107382ac [0078.109] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0x216d4776 [0078.109] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0xfb0e54ce [0078.109] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0x8ed8172f [0078.109] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0xc34075d4 [0078.109] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0x35b01592 [0078.109] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0x73bd06aa [0078.109] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0xa3b3157d [0078.109] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0x1eceea5e [0078.109] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0x60b604eb [0078.109] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0x220cdbc3 [0078.109] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0x222fcb54 [0078.109] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0xe621a118 [0078.109] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0xfd9b04c1 [0078.109] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0x585fe984 [0078.109] RtlRandom (in: Seed=0x1dbffd9c | out: Seed=0x1dbffd9c) returned 0x483d77e8 [0078.250] SetFilePointerEx (in: hFile=0x12f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.250] ReadFile (in: hFile=0x12f4, lpBuffer=0x5bad008, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1dbffd70, lpOverlapped=0x0 | out: lpBuffer=0x5bad008*, lpNumberOfBytesRead=0x1dbffd70*=0xc800, lpOverlapped=0x0) returned 1 [0078.250] SetFilePointerEx (in: hFile=0x12f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.250] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5770 [0078.250] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5497688 [0078.250] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9688 [0078.250] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9688) returned 1 [0078.251] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5bb9810 [0078.252] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9778 [0078.252] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c97a0 [0078.252] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c97a0) returned 1 [0078.252] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5497688) returned 1 [0078.252] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5770) returned 1 [0078.252] WriteFile (in: hFile=0x12f4, lpBuffer=0x5bb9810*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1dbffd70, lpOverlapped=0x0 | out: lpBuffer=0x5bb9810*, lpNumberOfBytesWritten=0x1dbffd70*=0xc800, lpOverlapped=0x0) returned 1 [0079.287] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bb9810) returned 1 [0079.287] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bad008) returned 1 [0079.287] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2d) returned 0x38b1100 [0079.287] SetFilePointerEx (in: hFile=0x12f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.288] WriteFile (in: hFile=0x12f4, lpBuffer=0x5406298*, nNumberOfBytesToWrite=0x111, lpNumberOfBytesWritten=0x1dbffdf0, lpOverlapped=0x0 | out: lpBuffer=0x5406298*, lpNumberOfBytesWritten=0x1dbffdf0*=0x111, lpOverlapped=0x0) returned 1 [0082.306] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5406298) Thread: id = 790 os_tid = 0x1b84 [0078.254] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\0-2fU4I-yh6ST.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\0-2fu4i-yh6st.jpg")) returned 0x20 [0078.254] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\0-2fU4I-yh6ST.jpg", dwFileAttributes=0x20) returned 1 [0078.255] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\0-2fU4I-yh6ST.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\0-2fu4i-yh6st.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x12f8 [0078.255] GetFileSizeEx (in: hFile=0x12f8, lpFileSize=0x1dc7fad0 | out: lpFileSize=0x1dc7fad0*=10140) returned 1 [0078.255] SetFilePointerEx (in: hFile=0x12f8, liDistanceToMove=0x2798, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.255] ReadFile (in: hFile=0x12f8, lpBuffer=0x1dc7fa54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1dc7fa50, lpOverlapped=0x0 | out: lpBuffer=0x1dc7fa54*, lpNumberOfBytesRead=0x1dc7fa50*=0x4, lpOverlapped=0x0) returned 1 [0078.255] SetFilePointerEx (in: hFile=0x12f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.255] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9868 [0078.255] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9660 [0078.255] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9890 [0078.255] NtQuerySystemTime (in: CurrentTime=0x1dc7fa30 | out: CurrentTime=0x1dc7fa30*=132260136354191632) returned 0x0 [0078.255] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0x78dbab7b [0078.255] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0xfacea023 [0078.255] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0xa49c8975 [0078.255] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0x73947a5b [0078.255] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0xcc09ab7 [0078.255] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0x1e2ec7f1 [0078.255] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0x9b81af99 [0078.255] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0xc0979a38 [0078.255] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0xfea904a6 [0078.255] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0x845c1007 [0078.255] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0xeefcf19e [0078.255] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0x593109 [0078.255] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0x95a671d7 [0078.255] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0x4276688e [0078.255] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0x28728bea [0078.255] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0x62dbfae8 [0078.255] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0x2d37b9cd [0078.255] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0xf2dee57e [0078.255] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0x1dcb4bbb [0078.255] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0xc5c2e995 [0078.255] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0x8c1aefe6 [0078.255] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0x99f1c32a [0078.256] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0xfa850d56 [0078.256] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0xf4cca0f9 [0078.256] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0xacfb0ac5 [0078.256] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0x1d817662 [0078.256] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0xed74e263 [0078.256] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0xb87b4a3 [0078.256] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0x58484e69 [0078.256] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0xcda20cf7 [0078.256] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0xdceb1072 [0078.256] RtlRandom (in: Seed=0x1dc7fa3c | out: Seed=0x1dc7fa3c) returned 0x21fedc06 [0078.266] ReadFile (in: hFile=0x12f8, lpBuffer=0x5af0048, nNumberOfBytesToRead=0x279c, lpNumberOfBytesRead=0x1dc7fa2c, lpOverlapped=0x0 | out: lpBuffer=0x5af0048*, lpNumberOfBytesRead=0x1dc7fa2c*=0x279c, lpOverlapped=0x0) returned 1 [0078.266] SetFilePointerEx (in: hFile=0x12f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.266] WriteFile (in: hFile=0x12f8, lpBuffer=0x5afc850*, nNumberOfBytesToWrite=0x279c, lpNumberOfBytesWritten=0x1dc7fa28, lpOverlapped=0x0 | out: lpBuffer=0x5afc850*, lpNumberOfBytesWritten=0x1dc7fa28*=0x279c, lpOverlapped=0x0) returned 1 [0082.119] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 791 os_tid = 0x1b88 [0078.271] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\0algdtmoqwEQsbLT.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\0algdtmoqweqsblt.bmp")) returned 0x20 [0078.271] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\0algdtmoqwEQsbLT.bmp", dwFileAttributes=0x20) returned 1 [0078.271] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\0algdtmoqwEQsbLT.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\0algdtmoqweqsblt.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x12fc [0078.271] GetFileSizeEx (in: hFile=0x12fc, lpFileSize=0x1dcffe98 | out: lpFileSize=0x1dcffe98*=28372) returned 1 [0078.271] SetFilePointerEx (in: hFile=0x12fc, liDistanceToMove=0x6ed0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.271] ReadFile (in: hFile=0x12fc, lpBuffer=0x1dcffe1c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1dcffe18, lpOverlapped=0x0 | out: lpBuffer=0x1dcffe1c*, lpNumberOfBytesRead=0x1dcffe18*=0x4, lpOverlapped=0x0) returned 1 [0078.272] SetFilePointerEx (in: hFile=0x12fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.272] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9868 [0078.272] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c96b0 [0078.272] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9750 [0078.272] NtQuerySystemTime (in: CurrentTime=0x1dcffdf8 | out: CurrentTime=0x1dcffdf8*=132260136354347986) returned 0x0 [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0x9620cab2 [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0x1c649c45 [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0x71469900 [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0xfd4edeac [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0x77a33be2 [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0x9723d82f [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0xaeeae8a3 [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0x6586b38b [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0xec2c9a1b [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0x9a7c5268 [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0x28aaaec5 [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0x56f39e51 [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0x325c8408 [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0xa5a4e6b7 [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0xb3056e86 [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0x43d8ae4b [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0x276a4bfc [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0x69e17eaf [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0x9a454779 [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0x878af2ab [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0x54cd1e02 [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0x94ff22e [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0x2750df03 [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0x6c322c81 [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0x5b9d3d4c [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0xc4fb904c [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0x57491272 [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0x2b03192c [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0xc8e8a8b8 [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0x2ef93549 [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0xfb3a6eda [0078.272] RtlRandom (in: Seed=0x1dcffe04 | out: Seed=0x1dcffe04) returned 0xfe69ffdc [0078.282] ReadFile (in: hFile=0x12fc, lpBuffer=0x5b09058, nNumberOfBytesToRead=0x6ed4, lpNumberOfBytesRead=0x1dcffdf4, lpOverlapped=0x0 | out: lpBuffer=0x5b09058*, lpNumberOfBytesRead=0x1dcffdf4*=0x6ed4, lpOverlapped=0x0) returned 1 [0078.283] SetFilePointerEx (in: hFile=0x12fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.283] WriteFile (in: hFile=0x12fc, lpBuffer=0x5b17868*, nNumberOfBytesToWrite=0x6ed4, lpNumberOfBytesWritten=0x1dcffdf0, lpOverlapped=0x0 | out: lpBuffer=0x5b17868*, lpNumberOfBytesWritten=0x1dcffdf0*=0x6ed4, lpOverlapped=0x0) returned 1 [0082.121] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 792 os_tid = 0x1b8c [0078.284] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4V8fHb1NEKeSJc.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4v8fhb1nekesjc.jpg")) returned 0x20 [0078.284] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4V8fHb1NEKeSJc.jpg", dwFileAttributes=0x20) returned 1 [0078.285] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4V8fHb1NEKeSJc.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4v8fhb1nekesjc.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1300 [0078.285] GetFileSizeEx (in: hFile=0x1300, lpFileSize=0x1dd7f888 | out: lpFileSize=0x1dd7f888*=26313) returned 1 [0078.285] SetFilePointerEx (in: hFile=0x1300, liDistanceToMove=0x66c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.285] ReadFile (in: hFile=0x1300, lpBuffer=0x1dd7f80c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1dd7f808, lpOverlapped=0x0 | out: lpBuffer=0x1dd7f80c*, lpNumberOfBytesRead=0x1dd7f808*=0x4, lpOverlapped=0x0) returned 1 [0078.285] SetFilePointerEx (in: hFile=0x1300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.285] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9868 [0078.285] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c96d8 [0078.285] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9610 [0078.285] NtQuerySystemTime (in: CurrentTime=0x1dd7f7e8 | out: CurrentTime=0x1dd7f7e8*=132260136354504581) returned 0x0 [0078.285] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0x363046e6 [0078.285] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0xd91ee8e [0078.285] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0x95266a07 [0078.285] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0x95c75b63 [0078.285] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0xe71ea578 [0078.285] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0x6ccc0f17 [0078.285] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0xd298fb2e [0078.285] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0xea6cf3c [0078.285] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0x1ac7c7bb [0078.285] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0x8d4aedbc [0078.285] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0x7ed71ad4 [0078.285] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0x707ae3ad [0078.285] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0xa47760a8 [0078.285] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0x92f1ead [0078.285] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0xe7290b85 [0078.285] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0x97b94c48 [0078.285] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0x43c37190 [0078.285] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0x776fdea9 [0078.285] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0x1db85df9 [0078.285] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0x22425258 [0078.285] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0x4ea2224a [0078.285] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0xa4bb0cf8 [0078.285] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0xf88a64be [0078.286] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0xeab43131 [0078.286] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0xcd4ca86c [0078.286] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0x703296ae [0078.286] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0x40e3581a [0078.286] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0x692031c1 [0078.286] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0xa5aaba4 [0078.286] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0x9b498d [0078.286] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0x59edb817 [0078.286] RtlRandom (in: Seed=0x1dd7f7f4 | out: Seed=0x1dd7f7f4) returned 0x61591e2f [0078.296] ReadFile (in: hFile=0x1300, lpBuffer=0x5b24070, nNumberOfBytesToRead=0x66c9, lpNumberOfBytesRead=0x1dd7f7e4, lpOverlapped=0x0 | out: lpBuffer=0x5b24070*, lpNumberOfBytesRead=0x1dd7f7e4*=0x66c9, lpOverlapped=0x0) returned 1 [0078.297] SetFilePointerEx (in: hFile=0x1300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.297] WriteFile (in: hFile=0x1300, lpBuffer=0x5b30878*, nNumberOfBytesToWrite=0x66c9, lpNumberOfBytesWritten=0x1dd7f7e0, lpOverlapped=0x0 | out: lpBuffer=0x5b30878*, lpNumberOfBytesWritten=0x1dd7f7e0*=0x66c9, lpOverlapped=0x0) returned 1 [0082.120] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 793 os_tid = 0x1b90 [0078.298] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\AVvZEDdWpVOsZ9.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\avvzeddwpvosz9.jpg")) returned 0x20 [0078.298] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\AVvZEDdWpVOsZ9.jpg", dwFileAttributes=0x20) returned 1 [0078.298] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\AVvZEDdWpVOsZ9.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\avvzeddwpvosz9.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1304 [0078.298] GetFileSizeEx (in: hFile=0x1304, lpFileSize=0x1ddffe34 | out: lpFileSize=0x1ddffe34*=76227) returned 1 [0078.298] SetFilePointerEx (in: hFile=0x1304, liDistanceToMove=0x129bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.298] ReadFile (in: hFile=0x1304, lpBuffer=0x1ddffdb8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ddffdb4, lpOverlapped=0x0 | out: lpBuffer=0x1ddffdb8*, lpNumberOfBytesRead=0x1ddffdb4*=0x4, lpOverlapped=0x0) returned 1 [0078.298] SetFilePointerEx (in: hFile=0x1304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.298] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9868 [0078.298] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9728 [0078.298] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9610 [0078.298] NtQuerySystemTime (in: CurrentTime=0x1ddffd94 | out: CurrentTime=0x1ddffd94*=132260136354504581) returned 0x0 [0078.298] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0x93c40e42 [0078.298] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0xe180a2e3 [0078.298] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0x381cc67b [0078.299] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0xf838e6e0 [0078.299] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0x29918024 [0078.299] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0x886c31a3 [0078.299] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0x6a9a6a08 [0078.299] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0xc0205b7a [0078.299] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0xfa3dfdb0 [0078.299] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0xc8cc5621 [0078.299] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0x6ef5145c [0078.299] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0x1518fafb [0078.299] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0x39430f74 [0078.299] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0xa8fb6c3f [0078.299] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0xfc7abedd [0078.299] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0xd7cf1284 [0078.299] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0x5de045f3 [0078.299] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0x1247daf3 [0078.299] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0x83f558da [0078.299] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0xe1c5843f [0078.299] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0x1fb6b373 [0078.299] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0x136adb97 [0078.299] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0x53d17dfb [0078.299] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0xa9152dd4 [0078.299] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0x8dc3d655 [0078.299] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0x15774b7c [0078.299] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0x1b9419f5 [0078.299] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0xe66cce33 [0078.299] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0x2ea09112 [0078.299] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0xab26435c [0078.299] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0xbb666e13 [0078.299] RtlRandom (in: Seed=0x1ddffda0 | out: Seed=0x1ddffda0) returned 0x58d96401 [0078.309] SetFilePointerEx (in: hFile=0x1304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.309] ReadFile (in: hFile=0x1304, lpBuffer=0x5b3d080, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1ddffd74, lpOverlapped=0x0 | out: lpBuffer=0x5b3d080*, lpNumberOfBytesRead=0x1ddffd74*=0xc800, lpOverlapped=0x0) returned 1 [0078.309] SetFilePointerEx (in: hFile=0x1304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.309] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5a88 [0078.309] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5496ad0 [0078.309] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9868 [0078.309] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9868) returned 1 [0078.310] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5b49888 [0078.314] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9868 [0078.314] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9610 [0078.314] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9610) returned 1 [0078.314] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496ad0) returned 1 [0078.314] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5a88) returned 1 [0078.314] WriteFile (in: hFile=0x1304, lpBuffer=0x5b49888*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1ddffd74, lpOverlapped=0x0 | out: lpBuffer=0x5b49888*, lpNumberOfBytesWritten=0x1ddffd74*=0xc800, lpOverlapped=0x0) returned 1 [0082.125] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5b49888) Thread: id = 794 os_tid = 0x1b94 [0078.316] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\C-RSge6FoDG.png" (normalized: "c:\\users\\fd1hvy\\pictures\\c-rsge6fodg.png")) returned 0x20 [0078.316] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\C-RSge6FoDG.png", dwFileAttributes=0x20) returned 1 [0078.316] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\C-RSge6FoDG.png" (normalized: "c:\\users\\fd1hvy\\pictures\\c-rsge6fodg.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1308 [0078.316] GetFileSizeEx (in: hFile=0x1308, lpFileSize=0x1de7fa4c | out: lpFileSize=0x1de7fa4c*=4860) returned 1 [0078.316] SetFilePointerEx (in: hFile=0x1308, liDistanceToMove=0x12f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.316] ReadFile (in: hFile=0x1308, lpBuffer=0x1de7f9d0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1de7f9cc, lpOverlapped=0x0 | out: lpBuffer=0x1de7f9d0*, lpNumberOfBytesRead=0x1de7f9cc*=0x4, lpOverlapped=0x0) returned 1 [0078.317] SetFilePointerEx (in: hFile=0x1308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.317] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9610 [0078.317] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c91d8 [0078.317] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9520 [0078.317] NtQuerySystemTime (in: CurrentTime=0x1de7f9ac | out: CurrentTime=0x1de7f9ac*=132260136354820306) returned 0x0 [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0x5b04b2c4 [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0x7cfaa797 [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0xbc687918 [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0x96b1418d [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0xe62d6380 [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0xc7e576e9 [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0xb2529a87 [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0x1b7cd772 [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0xcda9f642 [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0xf321d185 [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0xf6f884bf [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0x52e27b86 [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0x457f7315 [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0xcabdb7e1 [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0x2df6060a [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0xe06a5b3b [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0x4695de8f [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0x9253787d [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0x8951dc21 [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0x22ecfb7c [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0xebf90604 [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0xdaf27e89 [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0xcfd5b5a0 [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0x3b9463d [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0xdc29e80d [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0xe6c88c24 [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0xb9556477 [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0x34f54297 [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0x962b3d5e [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0xa0b6974f [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0xb63bb26c [0078.317] RtlRandom (in: Seed=0x1de7f9b8 | out: Seed=0x1de7f9b8) returned 0xb747dced [0078.327] ReadFile (in: hFile=0x1308, lpBuffer=0x5b56090, nNumberOfBytesToRead=0x12fc, lpNumberOfBytesRead=0x1de7f9a8, lpOverlapped=0x0 | out: lpBuffer=0x5b56090*, lpNumberOfBytesRead=0x1de7f9a8*=0x12fc, lpOverlapped=0x0) returned 1 [0078.328] SetFilePointerEx (in: hFile=0x1308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.328] WriteFile (in: hFile=0x1308, lpBuffer=0x5b62898*, nNumberOfBytesToWrite=0x12fc, lpNumberOfBytesWritten=0x1de7f9a4, lpOverlapped=0x0 | out: lpBuffer=0x5b62898*, lpNumberOfBytesWritten=0x1de7f9a4*=0x12fc, lpOverlapped=0x0) returned 1 [0082.125] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 795 os_tid = 0x1b98 [0078.329] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x541b308 [0078.329] wcscpy (in: _Dest=0x541b308, _Source="C:\\Users\\FD1HVy\\Pictures\\Camera Roll" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\Camera Roll") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll" [0078.329] wcscat (in: _Dest=0x541b308, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\" [0078.329] wcscat (in: _Dest=0x541b308, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*" [0078.329] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5462bf8 [0078.329] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*", lpFindFileData=0x5462bf8 | out: lpFindFileData=0x5462bf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f40 [0082.121] wcscmp (_String1=".", _String2=".") returned 0 [0082.121] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5462bf8 | out: lpFindFileData=0x5462bf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.122] wcscmp (_String1="..", _String2=".") returned 1 [0082.122] wcscmp (_String1="..", _String2="..") returned 0 [0082.122] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5462bf8 | out: lpFindFileData=0x5462bf8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0082.122] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0082.122] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0082.122] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x5462bf8 | out: lpFindFileData=0x5462bf8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0082.122] FindClose (in: hFindFile=0x5444f40 | out: hFindFile=0x5444f40) returned 1 [0082.122] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5462bf8) returned 1 [0082.122] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541b308) returned 1 [0082.122] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39000a0) returned 1 Thread: id = 796 os_tid = 0x1b9c [0078.333] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dCJ2.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\dcj2.bmp")) returned 0x20 [0078.333] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dCJ2.bmp", dwFileAttributes=0x20) returned 1 [0078.333] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dCJ2.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\dcj2.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x130c [0078.333] GetFileSizeEx (in: hFile=0x130c, lpFileSize=0x1df7f894 | out: lpFileSize=0x1df7f894*=61909) returned 1 [0078.333] SetFilePointerEx (in: hFile=0x130c, liDistanceToMove=0xf1d1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.333] ReadFile (in: hFile=0x130c, lpBuffer=0x1df7f818, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1df7f814, lpOverlapped=0x0 | out: lpBuffer=0x1df7f818*, lpNumberOfBytesRead=0x1df7f814*=0x4, lpOverlapped=0x0) returned 1 [0078.333] SetFilePointerEx (in: hFile=0x130c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.333] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9610 [0078.333] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9200 [0078.334] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9520 [0078.334] NtQuerySystemTime (in: CurrentTime=0x1df7f7f4 | out: CurrentTime=0x1df7f7f4*=132260136354973146) returned 0x0 [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0x82c080c7 [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0x89a7d23b [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0xe99768e5 [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0xbef0492e [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0xbd9076f6 [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0x62d5436b [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0xe6fe74dc [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0x7ce3e83d [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0x8ae91cfb [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0x4c48e5e5 [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0x356527ce [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0x7b9e347f [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0xd644a85f [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0x7012689f [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0x4fbd8394 [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0x17035fab [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0x1d0d611d [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0x16e9d002 [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0x7eec7f7 [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0x866e2793 [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0xef1b1ab4 [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0x601c53b4 [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0x17159cb8 [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0x1044ee40 [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0xc1554178 [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0x2bab759e [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0xdadce8af [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0x4c275532 [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0xfb976444 [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0xa09bd3 [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0xe0680c65 [0078.334] RtlRandom (in: Seed=0x1df7f800 | out: Seed=0x1df7f800) returned 0xc6e9eb5c [0078.344] SetFilePointerEx (in: hFile=0x130c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.344] ReadFile (in: hFile=0x130c, lpBuffer=0x5b6f0a0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1df7f7d4, lpOverlapped=0x0 | out: lpBuffer=0x5b6f0a0*, lpNumberOfBytesRead=0x1df7f7d4*=0xc800, lpOverlapped=0x0) returned 1 [0078.344] SetFilePointerEx (in: hFile=0x130c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.344] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5ad0 [0078.344] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5496b48 [0078.344] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9610 [0078.344] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9610) returned 1 [0078.345] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5b7b8a8 [0078.350] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9610 [0078.350] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c93e0 [0078.350] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c93e0) returned 1 [0078.350] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496b48) returned 1 [0078.350] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5ad0) returned 1 [0078.350] WriteFile (in: hFile=0x130c, lpBuffer=0x5b7b8a8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1df7f7d4, lpOverlapped=0x0 | out: lpBuffer=0x5b7b8a8*, lpNumberOfBytesWritten=0x1df7f7d4*=0xc800, lpOverlapped=0x0) returned 1 [0082.133] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5b7b8a8) Thread: id = 797 os_tid = 0x1ba0 [0078.350] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\e8RP7fcF2GbKFno4wEQ.png" (normalized: "c:\\users\\fd1hvy\\pictures\\e8rp7fcf2gbkfno4weq.png")) returned 0x20 [0078.351] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\e8RP7fcF2GbKFno4wEQ.png", dwFileAttributes=0x20) returned 1 [0078.351] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\e8RP7fcF2GbKFno4wEQ.png" (normalized: "c:\\users\\fd1hvy\\pictures\\e8rp7fcf2gbkfno4weq.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1310 [0078.351] GetFileSizeEx (in: hFile=0x1310, lpFileSize=0x1dfff89c | out: lpFileSize=0x1dfff89c*=39441) returned 1 [0078.351] SetFilePointerEx (in: hFile=0x1310, liDistanceToMove=0x9a0d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.351] ReadFile (in: hFile=0x1310, lpBuffer=0x1dfff820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1dfff81c, lpOverlapped=0x0 | out: lpBuffer=0x1dfff820*, lpNumberOfBytesRead=0x1dfff81c*=0x4, lpOverlapped=0x0) returned 1 [0078.351] SetFilePointerEx (in: hFile=0x1310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.351] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9548 [0078.351] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9250 [0078.351] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9520 [0078.351] NtQuerySystemTime (in: CurrentTime=0x1dfff7fc | out: CurrentTime=0x1dfff7fc*=132260136355147134) returned 0x0 [0078.351] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0x8571a2 [0078.351] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0x55310002 [0078.351] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0xbfdd9348 [0078.351] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0x567e45fd [0078.351] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0x9a31f5d5 [0078.351] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0x4c3eaa9a [0078.351] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0xfbe582d8 [0078.351] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0x886d935c [0078.351] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0x45b6ca88 [0078.351] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0xaba5d50d [0078.352] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0x212b1de5 [0078.352] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0x3cfa1fed [0078.352] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0x6876b00 [0078.352] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0x38856941 [0078.352] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0x258f4ae4 [0078.352] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0x9e1a2846 [0078.352] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0x5e2038ad [0078.352] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0x133054ea [0078.352] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0x69f3bb91 [0078.352] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0xadc319c9 [0078.352] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0xfc23b639 [0078.352] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0xc2aeffc0 [0078.352] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0x2ccd9267 [0078.352] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0xab2cd0d2 [0078.352] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0x36083050 [0078.352] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0xaf67e421 [0078.352] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0x899ed70c [0078.352] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0xe9986941 [0078.352] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0xc57a4f83 [0078.352] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0x9d786e04 [0078.352] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0x2fc64d19 [0078.352] RtlRandom (in: Seed=0x1dfff808 | out: Seed=0x1dfff808) returned 0xb72df5f1 [0078.362] ReadFile (in: hFile=0x1310, lpBuffer=0x5b880b0, nNumberOfBytesToRead=0x9a11, lpNumberOfBytesRead=0x1dfff7f8, lpOverlapped=0x0 | out: lpBuffer=0x5b880b0*, lpNumberOfBytesRead=0x1dfff7f8*=0x9a11, lpOverlapped=0x0) returned 1 [0078.364] SetFilePointerEx (in: hFile=0x1310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.364] WriteFile (in: hFile=0x1310, lpBuffer=0x5b948b8*, nNumberOfBytesToWrite=0x9a11, lpNumberOfBytesWritten=0x1dfff7f4, lpOverlapped=0x0 | out: lpBuffer=0x5b948b8*, lpNumberOfBytesWritten=0x1dfff7f4*=0x9a11, lpOverlapped=0x0) returned 1 [0082.131] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 798 os_tid = 0x1ba4 [0078.364] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\eZxR4UE1l.png" (normalized: "c:\\users\\fd1hvy\\pictures\\ezxr4ue1l.png")) returned 0x20 [0078.364] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\eZxR4UE1l.png", dwFileAttributes=0x20) returned 1 [0078.364] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\eZxR4UE1l.png" (normalized: "c:\\users\\fd1hvy\\pictures\\ezxr4ue1l.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1314 [0078.365] GetFileSizeEx (in: hFile=0x1314, lpFileSize=0x1e07f8f0 | out: lpFileSize=0x1e07f8f0*=26435) returned 1 [0078.365] SetFilePointerEx (in: hFile=0x1314, liDistanceToMove=0x673f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.365] ReadFile (in: hFile=0x1314, lpBuffer=0x1e07f874, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e07f870, lpOverlapped=0x0 | out: lpBuffer=0x1e07f874*, lpNumberOfBytesRead=0x1e07f870*=0x4, lpOverlapped=0x0) returned 1 [0078.365] SetFilePointerEx (in: hFile=0x1314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.365] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9548 [0078.365] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c92a0 [0078.365] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9520 [0078.365] NtQuerySystemTime (in: CurrentTime=0x1e07f850 | out: CurrentTime=0x1e07f850*=132260136355285507) returned 0x0 [0078.365] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0xf8d88a64 [0078.365] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0x7cc11fe6 [0078.365] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0x1159df47 [0078.365] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0xca1856ba [0078.365] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0x7fe3f820 [0078.365] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0x378199a9 [0078.365] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0xaf25602e [0078.365] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0xee443a78 [0078.365] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0x4def747f [0078.365] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0x7caf9ddf [0078.365] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0xb24b63ea [0078.365] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0xf4a02d6 [0078.365] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0x736f2f8f [0078.365] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0x6d2d3412 [0078.365] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0xa99422a1 [0078.365] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0xd279dda1 [0078.365] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0x7e335ad9 [0078.365] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0xb48c4def [0078.365] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0x41740e43 [0078.365] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0x7749f73d [0078.365] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0x681c2a20 [0078.365] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0x66072f [0078.365] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0x6004702 [0078.365] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0x5e71159c [0078.365] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0x7d5a39a8 [0078.365] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0xfa582e7 [0078.365] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0x57cacb5a [0078.365] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0x9710472b [0078.366] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0xda01a552 [0078.366] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0x4b09197e [0078.366] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0x853166ad [0078.366] RtlRandom (in: Seed=0x1e07f85c | out: Seed=0x1e07f85c) returned 0x19dc2be7 [0078.376] ReadFile (in: hFile=0x1314, lpBuffer=0x5bc78e0, nNumberOfBytesToRead=0x6743, lpNumberOfBytesRead=0x1e07f84c, lpOverlapped=0x0 | out: lpBuffer=0x5bc78e0*, lpNumberOfBytesRead=0x1e07f84c*=0x6743, lpOverlapped=0x0) returned 1 [0078.376] SetFilePointerEx (in: hFile=0x1314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.377] WriteFile (in: hFile=0x1314, lpBuffer=0x5bd40e8*, nNumberOfBytesToWrite=0x6743, lpNumberOfBytesWritten=0x1e07f848, lpOverlapped=0x0 | out: lpBuffer=0x5bd40e8*, lpNumberOfBytesWritten=0x1e07f848*=0x6743, lpOverlapped=0x0) returned 1 [0082.132] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 799 os_tid = 0x1ba8 [0078.377] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\f9G-epH1h mcDmhoie.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\f9g-eph1h mcdmhoie.gif")) returned 0x20 [0078.377] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\f9G-epH1h mcDmhoie.gif", dwFileAttributes=0x20) returned 1 [0078.377] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\f9G-epH1h mcDmhoie.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\f9g-eph1h mcdmhoie.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1318 [0078.377] GetFileSizeEx (in: hFile=0x1318, lpFileSize=0x1e0ff978 | out: lpFileSize=0x1e0ff978*=53099) returned 1 [0078.377] SetFilePointerEx (in: hFile=0x1318, liDistanceToMove=0xcf67, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.378] ReadFile (in: hFile=0x1318, lpBuffer=0x1e0ff8fc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e0ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x1e0ff8fc*, lpNumberOfBytesRead=0x1e0ff8f8*=0x4, lpOverlapped=0x0) returned 1 [0078.378] SetFilePointerEx (in: hFile=0x1318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.378] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9548 [0078.378] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c92f0 [0078.378] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9520 [0078.379] NtQuerySystemTime (in: CurrentTime=0x1e0ff8d8 | out: CurrentTime=0x1e0ff8d8*=132260136355442062) returned 0x0 [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0x8a45cef8 [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0x1e0bc13f [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0xfb46ab83 [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0x6caea5b [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0x44458c7 [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0x140f1b3 [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0x4c9df00f [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0x5397d3a6 [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0x5b7d10a6 [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0xc0d4340f [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0xae6d43f3 [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0x8d144277 [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0xcc83b0e5 [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0x4a0ebbad [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0x1606b2ea [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0x873be2c1 [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0x4aeef9a8 [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0xa140a28 [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0x71d14af2 [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0x59876dbe [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0xe79d005a [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0xd82d4a8 [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0x25dd0ccc [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0xff6608bf [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0x9331de3e [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0xf33224a2 [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0xfd18832e [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0x17253e58 [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0xc00edbda [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0xf479fee0 [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0x7107cb74 [0078.379] RtlRandom (in: Seed=0x1e0ff8e4 | out: Seed=0x1e0ff8e4) returned 0x50549757 [0078.389] SetFilePointerEx (in: hFile=0x1318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.389] ReadFile (in: hFile=0x1318, lpBuffer=0x5be08f0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1e0ff8b8, lpOverlapped=0x0 | out: lpBuffer=0x5be08f0*, lpNumberOfBytesRead=0x1e0ff8b8*=0xc800, lpOverlapped=0x0) returned 1 [0078.389] SetFilePointerEx (in: hFile=0x1318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.389] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5ba8 [0078.389] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5496c38 [0078.389] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9340 [0078.389] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9340) returned 1 [0078.390] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5bed0f8 [0078.395] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c93e0 [0078.395] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9408 [0078.395] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9408) returned 1 [0078.395] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496c38) returned 1 [0078.395] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5ba8) returned 1 [0078.395] WriteFile (in: hFile=0x1318, lpBuffer=0x5bed0f8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1e0ff8b8, lpOverlapped=0x0 | out: lpBuffer=0x5bed0f8*, lpNumberOfBytesWritten=0x1e0ff8b8*=0xc800, lpOverlapped=0x0) returned 1 [0082.135] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bed0f8) Thread: id = 800 os_tid = 0x1bac [0078.396] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\fLcjAxTi18dQlVO.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\flcjaxti18dqlvo.bmp")) returned 0x20 [0078.396] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\fLcjAxTi18dQlVO.bmp", dwFileAttributes=0x20) returned 1 [0078.396] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\fLcjAxTi18dQlVO.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\flcjaxti18dqlvo.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x131c [0078.396] GetFileSizeEx (in: hFile=0x131c, lpFileSize=0x1e17fa44 | out: lpFileSize=0x1e17fa44*=51256) returned 1 [0078.396] SetFilePointerEx (in: hFile=0x131c, liDistanceToMove=0xc834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.396] ReadFile (in: hFile=0x131c, lpBuffer=0x1e17f9c8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e17f9c4, lpOverlapped=0x0 | out: lpBuffer=0x1e17f9c8*, lpNumberOfBytesRead=0x1e17f9c4*=0x4, lpOverlapped=0x0) returned 1 [0078.396] SetFilePointerEx (in: hFile=0x131c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.396] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9548 [0078.396] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9340 [0078.396] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9520 [0078.396] NtQuerySystemTime (in: CurrentTime=0x1e17f9a4 | out: CurrentTime=0x1e17f9a4*=132260136355598269) returned 0x0 [0078.396] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0x2d444701 [0078.397] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0xc3f3a99b [0078.397] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0x9d8e99cd [0078.397] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0x476e6b2e [0078.397] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0xc2bc51a9 [0078.397] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0xa02af384 [0078.397] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0x8537fea2 [0078.397] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0x6a4d7bf8 [0078.397] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0x1c7e3c4f [0078.397] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0x41f93eef [0078.397] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0xaf97a624 [0078.397] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0x9f88a9cf [0078.397] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0x12e700c2 [0078.397] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0xe1219959 [0078.397] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0x56fa75e3 [0078.397] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0x7a66182b [0078.397] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0x30c23766 [0078.397] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0x7a768b3d [0078.397] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0xa6e004db [0078.397] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0xed07221c [0078.397] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0x74db91c9 [0078.397] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0x7f72b787 [0078.397] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0xf02198 [0078.397] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0xbe719d65 [0078.397] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0xe891ea95 [0078.397] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0x45b42b50 [0078.397] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0xcf7002c9 [0078.397] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0xe4ac053c [0078.397] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0xc148ea49 [0078.397] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0xf731cf0d [0078.397] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0x37cc8093 [0078.397] RtlRandom (in: Seed=0x1e17f9b0 | out: Seed=0x1e17f9b0) returned 0x9d82be83 [0078.407] SetFilePointerEx (in: hFile=0x131c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.407] ReadFile (in: hFile=0x131c, lpBuffer=0x5bf9900, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1e17f984, lpOverlapped=0x0 | out: lpBuffer=0x5bf9900*, lpNumberOfBytesRead=0x1e17f984*=0xc800, lpOverlapped=0x0) returned 1 [0078.407] SetFilePointerEx (in: hFile=0x131c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.407] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5ba8 [0078.407] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5496c38 [0078.407] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9390 [0078.407] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9390) returned 1 [0078.408] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5c06108 [0078.412] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9408 [0078.412] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9430 [0078.412] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9430) returned 1 [0078.412] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496c38) returned 1 [0078.412] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5ba8) returned 1 [0078.412] WriteFile (in: hFile=0x131c, lpBuffer=0x5c06108*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1e17f984, lpOverlapped=0x0 | out: lpBuffer=0x5c06108*, lpNumberOfBytesWritten=0x1e17f984*=0xc800, lpOverlapped=0x0) returned 1 [0082.137] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5c06108) Thread: id = 801 os_tid = 0x1bb0 [0078.413] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\GJoKdTfOL9ji8GXtw1b.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\gjokdtfol9ji8gxtw1b.jpg")) returned 0x20 [0078.413] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\GJoKdTfOL9ji8GXtw1b.jpg", dwFileAttributes=0x20) returned 1 [0078.413] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\GJoKdTfOL9ji8GXtw1b.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\gjokdtfol9ji8gxtw1b.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1320 [0078.413] GetFileSizeEx (in: hFile=0x1320, lpFileSize=0x1e1ffe9c | out: lpFileSize=0x1e1ffe9c*=50830) returned 1 [0078.413] SetFilePointerEx (in: hFile=0x1320, liDistanceToMove=0xc68a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.413] ReadFile (in: hFile=0x1320, lpBuffer=0x1e1ffe20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e1ffe1c, lpOverlapped=0x0 | out: lpBuffer=0x1e1ffe20*, lpNumberOfBytesRead=0x1e1ffe1c*=0x4, lpOverlapped=0x0) returned 1 [0078.413] SetFilePointerEx (in: hFile=0x1320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.413] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9548 [0078.413] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9390 [0078.413] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9520 [0078.413] NtQuerySystemTime (in: CurrentTime=0x1e1ffdfc | out: CurrentTime=0x1e1ffdfc*=132260136355771027) returned 0x0 [0078.413] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0x27c60233 [0078.413] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0x33ee9e0a [0078.413] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0xa10b80f0 [0078.413] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0x96f5a02a [0078.414] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0x76770b54 [0078.414] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0x7082bff8 [0078.414] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0xa2c3658a [0078.414] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0x83e951ec [0078.414] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0x3ea59a05 [0078.414] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0xba024f28 [0078.414] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0x7c24b599 [0078.414] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0x4d96a5e3 [0078.414] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0x32dfa57a [0078.414] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0xa38c7a8c [0078.414] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0xeff002c5 [0078.414] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0x53044144 [0078.414] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0xc5f3ee55 [0078.414] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0x7b2aeee7 [0078.414] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0xc085fd6b [0078.414] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0x180ef011 [0078.414] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0xd51c90a7 [0078.414] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0x33ada3c8 [0078.414] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0x6baa7d93 [0078.414] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0x10f12fc3 [0078.414] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0xe799a35b [0078.414] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0x8a469893 [0078.414] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0x3bfdd11e [0078.414] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0x91ddc4b4 [0078.414] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0x4ad17540 [0078.414] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0xf541d055 [0078.414] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0xf6aa58ff [0078.414] RtlRandom (in: Seed=0x1e1ffe08 | out: Seed=0x1e1ffe08) returned 0x5069579b [0078.424] ReadFile (in: hFile=0x1320, lpBuffer=0x5c12910, nNumberOfBytesToRead=0xc68e, lpNumberOfBytesRead=0x1e1ffdf8, lpOverlapped=0x0 | out: lpBuffer=0x5c12910*, lpNumberOfBytesRead=0x1e1ffdf8*=0xc68e, lpOverlapped=0x0) returned 1 [0078.435] SetFilePointerEx (in: hFile=0x1320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.436] WriteFile (in: hFile=0x1320, lpBuffer=0x5c1f118*, nNumberOfBytesToWrite=0xc68e, lpNumberOfBytesWritten=0x1e1ffdf4, lpOverlapped=0x0 | out: lpBuffer=0x5c1f118*, lpNumberOfBytesWritten=0x1e1ffdf4*=0xc68e, lpOverlapped=0x0) returned 1 [0082.136] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 802 os_tid = 0x1bb4 [0078.436] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jbc4PG hVWo7ul7-.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\jbc4pg hvwo7ul7-.bmp")) returned 0x20 [0078.436] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jbc4PG hVWo7ul7-.bmp", dwFileAttributes=0x20) returned 1 [0078.436] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jbc4PG hVWo7ul7-.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\jbc4pg hvwo7ul7-.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1324 [0078.437] GetFileSizeEx (in: hFile=0x1324, lpFileSize=0x1e27f9f8 | out: lpFileSize=0x1e27f9f8*=42551) returned 1 [0078.437] SetFilePointerEx (in: hFile=0x1324, liDistanceToMove=0xa633, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.437] ReadFile (in: hFile=0x1324, lpBuffer=0x1e27f97c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e27f978, lpOverlapped=0x0 | out: lpBuffer=0x1e27f97c*, lpNumberOfBytesRead=0x1e27f978*=0x4, lpOverlapped=0x0) returned 1 [0078.437] SetFilePointerEx (in: hFile=0x1324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.437] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9548 [0078.437] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9430 [0078.437] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9520 [0078.437] NtQuerySystemTime (in: CurrentTime=0x1e27f958 | out: CurrentTime=0x1e27f958*=132260136355910523) returned 0x0 [0078.437] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0x8509346a [0078.437] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0xacc2416d [0078.437] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0xe00d030b [0078.437] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0xd357dbdb [0078.437] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0x50550c87 [0078.437] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0x44f55732 [0078.437] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0xe12d2758 [0078.437] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0xafbfcba7 [0078.437] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0xf89cc8a9 [0078.437] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0x2e5958f2 [0078.437] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0x5246a512 [0078.437] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0x47050c92 [0078.437] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0x64945b77 [0078.437] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0x91c037cb [0078.437] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0x1b9ebd3f [0078.437] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0xe30ec052 [0078.437] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0x2f4c7a5f [0078.437] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0x3dfe93c7 [0078.437] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0xfff268d7 [0078.437] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0x612bf09d [0078.437] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0xae072ff [0078.437] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0x6f3a9e09 [0078.437] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0x51623ff [0078.437] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0xabd00383 [0078.437] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0x46769690 [0078.437] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0x3cff0f1 [0078.437] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0x38bfd228 [0078.438] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0x951a1318 [0078.438] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0x108ade12 [0078.438] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0x4fcd1ebf [0078.438] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0xac13820b [0078.438] RtlRandom (in: Seed=0x1e27f964 | out: Seed=0x1e27f964) returned 0xf9220e29 [0078.448] ReadFile (in: hFile=0x1324, lpBuffer=0x5c2b920, nNumberOfBytesToRead=0xa637, lpNumberOfBytesRead=0x1e27f954, lpOverlapped=0x0 | out: lpBuffer=0x5c2b920*, lpNumberOfBytesRead=0x1e27f954*=0xa637, lpOverlapped=0x0) returned 1 [0078.450] SetFilePointerEx (in: hFile=0x1324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.450] WriteFile (in: hFile=0x1324, lpBuffer=0x5c38128*, nNumberOfBytesToWrite=0xa637, lpNumberOfBytesWritten=0x1e27f950, lpOverlapped=0x0 | out: lpBuffer=0x5c38128*, lpNumberOfBytesWritten=0x1e27f950*=0xa637, lpOverlapped=0x0) returned 1 [0082.138] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 803 os_tid = 0x1bb8 [0078.450] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\KtP2-2cxUhk6Xb8YJ7.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ktp2-2cxuhk6xb8yj7.jpg")) returned 0x20 [0078.450] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\KtP2-2cxUhk6Xb8YJ7.jpg", dwFileAttributes=0x20) returned 1 [0078.451] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\KtP2-2cxUhk6Xb8YJ7.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ktp2-2cxuhk6xb8yj7.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1328 [0078.451] GetFileSizeEx (in: hFile=0x1328, lpFileSize=0x1e2ffec8 | out: lpFileSize=0x1e2ffec8*=100415) returned 1 [0078.451] SetFilePointerEx (in: hFile=0x1328, liDistanceToMove=0x1883b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.451] ReadFile (in: hFile=0x1328, lpBuffer=0x1e2ffe4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e2ffe48, lpOverlapped=0x0 | out: lpBuffer=0x1e2ffe4c*, lpNumberOfBytesRead=0x1e2ffe48*=0x4, lpOverlapped=0x0) returned 1 [0078.451] SetFilePointerEx (in: hFile=0x1328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.451] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9548 [0078.451] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9480 [0078.451] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9520 [0078.451] NtQuerySystemTime (in: CurrentTime=0x1e2ffe28 | out: CurrentTime=0x1e2ffe28*=132260136356067119) returned 0x0 [0078.451] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0xa78de680 [0078.451] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0x43a811d1 [0078.451] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0x32992029 [0078.451] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0x230b16bb [0078.451] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0x78f5a121 [0078.451] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0xc529a680 [0078.451] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0x42e605e7 [0078.451] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0xa2b07acc [0078.451] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0xa63f524a [0078.451] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0xc9b8575 [0078.451] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0x586ea858 [0078.451] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0xa2126e4d [0078.451] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0xa6bb376b [0078.451] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0x1a37e396 [0078.451] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0xea3f99a7 [0078.451] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0x2ce209cb [0078.451] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0x4a7ba4da [0078.452] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0xa318e35d [0078.452] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0x4b4778c8 [0078.452] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0x2b36e6ef [0078.452] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0xee2e8667 [0078.452] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0xbb145be6 [0078.452] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0x23b15fd3 [0078.452] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0x93a5da73 [0078.452] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0x2b90b32b [0078.452] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0x469ee35e [0078.452] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0x47e4ed09 [0078.452] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0xe88aea2f [0078.452] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0x7d06f09e [0078.452] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0xadaa5849 [0078.452] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0x85efb4f7 [0078.452] RtlRandom (in: Seed=0x1e2ffe34 | out: Seed=0x1e2ffe34) returned 0x3430ac30 [0078.462] SetFilePointerEx (in: hFile=0x1328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.462] ReadFile (in: hFile=0x1328, lpBuffer=0x5c44930, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1e2ffe08, lpOverlapped=0x0 | out: lpBuffer=0x5c44930*, lpNumberOfBytesRead=0x1e2ffe08*=0xc800, lpOverlapped=0x0) returned 1 [0078.462] SetFilePointerEx (in: hFile=0x1328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.462] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5698 [0078.462] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5496d28 [0078.462] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9520 [0078.462] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9520) returned 1 [0078.463] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5c51138 [0078.467] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9520 [0078.467] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9548 [0078.467] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9548) returned 1 [0078.467] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496d28) returned 1 [0078.467] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5698) returned 1 [0078.467] WriteFile (in: hFile=0x1328, lpBuffer=0x5c51138*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1e2ffe08, lpOverlapped=0x0 | out: lpBuffer=0x5c51138*, lpNumberOfBytesWritten=0x1e2ffe08*=0xc800, lpOverlapped=0x0) returned 1 [0082.141] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5c51138) Thread: id = 804 os_tid = 0x1bbc [0078.468] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\nx9GYYC2Rsjy1CN.png" (normalized: "c:\\users\\fd1hvy\\pictures\\nx9gyyc2rsjy1cn.png")) returned 0x20 [0078.468] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\nx9GYYC2Rsjy1CN.png", dwFileAttributes=0x20) returned 1 [0078.468] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\nx9GYYC2Rsjy1CN.png" (normalized: "c:\\users\\fd1hvy\\pictures\\nx9gyyc2rsjy1cn.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x132c [0078.468] GetFileSizeEx (in: hFile=0x132c, lpFileSize=0x1e37fac8 | out: lpFileSize=0x1e37fac8*=93880) returned 1 [0078.468] SetFilePointerEx (in: hFile=0x132c, liDistanceToMove=0x16eb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.469] ReadFile (in: hFile=0x132c, lpBuffer=0x1e37fa4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e37fa48, lpOverlapped=0x0 | out: lpBuffer=0x1e37fa4c*, lpNumberOfBytesRead=0x1e37fa48*=0x4, lpOverlapped=0x0) returned 1 [0078.469] SetFilePointerEx (in: hFile=0x132c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.469] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9548 [0078.469] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9188 [0078.469] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f28 [0078.469] NtQuerySystemTime (in: CurrentTime=0x1e37fa28 | out: CurrentTime=0x1e37fa28*=132260136356223525) returned 0x0 [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0x3c6b9269 [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0xec5670ca [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0x8a911f78 [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0xb950ceb1 [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0xe38fd192 [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0x14f37cb5 [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0x29160636 [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0x2c55a47c [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0x17ee67d3 [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0x83ab9f48 [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0x249964ec [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0xef616f55 [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0xce14f0ee [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0x5f260113 [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0xb143fa9c [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0xf6f9903 [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0xb693534f [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0x49d3d416 [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0xab6fe574 [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0xaecb0bfa [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0xeee9ed7a [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0xb95f81b6 [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0xe49c02d6 [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0xcb889e15 [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0xd7804ffa [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0x300ec038 [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0x93f649da [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0x747d8d60 [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0x94a77d75 [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0x95599065 [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0x3530c18d [0078.469] RtlRandom (in: Seed=0x1e37fa34 | out: Seed=0x1e37fa34) returned 0xc49983d0 [0078.479] SetFilePointerEx (in: hFile=0x132c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.479] ReadFile (in: hFile=0x132c, lpBuffer=0x5c5d940, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1e37fa08, lpOverlapped=0x0 | out: lpBuffer=0x5c5d940*, lpNumberOfBytesRead=0x1e37fa08*=0xc800, lpOverlapped=0x0) returned 1 [0078.480] SetFilePointerEx (in: hFile=0x132c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.480] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5698 [0078.480] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5496d28 [0078.480] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f50 [0078.480] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559f50) returned 1 [0078.481] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5c6a148 [0078.482] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559e38 [0078.482] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559eb0 [0078.482] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5559eb0) returned 1 [0078.482] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496d28) returned 1 [0078.482] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5698) returned 1 [0078.482] WriteFile (in: hFile=0x132c, lpBuffer=0x5c6a148*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1e37fa08, lpOverlapped=0x0 | out: lpBuffer=0x5c6a148*, lpNumberOfBytesWritten=0x1e37fa08*=0xc800, lpOverlapped=0x0) returned 1 [0082.141] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5c6a148) Thread: id = 805 os_tid = 0x1bc0 [0078.482] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\pdMKY_DQ4R6F.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\pdmky_dq4r6f.jpg")) returned 0x20 [0078.483] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\pdMKY_DQ4R6F.jpg", dwFileAttributes=0x20) returned 1 [0078.483] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\pdMKY_DQ4R6F.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\pdmky_dq4r6f.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1330 [0078.483] GetFileSizeEx (in: hFile=0x1330, lpFileSize=0x1e3ffe74 | out: lpFileSize=0x1e3ffe74*=47333) returned 1 [0078.483] SetFilePointerEx (in: hFile=0x1330, liDistanceToMove=0xb8e1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.483] ReadFile (in: hFile=0x1330, lpBuffer=0x1e3ffdf8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e3ffdf4, lpOverlapped=0x0 | out: lpBuffer=0x1e3ffdf8*, lpNumberOfBytesRead=0x1e3ffdf4*=0x4, lpOverlapped=0x0) returned 1 [0078.483] SetFilePointerEx (in: hFile=0x1330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.483] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x555a040 [0078.483] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559e10 [0078.483] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559d98 [0078.483] NtQuerySystemTime (in: CurrentTime=0x1e3ffdd4 | out: CurrentTime=0x1e3ffdd4*=132260136356379438) returned 0x0 [0078.483] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0xacfb8ef1 [0078.483] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0xc2893b50 [0078.483] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0xa9ba8700 [0078.483] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0x60e872b7 [0078.483] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0x7d24406c [0078.483] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0x780bfc83 [0078.483] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0xc5e4de88 [0078.483] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0x8b909354 [0078.483] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0x47182985 [0078.483] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0xb7e84f8c [0078.483] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0xa59a22a0 [0078.483] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0x7c2fdcfc [0078.483] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0xcd6de14a [0078.484] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0x7951ba3e [0078.484] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0xada1b92d [0078.484] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0x1ad7a709 [0078.484] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0x9df484f8 [0078.484] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0x1700991b [0078.484] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0x393eef6c [0078.484] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0xd7c7f6c6 [0078.484] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0xb4e74ce4 [0078.484] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0xaf903562 [0078.484] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0xbbfdeeb9 [0078.484] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0xb7a3fd07 [0078.484] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0x273595e5 [0078.484] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0x2467e832 [0078.484] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0x6d0a0c47 [0078.484] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0x794c2765 [0078.484] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0xe4c94c3f [0078.484] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0xff64d11b [0078.484] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0x88c314a5 [0078.484] RtlRandom (in: Seed=0x1e3ffde0 | out: Seed=0x1e3ffde0) returned 0xf63cf791 [0078.494] ReadFile (in: hFile=0x1330, lpBuffer=0x5c76950, nNumberOfBytesToRead=0xb8e5, lpNumberOfBytesRead=0x1e3ffdd0, lpOverlapped=0x0 | out: lpBuffer=0x5c76950*, lpNumberOfBytesRead=0x1e3ffdd0*=0xb8e5, lpOverlapped=0x0) returned 1 [0078.496] SetFilePointerEx (in: hFile=0x1330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.496] WriteFile (in: hFile=0x1330, lpBuffer=0x5c83158*, nNumberOfBytesToWrite=0xb8e5, lpNumberOfBytesWritten=0x1e3ffdcc, lpOverlapped=0x0 | out: lpBuffer=0x5c83158*, lpNumberOfBytesWritten=0x1e3ffdcc*=0xb8e5, lpOverlapped=0x0) returned 1 [0082.152] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 806 os_tid = 0x1bc4 [0078.498] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\pg_Otsmww.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\pg_otsmww.jpg")) returned 0x20 [0078.498] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\pg_Otsmww.jpg", dwFileAttributes=0x20) returned 1 [0078.499] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\pg_Otsmww.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\pg_otsmww.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1334 [0078.499] GetFileSizeEx (in: hFile=0x1334, lpFileSize=0x1e47fa0c | out: lpFileSize=0x1e47fa0c*=37805) returned 1 [0078.499] SetFilePointerEx (in: hFile=0x1334, liDistanceToMove=0x93a9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.499] ReadFile (in: hFile=0x1334, lpBuffer=0x1e47f990, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e47f98c, lpOverlapped=0x0 | out: lpBuffer=0x1e47f990*, lpNumberOfBytesRead=0x1e47f98c*=0x4, lpOverlapped=0x0) returned 1 [0078.499] SetFilePointerEx (in: hFile=0x1334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.499] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x555a040 [0078.499] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559d98 [0078.499] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559de8 [0078.499] NtQuerySystemTime (in: CurrentTime=0x1e47f96c | out: CurrentTime=0x1e47f96c*=132260136356535977) returned 0x0 [0078.499] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0x76c803f7 [0078.499] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0x90a72e8a [0078.499] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0x20dc0022 [0078.499] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0x8408600d [0078.499] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0x9504064b [0078.499] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0x5aa92878 [0078.499] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0xe1beab14 [0078.499] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0x78961f53 [0078.499] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0xafde4614 [0078.499] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0x51301a0e [0078.499] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0xe21083a2 [0078.499] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0x6fb7dabf [0078.499] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0xd9afb168 [0078.499] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0xc70985d5 [0078.499] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0x7ecd1baf [0078.499] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0xcbe4e171 [0078.499] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0x79f2e03b [0078.499] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0xb272dfc3 [0078.499] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0xebf22cb [0078.500] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0x4818ba0c [0078.500] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0x39b28110 [0078.500] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0xc30f9579 [0078.500] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0x20fde088 [0078.500] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0x97f01b8d [0078.500] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0xbc9bf547 [0078.500] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0x609a8de8 [0078.500] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0x268a185a [0078.500] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0x2a392315 [0078.500] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0x7d47bde5 [0078.500] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0x3c2cf6ae [0078.500] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0x88e7c6d9 [0078.500] RtlRandom (in: Seed=0x1e47f978 | out: Seed=0x1e47f978) returned 0xdc699e3f [0078.516] ReadFile (in: hFile=0x1334, lpBuffer=0x5c9f968, nNumberOfBytesToRead=0x93ad, lpNumberOfBytesRead=0x1e47f968, lpOverlapped=0x0 | out: lpBuffer=0x5c9f968*, lpNumberOfBytesRead=0x1e47f968*=0x93ad, lpOverlapped=0x0) returned 1 [0078.517] SetFilePointerEx (in: hFile=0x1334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.517] WriteFile (in: hFile=0x1334, lpBuffer=0x5cac170*, nNumberOfBytesToWrite=0x93ad, lpNumberOfBytesWritten=0x1e47f964, lpOverlapped=0x0 | out: lpBuffer=0x5cac170*, lpNumberOfBytesWritten=0x1e47f964*=0x93ad, lpOverlapped=0x0) returned 1 [0082.145] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 807 os_tid = 0x1bc8 [0078.518] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\PIFelTYGWeNcE8I.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\pifeltygwence8i.jpg")) returned 0x20 [0078.518] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\PIFelTYGWeNcE8I.jpg", dwFileAttributes=0x20) returned 1 [0078.518] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\PIFelTYGWeNcE8I.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\pifeltygwence8i.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1338 [0078.518] GetFileSizeEx (in: hFile=0x1338, lpFileSize=0x1e4ffbd4 | out: lpFileSize=0x1e4ffbd4*=35747) returned 1 [0078.518] SetFilePointerEx (in: hFile=0x1338, liDistanceToMove=0x8b9f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.518] ReadFile (in: hFile=0x1338, lpBuffer=0x1e4ffb58, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e4ffb54, lpOverlapped=0x0 | out: lpBuffer=0x1e4ffb58*, lpNumberOfBytesRead=0x1e4ffb54*=0x4, lpOverlapped=0x0) returned 1 [0078.518] SetFilePointerEx (in: hFile=0x1338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.518] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x555a040 [0078.519] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559de8 [0078.519] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559ed8 [0078.519] NtQuerySystemTime (in: CurrentTime=0x1e4ffb34 | out: CurrentTime=0x1e4ffb34*=132260136356848164) returned 0x0 [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0x65520255 [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0x5879f8dd [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0x7180089 [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0xa8a32fa7 [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0x732b4b94 [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0x99dd943a [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0x5100d647 [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0x545f4783 [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0x9ece750e [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0x733c23ea [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0xe71e6121 [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0x23f39a09 [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0xfb61a33e [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0xbebb0668 [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0xead28627 [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0xfc79c111 [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0xbb9116b8 [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0x251c064d [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0x36886cad [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0xae6b02 [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0x6cce6ab2 [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0x138457c8 [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0x2fdcc9b1 [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0x3c4c5064 [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0x73e6cbfb [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0x8833df44 [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0x2607db95 [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0x4fd3bad6 [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0xe57ba761 [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0x7e1164c3 [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0xcf88c60c [0078.519] RtlRandom (in: Seed=0x1e4ffb40 | out: Seed=0x1e4ffb40) returned 0x3bd57476 [0078.529] ReadFile (in: hFile=0x1338, lpBuffer=0x5cb8978, nNumberOfBytesToRead=0x8ba3, lpNumberOfBytesRead=0x1e4ffb30, lpOverlapped=0x0 | out: lpBuffer=0x5cb8978*, lpNumberOfBytesRead=0x1e4ffb30*=0x8ba3, lpOverlapped=0x0) returned 1 [0078.531] SetFilePointerEx (in: hFile=0x1338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.531] WriteFile (in: hFile=0x1338, lpBuffer=0x5cc5180*, nNumberOfBytesToWrite=0x8ba3, lpNumberOfBytesWritten=0x1e4ffb2c, lpOverlapped=0x0 | out: lpBuffer=0x5cc5180*, lpNumberOfBytesWritten=0x1e4ffb2c*=0x8ba3, lpOverlapped=0x0) returned 1 [0082.145] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 808 os_tid = 0x1bcc [0078.531] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\pz8mRn91F.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\pz8mrn91f.jpg")) returned 0x20 [0078.531] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\pz8mRn91F.jpg", dwFileAttributes=0x20) returned 1 [0078.532] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\pz8mRn91F.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\pz8mrn91f.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x133c [0078.532] GetFileSizeEx (in: hFile=0x133c, lpFileSize=0x1e57feb8 | out: lpFileSize=0x1e57feb8*=83787) returned 1 [0078.532] SetFilePointerEx (in: hFile=0x133c, liDistanceToMove=0x14747, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.532] ReadFile (in: hFile=0x133c, lpBuffer=0x1e57fe3c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e57fe38, lpOverlapped=0x0 | out: lpBuffer=0x1e57fe3c*, lpNumberOfBytesRead=0x1e57fe38*=0x4, lpOverlapped=0x0) returned 1 [0078.532] SetFilePointerEx (in: hFile=0x133c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.532] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559ed8 [0078.532] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5559f78 [0078.532] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x555a040 [0078.532] NtQuerySystemTime (in: CurrentTime=0x1e57fe18 | out: CurrentTime=0x1e57fe18*=132260136356848164) returned 0x0 [0078.532] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0xbceb8bee [0078.532] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0x3bb41889 [0078.532] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0xa820cec1 [0078.532] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0x30c67456 [0078.532] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0x697b50fc [0078.532] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0x865f8639 [0078.532] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0x1745fa97 [0078.532] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0xcb54c420 [0078.532] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0x9c86048f [0078.532] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0x1407a4ca [0078.532] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0x3c08352a [0078.532] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0xf5d9859c [0078.532] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0x58355f4 [0078.532] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0x9cae521c [0078.532] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0x70c65dd8 [0078.532] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0xfce2c042 [0078.532] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0x3f58eaa5 [0078.532] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0xbb857e9d [0078.532] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0x6b48fecc [0078.532] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0x4f7398a9 [0078.532] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0x47924a32 [0078.533] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0x1bca91fc [0078.533] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0xa36d9d46 [0078.533] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0x5225b216 [0078.533] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0x5a9c6789 [0078.533] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0xd2b03b78 [0078.533] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0x8c7e6bf1 [0078.533] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0xdd40014a [0078.533] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0x3cc1ffc8 [0078.533] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0x3fd132b6 [0078.533] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0xcf25f9cc [0078.533] RtlRandom (in: Seed=0x1e57fe24 | out: Seed=0x1e57fe24) returned 0xe773761d [0078.543] SetFilePointerEx (in: hFile=0x133c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.543] ReadFile (in: hFile=0x133c, lpBuffer=0x5cd1988, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1e57fdf8, lpOverlapped=0x0 | out: lpBuffer=0x5cd1988*, lpNumberOfBytesRead=0x1e57fdf8*=0xc800, lpOverlapped=0x0) returned 1 [0078.544] SetFilePointerEx (in: hFile=0x133c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.544] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5fe0 [0078.544] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5496f08 [0078.544] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4fe0 [0078.544] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a4fe0) returned 1 [0078.545] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5cde190 [0078.549] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a4fe0 [0078.549] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5030 [0078.549] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5030) returned 1 [0078.549] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496f08) returned 1 [0078.549] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5fe0) returned 1 [0078.549] WriteFile (in: hFile=0x133c, lpBuffer=0x5cde190*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1e57fdf8, lpOverlapped=0x0 | out: lpBuffer=0x5cde190*, lpNumberOfBytesWritten=0x1e57fdf8*=0xc800, lpOverlapped=0x0) returned 1 [0082.147] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5cde190) Thread: id = 809 os_tid = 0x1bd0 [0078.550] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\rmRm5VujyX_HCC.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\rmrm5vujyx_hcc.gif")) returned 0x20 [0078.550] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\rmRm5VujyX_HCC.gif", dwFileAttributes=0x20) returned 1 [0078.550] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\rmRm5VujyX_HCC.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\rmrm5vujyx_hcc.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1340 [0078.550] GetFileSizeEx (in: hFile=0x1340, lpFileSize=0x1e5ffbcc | out: lpFileSize=0x1e5ffbcc*=12035) returned 1 [0078.550] SetFilePointerEx (in: hFile=0x1340, liDistanceToMove=0x2eff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.550] ReadFile (in: hFile=0x1340, lpBuffer=0x1e5ffb50, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e5ffb4c, lpOverlapped=0x0 | out: lpBuffer=0x1e5ffb50*, lpNumberOfBytesRead=0x1e5ffb4c*=0x4, lpOverlapped=0x0) returned 1 [0078.550] SetFilePointerEx (in: hFile=0x1340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.550] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5030 [0078.550] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5058 [0078.550] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a50a8 [0078.551] NtQuerySystemTime (in: CurrentTime=0x1e5ffb2c | out: CurrentTime=0x1e5ffb2c*=132260136357160694) returned 0x0 [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0x6db2a198 [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0x8ba42cfc [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0x36a0aee2 [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0x995ba5ab [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0xe64f7f85 [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0x9be90a82 [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0x29c83bb9 [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0x75e82df8 [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0xac03c177 [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0xb352a49e [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0x343f5b1f [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0x315e1738 [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0x4e619498 [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0x8c8a566 [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0xfabf6b6c [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0x342767dc [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0x949ee577 [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0xe4eafeb8 [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0x57c64594 [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0xe6bd0149 [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0x5be7f70b [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0x624ad445 [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0x23e4ebf2 [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0x37ebd98c [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0xc7c4815f [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0x18149507 [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0x42358d3f [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0x7e2791ec [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0xc113b09e [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0xdd2184e0 [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0xb844c365 [0078.551] RtlRandom (in: Seed=0x1e5ffb38 | out: Seed=0x1e5ffb38) returned 0x9840eccc [0078.561] ReadFile (in: hFile=0x1340, lpBuffer=0x5cea998, nNumberOfBytesToRead=0x2f03, lpNumberOfBytesRead=0x1e5ffb28, lpOverlapped=0x0 | out: lpBuffer=0x5cea998*, lpNumberOfBytesRead=0x1e5ffb28*=0x2f03, lpOverlapped=0x0) returned 1 [0078.562] SetFilePointerEx (in: hFile=0x1340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.562] WriteFile (in: hFile=0x1340, lpBuffer=0x5cf71a0*, nNumberOfBytesToWrite=0x2f03, lpNumberOfBytesWritten=0x1e5ffb24, lpOverlapped=0x0 | out: lpBuffer=0x5cf71a0*, lpNumberOfBytesWritten=0x1e5ffb24*=0x2f03, lpOverlapped=0x0) returned 1 [0082.148] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 810 os_tid = 0x1bd4 [0078.562] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\rYWV6NLyHJH.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\rywv6nlyhjh.gif")) returned 0x20 [0078.562] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\rYWV6NLyHJH.gif", dwFileAttributes=0x20) returned 1 [0078.563] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\rYWV6NLyHJH.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\rywv6nlyhjh.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1344 [0078.563] GetFileSizeEx (in: hFile=0x1344, lpFileSize=0x1e67f7bc | out: lpFileSize=0x1e67f7bc*=94894) returned 1 [0078.563] SetFilePointerEx (in: hFile=0x1344, liDistanceToMove=0x172aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.563] ReadFile (in: hFile=0x1344, lpBuffer=0x1e67f740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e67f73c, lpOverlapped=0x0 | out: lpBuffer=0x1e67f740*, lpNumberOfBytesRead=0x1e67f73c*=0x4, lpOverlapped=0x0) returned 1 [0078.563] SetFilePointerEx (in: hFile=0x1344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.563] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x555a040 [0078.563] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a5030 [0078.563] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a50a8 [0078.563] NtQuerySystemTime (in: CurrentTime=0x1e67f71c | out: CurrentTime=0x1e67f71c*=132260136357160694) returned 0x0 [0078.563] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0x19bbd2bb [0078.563] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0x183ea80f [0078.563] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0xe0e9c053 [0078.563] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0x45db6c14 [0078.563] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0x9a6a5b57 [0078.563] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0x201f9135 [0078.563] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0x552c054 [0078.563] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0x904b92a6 [0078.563] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0x2ca32ed [0078.563] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0x7f9b1af9 [0078.563] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0x7e28c6bd [0078.563] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0xeab9b490 [0078.563] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0xf5abae49 [0078.563] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0x1b0830dd [0078.563] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0x283f2817 [0078.563] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0xc9b403f4 [0078.563] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0xa858e3be [0078.563] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0xe9b33538 [0078.563] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0xdb0afe9f [0078.563] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0xd6c864d4 [0078.563] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0x882ebaea [0078.563] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0x8dd1a76 [0078.564] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0xe460cb06 [0078.564] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0x83eaae3b [0078.564] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0xb295248e [0078.564] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0xa933c449 [0078.564] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0x3f3e4119 [0078.564] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0x5d794528 [0078.564] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0x564eefd1 [0078.564] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0x78f00ae2 [0078.564] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0x418f7244 [0078.564] RtlRandom (in: Seed=0x1e67f728 | out: Seed=0x1e67f728) returned 0x1b5ae861 [0078.573] SetFilePointerEx (in: hFile=0x1344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.574] ReadFile (in: hFile=0x1344, lpBuffer=0x5d039a8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1e67f6fc, lpOverlapped=0x0 | out: lpBuffer=0x5d039a8*, lpNumberOfBytesRead=0x1e67f6fc*=0xc800, lpOverlapped=0x0) returned 1 [0078.574] SetFilePointerEx (in: hFile=0x1344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.574] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a60b8 [0078.574] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5496f80 [0078.574] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a50a8 [0078.574] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a50a8) returned 1 [0078.575] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5d101b0 [0078.579] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x38a50a8 [0078.579] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x555a040 [0078.579] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x555a040) returned 1 [0078.579] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496f80) returned 1 [0078.579] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a60b8) returned 1 [0078.579] WriteFile (in: hFile=0x1344, lpBuffer=0x5d101b0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1e67f6fc, lpOverlapped=0x0 | out: lpBuffer=0x5d101b0*, lpNumberOfBytesWritten=0x1e67f6fc*=0xc800, lpOverlapped=0x0) returned 1 [0082.149] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5d101b0) Thread: id = 811 os_tid = 0x1bd8 [0078.580] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x5498408 [0078.580] wcscpy (in: _Dest=0x5498408, _Source="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures" [0078.580] wcscat (in: _Dest=0x5498408, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\" [0078.580] wcscat (in: _Dest=0x5498408, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*" [0078.580] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5463330 [0078.580] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*", lpFindFileData=0x5463330 | out: lpFindFileData=0x5463330*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0082.216] wcscmp (_String1=".", _String2=".") returned 0 [0082.216] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5463330 | out: lpFindFileData=0x5463330*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.216] wcscmp (_String1="..", _String2=".") returned 1 [0082.216] wcscmp (_String1="..", _String2="..") returned 0 [0082.216] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5463330 | out: lpFindFileData=0x5463330*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0082.216] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0082.216] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0082.216] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5463330 | out: lpFindFileData=0x5463330*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0082.216] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0082.216] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5463330) returned 1 [0082.216] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5498408) returned 1 [0082.216] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3900150) returned 1 Thread: id = 812 os_tid = 0x1bdc [0078.580] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\SelLngVXnEkSdjqcmVS.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\sellngvxneksdjqcmvs.jpg")) returned 0x20 [0078.580] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\SelLngVXnEkSdjqcmVS.jpg", dwFileAttributes=0x20) returned 1 [0078.581] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\SelLngVXnEkSdjqcmVS.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\sellngvxneksdjqcmvs.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1348 [0078.581] GetFileSizeEx (in: hFile=0x1348, lpFileSize=0x1e77fb68 | out: lpFileSize=0x1e77fb68*=59544) returned 1 [0078.581] SetFilePointerEx (in: hFile=0x1348, liDistanceToMove=0xe894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.581] ReadFile (in: hFile=0x1348, lpBuffer=0x1e77faec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e77fae8, lpOverlapped=0x0 | out: lpBuffer=0x1e77faec*, lpNumberOfBytesRead=0x1e77fae8*=0x4, lpOverlapped=0x0) returned 1 [0078.581] SetFilePointerEx (in: hFile=0x1348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.581] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x555a040 [0078.581] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6688 [0078.581] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc66d8 [0078.581] NtQuerySystemTime (in: CurrentTime=0x1e77fac8 | out: CurrentTime=0x1e77fac8*=132260136357473071) returned 0x0 [0078.581] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0x1748002e [0078.581] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0x4a748be3 [0078.581] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0xc37fe6b3 [0078.581] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0x23768aef [0078.581] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0x8135fd97 [0078.581] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0x1a1370e [0078.581] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0xfb461059 [0078.581] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0x63eddd5c [0078.581] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0x7e96beae [0078.581] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0x2e91f80d [0078.581] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0x1eaced3 [0078.581] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0xd4968180 [0078.581] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0x310085cb [0078.581] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0xfa393cd5 [0078.581] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0xd3038339 [0078.581] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0x3d082b8d [0078.581] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0x2a84b6af [0078.582] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0x7e75d8ce [0078.582] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0xb00fd31e [0078.582] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0x7acc25d3 [0078.582] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0xb6abb682 [0078.582] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0xefd2f1e7 [0078.582] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0x6fc7ce21 [0078.582] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0x7bb1557 [0078.582] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0x9c2d268 [0078.582] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0xcee5c6a7 [0078.582] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0x6c8292bf [0078.582] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0x1af77bea [0078.582] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0x8bd19cde [0078.582] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0x39f5563f [0078.582] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0x517be5ca [0078.582] RtlRandom (in: Seed=0x1e77fad4 | out: Seed=0x1e77fad4) returned 0x51aba9cd [0078.591] SetFilePointerEx (in: hFile=0x1348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.591] ReadFile (in: hFile=0x1348, lpBuffer=0x5d1c9b8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1e77faa8, lpOverlapped=0x0 | out: lpBuffer=0x5d1c9b8*, lpNumberOfBytesRead=0x1e77faa8*=0xc800, lpOverlapped=0x0) returned 1 [0078.592] SetFilePointerEx (in: hFile=0x1348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.592] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a6220 [0078.592] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5496f80 [0078.592] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6728 [0078.592] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bc6728) returned 1 [0078.593] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5d291c0 [0078.598] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc65e8 [0078.598] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6660 [0078.598] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bc6660) returned 1 [0078.598] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496f80) returned 1 [0078.598] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6220) returned 1 [0078.598] WriteFile (in: hFile=0x1348, lpBuffer=0x5d291c0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1e77faa8, lpOverlapped=0x0 | out: lpBuffer=0x5d291c0*, lpNumberOfBytesWritten=0x1e77faa8*=0xc800, lpOverlapped=0x0) returned 1 [0082.150] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5d291c0) Thread: id = 813 os_tid = 0x1be0 [0078.601] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\SPley3vWhB_6hs.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\spley3vwhb_6hs.gif")) returned 0x20 [0078.601] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\SPley3vWhB_6hs.gif", dwFileAttributes=0x20) returned 1 [0078.601] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\SPley3vWhB_6hs.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\spley3vwhb_6hs.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x134c [0078.601] GetFileSizeEx (in: hFile=0x134c, lpFileSize=0x1e7ff7ac | out: lpFileSize=0x1e7ff7ac*=87760) returned 1 [0078.601] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0x156cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.601] ReadFile (in: hFile=0x134c, lpBuffer=0x1e7ff730, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e7ff72c, lpOverlapped=0x0 | out: lpBuffer=0x1e7ff730*, lpNumberOfBytesRead=0x1e7ff72c*=0x4, lpOverlapped=0x0) returned 1 [0078.601] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.601] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6728 [0078.601] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6778 [0078.602] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6610 [0078.602] NtQuerySystemTime (in: CurrentTime=0x1e7ff70c | out: CurrentTime=0x1e7ff70c*=132260136357629372) returned 0x0 [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0x7d816248 [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0x3230c10c [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0xe365214e [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0x82e5fc96 [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0x47255e8d [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0x8da72d0a [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0x2ccbb377 [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0x316b5a0 [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0x2ae439c1 [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0x16236559 [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0x31e7ea84 [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0x64e00e1e [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0xf8895c94 [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0xe58607b6 [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0x51630757 [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0x688e5503 [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0x713dbb8f [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0xb04ac120 [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0x52ec92bf [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0xd7b96a1 [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0x2c412bd3 [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0xa3b96098 [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0x6fea82db [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0x9465adbc [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0x147eefcf [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0x9777e681 [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0x7d8fca1c [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0x438b89e1 [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0x2034ec6d [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0xca4aab6e [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0x5e8b6cf2 [0078.602] RtlRandom (in: Seed=0x1e7ff718 | out: Seed=0x1e7ff718) returned 0xa7b72fb4 [0078.612] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.612] ReadFile (in: hFile=0x134c, lpBuffer=0x5d359c8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1e7ff6ec, lpOverlapped=0x0 | out: lpBuffer=0x5d359c8*, lpNumberOfBytesRead=0x1e7ff6ec*=0xc800, lpOverlapped=0x0) returned 1 [0078.612] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.612] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a63d0 [0078.612] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5496f80 [0078.612] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc67c8 [0078.612] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bc67c8) returned 1 [0078.613] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5d421d0 [0078.617] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6610 [0078.617] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6660 [0078.617] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bc6660) returned 1 [0078.617] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496f80) returned 1 [0078.617] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a63d0) returned 1 [0078.617] WriteFile (in: hFile=0x134c, lpBuffer=0x5d421d0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1e7ff6ec, lpOverlapped=0x0 | out: lpBuffer=0x5d421d0*, lpNumberOfBytesWritten=0x1e7ff6ec*=0xc800, lpOverlapped=0x0) returned 1 [0082.151] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5d421d0) Thread: id = 814 os_tid = 0x1be4 [0078.618] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\UPDgNAJFk_8.png" (normalized: "c:\\users\\fd1hvy\\pictures\\updgnajfk_8.png")) returned 0x20 [0078.618] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\UPDgNAJFk_8.png", dwFileAttributes=0x20) returned 1 [0078.618] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\UPDgNAJFk_8.png" (normalized: "c:\\users\\fd1hvy\\pictures\\updgnajfk_8.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1350 [0078.618] GetFileSizeEx (in: hFile=0x1350, lpFileSize=0x1e87fd2c | out: lpFileSize=0x1e87fd2c*=55154) returned 1 [0078.618] SetFilePointerEx (in: hFile=0x1350, liDistanceToMove=0xd76e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.618] ReadFile (in: hFile=0x1350, lpBuffer=0x1e87fcb0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e87fcac, lpOverlapped=0x0 | out: lpBuffer=0x1e87fcb0*, lpNumberOfBytesRead=0x1e87fcac*=0x4, lpOverlapped=0x0) returned 1 [0078.619] SetFilePointerEx (in: hFile=0x1350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.619] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc67c8 [0078.619] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc67a0 [0078.619] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6660 [0078.619] NtQuerySystemTime (in: CurrentTime=0x1e87fc8c | out: CurrentTime=0x1e87fc8c*=132260136357785465) returned 0x0 [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0x93b8bfe [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0x7c4e52de [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0x5ccc3d9e [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0x8508fb56 [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0xe918bb45 [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0x8f0dbe2a [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0xdd0ae628 [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0xb49936e5 [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0x50fc295d [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0x37edc0a5 [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0xcbdc3789 [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0xd03a2c69 [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0x22def569 [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0xd4bf42 [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0xa3ded5dd [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0xf8b9386c [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0x98cc5a17 [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0xa9eba5ca [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0x83ac7e5c [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0x73f25925 [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0x12b430e5 [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0xb2f789c9 [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0xf974db8 [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0x615ce6f [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0xe007caaf [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0xc41d80ad [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0x94a3ba5f [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0x44c91edf [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0x215ab938 [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0xa1894eec [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0x3c91fbe0 [0078.619] RtlRandom (in: Seed=0x1e87fc98 | out: Seed=0x1e87fc98) returned 0xabe15369 [0078.629] SetFilePointerEx (in: hFile=0x1350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.629] ReadFile (in: hFile=0x1350, lpBuffer=0x5d4e9d8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1e87fc6c, lpOverlapped=0x0 | out: lpBuffer=0x5d4e9d8*, lpNumberOfBytesRead=0x1e87fc6c*=0xc800, lpOverlapped=0x0) returned 1 [0078.630] SetFilePointerEx (in: hFile=0x1350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.630] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a63d0 [0078.630] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5496f80 [0078.630] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc67c8 [0078.630] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bc67c8) returned 1 [0078.631] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5d5b1e0 [0078.635] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6660 [0078.635] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc67c8 [0078.635] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bc67c8) returned 1 [0078.635] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496f80) returned 1 [0078.635] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a63d0) returned 1 [0078.635] WriteFile (in: hFile=0x1350, lpBuffer=0x5d5b1e0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1e87fc6c, lpOverlapped=0x0 | out: lpBuffer=0x5d5b1e0*, lpNumberOfBytesWritten=0x1e87fc6c*=0xc800, lpOverlapped=0x0) returned 1 [0082.153] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5d5b1e0) Thread: id = 815 os_tid = 0x1be8 [0078.635] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\WYmAnlDUMTZ_Pt.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\wymanldumtz_pt.gif")) returned 0x20 [0078.635] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\WYmAnlDUMTZ_Pt.gif", dwFileAttributes=0x20) returned 1 [0078.636] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\WYmAnlDUMTZ_Pt.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\wymanldumtz_pt.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1354 [0078.636] GetFileSizeEx (in: hFile=0x1354, lpFileSize=0x1e8ffadc | out: lpFileSize=0x1e8ffadc*=12075) returned 1 [0078.636] SetFilePointerEx (in: hFile=0x1354, liDistanceToMove=0x2f27, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.636] ReadFile (in: hFile=0x1354, lpBuffer=0x1e8ffa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e8ffa5c, lpOverlapped=0x0 | out: lpBuffer=0x1e8ffa60*, lpNumberOfBytesRead=0x1e8ffa5c*=0x4, lpOverlapped=0x0) returned 1 [0078.636] SetFilePointerEx (in: hFile=0x1354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.636] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc67c8 [0078.636] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc67f0 [0078.636] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6548 [0078.636] NtQuerySystemTime (in: CurrentTime=0x1e8ffa3c | out: CurrentTime=0x1e8ffa3c*=132260136357941980) returned 0x0 [0078.636] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0xb78a13f1 [0078.636] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0x4cf6481c [0078.636] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0x46df6560 [0078.636] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0x3354885a [0078.636] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0x361b6c25 [0078.636] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0x4fa588d5 [0078.636] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0x6d7b8ebc [0078.636] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0x31c442b [0078.636] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0x1f152f86 [0078.636] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0x6c368bcf [0078.636] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0xad4547e0 [0078.636] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0xafb3ed03 [0078.636] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0x6b7c1fe9 [0078.636] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0x157231 [0078.636] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0x84960477 [0078.636] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0x66fb3920 [0078.637] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0xb551ff29 [0078.637] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0x61751c98 [0078.637] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0xd02cb9b9 [0078.637] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0x9aabcff1 [0078.637] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0xdfdbcc00 [0078.637] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0xe22c7fb [0078.637] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0x367ad1fb [0078.637] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0xb3e1fb53 [0078.637] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0xaf658eb1 [0078.637] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0xb8177b83 [0078.637] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0x861a0510 [0078.637] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0x59b29133 [0078.637] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0x9c60ce46 [0078.637] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0x10633536 [0078.637] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0x7be26679 [0078.637] RtlRandom (in: Seed=0x1e8ffa48 | out: Seed=0x1e8ffa48) returned 0x633af6d7 [0078.647] ReadFile (in: hFile=0x1354, lpBuffer=0x5d679e8, nNumberOfBytesToRead=0x2f2b, lpNumberOfBytesRead=0x1e8ffa38, lpOverlapped=0x0 | out: lpBuffer=0x5d679e8*, lpNumberOfBytesRead=0x1e8ffa38*=0x2f2b, lpOverlapped=0x0) returned 1 [0078.648] SetFilePointerEx (in: hFile=0x1354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.648] WriteFile (in: hFile=0x1354, lpBuffer=0x5d741f0*, nNumberOfBytesToWrite=0x2f2b, lpNumberOfBytesWritten=0x1e8ffa34, lpOverlapped=0x0 | out: lpBuffer=0x5d741f0*, lpNumberOfBytesWritten=0x1e8ffa34*=0x2f2b, lpOverlapped=0x0) returned 1 [0082.154] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 816 os_tid = 0x1bec [0078.648] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\zF-qkv6.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\zf-qkv6.jpg")) returned 0x20 [0078.648] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\zF-qkv6.jpg", dwFileAttributes=0x20) returned 1 [0078.649] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\zF-qkv6.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\zf-qkv6.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1358 [0078.649] GetFileSizeEx (in: hFile=0x1358, lpFileSize=0x1e97fc44 | out: lpFileSize=0x1e97fc44*=5703) returned 1 [0078.649] SetFilePointerEx (in: hFile=0x1358, liDistanceToMove=0x1643, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.649] ReadFile (in: hFile=0x1358, lpBuffer=0x1e97fbc8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e97fbc4, lpOverlapped=0x0 | out: lpBuffer=0x1e97fbc8*, lpNumberOfBytesRead=0x1e97fbc4*=0x4, lpOverlapped=0x0) returned 1 [0078.649] SetFilePointerEx (in: hFile=0x1358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.649] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc67c8 [0078.649] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6548 [0078.649] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc65c0 [0078.649] NtQuerySystemTime (in: CurrentTime=0x1e97fba4 | out: CurrentTime=0x1e97fba4*=132260136358098110) returned 0x0 [0078.649] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0xcd749edf [0078.649] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0xc3d9cb55 [0078.649] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0xf79c716c [0078.649] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0x9ecaf7a1 [0078.649] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0x76fdb565 [0078.649] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0x1e7aadec [0078.649] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0x464b4bfe [0078.649] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0xaaa4669b [0078.649] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0x57e255c1 [0078.649] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0xccfdee7a [0078.649] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0x172ea28c [0078.649] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0xb564d6c [0078.649] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0x4586d2d9 [0078.649] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0x15812892 [0078.649] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0x6fadbbd7 [0078.649] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0x93c15bcb [0078.649] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0xe08ca07b [0078.649] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0x83c5094c [0078.649] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0x4122d540 [0078.649] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0x21c47fd2 [0078.649] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0x54fc0923 [0078.650] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0xbe609a60 [0078.650] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0x89392e30 [0078.650] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0x6000eebb [0078.650] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0xafb2911e [0078.650] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0x545ec04a [0078.650] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0x3e34ad65 [0078.650] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0x83905a01 [0078.650] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0x413bbf54 [0078.650] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0xd146f50 [0078.650] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0x31502d13 [0078.650] RtlRandom (in: Seed=0x1e97fbb0 | out: Seed=0x1e97fbb0) returned 0x3d32bf9b [0078.705] ReadFile (in: hFile=0x1358, lpBuffer=0x5d809f8, nNumberOfBytesToRead=0x1647, lpNumberOfBytesRead=0x1e97fba0, lpOverlapped=0x0 | out: lpBuffer=0x5d809f8*, lpNumberOfBytesRead=0x1e97fba0*=0x1647, lpOverlapped=0x0) returned 1 [0078.706] SetFilePointerEx (in: hFile=0x1358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.706] WriteFile (in: hFile=0x1358, lpBuffer=0x5d8d200*, nNumberOfBytesToWrite=0x1647, lpNumberOfBytesWritten=0x1e97fb9c, lpOverlapped=0x0 | out: lpBuffer=0x5d8d200*, lpNumberOfBytesWritten=0x1e97fb9c*=0x1647, lpOverlapped=0x0) returned 1 [0082.156] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 817 os_tid = 0x1bf0 [0078.707] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\_IFws.png" (normalized: "c:\\users\\fd1hvy\\pictures\\_ifws.png")) returned 0x20 [0078.707] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\_IFws.png", dwFileAttributes=0x20) returned 1 [0078.707] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\_IFws.png" (normalized: "c:\\users\\fd1hvy\\pictures\\_ifws.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x135c [0078.707] GetFileSizeEx (in: hFile=0x135c, lpFileSize=0x1e9ffb78 | out: lpFileSize=0x1e9ffb78*=10974) returned 1 [0078.707] SetFilePointerEx (in: hFile=0x135c, liDistanceToMove=0x2ada, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.707] ReadFile (in: hFile=0x135c, lpBuffer=0x1e9ffafc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e9ffaf8, lpOverlapped=0x0 | out: lpBuffer=0x1e9ffafc*, lpNumberOfBytesRead=0x1e9ffaf8*=0x4, lpOverlapped=0x0) returned 1 [0078.707] SetFilePointerEx (in: hFile=0x135c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.708] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc67c8 [0078.708] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc65c0 [0078.708] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc62a0 [0078.708] NtQuerySystemTime (in: CurrentTime=0x1e9ffad8 | out: CurrentTime=0x1e9ffad8*=132260136358723381) returned 0x0 [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0x6d289fc6 [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0xfc05966e [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0x3b79e08d [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0x693028b4 [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0x68538e5c [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0xefaf7169 [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0xcd23c76b [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0x1e4cd634 [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0xf888dcf0 [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0x7c869b27 [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0x175613b6 [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0x5c1765d6 [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0x336d842d [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0x2de3f460 [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0xc05aa39f [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0x7fd522f2 [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0x73182a08 [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0x87e0a891 [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0x82c36ba2 [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0xd0c2ef8c [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0xb4b4b079 [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0x123ff906 [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0x15849c6f [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0x2b5cd42b [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0x4857490d [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0x14a018f0 [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0xd3c8ec67 [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0x3ffdf425 [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0x53ec38be [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0x211f242a [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0x2ffee25c [0078.708] RtlRandom (in: Seed=0x1e9ffae4 | out: Seed=0x1e9ffae4) returned 0x228944ca [0078.719] ReadFile (in: hFile=0x135c, lpBuffer=0x5d99a08, nNumberOfBytesToRead=0x2ade, lpNumberOfBytesRead=0x1e9ffad4, lpOverlapped=0x0 | out: lpBuffer=0x5d99a08*, lpNumberOfBytesRead=0x1e9ffad4*=0x2ade, lpOverlapped=0x0) returned 1 [0078.720] SetFilePointerEx (in: hFile=0x135c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.720] WriteFile (in: hFile=0x135c, lpBuffer=0x5da6210*, nNumberOfBytesToWrite=0x2ade, lpNumberOfBytesWritten=0x1e9ffad0, lpOverlapped=0x0 | out: lpBuffer=0x5da6210*, lpNumberOfBytesWritten=0x1e9ffad0*=0x2ade, lpOverlapped=0x0) returned 1 [0082.158] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 818 os_tid = 0x1bf4 [0078.720] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\38uKSkZAiozNgTxGB.wav" (normalized: "c:\\users\\fd1hvy\\music\\38ukskzaiozngtxgb.wav")) returned 0x20 [0078.720] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\38uKSkZAiozNgTxGB.wav", dwFileAttributes=0x20) returned 1 [0078.720] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\38uKSkZAiozNgTxGB.wav" (normalized: "c:\\users\\fd1hvy\\music\\38ukskzaiozngtxgb.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1360 [0078.721] GetFileSizeEx (in: hFile=0x1360, lpFileSize=0x1ea7fc94 | out: lpFileSize=0x1ea7fc94*=41756) returned 1 [0078.721] SetFilePointerEx (in: hFile=0x1360, liDistanceToMove=0xa318, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.721] ReadFile (in: hFile=0x1360, lpBuffer=0x1ea7fc18, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ea7fc14, lpOverlapped=0x0 | out: lpBuffer=0x1ea7fc18*, lpNumberOfBytesRead=0x1ea7fc14*=0x4, lpOverlapped=0x0) returned 1 [0078.721] SetFilePointerEx (in: hFile=0x1360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.721] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc67c8 [0078.721] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6430 [0078.721] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6160 [0078.721] NtQuerySystemTime (in: CurrentTime=0x1ea7fbf4 | out: CurrentTime=0x1ea7fbf4*=132260136358723381) returned 0x0 [0078.721] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0x481bf24 [0078.721] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0x36cf24da [0078.721] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0xa58d2d7c [0078.721] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0x6e1486a1 [0078.721] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0x47006e3c [0078.721] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0x7d44a794 [0078.721] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0xb0b179eb [0078.721] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0x653d446c [0078.721] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0x89269e49 [0078.721] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0xb4ad2026 [0078.721] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0xa27b5b92 [0078.721] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0xcf79e0fe [0078.721] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0x16790d0 [0078.721] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0x9ab20ee9 [0078.721] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0x99be267f [0078.721] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0xce226c04 [0078.721] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0xee86ba08 [0078.721] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0xb8fae07f [0078.721] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0x787af6f3 [0078.721] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0x5f905b76 [0078.721] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0xd6875915 [0078.721] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0xd5542055 [0078.721] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0x4c810eaa [0078.721] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0x1da5e3af [0078.722] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0xc055f360 [0078.722] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0x3bd6beb7 [0078.722] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0x2592e9f8 [0078.722] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0x651621ca [0078.722] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0x9389c1a2 [0078.722] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0x7f7ade23 [0078.722] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0x7cff3213 [0078.722] RtlRandom (in: Seed=0x1ea7fc00 | out: Seed=0x1ea7fc00) returned 0xb6aa32e7 [0078.732] ReadFile (in: hFile=0x1360, lpBuffer=0x5db2a18, nNumberOfBytesToRead=0xa31c, lpNumberOfBytesRead=0x1ea7fbf0, lpOverlapped=0x0 | out: lpBuffer=0x5db2a18*, lpNumberOfBytesRead=0x1ea7fbf0*=0xa31c, lpOverlapped=0x0) returned 1 [0078.734] SetFilePointerEx (in: hFile=0x1360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.734] WriteFile (in: hFile=0x1360, lpBuffer=0x5dbf220*, nNumberOfBytesToWrite=0xa31c, lpNumberOfBytesWritten=0x1ea7fbec, lpOverlapped=0x0 | out: lpBuffer=0x5dbf220*, lpNumberOfBytesWritten=0x1ea7fbec*=0xa31c, lpOverlapped=0x0) returned 1 [0082.158] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 819 os_tid = 0x1bf8 [0078.734] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\3RPF7uizkWhEbCYZX82n.m4a" (normalized: "c:\\users\\fd1hvy\\music\\3rpf7uizkwhebcyzx82n.m4a")) returned 0x20 [0078.734] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\3RPF7uizkWhEbCYZX82n.m4a", dwFileAttributes=0x20) returned 1 [0078.734] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\3RPF7uizkWhEbCYZX82n.m4a" (normalized: "c:\\users\\fd1hvy\\music\\3rpf7uizkwhebcyzx82n.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1364 [0078.735] GetFileSizeEx (in: hFile=0x1364, lpFileSize=0x1eaffab8 | out: lpFileSize=0x1eaffab8*=81962) returned 1 [0078.735] SetFilePointerEx (in: hFile=0x1364, liDistanceToMove=0x14026, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.735] ReadFile (in: hFile=0x1364, lpBuffer=0x1eaffa3c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1eaffa38, lpOverlapped=0x0 | out: lpBuffer=0x1eaffa3c*, lpNumberOfBytesRead=0x1eaffa38*=0x4, lpOverlapped=0x0) returned 1 [0078.735] SetFilePointerEx (in: hFile=0x1364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.735] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc67c8 [0078.735] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6048 [0078.735] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6458 [0078.735] NtQuerySystemTime (in: CurrentTime=0x1eaffa18 | out: CurrentTime=0x1eaffa18*=132260136358879616) returned 0x0 [0078.735] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0x6b7769ca [0078.735] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0x1b0e519e [0078.735] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0xc39a4691 [0078.735] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0x2b48247e [0078.735] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0x828deac4 [0078.735] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0xc4ffc52d [0078.735] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0xba5c90b8 [0078.735] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0xa08b843d [0078.735] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0xb5d121f4 [0078.735] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0x726fd9fe [0078.735] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0xf54f70b0 [0078.735] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0x9fc1c5b4 [0078.735] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0xaa8a5b5d [0078.735] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0x1f872773 [0078.735] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0x7508e8a6 [0078.735] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0xafaf5b5d [0078.735] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0x4065e770 [0078.735] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0xede2e998 [0078.735] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0xc1030c47 [0078.735] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0xa7bd7be7 [0078.735] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0xba38c96d [0078.735] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0xa3edcf3 [0078.735] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0xba9ccdca [0078.735] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0xc47989aa [0078.736] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0xa8d7a45 [0078.736] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0x5a3c326f [0078.736] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0xc5a2cac6 [0078.736] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0x39edb856 [0078.736] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0x20a31c04 [0078.736] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0x54717fb0 [0078.736] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0xae7b230 [0078.736] RtlRandom (in: Seed=0x1eaffa24 | out: Seed=0x1eaffa24) returned 0x33b1416f [0078.746] SetFilePointerEx (in: hFile=0x1364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.746] ReadFile (in: hFile=0x1364, lpBuffer=0x5dcba28, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1eaff9f8, lpOverlapped=0x0 | out: lpBuffer=0x5dcba28*, lpNumberOfBytesRead=0x1eaff9f8*=0xc800, lpOverlapped=0x0) returned 1 [0078.746] SetFilePointerEx (in: hFile=0x1364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.746] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a6220 [0078.746] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5467e18 [0078.746] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc67c8 [0078.746] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bc67c8) returned 1 [0078.747] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5dd8230 [0078.751] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc67c8 [0078.751] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6368 [0078.751] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bc6368) returned 1 [0078.751] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5467e18) returned 1 [0078.751] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6220) returned 1 [0078.751] WriteFile (in: hFile=0x1364, lpBuffer=0x5dd8230*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1eaff9f8, lpOverlapped=0x0 | out: lpBuffer=0x5dd8230*, lpNumberOfBytesWritten=0x1eaff9f8*=0xc800, lpOverlapped=0x0) returned 1 [0082.175] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5dd8230) Thread: id = 820 os_tid = 0x1bfc [0078.752] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\8PJXMFVd1.mp3" (normalized: "c:\\users\\fd1hvy\\music\\8pjxmfvd1.mp3")) returned 0x20 [0078.752] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\8PJXMFVd1.mp3", dwFileAttributes=0x20) returned 1 [0078.752] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\8PJXMFVd1.mp3" (normalized: "c:\\users\\fd1hvy\\music\\8pjxmfvd1.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1368 [0078.752] GetFileSizeEx (in: hFile=0x1368, lpFileSize=0x1eb7f880 | out: lpFileSize=0x1eb7f880*=56073) returned 1 [0078.752] SetFilePointerEx (in: hFile=0x1368, liDistanceToMove=0xdb05, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.753] ReadFile (in: hFile=0x1368, lpBuffer=0x1eb7f804, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1eb7f800, lpOverlapped=0x0 | out: lpBuffer=0x1eb7f804*, lpNumberOfBytesRead=0x1eb7f800*=0x4, lpOverlapped=0x0) returned 1 [0078.753] SetFilePointerEx (in: hFile=0x1368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.753] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6278 [0078.753] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc60c0 [0078.753] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6458 [0078.753] NtQuerySystemTime (in: CurrentTime=0x1eb7f7e0 | out: CurrentTime=0x1eb7f7e0*=132260136359191944) returned 0x0 [0078.753] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0xca5db0e4 [0078.753] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0x3dbc13c5 [0078.753] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0x1ca9bcce [0078.753] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0x9667e99b [0078.753] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0xeab80b1f [0078.753] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0x1ec3d13 [0078.753] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0xc5b7b891 [0078.753] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0xbcb2e9ad [0078.754] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0xf1ecee8d [0078.754] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0x4163562a [0078.754] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0x49836f57 [0078.754] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0x9a15d425 [0078.754] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0x288d73c [0078.754] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0xc362c4ae [0078.754] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0x64cbac36 [0078.754] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0xef262285 [0078.754] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0xf0b67512 [0078.754] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0x4bd42333 [0078.754] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0xb32d906c [0078.754] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0x3a2ddbbd [0078.754] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0x7de4cc77 [0078.754] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0xf2d39406 [0078.754] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0x213f21c4 [0078.754] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0xb5d1fb2b [0078.754] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0x10d3fb52 [0078.754] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0x820ab776 [0078.754] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0xd68065f0 [0078.754] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0x96ad0c38 [0078.754] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0xbe25066c [0078.754] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0x947778f6 [0078.754] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0x4cb4d39c [0078.754] RtlRandom (in: Seed=0x1eb7f7ec | out: Seed=0x1eb7f7ec) returned 0x6d12a6ec [0078.764] SetFilePointerEx (in: hFile=0x1368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.765] ReadFile (in: hFile=0x1368, lpBuffer=0x5de4a38, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1eb7f7c0, lpOverlapped=0x0 | out: lpBuffer=0x5de4a38*, lpNumberOfBytesRead=0x1eb7f7c0*=0xc800, lpOverlapped=0x0) returned 1 [0078.765] SetFilePointerEx (in: hFile=0x1368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.765] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a6220 [0078.765] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5467e18 [0078.765] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6160 [0078.765] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bc6160) returned 1 [0078.766] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5df1240 [0078.771] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6368 [0078.771] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6458 [0078.771] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bc6458) returned 1 [0078.771] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5467e18) returned 1 [0078.771] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6220) returned 1 [0078.771] WriteFile (in: hFile=0x1368, lpBuffer=0x5df1240*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1eb7f7c0, lpOverlapped=0x0 | out: lpBuffer=0x5df1240*, lpNumberOfBytesWritten=0x1eb7f7c0*=0xc800, lpOverlapped=0x0) returned 1 [0082.174] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5df1240) Thread: id = 821 os_tid = 0x137c [0078.772] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\ppDpDLkO.m4a" (normalized: "c:\\users\\fd1hvy\\music\\ppdpdlko.m4a")) returned 0x20 [0078.772] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\ppDpDLkO.m4a", dwFileAttributes=0x20) returned 1 [0078.772] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\ppDpDLkO.m4a" (normalized: "c:\\users\\fd1hvy\\music\\ppdpdlko.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x136c [0078.772] GetFileSizeEx (in: hFile=0x136c, lpFileSize=0x1ebffcc4 | out: lpFileSize=0x1ebffcc4*=47572) returned 1 [0078.772] SetFilePointerEx (in: hFile=0x136c, liDistanceToMove=0xb9d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.773] ReadFile (in: hFile=0x136c, lpBuffer=0x1ebffc48, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ebffc44, lpOverlapped=0x0 | out: lpBuffer=0x1ebffc48*, lpNumberOfBytesRead=0x1ebffc44*=0x4, lpOverlapped=0x0) returned 1 [0078.773] SetFilePointerEx (in: hFile=0x136c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.773] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6278 [0078.773] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6138 [0078.773] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6458 [0078.773] NtQuerySystemTime (in: CurrentTime=0x1ebffc24 | out: CurrentTime=0x1ebffc24*=132260136359353610) returned 0x0 [0078.773] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0x69ad73fa [0078.773] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0x60236a0c [0078.773] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0x3f4bae6c [0078.773] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0x5d549802 [0078.773] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0x810832f9 [0078.773] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0xcd8ec2c4 [0078.773] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0x35043b16 [0078.773] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0x102ccdcc [0078.773] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0xfa99f106 [0078.773] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0x4c8ba3f9 [0078.773] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0xb80048ac [0078.773] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0xe560cdfd [0078.773] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0xa72783f4 [0078.773] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0xd81a5070 [0078.773] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0x655ad81f [0078.773] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0xc1e7e7f2 [0078.773] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0xe95c3cc2 [0078.773] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0x942ad50a [0078.773] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0xc3d15195 [0078.773] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0xb4b0a134 [0078.773] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0xd6fc4cab [0078.773] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0xc1be1e29 [0078.773] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0xf0ff19a1 [0078.773] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0x324c6a95 [0078.773] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0x2b4636e0 [0078.773] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0xf03b09c3 [0078.773] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0x27aeb84b [0078.774] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0xe273943a [0078.774] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0x882433d1 [0078.774] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0x26310cc [0078.774] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0x69379cc1 [0078.774] RtlRandom (in: Seed=0x1ebffc30 | out: Seed=0x1ebffc30) returned 0x1e1a0d0a [0078.785] ReadFile (in: hFile=0x136c, lpBuffer=0x5dfda48, nNumberOfBytesToRead=0xb9d4, lpNumberOfBytesRead=0x1ebffc20, lpOverlapped=0x0 | out: lpBuffer=0x5dfda48*, lpNumberOfBytesRead=0x1ebffc20*=0xb9d4, lpOverlapped=0x0) returned 1 [0078.786] SetFilePointerEx (in: hFile=0x136c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.786] WriteFile (in: hFile=0x136c, lpBuffer=0x5e0a250*, nNumberOfBytesToWrite=0xb9d4, lpNumberOfBytesWritten=0x1ebffc1c, lpOverlapped=0x0 | out: lpBuffer=0x5e0a250*, lpNumberOfBytesWritten=0x1ebffc1c*=0xb9d4, lpOverlapped=0x0) returned 1 [0082.176] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 822 os_tid = 0xf28 [0078.787] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\s0GdPqj8GLeJZL.m4a" (normalized: "c:\\users\\fd1hvy\\music\\s0gdpqj8glejzl.m4a")) returned 0x20 [0078.787] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\s0GdPqj8GLeJZL.m4a", dwFileAttributes=0x20) returned 1 [0078.787] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\s0GdPqj8GLeJZL.m4a" (normalized: "c:\\users\\fd1hvy\\music\\s0gdpqj8glejzl.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1370 [0078.787] GetFileSizeEx (in: hFile=0x1370, lpFileSize=0x1ec7f7a4 | out: lpFileSize=0x1ec7f7a4*=55778) returned 1 [0078.787] SetFilePointerEx (in: hFile=0x1370, liDistanceToMove=0xd9de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.787] ReadFile (in: hFile=0x1370, lpBuffer=0x1ec7f728, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ec7f724, lpOverlapped=0x0 | out: lpBuffer=0x1ec7f728*, lpNumberOfBytesRead=0x1ec7f724*=0x4, lpOverlapped=0x0) returned 1 [0078.788] SetFilePointerEx (in: hFile=0x1370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.788] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc62a0 [0078.788] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6458 [0078.788] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc61d8 [0078.788] NtQuerySystemTime (in: CurrentTime=0x1ec7f704 | out: CurrentTime=0x1ec7f704*=132260136359504578) returned 0x0 [0078.788] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0x3f45af0e [0078.788] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0x77006b31 [0078.788] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0x50a85501 [0078.788] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0x7d8aac60 [0078.788] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0xc95e079c [0078.788] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0xdfe3886d [0078.788] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0x56ea6b3e [0078.788] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0x4dd96df4 [0078.788] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0x1d8c5c61 [0078.788] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0x87187aa9 [0078.788] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0xfefc2e9a [0078.788] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0x787e94be [0078.788] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0x2d08232c [0078.788] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0xe0e6f689 [0078.788] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0xb8dc0bcd [0078.788] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0x4575fa6 [0078.788] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0x33a9e276 [0078.788] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0x76f60677 [0078.788] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0xc235b732 [0078.788] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0x91f9b837 [0078.788] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0xd7fe9e54 [0078.788] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0x77b3e1f8 [0078.788] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0xa2daef7a [0078.788] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0x93df26ca [0078.788] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0x29f7d64d [0078.788] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0xef299f55 [0078.788] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0x5a064158 [0078.788] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0x41b597cd [0078.788] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0xbdd4d32d [0078.788] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0xf99fc547 [0078.789] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0x262ae589 [0078.789] RtlRandom (in: Seed=0x1ec7f710 | out: Seed=0x1ec7f710) returned 0xf321fb8b [0078.799] SetFilePointerEx (in: hFile=0x1370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.799] ReadFile (in: hFile=0x1370, lpBuffer=0x5e16a58, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1ec7f6e4, lpOverlapped=0x0 | out: lpBuffer=0x5e16a58*, lpNumberOfBytesRead=0x1ec7f6e4*=0xc800, lpOverlapped=0x0) returned 1 [0078.799] SetFilePointerEx (in: hFile=0x1370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.799] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a6418 [0078.799] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5467a58 [0078.799] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc64d0 [0078.799] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bc64d0) returned 1 [0078.800] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5e23260 [0078.805] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc61d8 [0078.805] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6228 [0078.805] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bc6228) returned 1 [0078.805] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5467a58) returned 1 [0078.805] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6418) returned 1 [0078.805] WriteFile (in: hFile=0x1370, lpBuffer=0x5e23260*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1ec7f6e4, lpOverlapped=0x0 | out: lpBuffer=0x5e23260*, lpNumberOfBytesWritten=0x1ec7f6e4*=0xc800, lpOverlapped=0x0) returned 1 [0082.179] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5e23260) Thread: id = 823 os_tid = 0x12d8 [0078.806] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\scM4r.m4a" (normalized: "c:\\users\\fd1hvy\\music\\scm4r.m4a")) returned 0x20 [0078.806] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\scM4r.m4a", dwFileAttributes=0x20) returned 1 [0078.807] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\scM4r.m4a" (normalized: "c:\\users\\fd1hvy\\music\\scm4r.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1374 [0078.807] GetFileSizeEx (in: hFile=0x1374, lpFileSize=0x1ecffb48 | out: lpFileSize=0x1ecffb48*=6181) returned 1 [0078.807] SetFilePointerEx (in: hFile=0x1374, liDistanceToMove=0x1821, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.807] ReadFile (in: hFile=0x1374, lpBuffer=0x1ecffacc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ecffac8, lpOverlapped=0x0 | out: lpBuffer=0x1ecffacc*, lpNumberOfBytesRead=0x1ecffac8*=0x4, lpOverlapped=0x0) returned 1 [0078.807] SetFilePointerEx (in: hFile=0x1374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.807] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6228 [0078.807] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6250 [0078.807] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc62f0 [0078.807] NtQuerySystemTime (in: CurrentTime=0x1ecffaa8 | out: CurrentTime=0x1ecffaa8*=132260136359660944) returned 0x0 [0078.807] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0x309946cf [0078.807] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0x58549007 [0078.807] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0x593bbfc8 [0078.807] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0x5eab73e [0078.807] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0x176ccc97 [0078.807] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0xa2f7547 [0078.808] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0x9447a992 [0078.808] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0x31f01132 [0078.808] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0x5590a2f4 [0078.808] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0xaabd0310 [0078.808] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0xbcb1b655 [0078.808] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0x9c68dad [0078.808] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0x599a5fc8 [0078.808] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0xb91f8eff [0078.808] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0x2c96901 [0078.808] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0x25aa5903 [0078.808] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0xfbc8e7f5 [0078.808] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0x5d34de8b [0078.808] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0x67d98398 [0078.808] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0x564f577c [0078.808] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0x4c678433 [0078.808] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0xa6ed3c93 [0078.808] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0x3ab5a18e [0078.808] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0x52b74392 [0078.808] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0x7a26166b [0078.808] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0xa4e476b2 [0078.808] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0x967196cc [0078.808] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0x1112020f [0078.808] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0xd7f4d1dd [0078.808] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0x99be316f [0078.808] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0x76de0b0e [0078.808] RtlRandom (in: Seed=0x1ecffab4 | out: Seed=0x1ecffab4) returned 0x7545549f [0078.819] ReadFile (in: hFile=0x1374, lpBuffer=0x5e2fa68, nNumberOfBytesToRead=0x1825, lpNumberOfBytesRead=0x1ecffaa4, lpOverlapped=0x0 | out: lpBuffer=0x5e2fa68*, lpNumberOfBytesRead=0x1ecffaa4*=0x1825, lpOverlapped=0x0) returned 1 [0078.819] SetFilePointerEx (in: hFile=0x1374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.819] WriteFile (in: hFile=0x1374, lpBuffer=0x5e3c270*, nNumberOfBytesToWrite=0x1825, lpNumberOfBytesWritten=0x1ecffaa0, lpOverlapped=0x0 | out: lpBuffer=0x5e3c270*, lpNumberOfBytesWritten=0x1ecffaa0*=0x1825, lpOverlapped=0x0) returned 1 [0082.177] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 824 os_tid = 0x12c0 [0078.821] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x42) returned 0x5bc6b38 [0078.821] wcscpy (in: _Dest=0x5bc6b38, _Source="C:\\Users\\FD1HVy\\Music\\siybYIA0" | out: _Dest="C:\\Users\\FD1HVy\\Music\\siybYIA0") returned="C:\\Users\\FD1HVy\\Music\\siybYIA0" [0078.821] wcscat (in: _Dest=0x5bc6b38, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\siybYIA0\\") returned="C:\\Users\\FD1HVy\\Music\\siybYIA0\\" [0078.821] wcscat (in: _Dest=0x5bc6b38, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Music\\siybYIA0\\*") returned="C:\\Users\\FD1HVy\\Music\\siybYIA0\\*" [0078.821] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5464da8 [0078.821] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\siybYIA0\\*", lpFindFileData=0x5464da8 | out: lpFindFileData=0x5464da8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8597cf10, ftCreationTime.dwHighDateTime=0x1d5ca2f, ftLastAccessTime.dwLowDateTime=0x74238d10, ftLastAccessTime.dwHighDateTime=0x1d5cf83, ftLastWriteTime.dwLowDateTime=0x74238d10, ftLastWriteTime.dwHighDateTime=0x1d5cf83, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54452c0 [0078.821] wcscmp (_String1=".", _String2=".") returned 0 [0078.821] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5464da8 | out: lpFindFileData=0x5464da8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8597cf10, ftCreationTime.dwHighDateTime=0x1d5ca2f, ftLastAccessTime.dwLowDateTime=0x74238d10, ftLastAccessTime.dwHighDateTime=0x1d5cf83, ftLastWriteTime.dwLowDateTime=0x74238d10, ftLastWriteTime.dwHighDateTime=0x1d5cf83, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.821] wcscmp (_String1="..", _String2=".") returned 1 [0078.821] wcscmp (_String1="..", _String2="..") returned 0 [0078.821] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5464da8 | out: lpFindFileData=0x5464da8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fdd9800, ftCreationTime.dwHighDateTime=0x1d5cf5a, ftLastAccessTime.dwLowDateTime=0x2e29ebd0, ftLastAccessTime.dwHighDateTime=0x1d5ca63, ftLastWriteTime.dwLowDateTime=0x2e29ebd0, ftLastWriteTime.dwHighDateTime=0x1d5ca63, nFileSizeHigh=0x0, nFileSizeLow=0x690f, dwReserved0=0x0, dwReserved1=0x0, cFileName="-n3dCJb.m4a", cAlternateFileName="")) returned 1 [0078.821] wcscmp (_String1="-n3dCJb.m4a", _String2=".") returned -1 [0078.821] wcscmp (_String1="-n3dCJb.m4a", _String2="..") returned -1 [0078.822] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x5498648 [0078.822] wcscpy (in: _Dest=0x5498648, _Source="C:\\Users\\FD1HVy\\Music\\siybYIA0" | out: _Dest="C:\\Users\\FD1HVy\\Music\\siybYIA0") returned="C:\\Users\\FD1HVy\\Music\\siybYIA0" [0078.822] wcscat (in: _Dest=0x5498648, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\siybYIA0\\") returned="C:\\Users\\FD1HVy\\Music\\siybYIA0\\" [0078.822] wcscat (in: _Dest=0x5498648, _Source="-n3dCJb.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\siybYIA0\\-n3dCJb.m4a") returned="C:\\Users\\FD1HVy\\Music\\siybYIA0\\-n3dCJb.m4a" [0080.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5498648, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1384 [0080.807] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5464da8 | out: lpFindFileData=0x5464da8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb20197b0, ftCreationTime.dwHighDateTime=0x1d5ca9e, ftLastAccessTime.dwLowDateTime=0x2e87d0d0, ftLastAccessTime.dwHighDateTime=0x1d5d678, ftLastWriteTime.dwLowDateTime=0x2e87d0d0, ftLastWriteTime.dwHighDateTime=0x1d5d678, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BpRZWhTjsHD", cAlternateFileName="BPRZWH~1")) returned 1 [0080.807] wcscmp (_String1="BpRZWhTjsHD", _String2=".") returned 1 [0080.807] wcscmp (_String1="BpRZWhTjsHD", _String2="..") returned 1 [0080.807] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x7583c80 [0080.807] wcscpy (in: _Dest=0x7583c80, _Source="C:\\Users\\FD1HVy\\Music\\siybYIA0" | out: _Dest="C:\\Users\\FD1HVy\\Music\\siybYIA0") returned="C:\\Users\\FD1HVy\\Music\\siybYIA0" [0080.807] wcscat (in: _Dest=0x7583c80, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\siybYIA0\\") returned="C:\\Users\\FD1HVy\\Music\\siybYIA0\\" [0080.807] wcscat (in: _Dest=0x7583c80, _Source="BpRZWhTjsHD" | out: _Dest="C:\\Users\\FD1HVy\\Music\\siybYIA0\\BpRZWhTjsHD") returned="C:\\Users\\FD1HVy\\Music\\siybYIA0\\BpRZWhTjsHD" [0080.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7583c80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x173c [0080.808] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5464da8 | out: lpFindFileData=0x5464da8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef749f80, ftCreationTime.dwHighDateTime=0x1d5c8ae, ftLastAccessTime.dwLowDateTime=0x1f90e410, ftLastAccessTime.dwHighDateTime=0x1d5d009, ftLastWriteTime.dwLowDateTime=0x1f90e410, ftLastWriteTime.dwHighDateTime=0x1d5d009, nFileSizeHigh=0x0, nFileSizeLow=0x16e78, dwReserved0=0x0, dwReserved1=0x0, cFileName="CK9Wpw.wav", cAlternateFileName="")) returned 1 [0080.808] wcscmp (_String1="CK9Wpw.wav", _String2=".") returned 1 [0080.808] wcscmp (_String1="CK9Wpw.wav", _String2="..") returned 1 [0080.808] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x7583ce0 [0080.808] wcscpy (in: _Dest=0x7583ce0, _Source="C:\\Users\\FD1HVy\\Music\\siybYIA0" | out: _Dest="C:\\Users\\FD1HVy\\Music\\siybYIA0") returned="C:\\Users\\FD1HVy\\Music\\siybYIA0" [0080.808] wcscat (in: _Dest=0x7583ce0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\siybYIA0\\") returned="C:\\Users\\FD1HVy\\Music\\siybYIA0\\" [0080.808] wcscat (in: _Dest=0x7583ce0, _Source="CK9Wpw.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\siybYIA0\\CK9Wpw.wav") returned="C:\\Users\\FD1HVy\\Music\\siybYIA0\\CK9Wpw.wav" [0080.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7583ce0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1740 [0080.808] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5464da8 | out: lpFindFileData=0x5464da8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a71b000, ftCreationTime.dwHighDateTime=0x1d5cb7a, ftLastAccessTime.dwLowDateTime=0x29f9b1f0, ftLastAccessTime.dwHighDateTime=0x1d5cb5b, ftLastWriteTime.dwLowDateTime=0x29f9b1f0, ftLastWriteTime.dwHighDateTime=0x1d5cb5b, nFileSizeHigh=0x0, nFileSizeLow=0x161a, dwReserved0=0x0, dwReserved1=0x0, cFileName="G3vnT-RcV.mp3", cAlternateFileName="G3VNT-~1.MP3")) returned 1 [0080.809] wcscmp (_String1="G3vnT-RcV.mp3", _String2=".") returned 1 [0080.809] wcscmp (_String1="G3vnT-RcV.mp3", _String2="..") returned 1 [0080.809] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x6e96118 [0080.809] wcscpy (in: _Dest=0x6e96118, _Source="C:\\Users\\FD1HVy\\Music\\siybYIA0" | out: _Dest="C:\\Users\\FD1HVy\\Music\\siybYIA0") returned="C:\\Users\\FD1HVy\\Music\\siybYIA0" [0080.809] wcscat (in: _Dest=0x6e96118, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\siybYIA0\\") returned="C:\\Users\\FD1HVy\\Music\\siybYIA0\\" [0080.809] wcscat (in: _Dest=0x6e96118, _Source="G3vnT-RcV.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\siybYIA0\\G3vnT-RcV.mp3") returned="C:\\Users\\FD1HVy\\Music\\siybYIA0\\G3vnT-RcV.mp3" [0080.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x6e96118, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1744 [0080.809] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5464da8 | out: lpFindFileData=0x5464da8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dc774d0, ftCreationTime.dwHighDateTime=0x1d5d459, ftLastAccessTime.dwLowDateTime=0x710a0db0, ftLastAccessTime.dwHighDateTime=0x1d5d6fa, ftLastWriteTime.dwLowDateTime=0x710a0db0, ftLastWriteTime.dwHighDateTime=0x1d5d6fa, nFileSizeHigh=0x0, nFileSizeLow=0x64d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="kPk65KjtvzEdXF.m4a", cAlternateFileName="KPK65K~1.M4A")) returned 1 [0080.809] wcscmp (_String1="kPk65KjtvzEdXF.m4a", _String2=".") returned 1 [0080.809] wcscmp (_String1="kPk65KjtvzEdXF.m4a", _String2="..") returned 1 [0080.809] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x5ba7188 [0080.809] wcscpy (in: _Dest=0x5ba7188, _Source="C:\\Users\\FD1HVy\\Music\\siybYIA0" | out: _Dest="C:\\Users\\FD1HVy\\Music\\siybYIA0") returned="C:\\Users\\FD1HVy\\Music\\siybYIA0" [0080.809] wcscat (in: _Dest=0x5ba7188, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\siybYIA0\\") returned="C:\\Users\\FD1HVy\\Music\\siybYIA0\\" [0080.809] wcscat (in: _Dest=0x5ba7188, _Source="kPk65KjtvzEdXF.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\siybYIA0\\kPk65KjtvzEdXF.m4a") returned="C:\\Users\\FD1HVy\\Music\\siybYIA0\\kPk65KjtvzEdXF.m4a" [0080.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba7188, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1748 [0080.810] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5464da8 | out: lpFindFileData=0x5464da8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c34a60, ftCreationTime.dwHighDateTime=0x1d5ce8f, ftLastAccessTime.dwLowDateTime=0xb047b960, ftLastAccessTime.dwHighDateTime=0x1d5cbb4, ftLastWriteTime.dwLowDateTime=0xb047b960, ftLastWriteTime.dwHighDateTime=0x1d5cbb4, nFileSizeHigh=0x0, nFileSizeLow=0x838d, dwReserved0=0x0, dwReserved1=0x0, cFileName="qzOf3JFfs-J.m4a", cAlternateFileName="QZOF3J~1.M4A")) returned 1 [0080.810] wcscmp (_String1="qzOf3JFfs-J.m4a", _String2=".") returned 1 [0080.810] wcscmp (_String1="qzOf3JFfs-J.m4a", _String2="..") returned 1 [0080.810] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x6e96180 [0080.810] wcscpy (in: _Dest=0x6e96180, _Source="C:\\Users\\FD1HVy\\Music\\siybYIA0" | out: _Dest="C:\\Users\\FD1HVy\\Music\\siybYIA0") returned="C:\\Users\\FD1HVy\\Music\\siybYIA0" [0080.810] wcscat (in: _Dest=0x6e96180, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\siybYIA0\\") returned="C:\\Users\\FD1HVy\\Music\\siybYIA0\\" [0080.810] wcscat (in: _Dest=0x6e96180, _Source="qzOf3JFfs-J.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\siybYIA0\\qzOf3JFfs-J.m4a") returned="C:\\Users\\FD1HVy\\Music\\siybYIA0\\qzOf3JFfs-J.m4a" [0080.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x6e96180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x174c [0080.811] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5464da8 | out: lpFindFileData=0x5464da8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ee10b40, ftCreationTime.dwHighDateTime=0x1d5d46b, ftLastAccessTime.dwLowDateTime=0xaf011970, ftLastAccessTime.dwHighDateTime=0x1d5d645, ftLastWriteTime.dwLowDateTime=0xaf011970, ftLastWriteTime.dwHighDateTime=0x1d5d645, nFileSizeHigh=0x0, nFileSizeLow=0x2f27, dwReserved0=0x0, dwReserved1=0x0, cFileName="u HkfxB.mp3", cAlternateFileName="UHKFXB~1.MP3")) returned 1 [0080.811] wcscmp (_String1="u HkfxB.mp3", _String2=".") returned 1 [0080.811] wcscmp (_String1="u HkfxB.mp3", _String2="..") returned 1 [0080.811] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x7583740 [0080.811] wcscpy (in: _Dest=0x7583740, _Source="C:\\Users\\FD1HVy\\Music\\siybYIA0" | out: _Dest="C:\\Users\\FD1HVy\\Music\\siybYIA0") returned="C:\\Users\\FD1HVy\\Music\\siybYIA0" [0080.811] wcscat (in: _Dest=0x7583740, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\siybYIA0\\") returned="C:\\Users\\FD1HVy\\Music\\siybYIA0\\" [0080.811] wcscat (in: _Dest=0x7583740, _Source="u HkfxB.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\siybYIA0\\u HkfxB.mp3") returned="C:\\Users\\FD1HVy\\Music\\siybYIA0\\u HkfxB.mp3" [0080.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7583740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1750 [0080.812] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5464da8 | out: lpFindFileData=0x5464da8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7989c00, ftCreationTime.dwHighDateTime=0x1d5d403, ftLastAccessTime.dwLowDateTime=0x4d61f10, ftLastAccessTime.dwHighDateTime=0x1d5c82e, ftLastWriteTime.dwLowDateTime=0x4d61f10, ftLastWriteTime.dwHighDateTime=0x1d5c82e, nFileSizeHigh=0x0, nFileSizeLow=0xe798, dwReserved0=0x0, dwReserved1=0x0, cFileName="xwWMYSyBx.wav", cAlternateFileName="XWWMYS~1.WAV")) returned 1 [0080.812] wcscmp (_String1="xwWMYSyBx.wav", _String2=".") returned 1 [0080.812] wcscmp (_String1="xwWMYSyBx.wav", _String2="..") returned 1 [0080.812] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x6e961e8 [0080.812] wcscpy (in: _Dest=0x6e961e8, _Source="C:\\Users\\FD1HVy\\Music\\siybYIA0" | out: _Dest="C:\\Users\\FD1HVy\\Music\\siybYIA0") returned="C:\\Users\\FD1HVy\\Music\\siybYIA0" [0080.812] wcscat (in: _Dest=0x6e961e8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\siybYIA0\\") returned="C:\\Users\\FD1HVy\\Music\\siybYIA0\\" [0080.812] wcscat (in: _Dest=0x6e961e8, _Source="xwWMYSyBx.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\siybYIA0\\xwWMYSyBx.wav") returned="C:\\Users\\FD1HVy\\Music\\siybYIA0\\xwWMYSyBx.wav" [0080.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x6e961e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1754 [0080.813] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5464da8 | out: lpFindFileData=0x5464da8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7989c00, ftCreationTime.dwHighDateTime=0x1d5d403, ftLastAccessTime.dwLowDateTime=0x4d61f10, ftLastAccessTime.dwHighDateTime=0x1d5c82e, ftLastWriteTime.dwLowDateTime=0x4d61f10, ftLastWriteTime.dwHighDateTime=0x1d5c82e, nFileSizeHigh=0x0, nFileSizeLow=0xe798, dwReserved0=0x0, dwReserved1=0x0, cFileName="xwWMYSyBx.wav", cAlternateFileName="XWWMYS~1.WAV")) returned 0 [0080.813] FindClose (in: hFindFile=0x54452c0 | out: hFindFile=0x54452c0) returned 1 [0080.813] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5464da8) returned 1 [0080.813] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bc6b38) returned 1 [0080.813] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5800) returned 1 Thread: id = 825 os_tid = 0xe88 [0078.822] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\TsHN_-DOMF Kz8I.m4a" (normalized: "c:\\users\\fd1hvy\\music\\tshn_-domf kz8i.m4a")) returned 0x20 [0078.822] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\TsHN_-DOMF Kz8I.m4a", dwFileAttributes=0x20) returned 1 [0078.822] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\TsHN_-DOMF Kz8I.m4a" (normalized: "c:\\users\\fd1hvy\\music\\tshn_-domf kz8i.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x137c [0078.823] GetFileSizeEx (in: hFile=0x137c, lpFileSize=0x1edffd28 | out: lpFileSize=0x1edffd28*=57263) returned 1 [0078.823] SetFilePointerEx (in: hFile=0x137c, liDistanceToMove=0xdfab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.823] ReadFile (in: hFile=0x137c, lpBuffer=0x1edffcac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1edffca8, lpOverlapped=0x0 | out: lpBuffer=0x1edffcac*, lpNumberOfBytesRead=0x1edffca8*=0x4, lpOverlapped=0x0) returned 1 [0078.823] SetFilePointerEx (in: hFile=0x137c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.823] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc64a8 [0078.823] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc64d0 [0078.823] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6228 [0078.823] NtQuerySystemTime (in: CurrentTime=0x1edffc88 | out: CurrentTime=0x1edffc88*=132260136359816943) returned 0x0 [0078.823] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0x3c96ae63 [0078.823] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0x36d875f9 [0078.823] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0x37669aca [0078.823] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0xbd7b6f9d [0078.823] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0x259a06e2 [0078.823] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0x72702318 [0078.823] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0x71ecf827 [0078.823] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0x21cf44eb [0078.823] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0x68d4dcaa [0078.823] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0xde4d1280 [0078.823] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0x23ec8aa1 [0078.823] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0x6cc935d0 [0078.823] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0x7cc446c4 [0078.823] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0x83a326cc [0078.823] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0xb326f859 [0078.823] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0xaaed6373 [0078.823] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0xc32ce517 [0078.823] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0x88d5456b [0078.823] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0x8a77b48b [0078.823] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0xab8e0fea [0078.823] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0x283f91c6 [0078.823] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0xbef18c3c [0078.823] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0xbb6d5f9c [0078.823] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0xb646749e [0078.824] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0x5974492c [0078.824] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0x76f811fd [0078.824] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0x22acd141 [0078.824] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0x991ee739 [0078.824] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0xd6c3acc0 [0078.824] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0xa9dc57b [0078.824] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0xec83cbb1 [0078.824] RtlRandom (in: Seed=0x1edffc94 | out: Seed=0x1edffc94) returned 0xaccb8044 [0078.834] SetFilePointerEx (in: hFile=0x137c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.834] ReadFile (in: hFile=0x137c, lpBuffer=0x5e48a78, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1edffc68, lpOverlapped=0x0 | out: lpBuffer=0x5e48a78*, lpNumberOfBytesRead=0x1edffc68*=0xc800, lpOverlapped=0x0) returned 1 [0078.834] SetFilePointerEx (in: hFile=0x137c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.834] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a6460 [0078.834] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5467a58 [0078.834] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6520 [0078.835] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bc6520) returned 1 [0078.835] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5e55280 [0078.840] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6228 [0078.840] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc62f0 [0078.840] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bc62f0) returned 1 [0078.840] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5467a58) returned 1 [0078.840] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6460) returned 1 [0078.840] WriteFile (in: hFile=0x137c, lpBuffer=0x5e55280*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1edffc68, lpOverlapped=0x0 | out: lpBuffer=0x5e55280*, lpNumberOfBytesWritten=0x1edffc68*=0xc800, lpOverlapped=0x0) returned 1 [0082.188] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5e55280) Thread: id = 826 os_tid = 0x1280 [0078.840] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\z8IVbLeOS2MdsJM4Qm.wav" (normalized: "c:\\users\\fd1hvy\\music\\z8ivbleos2mdsjm4qm.wav")) returned 0x20 [0078.840] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\z8IVbLeOS2MdsJM4Qm.wav", dwFileAttributes=0x20) returned 1 [0078.841] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\z8IVbLeOS2MdsJM4Qm.wav" (normalized: "c:\\users\\fd1hvy\\music\\z8ivbleos2mdsjm4qm.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1380 [0078.841] GetFileSizeEx (in: hFile=0x1380, lpFileSize=0x1ee7fe98 | out: lpFileSize=0x1ee7fe98*=84064) returned 1 [0078.841] SetFilePointerEx (in: hFile=0x1380, liDistanceToMove=0x1485c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.841] ReadFile (in: hFile=0x1380, lpBuffer=0x1ee7fe1c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ee7fe18, lpOverlapped=0x0 | out: lpBuffer=0x1ee7fe1c*, lpNumberOfBytesRead=0x1ee7fe18*=0x4, lpOverlapped=0x0) returned 1 [0078.841] SetFilePointerEx (in: hFile=0x1380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.841] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc64a8 [0078.841] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc6520 [0078.841] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc62f0 [0078.841] NtQuerySystemTime (in: CurrentTime=0x1ee7fdf8 | out: CurrentTime=0x1ee7fdf8*=132260136359982072) returned 0x0 [0078.841] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0xc51d6087 [0078.841] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0x48458afd [0078.841] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0x5976a30d [0078.841] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0xfe4436b3 [0078.841] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0x7cf006dc [0078.841] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0xc5f30330 [0078.841] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0xdaf5d2ab [0078.841] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0x75345cb6 [0078.841] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0x7f488630 [0078.841] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0x15508ac9 [0078.841] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0xf6a1cf8 [0078.841] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0x60f85fed [0078.841] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0xea0492c3 [0078.841] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0xe3b510bc [0078.841] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0xacb7a0d0 [0078.842] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0xa6be6bbc [0078.842] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0x83960e78 [0078.842] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0xa257ac45 [0078.842] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0x944faca2 [0078.842] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0xe0f7ec1b [0078.842] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0xbcf4a517 [0078.842] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0x1d2641fc [0078.842] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0x111ca307 [0078.842] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0x52e0019c [0078.842] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0xbdae1a79 [0078.842] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0xf35e9413 [0078.842] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0xe3b79f8d [0078.842] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0xf3dc7f34 [0078.842] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0x32066d11 [0078.842] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0x977ee613 [0078.842] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0xcb3c576 [0078.842] RtlRandom (in: Seed=0x1ee7fe04 | out: Seed=0x1ee7fe04) returned 0xc91026b5 [0078.852] SetFilePointerEx (in: hFile=0x1380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.852] ReadFile (in: hFile=0x1380, lpBuffer=0x5e61a88, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1ee7fdd8, lpOverlapped=0x0 | out: lpBuffer=0x5e61a88*, lpNumberOfBytesRead=0x1ee7fdd8*=0xc800, lpOverlapped=0x0) returned 1 [0078.852] SetFilePointerEx (in: hFile=0x1380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.852] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a6460 [0078.852] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5467080 [0078.852] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc62f0 [0078.852] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bc62f0) returned 1 [0078.853] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5e6e290 [0078.857] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc64a8 [0078.857] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc62f0 [0078.857] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bc62f0) returned 1 [0078.857] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5467080) returned 1 [0078.857] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6460) returned 1 [0078.857] WriteFile (in: hFile=0x1380, lpBuffer=0x5e6e290*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1ee7fdd8, lpOverlapped=0x0 | out: lpBuffer=0x5e6e290*, lpNumberOfBytesWritten=0x1ee7fdd8*=0xc800, lpOverlapped=0x0) returned 1 [0082.186] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5e6e290) Thread: id = 827 os_tid = 0x130c [0078.860] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3e) returned 0x38a6460 [0078.860] wcscpy (in: _Dest=0x38a6460, _Source="C:\\Users\\FD1HVy\\Music\\_PLqwB" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB" [0078.861] wcscat (in: _Dest=0x38a6460, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\" [0078.861] wcscat (in: _Dest=0x38a6460, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\*") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\*" [0078.861] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54624c0 [0078.861] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\*", lpFindFileData=0x54624c0 | out: lpFindFileData=0x54624c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0091b20, ftCreationTime.dwHighDateTime=0x1d5d221, ftLastAccessTime.dwLowDateTime=0xabe34d0, ftLastAccessTime.dwHighDateTime=0x1d5d55d, ftLastWriteTime.dwLowDateTime=0xabe34d0, ftLastWriteTime.dwHighDateTime=0x1d5d55d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba18b0 [0078.861] wcscmp (_String1=".", _String2=".") returned 0 [0078.861] FindNextFileW (in: hFindFile=0x5ba18b0, lpFindFileData=0x54624c0 | out: lpFindFileData=0x54624c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0091b20, ftCreationTime.dwHighDateTime=0x1d5d221, ftLastAccessTime.dwLowDateTime=0xabe34d0, ftLastAccessTime.dwHighDateTime=0x1d5d55d, ftLastWriteTime.dwLowDateTime=0xabe34d0, ftLastWriteTime.dwHighDateTime=0x1d5d55d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.861] wcscmp (_String1="..", _String2=".") returned 1 [0078.861] wcscmp (_String1="..", _String2="..") returned 0 [0078.861] FindNextFileW (in: hFindFile=0x5ba18b0, lpFindFileData=0x54624c0 | out: lpFindFileData=0x54624c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8046be0, ftCreationTime.dwHighDateTime=0x1d5d425, ftLastAccessTime.dwLowDateTime=0xef89e770, ftLastAccessTime.dwHighDateTime=0x1d5d5ef, ftLastWriteTime.dwLowDateTime=0xef89e770, ftLastWriteTime.dwHighDateTime=0x1d5d5ef, nFileSizeHigh=0x0, nFileSizeLow=0xb869, dwReserved0=0x0, dwReserved1=0x0, cFileName="0KnmiLXS1V6M1uAu.mp3", cAlternateFileName="0KNMIL~1.MP3")) returned 1 [0078.861] wcscmp (_String1="0KnmiLXS1V6M1uAu.mp3", _String2=".") returned 1 [0078.861] wcscmp (_String1="0KnmiLXS1V6M1uAu.mp3", _String2="..") returned 1 [0078.861] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x54682b0 [0078.861] wcscpy (in: _Dest=0x54682b0, _Source="C:\\Users\\FD1HVy\\Music\\_PLqwB" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB" [0078.861] wcscat (in: _Dest=0x54682b0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\" [0078.861] wcscat (in: _Dest=0x54682b0, _Source="0KnmiLXS1V6M1uAu.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\0KnmiLXS1V6M1uAu.mp3") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\0KnmiLXS1V6M1uAu.mp3" [0080.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54682b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1388 [0080.794] FindNextFileW (in: hFindFile=0x5ba18b0, lpFindFileData=0x54624c0 | out: lpFindFileData=0x54624c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b5a520, ftCreationTime.dwHighDateTime=0x1d5cd6b, ftLastAccessTime.dwLowDateTime=0xca201070, ftLastAccessTime.dwHighDateTime=0x1d5d349, ftLastWriteTime.dwLowDateTime=0xca201070, ftLastWriteTime.dwHighDateTime=0x1d5d349, nFileSizeHigh=0x0, nFileSizeLow=0xbf5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="1B6Fp9MVEOF.mp3", cAlternateFileName="1B6FP9~1.MP3")) returned 1 [0080.794] wcscmp (_String1="1B6Fp9MVEOF.mp3", _String2=".") returned 1 [0080.794] wcscmp (_String1="1B6Fp9MVEOF.mp3", _String2="..") returned 1 [0080.794] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x6e95fe0 [0080.794] wcscpy (in: _Dest=0x6e95fe0, _Source="C:\\Users\\FD1HVy\\Music\\_PLqwB" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB" [0080.794] wcscat (in: _Dest=0x6e95fe0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\" [0080.795] wcscat (in: _Dest=0x6e95fe0, _Source="1B6Fp9MVEOF.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\1B6Fp9MVEOF.mp3") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\1B6Fp9MVEOF.mp3" [0080.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x6e95fe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1708 [0080.795] FindNextFileW (in: hFindFile=0x5ba18b0, lpFindFileData=0x54624c0 | out: lpFindFileData=0x54624c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22f21000, ftCreationTime.dwHighDateTime=0x1d5d7d6, ftLastAccessTime.dwLowDateTime=0xb16ace30, ftLastAccessTime.dwHighDateTime=0x1d5ccc8, ftLastWriteTime.dwLowDateTime=0xb16ace30, ftLastWriteTime.dwHighDateTime=0x1d5ccc8, nFileSizeHigh=0x0, nFileSizeLow=0xad7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="94TVfm.wav", cAlternateFileName="")) returned 1 [0080.795] wcscmp (_String1="94TVfm.wav", _String2=".") returned 1 [0080.795] wcscmp (_String1="94TVfm.wav", _String2="..") returned 1 [0080.795] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x757e238 [0080.795] wcscpy (in: _Dest=0x757e238, _Source="C:\\Users\\FD1HVy\\Music\\_PLqwB" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB" [0080.795] wcscat (in: _Dest=0x757e238, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\" [0080.795] wcscat (in: _Dest=0x757e238, _Source="94TVfm.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\94TVfm.wav") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\94TVfm.wav" [0080.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x757e238, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x170c [0080.796] FindNextFileW (in: hFindFile=0x5ba18b0, lpFindFileData=0x54624c0 | out: lpFindFileData=0x54624c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc708dbc0, ftCreationTime.dwHighDateTime=0x1d5ccae, ftLastAccessTime.dwLowDateTime=0x2ba20600, ftLastAccessTime.dwHighDateTime=0x1d5c882, ftLastWriteTime.dwLowDateTime=0x2ba20600, ftLastWriteTime.dwHighDateTime=0x1d5c882, nFileSizeHigh=0x0, nFileSizeLow=0x894b, dwReserved0=0x0, dwReserved1=0x0, cFileName="azZQ4sJMcGr2Gf.wav", cAlternateFileName="AZZQ4S~1.WAV")) returned 1 [0080.796] wcscmp (_String1="azZQ4sJMcGr2Gf.wav", _String2=".") returned 1 [0080.796] wcscmp (_String1="azZQ4sJMcGr2Gf.wav", _String2="..") returned 1 [0080.796] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x6e95f78 [0080.796] wcscpy (in: _Dest=0x6e95f78, _Source="C:\\Users\\FD1HVy\\Music\\_PLqwB" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB" [0080.796] wcscat (in: _Dest=0x6e95f78, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\" [0080.796] wcscat (in: _Dest=0x6e95f78, _Source="azZQ4sJMcGr2Gf.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\azZQ4sJMcGr2Gf.wav") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\azZQ4sJMcGr2Gf.wav" [0080.796] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x6e95f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1710 [0080.797] FindNextFileW (in: hFindFile=0x5ba18b0, lpFindFileData=0x54624c0 | out: lpFindFileData=0x54624c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68230750, ftCreationTime.dwHighDateTime=0x1d5d043, ftLastAccessTime.dwLowDateTime=0x4d4c2e60, ftLastAccessTime.dwHighDateTime=0x1d5d2a6, ftLastWriteTime.dwLowDateTime=0x4d4c2e60, ftLastWriteTime.dwHighDateTime=0x1d5d2a6, nFileSizeHigh=0x0, nFileSizeLow=0x5ddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="C9PNUHen.mp3", cAlternateFileName="")) returned 1 [0080.797] wcscmp (_String1="C9PNUHen.mp3", _String2=".") returned 1 [0080.797] wcscmp (_String1="C9PNUHen.mp3", _String2="..") returned 1 [0080.797] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x543d818 [0080.797] wcscpy (in: _Dest=0x543d818, _Source="C:\\Users\\FD1HVy\\Music\\_PLqwB" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB" [0080.797] wcscat (in: _Dest=0x543d818, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\" [0080.797] wcscat (in: _Dest=0x543d818, _Source="C9PNUHen.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\C9PNUHen.mp3") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\C9PNUHen.mp3" [0080.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x543d818, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1714 [0080.798] FindNextFileW (in: hFindFile=0x5ba18b0, lpFindFileData=0x54624c0 | out: lpFindFileData=0x54624c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cdee990, ftCreationTime.dwHighDateTime=0x1d5ccdf, ftLastAccessTime.dwLowDateTime=0x8cef1b00, ftLastAccessTime.dwHighDateTime=0x1d5c7a1, ftLastWriteTime.dwLowDateTime=0x8cef1b00, ftLastWriteTime.dwHighDateTime=0x1d5c7a1, nFileSizeHigh=0x0, nFileSizeLow=0xe3b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="iFFa.m4a", cAlternateFileName="")) returned 1 [0080.798] wcscmp (_String1="iFFa.m4a", _String2=".") returned 1 [0080.798] wcscmp (_String1="iFFa.m4a", _String2="..") returned 1 [0080.798] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x757e188 [0080.798] wcscpy (in: _Dest=0x757e188, _Source="C:\\Users\\FD1HVy\\Music\\_PLqwB" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB" [0080.798] wcscat (in: _Dest=0x757e188, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\" [0080.798] wcscat (in: _Dest=0x757e188, _Source="iFFa.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\iFFa.m4a") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\iFFa.m4a" [0080.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x757e188, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1718 [0080.798] FindNextFileW (in: hFindFile=0x5ba18b0, lpFindFileData=0x54624c0 | out: lpFindFileData=0x54624c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b54df0, ftCreationTime.dwHighDateTime=0x1d5c8a3, ftLastAccessTime.dwLowDateTime=0x5ed162f0, ftLastAccessTime.dwHighDateTime=0x1d5cf58, ftLastWriteTime.dwLowDateTime=0x5ed162f0, ftLastWriteTime.dwHighDateTime=0x1d5cf58, nFileSizeHigh=0x0, nFileSizeLow=0x4023, dwReserved0=0x0, dwReserved1=0x0, cFileName="lQ0I7gC_.m4a", cAlternateFileName="")) returned 1 [0080.798] wcscmp (_String1="lQ0I7gC_.m4a", _String2=".") returned 1 [0080.798] wcscmp (_String1="lQ0I7gC_.m4a", _String2="..") returned 1 [0080.798] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x5498768 [0080.799] wcscpy (in: _Dest=0x5498768, _Source="C:\\Users\\FD1HVy\\Music\\_PLqwB" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB" [0080.799] wcscat (in: _Dest=0x5498768, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\" [0080.799] wcscat (in: _Dest=0x5498768, _Source="lQ0I7gC_.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\lQ0I7gC_.m4a") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\lQ0I7gC_.m4a" [0080.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5498768, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x171c [0080.799] FindNextFileW (in: hFindFile=0x5ba18b0, lpFindFileData=0x54624c0 | out: lpFindFileData=0x54624c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f631af0, ftCreationTime.dwHighDateTime=0x1d5cd8b, ftLastAccessTime.dwLowDateTime=0x53269160, ftLastAccessTime.dwHighDateTime=0x1d5d4c5, ftLastWriteTime.dwLowDateTime=0x53269160, ftLastWriteTime.dwHighDateTime=0x1d5d4c5, nFileSizeHigh=0x0, nFileSizeLow=0xebfa, dwReserved0=0x0, dwReserved1=0x0, cFileName="orND3Tchiwkya4H5.wav", cAlternateFileName="ORND3T~1.WAV")) returned 1 [0080.799] wcscmp (_String1="orND3Tchiwkya4H5.wav", _String2=".") returned 1 [0080.799] wcscmp (_String1="orND3Tchiwkya4H5.wav", _String2="..") returned 1 [0080.799] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x5ba7268 [0080.799] wcscpy (in: _Dest=0x5ba7268, _Source="C:\\Users\\FD1HVy\\Music\\_PLqwB" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB" [0080.799] wcscat (in: _Dest=0x5ba7268, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\" [0080.799] wcscat (in: _Dest=0x5ba7268, _Source="orND3Tchiwkya4H5.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\orND3Tchiwkya4H5.wav") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\orND3Tchiwkya4H5.wav" [0080.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba7268, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1720 [0080.800] FindNextFileW (in: hFindFile=0x5ba18b0, lpFindFileData=0x54624c0 | out: lpFindFileData=0x54624c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6057b9e0, ftCreationTime.dwHighDateTime=0x1d5ce5d, ftLastAccessTime.dwLowDateTime=0x5d12f3f0, ftLastAccessTime.dwHighDateTime=0x1d5c91f, ftLastWriteTime.dwLowDateTime=0x5d12f3f0, ftLastWriteTime.dwHighDateTime=0x1d5c91f, nFileSizeHigh=0x0, nFileSizeLow=0x167fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="rwHfI4_h.wav", cAlternateFileName="")) returned 1 [0080.800] wcscmp (_String1="rwHfI4_h.wav", _String2=".") returned 1 [0080.800] wcscmp (_String1="rwHfI4_h.wav", _String2="..") returned 1 [0080.800] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x5498708 [0080.800] wcscpy (in: _Dest=0x5498708, _Source="C:\\Users\\FD1HVy\\Music\\_PLqwB" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB" [0080.800] wcscat (in: _Dest=0x5498708, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\" [0080.800] wcscat (in: _Dest=0x5498708, _Source="rwHfI4_h.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\rwHfI4_h.wav") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\rwHfI4_h.wav" [0080.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5498708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1724 [0080.801] FindNextFileW (in: hFindFile=0x5ba18b0, lpFindFileData=0x54624c0 | out: lpFindFileData=0x54624c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1114e10, ftCreationTime.dwHighDateTime=0x1d5d15e, ftLastAccessTime.dwLowDateTime=0x5aab52c0, ftLastAccessTime.dwHighDateTime=0x1d5d233, ftLastWriteTime.dwLowDateTime=0x5aab52c0, ftLastWriteTime.dwHighDateTime=0x1d5d233, nFileSizeHigh=0x0, nFileSizeLow=0x18d09, dwReserved0=0x0, dwReserved1=0x0, cFileName="sgP96Lia9.mp3", cAlternateFileName="SGP96L~1.MP3")) returned 1 [0080.801] wcscmp (_String1="sgP96Lia9.mp3", _String2=".") returned 1 [0080.801] wcscmp (_String1="sgP96Lia9.mp3", _String2="..") returned 1 [0080.801] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x7583bc0 [0080.801] wcscpy (in: _Dest=0x7583bc0, _Source="C:\\Users\\FD1HVy\\Music\\_PLqwB" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB" [0080.801] wcscat (in: _Dest=0x7583bc0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\" [0080.801] wcscat (in: _Dest=0x7583bc0, _Source="sgP96Lia9.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\sgP96Lia9.mp3") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\sgP96Lia9.mp3" [0080.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7583bc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1728 [0080.802] FindNextFileW (in: hFindFile=0x5ba18b0, lpFindFileData=0x54624c0 | out: lpFindFileData=0x54624c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x400d3240, ftCreationTime.dwHighDateTime=0x1d5c8ff, ftLastAccessTime.dwLowDateTime=0xa317dc70, ftLastAccessTime.dwHighDateTime=0x1d5d2f8, ftLastWriteTime.dwLowDateTime=0xa317dc70, ftLastWriteTime.dwHighDateTime=0x1d5d2f8, nFileSizeHigh=0x0, nFileSizeLow=0xa997, dwReserved0=0x0, dwReserved1=0x0, cFileName="v6XSRpF077 2LUq8xHtn.m4a", cAlternateFileName="V6XSRP~1.M4A")) returned 1 [0080.802] wcscmp (_String1="v6XSRpF077 2LUq8xHtn.m4a", _String2=".") returned 1 [0080.802] wcscmp (_String1="v6XSRpF077 2LUq8xHtn.m4a", _String2="..") returned 1 [0080.802] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6c) returned 0x38aaa68 [0080.802] wcscpy (in: _Dest=0x38aaa68, _Source="C:\\Users\\FD1HVy\\Music\\_PLqwB" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB" [0080.802] wcscat (in: _Dest=0x38aaa68, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\" [0080.802] wcscat (in: _Dest=0x38aaa68, _Source="v6XSRpF077 2LUq8xHtn.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\v6XSRpF077 2LUq8xHtn.m4a") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\v6XSRpF077 2LUq8xHtn.m4a" [0080.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38aaa68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x172c [0080.803] FindNextFileW (in: hFindFile=0x5ba18b0, lpFindFileData=0x54624c0 | out: lpFindFileData=0x54624c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58455ed0, ftCreationTime.dwHighDateTime=0x1d5c839, ftLastAccessTime.dwLowDateTime=0x99e4b980, ftLastAccessTime.dwHighDateTime=0x1d5d7d4, ftLastWriteTime.dwLowDateTime=0x99e4b980, ftLastWriteTime.dwHighDateTime=0x1d5d7d4, nFileSizeHigh=0x0, nFileSizeLow=0xcede, dwReserved0=0x0, dwReserved1=0x0, cFileName="y7ng-NLkqB2JRPZIWQ.mp3", cAlternateFileName="Y7NG-N~1.MP3")) returned 1 [0080.803] wcscmp (_String1="y7ng-NLkqB2JRPZIWQ.mp3", _String2=".") returned 1 [0080.803] wcscmp (_String1="y7ng-NLkqB2JRPZIWQ.mp3", _String2="..") returned 1 [0080.803] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x68) returned 0x5ba7118 [0080.803] wcscpy (in: _Dest=0x5ba7118, _Source="C:\\Users\\FD1HVy\\Music\\_PLqwB" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB" [0080.803] wcscat (in: _Dest=0x5ba7118, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\" [0080.803] wcscat (in: _Dest=0x5ba7118, _Source="y7ng-NLkqB2JRPZIWQ.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\y7ng-NLkqB2JRPZIWQ.mp3") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\y7ng-NLkqB2JRPZIWQ.mp3" [0080.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba7118, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1730 [0080.803] FindNextFileW (in: hFindFile=0x5ba18b0, lpFindFileData=0x54624c0 | out: lpFindFileData=0x54624c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bfda190, ftCreationTime.dwHighDateTime=0x1d5d41c, ftLastAccessTime.dwLowDateTime=0xe6046a70, ftLastAccessTime.dwHighDateTime=0x1d5c822, ftLastWriteTime.dwLowDateTime=0xe6046a70, ftLastWriteTime.dwHighDateTime=0x1d5c822, nFileSizeHigh=0x0, nFileSizeLow=0x4029, dwReserved0=0x0, dwReserved1=0x0, cFileName="yLuqNTWrEwGtf.wav", cAlternateFileName="YLUQNT~1.WAV")) returned 1 [0080.803] wcscmp (_String1="yLuqNTWrEwGtf.wav", _String2=".") returned 1 [0080.803] wcscmp (_String1="yLuqNTWrEwGtf.wav", _String2="..") returned 1 [0080.804] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x6e96048 [0080.804] wcscpy (in: _Dest=0x6e96048, _Source="C:\\Users\\FD1HVy\\Music\\_PLqwB" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB" [0080.804] wcscat (in: _Dest=0x6e96048, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\" [0080.804] wcscat (in: _Dest=0x6e96048, _Source="yLuqNTWrEwGtf.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\yLuqNTWrEwGtf.wav") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\yLuqNTWrEwGtf.wav" [0080.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x6e96048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1734 [0080.804] FindNextFileW (in: hFindFile=0x5ba18b0, lpFindFileData=0x54624c0 | out: lpFindFileData=0x54624c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d115810, ftCreationTime.dwHighDateTime=0x1d5d1aa, ftLastAccessTime.dwLowDateTime=0x99725ce0, ftLastAccessTime.dwHighDateTime=0x1d5cc95, ftLastWriteTime.dwLowDateTime=0x99725ce0, ftLastWriteTime.dwHighDateTime=0x1d5cc95, nFileSizeHigh=0x0, nFileSizeLow=0x8984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZqEHyyb-ebHUXQZ4.m4a", cAlternateFileName="ZQEHYY~1.M4A")) returned 1 [0080.804] wcscmp (_String1="ZqEHyyb-ebHUXQZ4.m4a", _String2=".") returned 1 [0080.804] wcscmp (_String1="ZqEHyyb-ebHUXQZ4.m4a", _String2="..") returned 1 [0080.804] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x5ba7b28 [0080.804] wcscpy (in: _Dest=0x5ba7b28, _Source="C:\\Users\\FD1HVy\\Music\\_PLqwB" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB" [0080.804] wcscat (in: _Dest=0x5ba7b28, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\" [0080.804] wcscat (in: _Dest=0x5ba7b28, _Source="ZqEHyyb-ebHUXQZ4.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\ZqEHyyb-ebHUXQZ4.m4a") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\ZqEHyyb-ebHUXQZ4.m4a" [0080.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba7b28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1738 [0080.805] FindNextFileW (in: hFindFile=0x5ba18b0, lpFindFileData=0x54624c0 | out: lpFindFileData=0x54624c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d115810, ftCreationTime.dwHighDateTime=0x1d5d1aa, ftLastAccessTime.dwLowDateTime=0x99725ce0, ftLastAccessTime.dwHighDateTime=0x1d5cc95, ftLastWriteTime.dwLowDateTime=0x99725ce0, ftLastWriteTime.dwHighDateTime=0x1d5cc95, nFileSizeHigh=0x0, nFileSizeLow=0x8984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZqEHyyb-ebHUXQZ4.m4a", cAlternateFileName="ZQEHYY~1.M4A")) returned 0 [0080.805] FindClose (in: hFindFile=0x5ba18b0 | out: hFindFile=0x5ba18b0) returned 1 [0080.805] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54624c0) returned 1 [0080.805] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6460) returned 1 [0080.805] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5848) returned 1 Thread: id = 828 os_tid = 0x1310 [0078.862] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x5bc6cc8 [0078.862] wcscpy (in: _Dest=0x5bc6cc8, _Source="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn" [0078.862] wcscat (in: _Dest=0x5bc6cc8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\" [0078.862] wcscat (in: _Dest=0x5bc6cc8, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\*") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\*" [0078.862] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5418e08 [0078.862] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\*", lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2bf3cfa0, ftCreationTime.dwHighDateTime=0x1d5d0be, ftLastAccessTime.dwLowDateTime=0x25884500, ftLastAccessTime.dwHighDateTime=0x1d5d3d5, ftLastWriteTime.dwLowDateTime=0x25884500, ftLastWriteTime.dwHighDateTime=0x1d5d3d5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba1870 [0078.862] wcscmp (_String1=".", _String2=".") returned 0 [0078.862] FindNextFileW (in: hFindFile=0x5ba1870, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2bf3cfa0, ftCreationTime.dwHighDateTime=0x1d5d0be, ftLastAccessTime.dwLowDateTime=0x25884500, ftLastAccessTime.dwHighDateTime=0x1d5d3d5, ftLastWriteTime.dwLowDateTime=0x25884500, ftLastWriteTime.dwHighDateTime=0x1d5d3d5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.863] wcscmp (_String1="..", _String2=".") returned 1 [0078.863] wcscmp (_String1="..", _String2="..") returned 0 [0078.863] FindNextFileW (in: hFindFile=0x5ba1870, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8818550, ftCreationTime.dwHighDateTime=0x1d5d26a, ftLastAccessTime.dwLowDateTime=0x58ae46e0, ftLastAccessTime.dwHighDateTime=0x1d5d20a, ftLastWriteTime.dwLowDateTime=0x58ae46e0, ftLastWriteTime.dwHighDateTime=0x1d5d20a, nFileSizeHigh=0x0, nFileSizeLow=0xc911, dwReserved0=0x0, dwReserved1=0x0, cFileName="8U_O3t04F3 Mtr.pps", cAlternateFileName="8U_O3T~1.PPS")) returned 1 [0078.863] wcscmp (_String1="8U_O3t04F3 Mtr.pps", _String2=".") returned 1 [0078.863] wcscmp (_String1="8U_O3t04F3 Mtr.pps", _String2="..") returned 1 [0078.863] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6a) returned 0x5467080 [0078.863] wcscpy (in: _Dest=0x5467080, _Source="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn" [0078.863] wcscat (in: _Dest=0x5467080, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\" [0078.863] wcscat (in: _Dest=0x5467080, _Source="8U_O3t04F3 Mtr.pps" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\8U_O3t04F3 Mtr.pps") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\8U_O3t04F3 Mtr.pps" [0080.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5467080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13b8 [0080.789] FindNextFileW (in: hFindFile=0x5ba1870, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x597cb370, ftCreationTime.dwHighDateTime=0x1d5cb04, ftLastAccessTime.dwLowDateTime=0xf62673c0, ftLastAccessTime.dwHighDateTime=0x1d5d241, ftLastWriteTime.dwLowDateTime=0xf62673c0, ftLastWriteTime.dwHighDateTime=0x1d5d241, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BP97_PDOR-hsoX09Mvv", cAlternateFileName="BP97_P~1")) returned 1 [0080.789] wcscmp (_String1="BP97_PDOR-hsoX09Mvv", _String2=".") returned 1 [0080.789] wcscmp (_String1="BP97_PDOR-hsoX09Mvv", _String2="..") returned 1 [0080.789] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6c) returned 0x5467d28 [0080.789] wcscpy (in: _Dest=0x5467d28, _Source="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn" [0080.789] wcscat (in: _Dest=0x5467d28, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\" [0080.789] wcscat (in: _Dest=0x5467d28, _Source="BP97_PDOR-hsoX09Mvv" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\BP97_PDOR-hsoX09Mvv") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\BP97_PDOR-hsoX09Mvv" [0080.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5467d28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16f8 [0080.790] FindNextFileW (in: hFindFile=0x5ba1870, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae6dc380, ftCreationTime.dwHighDateTime=0x1d5cb57, ftLastAccessTime.dwLowDateTime=0x7ae0cb40, ftLastAccessTime.dwHighDateTime=0x1d5c7b8, ftLastWriteTime.dwLowDateTime=0x7ae0cb40, ftLastWriteTime.dwHighDateTime=0x1d5c7b8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NLhaD5NP4PeFv", cAlternateFileName="NLHAD5~1")) returned 1 [0080.790] wcscmp (_String1="NLhaD5NP4PeFv", _String2=".") returned 1 [0080.790] wcscmp (_String1="NLhaD5NP4PeFv", _String2="..") returned 1 [0080.790] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x6e958f8 [0080.790] wcscpy (in: _Dest=0x6e958f8, _Source="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn" [0080.790] wcscat (in: _Dest=0x6e958f8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\" [0080.790] wcscat (in: _Dest=0x6e958f8, _Source="NLhaD5NP4PeFv" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\NLhaD5NP4PeFv") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\NLhaD5NP4PeFv" [0080.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x6e958f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16fc [0080.791] FindNextFileW (in: hFindFile=0x5ba1870, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x488ca10, ftCreationTime.dwHighDateTime=0x1d5d2fd, ftLastAccessTime.dwLowDateTime=0x4322a060, ftLastAccessTime.dwHighDateTime=0x1d5ca43, ftLastWriteTime.dwLowDateTime=0x4322a060, ftLastWriteTime.dwHighDateTime=0x1d5ca43, nFileSizeHigh=0x0, nFileSizeLow=0xbddc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PXlpnL8zaDXPEQqI.pptx", cAlternateFileName="PXLPNL~1.PPT")) returned 1 [0080.791] wcscmp (_String1="PXlpnL8zaDXPEQqI.pptx", _String2=".") returned 1 [0080.791] wcscmp (_String1="PXlpnL8zaDXPEQqI.pptx", _String2="..") returned 1 [0080.791] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5467f08 [0080.791] wcscpy (in: _Dest=0x5467f08, _Source="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn" [0080.791] wcscat (in: _Dest=0x5467f08, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\" [0080.791] wcscat (in: _Dest=0x5467f08, _Source="PXlpnL8zaDXPEQqI.pptx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\PXlpnL8zaDXPEQqI.pptx") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\PXlpnL8zaDXPEQqI.pptx" [0080.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5467f08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1700 [0080.792] FindNextFileW (in: hFindFile=0x5ba1870, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0adf270, ftCreationTime.dwHighDateTime=0x1d5ceb9, ftLastAccessTime.dwLowDateTime=0xa78e0420, ftLastAccessTime.dwHighDateTime=0x1d5cf3b, ftLastWriteTime.dwLowDateTime=0xa78e0420, ftLastWriteTime.dwHighDateTime=0x1d5cf3b, nFileSizeHigh=0x0, nFileSizeLow=0xd8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="QBl0VZJKsl_M.pdf", cAlternateFileName="QBL0VZ~1.PDF")) returned 1 [0080.792] wcscmp (_String1="QBl0VZJKsl_M.pdf", _String2=".") returned 1 [0080.792] wcscmp (_String1="QBl0VZJKsl_M.pdf", _String2="..") returned 1 [0080.792] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x5ba70a8 [0080.792] wcscpy (in: _Dest=0x5ba70a8, _Source="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn" [0080.792] wcscat (in: _Dest=0x5ba70a8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\" [0080.792] wcscat (in: _Dest=0x5ba70a8, _Source="QBl0VZJKsl_M.pdf" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\QBl0VZJKsl_M.pdf") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\QBl0VZJKsl_M.pdf" [0080.792] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba70a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1704 [0080.793] FindNextFileW (in: hFindFile=0x5ba1870, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0adf270, ftCreationTime.dwHighDateTime=0x1d5ceb9, ftLastAccessTime.dwLowDateTime=0xa78e0420, ftLastAccessTime.dwHighDateTime=0x1d5cf3b, ftLastWriteTime.dwLowDateTime=0xa78e0420, ftLastWriteTime.dwHighDateTime=0x1d5cf3b, nFileSizeHigh=0x0, nFileSizeLow=0xd8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="QBl0VZJKsl_M.pdf", cAlternateFileName="QBL0VZ~1.PDF")) returned 0 [0080.793] FindClose (in: hFindFile=0x5ba1870 | out: hFindFile=0x5ba1870) returned 1 [0080.793] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5418e08) returned 1 [0080.793] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bc6cc8) returned 1 [0080.793] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5442f60) returned 1 Thread: id = 829 os_tid = 0x127c [0078.863] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\5d8j8.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\5d8j8.xlsx")) returned 0x20 [0078.863] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\5d8j8.xlsx", dwFileAttributes=0x20) returned 1 [0078.863] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\5d8j8.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\5d8j8.xlsx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x138c [0078.864] GetFileSizeEx (in: hFile=0x138c, lpFileSize=0x1efffe08 | out: lpFileSize=0x1efffe08*=74957) returned 1 [0078.864] SetFilePointerEx (in: hFile=0x138c, liDistanceToMove=0x124c9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.864] ReadFile (in: hFile=0x138c, lpBuffer=0x1efffd8c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1efffd88, lpOverlapped=0x0 | out: lpBuffer=0x1efffd8c*, lpNumberOfBytesRead=0x1efffd88*=0x4, lpOverlapped=0x0) returned 1 [0078.864] SetFilePointerEx (in: hFile=0x138c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.864] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5bc62f0 [0078.864] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9c88 [0078.864] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9cb0 [0078.864] NtQuerySystemTime (in: CurrentTime=0x1efffd68 | out: CurrentTime=0x1efffd68*=132260136360285830) returned 0x0 [0078.864] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0x4fa0ef5c [0078.864] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0xcc4b6562 [0078.864] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0xef7448ee [0078.864] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0xfe5fc59c [0078.864] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0xc3fc5756 [0078.864] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0x79767166 [0078.864] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0x44ec30a8 [0078.864] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0x8000ab04 [0078.864] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0xa5900b99 [0078.864] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0x8f7769d7 [0078.864] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0x83438608 [0078.864] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0xd9c085a0 [0078.864] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0x65bb9022 [0078.864] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0x5a5be341 [0078.864] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0x44910728 [0078.864] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0x7b9d86ff [0078.864] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0x2ad5861b [0078.864] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0x50204a13 [0078.864] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0x51b9e940 [0078.864] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0x344263d7 [0078.864] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0x67c06bee [0078.864] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0x82d22ef5 [0078.865] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0xc9e16316 [0078.865] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0x848e8900 [0078.865] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0xf377d7ca [0078.865] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0x310a51cb [0078.865] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0x7381130 [0078.865] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0x23feb608 [0078.865] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0xe32ca41e [0078.865] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0x93dc2a23 [0078.865] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0xb12b00e4 [0078.865] RtlRandom (in: Seed=0x1efffd74 | out: Seed=0x1efffd74) returned 0x406fb095 [0078.874] SetFilePointerEx (in: hFile=0x138c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.874] ReadFile (in: hFile=0x138c, lpBuffer=0x5e7aa98, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1efffd48, lpOverlapped=0x0 | out: lpBuffer=0x5e7aa98*, lpNumberOfBytesRead=0x1efffd48*=0xc800, lpOverlapped=0x0) returned 1 [0078.875] SetFilePointerEx (in: hFile=0x138c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.875] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a64a8 [0078.875] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5467a58 [0078.875] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9be8 [0078.875] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9be8) returned 1 [0078.876] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5e872a0 [0078.882] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9a30 [0078.882] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9b20 [0078.882] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9b20) returned 1 [0078.882] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5467a58) returned 1 [0078.882] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a64a8) returned 1 [0078.882] WriteFile (in: hFile=0x138c, lpBuffer=0x5e872a0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1efffd48, lpOverlapped=0x0 | out: lpBuffer=0x5e872a0*, lpNumberOfBytesWritten=0x1efffd48*=0xc800, lpOverlapped=0x0) returned 1 [0082.189] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5e872a0) Thread: id = 830 os_tid = 0x13a4 [0078.883] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\7fYhDgrk4Oflzx.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\7fyhdgrk4oflzx.pptx")) returned 0x20 [0078.884] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\7fYhDgrk4Oflzx.pptx", dwFileAttributes=0x20) returned 1 [0078.884] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\7fYhDgrk4Oflzx.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\7fyhdgrk4oflzx.pptx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1390 [0078.884] GetFileSizeEx (in: hFile=0x1390, lpFileSize=0x1f07fafc | out: lpFileSize=0x1f07fafc*=76762) returned 1 [0078.884] SetFilePointerEx (in: hFile=0x1390, liDistanceToMove=0x12bd6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.884] ReadFile (in: hFile=0x1390, lpBuffer=0x1f07fa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f07fa7c, lpOverlapped=0x0 | out: lpBuffer=0x1f07fa80*, lpNumberOfBytesRead=0x1f07fa7c*=0x4, lpOverlapped=0x0) returned 1 [0078.884] SetFilePointerEx (in: hFile=0x1390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.884] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9c38 [0078.884] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9aa8 [0078.884] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9dc8 [0078.884] NtQuerySystemTime (in: CurrentTime=0x1f07fa5c | out: CurrentTime=0x1f07fa5c*=132260136360452004) returned 0x0 [0078.884] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0x463fd474 [0078.884] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0xc87ec654 [0078.884] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0x927b151a [0078.885] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0xb85957a3 [0078.885] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0x1199b436 [0078.885] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0x9acc6df5 [0078.885] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0x25b94b56 [0078.885] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0x4717d009 [0078.885] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0x8bd7a45d [0078.885] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0x87450eda [0078.885] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0x66b2ac58 [0078.885] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0xb3943a85 [0078.885] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0x6d313177 [0078.885] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0x1ea2ae2f [0078.885] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0x82e20276 [0078.885] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0x2ee68cc8 [0078.885] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0x88414188 [0078.885] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0xbd034a42 [0078.885] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0x23d1733d [0078.885] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0x293f3da [0078.885] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0xd338dcf6 [0078.885] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0x27ffe258 [0078.885] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0xc7a03d6d [0078.885] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0xfe18b22c [0078.885] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0xc9f328fe [0078.885] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0xec3af5f9 [0078.885] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0x5a1dea0e [0078.885] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0x43493a89 [0078.885] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0x70ec0f92 [0078.885] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0xdddf4b8a [0078.885] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0x5e1bd5ea [0078.885] RtlRandom (in: Seed=0x1f07fa68 | out: Seed=0x1f07fa68) returned 0xdd2f89f0 [0078.895] SetFilePointerEx (in: hFile=0x1390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.895] ReadFile (in: hFile=0x1390, lpBuffer=0x5e93aa8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1f07fa3c, lpOverlapped=0x0 | out: lpBuffer=0x5e93aa8*, lpNumberOfBytesRead=0x1f07fa3c*=0xc800, lpOverlapped=0x0) returned 1 [0078.895] SetFilePointerEx (in: hFile=0x1390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.895] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a64a8 [0078.895] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5467170 [0078.895] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9a80 [0078.895] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9a80) returned 1 [0078.896] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5ea02b0 [0078.900] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9be8 [0078.900] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9c10 [0078.900] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9c10) returned 1 [0078.900] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5467170) returned 1 [0078.901] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a64a8) returned 1 [0078.901] WriteFile (in: hFile=0x1390, lpBuffer=0x5ea02b0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1f07fa3c, lpOverlapped=0x0 | out: lpBuffer=0x5ea02b0*, lpNumberOfBytesWritten=0x1f07fa3c*=0xc800, lpOverlapped=0x0) returned 1 [0082.201] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ea02b0) Thread: id = 831 os_tid = 0x1248 [0078.902] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\B7J1.docx" (normalized: "c:\\users\\fd1hvy\\documents\\b7j1.docx")) returned 0x20 [0078.902] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\B7J1.docx", dwFileAttributes=0x20) returned 1 [0078.902] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\B7J1.docx" (normalized: "c:\\users\\fd1hvy\\documents\\b7j1.docx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1394 [0078.902] GetFileSizeEx (in: hFile=0x1394, lpFileSize=0x1f0ffa10 | out: lpFileSize=0x1f0ffa10*=77728) returned 1 [0078.902] SetFilePointerEx (in: hFile=0x1394, liDistanceToMove=0x12f9c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.902] ReadFile (in: hFile=0x1394, lpBuffer=0x1f0ff994, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f0ff990, lpOverlapped=0x0 | out: lpBuffer=0x1f0ff994*, lpNumberOfBytesRead=0x1f0ff990*=0x4, lpOverlapped=0x0) returned 1 [0078.903] SetFilePointerEx (in: hFile=0x1394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.903] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9c38 [0078.903] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9ad0 [0078.903] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9dc8 [0078.903] NtQuerySystemTime (in: CurrentTime=0x1f0ff970 | out: CurrentTime=0x1f0ff970*=132260136360598292) returned 0x0 [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0x3c6f2b2e [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0xc4b904ae [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0x3c923b2f [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0xe3f54eb4 [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0x2d73a045 [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0x622a94d9 [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0xa90a319a [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0x5dc30414 [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0x59229131 [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0xe607a746 [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0x20bd84d8 [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0x468ad61c [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0xe6ccabe5 [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0x47c0dcb4 [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0x9f39e551 [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0x979e1a10 [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0xb80c86ac [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0x291479b0 [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0xbf828ab3 [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0xb6f5a86d [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0x7732a0ea [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0xbb8857f2 [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0xf589cf77 [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0x86d7fb4 [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0x821ee359 [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0xf68398cb [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0x7adebbfd [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0x5ae2fc5c [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0x41dbcda5 [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0x944bc208 [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0x3de530ad [0078.903] RtlRandom (in: Seed=0x1f0ff97c | out: Seed=0x1f0ff97c) returned 0xa60b9249 [0078.914] SetFilePointerEx (in: hFile=0x1394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.914] ReadFile (in: hFile=0x1394, lpBuffer=0x5eacab8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1f0ff950, lpOverlapped=0x0 | out: lpBuffer=0x5eacab8*, lpNumberOfBytesRead=0x1f0ff950*=0xc800, lpOverlapped=0x0) returned 1 [0078.914] SetFilePointerEx (in: hFile=0x1394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.914] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a64a8 [0078.914] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5467170 [0078.914] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9af8 [0078.915] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9af8) returned 1 [0078.915] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x5eb92c0 [0078.919] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9c10 [0078.919] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9c38 [0078.920] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9c38) returned 1 [0078.920] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5467170) returned 1 [0078.920] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a64a8) returned 1 [0078.920] WriteFile (in: hFile=0x1394, lpBuffer=0x5eb92c0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1f0ff950, lpOverlapped=0x0 | out: lpBuffer=0x5eb92c0*, lpNumberOfBytesWritten=0x1f0ff950*=0xc800, lpOverlapped=0x0) returned 1 [0082.201] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eb92c0) Thread: id = 832 os_tid = 0xf1c [0078.921] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BhVG8sEYuHI e.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\bhvg8seyuhi e.xlsx")) returned 0x20 [0078.921] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BhVG8sEYuHI e.xlsx", dwFileAttributes=0x20) returned 1 [0078.922] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BhVG8sEYuHI e.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\bhvg8seyuhi e.xlsx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1398 [0078.922] GetFileSizeEx (in: hFile=0x1398, lpFileSize=0x1f17fae4 | out: lpFileSize=0x1f17fae4*=46659) returned 1 [0078.922] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0xb63f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.922] ReadFile (in: hFile=0x1398, lpBuffer=0x1f17fa68, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f17fa64, lpOverlapped=0x0 | out: lpBuffer=0x1f17fa68*, lpNumberOfBytesRead=0x1f17fa64*=0x4, lpOverlapped=0x0) returned 1 [0078.922] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9c38 [0078.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9af8 [0078.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9dc8 [0078.922] NtQuerySystemTime (in: CurrentTime=0x1f17fa44 | out: CurrentTime=0x1f17fa44*=132260136360754402) returned 0x0 [0078.922] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0x64c0c5e2 [0078.922] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0x8ac10a76 [0078.922] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0x33689b7b [0078.922] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0x91e68970 [0078.922] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0x8adb373e [0078.922] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0x326acd09 [0078.922] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0x2e22b23f [0078.922] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0xe6487bf [0078.922] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0xa33c4a55 [0078.922] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0xac631e1a [0078.922] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0x2ec6f551 [0078.922] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0x5dd2622a [0078.922] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0x75c8e3c1 [0078.922] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0xfe060295 [0078.922] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0xf2ecdb3e [0078.922] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0xf68d1946 [0078.922] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0x8740317e [0078.922] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0x70bf9c52 [0078.922] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0x3724c653 [0078.923] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0x3a88a36f [0078.923] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0xa247254f [0078.923] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0x5527e952 [0078.923] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0x2515fbed [0078.923] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0xa87ebfba [0078.923] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0xbf0fde97 [0078.923] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0xafdf85d4 [0078.923] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0x42ebac4f [0078.923] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0x3f8bc446 [0078.923] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0x8aef490 [0078.923] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0xaeea6e62 [0078.923] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0xa656e003 [0078.923] RtlRandom (in: Seed=0x1f17fa50 | out: Seed=0x1f17fa50) returned 0x584f243e [0078.935] ReadFile (in: hFile=0x1398, lpBuffer=0x5ec5ac8, nNumberOfBytesToRead=0xb643, lpNumberOfBytesRead=0x1f17fa40, lpOverlapped=0x0 | out: lpBuffer=0x5ec5ac8*, lpNumberOfBytesRead=0x1f17fa40*=0xb643, lpOverlapped=0x0) returned 1 [0078.937] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.937] WriteFile (in: hFile=0x1398, lpBuffer=0x5ed22d0*, nNumberOfBytesToWrite=0xb643, lpNumberOfBytesWritten=0x1f17fa3c, lpOverlapped=0x0 | out: lpBuffer=0x5ed22d0*, lpNumberOfBytesWritten=0x1f17fa3c*=0xb643, lpOverlapped=0x0) returned 1 [0082.202] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 833 os_tid = 0xf18 [0078.938] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BOdetRenpdxKb6QC1UrV.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\bodetrenpdxkb6qc1urv.xlsx")) returned 0x20 [0078.938] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BOdetRenpdxKb6QC1UrV.xlsx", dwFileAttributes=0x20) returned 1 [0078.938] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BOdetRenpdxKb6QC1UrV.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\bodetrenpdxkb6qc1urv.xlsx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x139c [0078.938] GetFileSizeEx (in: hFile=0x139c, lpFileSize=0x1f1ff824 | out: lpFileSize=0x1f1ff824*=7151) returned 1 [0078.939] SetFilePointerEx (in: hFile=0x139c, liDistanceToMove=0x1beb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.939] ReadFile (in: hFile=0x139c, lpBuffer=0x1f1ff7a8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f1ff7a4, lpOverlapped=0x0 | out: lpBuffer=0x1f1ff7a8*, lpNumberOfBytesRead=0x1f1ff7a4*=0x4, lpOverlapped=0x0) returned 1 [0078.939] SetFilePointerEx (in: hFile=0x139c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.939] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9c38 [0078.939] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9b48 [0078.939] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9dc8 [0078.939] NtQuerySystemTime (in: CurrentTime=0x1f1ff784 | out: CurrentTime=0x1f1ff784*=132260136360917650) returned 0x0 [0078.939] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0x8e6af679 [0078.939] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0x64c8baf3 [0078.939] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0xc49fabca [0078.939] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0xd93acdf4 [0078.939] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0x59288e82 [0078.939] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0x45b03d26 [0078.939] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0xca3126bc [0078.939] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0x4dd5bcba [0078.939] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0x8dc057f2 [0078.939] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0x1ce8e583 [0078.939] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0x2b43b05 [0078.939] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0xaa241485 [0078.939] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0x6eb8a3ad [0078.939] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0xd891c77d [0078.939] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0x88767c72 [0078.939] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0x1adb79f7 [0078.939] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0xb520ab76 [0078.939] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0x3ac4d782 [0078.939] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0xa50cf7cd [0078.939] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0xb7731e93 [0078.939] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0x9f18f4a [0078.939] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0xae3899ea [0078.939] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0x11b39741 [0078.939] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0x8c71abf1 [0078.939] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0x75b93f1 [0078.939] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0x1aa273b7 [0078.939] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0x5d37445e [0078.939] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0xaaee26f5 [0078.939] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0x3b8bf5a6 [0078.940] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0x1e196077 [0078.940] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0xfe1fcd7a [0078.940] RtlRandom (in: Seed=0x1f1ff790 | out: Seed=0x1f1ff790) returned 0x121d9a7b [0078.950] ReadFile (in: hFile=0x139c, lpBuffer=0x5edead8, nNumberOfBytesToRead=0x1bef, lpNumberOfBytesRead=0x1f1ff780, lpOverlapped=0x0 | out: lpBuffer=0x5edead8*, lpNumberOfBytesRead=0x1f1ff780*=0x1bef, lpOverlapped=0x0) returned 1 [0078.950] SetFilePointerEx (in: hFile=0x139c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.950] WriteFile (in: hFile=0x139c, lpBuffer=0x6e70048*, nNumberOfBytesToWrite=0x1bef, lpNumberOfBytesWritten=0x1f1ff77c, lpOverlapped=0x0 | out: lpBuffer=0x6e70048*, lpNumberOfBytesWritten=0x1f1ff77c*=0x1bef, lpOverlapped=0x0) returned 1 [0082.203] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 834 os_tid = 0x360 [0078.951] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BSQC9Dr4kg9Tb2.docx" (normalized: "c:\\users\\fd1hvy\\documents\\bsqc9dr4kg9tb2.docx")) returned 0x20 [0078.951] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BSQC9Dr4kg9Tb2.docx", dwFileAttributes=0x20) returned 1 [0078.952] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BSQC9Dr4kg9Tb2.docx" (normalized: "c:\\users\\fd1hvy\\documents\\bsqc9dr4kg9tb2.docx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13a0 [0078.952] GetFileSizeEx (in: hFile=0x13a0, lpFileSize=0x1f27f7ac | out: lpFileSize=0x1f27f7ac*=30452) returned 1 [0078.952] SetFilePointerEx (in: hFile=0x13a0, liDistanceToMove=0x76f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.952] ReadFile (in: hFile=0x13a0, lpBuffer=0x1f27f730, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f27f72c, lpOverlapped=0x0 | out: lpBuffer=0x1f27f730*, lpNumberOfBytesRead=0x1f27f72c*=0x4, lpOverlapped=0x0) returned 1 [0078.952] SetFilePointerEx (in: hFile=0x13a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.952] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9c38 [0078.952] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9b98 [0078.952] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9dc8 [0078.952] NtQuerySystemTime (in: CurrentTime=0x1f27f70c | out: CurrentTime=0x1f27f70c*=132260136361066951) returned 0x0 [0078.952] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0x4c224317 [0078.952] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0x198765e5 [0078.952] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0xcd6b8a [0078.952] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0x1b3c1e65 [0078.952] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0x3197ac97 [0078.952] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0x1b51d64b [0078.952] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0xed19086c [0078.952] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0x53182216 [0078.952] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0xdc3bbc1c [0078.952] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0x6f1ce5a4 [0078.952] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0xe1033585 [0078.952] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0x8d3e466 [0078.952] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0x5aeed036 [0078.952] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0xe50a9b40 [0078.953] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0x62304453 [0078.953] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0x2f347939 [0078.953] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0x312cdcda [0078.953] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0xd2601a0b [0078.953] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0x51e0bce8 [0078.953] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0x5fff133e [0078.953] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0xa5c04f66 [0078.953] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0x5a512f95 [0078.953] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0x5a482be [0078.953] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0xbf5ae0da [0078.953] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0x445635fd [0078.953] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0x3fbaf9cd [0078.953] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0xf52127fa [0078.953] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0x9b265c59 [0078.953] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0x3b32005a [0078.953] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0x7610f89 [0078.953] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0x372e8f94 [0078.953] RtlRandom (in: Seed=0x1f27f718 | out: Seed=0x1f27f718) returned 0xb3f6f462 [0078.963] ReadFile (in: hFile=0x13a0, lpBuffer=0x6e7c850, nNumberOfBytesToRead=0x76f4, lpNumberOfBytesRead=0x1f27f708, lpOverlapped=0x0 | out: lpBuffer=0x6e7c850*, lpNumberOfBytesRead=0x1f27f708*=0x76f4, lpOverlapped=0x0) returned 1 [0078.964] SetFilePointerEx (in: hFile=0x13a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.965] WriteFile (in: hFile=0x13a0, lpBuffer=0x6e89058*, nNumberOfBytesToWrite=0x76f4, lpNumberOfBytesWritten=0x1f27f704, lpOverlapped=0x0 | out: lpBuffer=0x6e89058*, lpNumberOfBytesWritten=0x1f27f704*=0x76f4, lpOverlapped=0x0) returned 1 [0082.210] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 835 os_tid = 0xfe8 [0078.966] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb")) returned 0x20 [0082.205] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", dwFileAttributes=0x20) returned 1 [0082.206] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1d24 [0082.210] GetFileSizeEx (in: hFile=0x1d24, lpFileSize=0x1f2ff7f4 | out: lpFileSize=0x1f2ff7f4*=348160) returned 1 [0082.210] SetFilePointerEx (in: hFile=0x1d24, liDistanceToMove=0x54ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.210] ReadFile (in: hFile=0x1d24, lpBuffer=0x1f2ff778, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f2ff774, lpOverlapped=0x0 | out: lpBuffer=0x1f2ff778*, lpNumberOfBytesRead=0x1f2ff774*=0x4, lpOverlapped=0x0) returned 1 [0082.215] SetFilePointerEx (in: hFile=0x1d24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.215] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 836 os_tid = 0xffc [0078.967] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hDFe0_c9uuJxXHVlQ.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\hdfe0_c9uujxxhvlq.xlsx")) returned 0x20 [0078.967] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hDFe0_c9uuJxXHVlQ.xlsx", dwFileAttributes=0x20) returned 1 [0078.967] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hDFe0_c9uuJxXHVlQ.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\hdfe0_c9uujxxhvlq.xlsx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13a4 [0078.968] GetFileSizeEx (in: hFile=0x13a4, lpFileSize=0x1f37fc3c | out: lpFileSize=0x1f37fc3c*=26029) returned 1 [0078.968] SetFilePointerEx (in: hFile=0x13a4, liDistanceToMove=0x65a9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.968] ReadFile (in: hFile=0x13a4, lpBuffer=0x1f37fbc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f37fbbc, lpOverlapped=0x0 | out: lpBuffer=0x1f37fbc0*, lpNumberOfBytesRead=0x1f37fbbc*=0x4, lpOverlapped=0x0) returned 1 [0078.968] SetFilePointerEx (in: hFile=0x13a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.968] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9c38 [0078.968] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9da0 [0078.968] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9dc8 [0078.968] NtQuerySystemTime (in: CurrentTime=0x1f37fb9c | out: CurrentTime=0x1f37fb9c*=132260136361223431) returned 0x0 [0078.968] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0xb7323b75 [0078.968] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0x132f138e [0078.968] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0x562c0bf2 [0078.968] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0x3e1c41f7 [0078.968] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0xc0b3cba5 [0078.968] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0xb5045878 [0078.968] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0xa54e3fb3 [0078.968] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0xc5eff6ce [0078.968] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0xc5cd0887 [0078.968] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0x3c8b0247 [0078.968] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0x161eb59d [0078.968] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0x6a4cd13f [0078.968] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0x2a64304a [0078.968] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0x45a3b5c0 [0078.968] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0xdf40045f [0078.968] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0xfba1acbe [0078.968] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0x10d024ac [0078.968] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0x55166a77 [0078.968] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0x47f8009e [0078.968] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0xbc395d60 [0078.968] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0x254ae94b [0078.968] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0x4d418fee [0078.968] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0x46a10c25 [0078.968] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0x50c7f762 [0078.968] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0x45be07ce [0078.969] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0x5c297aff [0078.969] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0xf266b793 [0078.969] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0x4178c77d [0078.969] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0x6441a9ea [0078.969] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0x30eeef6a [0078.969] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0xe400b0d5 [0078.969] RtlRandom (in: Seed=0x1f37fba8 | out: Seed=0x1f37fba8) returned 0x516f4109 [0078.979] ReadFile (in: hFile=0x13a4, lpBuffer=0x6e96868, nNumberOfBytesToRead=0x65ad, lpNumberOfBytesRead=0x1f37fb98, lpOverlapped=0x0 | out: lpBuffer=0x6e96868*, lpNumberOfBytesRead=0x1f37fb98*=0x65ad, lpOverlapped=0x0) returned 1 [0078.980] SetFilePointerEx (in: hFile=0x13a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.980] WriteFile (in: hFile=0x13a4, lpBuffer=0x6ea3070*, nNumberOfBytesToWrite=0x65ad, lpNumberOfBytesWritten=0x1f37fb94, lpOverlapped=0x0 | out: lpBuffer=0x6ea3070*, lpNumberOfBytesWritten=0x1f37fb94*=0x65ad, lpOverlapped=0x0) returned 1 [0082.204] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 837 os_tid = 0x520 [0078.980] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\LgDLYrs.docx" (normalized: "c:\\users\\fd1hvy\\documents\\lgdlyrs.docx")) returned 0x20 [0078.981] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\LgDLYrs.docx", dwFileAttributes=0x20) returned 1 [0078.981] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\LgDLYrs.docx" (normalized: "c:\\users\\fd1hvy\\documents\\lgdlyrs.docx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13a8 [0078.981] GetFileSizeEx (in: hFile=0x13a8, lpFileSize=0x1f3ff784 | out: lpFileSize=0x1f3ff784*=42862) returned 1 [0078.981] SetFilePointerEx (in: hFile=0x13a8, liDistanceToMove=0xa76a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.981] ReadFile (in: hFile=0x13a8, lpBuffer=0x1f3ff708, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f3ff704, lpOverlapped=0x0 | out: lpBuffer=0x1f3ff708*, lpNumberOfBytesRead=0x1f3ff704*=0x4, lpOverlapped=0x0) returned 1 [0078.981] SetFilePointerEx (in: hFile=0x13a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.981] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9c38 [0078.981] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9dc8 [0078.981] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9918 [0078.981] NtQuerySystemTime (in: CurrentTime=0x1f3ff6e4 | out: CurrentTime=0x1f3ff6e4*=132260136361379556) returned 0x0 [0078.981] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0x8d61abeb [0078.981] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0x85c57bb [0078.981] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0x8f98f8fa [0078.981] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0xad699250 [0078.981] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0xa0f136f6 [0078.981] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0x7431b172 [0078.981] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0x7fdb736c [0078.981] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0x339ddc54 [0078.981] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0x1bad765a [0078.981] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0x6f4cd2c9 [0078.982] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0xc7d92052 [0078.982] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0x71e1b10f [0078.982] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0xf6209064 [0078.982] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0x13ec2044 [0078.982] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0x5d235814 [0078.982] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0x136b007e [0078.982] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0xe9f38e6d [0078.982] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0xf759a795 [0078.982] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0x747be76e [0078.982] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0xd90fed34 [0078.982] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0xf72ea3c5 [0078.982] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0x4da2367a [0078.982] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0x9b7851bf [0078.982] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0xfa642adb [0078.982] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0x36b071b8 [0078.982] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0xfff39fc6 [0078.982] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0x8b05bec7 [0078.982] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0x2fac7be1 [0078.982] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0x471d6c0e [0078.982] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0xf2100207 [0078.982] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0x6a4d2cab [0078.982] RtlRandom (in: Seed=0x1f3ff6f0 | out: Seed=0x1f3ff6f0) returned 0xb163c5e4 [0078.993] ReadFile (in: hFile=0x13a8, lpBuffer=0x6eaf878, nNumberOfBytesToRead=0xa76e, lpNumberOfBytesRead=0x1f3ff6e0, lpOverlapped=0x0 | out: lpBuffer=0x6eaf878*, lpNumberOfBytesRead=0x1f3ff6e0*=0xa76e, lpOverlapped=0x0) returned 1 [0078.994] SetFilePointerEx (in: hFile=0x13a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.994] WriteFile (in: hFile=0x13a8, lpBuffer=0x6ebc080*, nNumberOfBytesToWrite=0xa76e, lpNumberOfBytesWritten=0x1f3ff6dc, lpOverlapped=0x0 | out: lpBuffer=0x6ebc080*, lpNumberOfBytesWritten=0x1f3ff6dc*=0xa76e, lpOverlapped=0x0) returned 1 [0082.285] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 838 os_tid = 0xce4 [0078.994] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x541b3b8 [0078.995] wcscpy (in: _Dest=0x541b3b8, _Source="C:\\Users\\FD1HVy\\Documents\\My Music" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Music") returned="C:\\Users\\FD1HVy\\Documents\\My Music" [0078.995] wcscat (in: _Dest=0x541b3b8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Music\\") returned="C:\\Users\\FD1HVy\\Documents\\My Music\\" [0078.995] wcscat (in: _Dest=0x541b3b8, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Music\\*") returned="C:\\Users\\FD1HVy\\Documents\\My Music\\*" [0078.995] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5419070 [0078.995] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music\\*", lpFindFileData=0x5419070 | out: lpFindFileData=0x5419070*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0082.273] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5419070) returned 1 [0082.273] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541b3b8) returned 1 [0082.273] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55324e0) returned 1 Thread: id = 839 os_tid = 0x4c0 [0078.995] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x50) returned 0x541b410 [0078.995] wcscpy (in: _Dest=0x541b410, _Source="C:\\Users\\FD1HVy\\Documents\\My Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Pictures") returned="C:\\Users\\FD1HVy\\Documents\\My Pictures" [0078.995] wcscat (in: _Dest=0x541b410, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Pictures\\") returned="C:\\Users\\FD1HVy\\Documents\\My Pictures\\" [0078.995] wcscat (in: _Dest=0x541b410, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Pictures\\*") returned="C:\\Users\\FD1HVy\\Documents\\My Pictures\\*" [0078.995] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5417f98 [0078.995] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures\\*", lpFindFileData=0x5417f98 | out: lpFindFileData=0x5417f98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0082.274] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5417f98) returned 1 [0082.274] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541b410) returned 1 [0082.274] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39004c0) returned 1 Thread: id = 840 os_tid = 0x4bc [0078.996] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x541b780 [0078.996] wcscpy (in: _Dest=0x541b780, _Source="C:\\Users\\FD1HVy\\Documents\\My Shapes" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes" [0078.996] wcscat (in: _Dest=0x541b780, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes\\") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\" [0078.996] wcscat (in: _Dest=0x541b780, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*" [0078.996] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5418200 [0078.996] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*", lpFindFileData=0x5418200 | out: lpFindFileData=0x5418200*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0082.278] wcscmp (_String1=".", _String2=".") returned 0 [0082.279] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5418200 | out: lpFindFileData=0x5418200*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.279] wcscmp (_String1="..", _String2=".") returned 1 [0082.279] wcscmp (_String1="..", _String2="..") returned 0 [0082.279] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5418200 | out: lpFindFileData=0x5418200*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0082.279] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0082.279] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0082.279] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5418200 | out: lpFindFileData=0x5418200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1a0f60e, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1a0f60e, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vssx", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0082.279] wcscmp (_String1="Favorites.vssx", _String2=".") returned 1 [0082.279] wcscmp (_String1="Favorites.vssx", _String2="..") returned 1 [0082.279] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x5ba7738 [0082.279] wcscpy (in: _Dest=0x5ba7738, _Source="C:\\Users\\FD1HVy\\Documents\\My Shapes" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes" [0082.279] wcscat (in: _Dest=0x5ba7738, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes\\") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\" [0082.279] wcscat (in: _Dest=0x5ba7738, _Source="Favorites.vssx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx" [0082.279] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba7738, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d94 [0082.279] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5418200 | out: lpFindFileData=0x5418200*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0082.280] wcscmp (_String1="_private", _String2=".") returned 1 [0082.280] wcscmp (_String1="_private", _String2="..") returned 1 [0082.280] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x542b250 [0082.280] wcscpy (in: _Dest=0x542b250, _Source="C:\\Users\\FD1HVy\\Documents\\My Shapes" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes" [0082.280] wcscat (in: _Dest=0x542b250, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes\\") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\" [0082.280] wcscat (in: _Dest=0x542b250, _Source="_private" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private" [0082.280] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x542b250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d98 [0082.280] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x5418200 | out: lpFindFileData=0x5418200*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0 [0082.280] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0082.281] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5418200) returned 1 [0082.281] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541b780) returned 1 [0082.281] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5532990) returned 1 Thread: id = 841 os_tid = 0xcdc [0078.996] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x541b7d8 [0078.996] wcscpy (in: _Dest=0x541b7d8, _Source="C:\\Users\\FD1HVy\\Documents\\My Videos" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Videos") returned="C:\\Users\\FD1HVy\\Documents\\My Videos" [0078.996] wcscat (in: _Dest=0x541b7d8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Videos\\") returned="C:\\Users\\FD1HVy\\Documents\\My Videos\\" [0078.996] wcscat (in: _Dest=0x541b7d8, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Videos\\*") returned="C:\\Users\\FD1HVy\\Documents\\My Videos\\*" [0078.996] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5418468 [0078.996] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos\\*", lpFindFileData=0x5418468 | out: lpFindFileData=0x5418468*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0082.275] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5418468) returned 1 [0082.275] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x541b7d8) returned 1 [0082.275] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55329e0) returned 1 Thread: id = 842 os_tid = 0xa1c [0078.997] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\NgaH9-S28Td4CjdpZ.docx" (normalized: "c:\\users\\fd1hvy\\documents\\ngah9-s28td4cjdpz.docx")) returned 0x20 [0078.997] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\NgaH9-S28Td4CjdpZ.docx", dwFileAttributes=0x20) returned 1 [0078.997] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\NgaH9-S28Td4CjdpZ.docx" (normalized: "c:\\users\\fd1hvy\\documents\\ngah9-s28td4cjdpz.docx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13ac [0078.998] GetFileSizeEx (in: hFile=0x13ac, lpFileSize=0x1f67fb90 | out: lpFileSize=0x1f67fb90*=55123) returned 1 [0078.998] SetFilePointerEx (in: hFile=0x13ac, liDistanceToMove=0xd74f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.998] ReadFile (in: hFile=0x13ac, lpBuffer=0x1f67fb14, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f67fb10, lpOverlapped=0x0 | out: lpBuffer=0x1f67fb14*, lpNumberOfBytesRead=0x1f67fb10*=0x4, lpOverlapped=0x0) returned 1 [0078.998] SetFilePointerEx (in: hFile=0x13ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.998] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9c38 [0078.998] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9918 [0078.998] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9990 [0078.998] NtQuerySystemTime (in: CurrentTime=0x1f67faf0 | out: CurrentTime=0x1f67faf0*=132260136361535806) returned 0x0 [0078.998] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0xccb540de [0078.998] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0x777f0282 [0078.998] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0xa9952bc [0078.998] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0xb64b9f93 [0078.998] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0x39e7a71c [0078.998] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0x771ff460 [0078.998] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0xe9a43f82 [0078.998] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0x29cde8ca [0078.998] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0x3491e814 [0078.998] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0xa14bfc35 [0078.998] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0xb8e7eb24 [0078.998] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0xbe85dce4 [0078.998] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0xfddb2381 [0078.998] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0x867ad330 [0078.998] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0x8f87cc40 [0078.998] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0x3e62051d [0078.998] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0xdf1fee9b [0078.998] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0x364c3916 [0078.998] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0xfd13c92f [0078.998] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0x25755951 [0078.998] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0xca7e28ee [0078.998] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0xc69047f5 [0078.998] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0x2eab4b7e [0078.998] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0x41c9a4a0 [0078.998] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0xc390b05b [0078.999] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0xc2015807 [0078.999] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0x909e0a68 [0078.999] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0x3c0e60a1 [0078.999] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0xe4b025bd [0078.999] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0xac43c321 [0078.999] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0x431eb79c [0078.999] RtlRandom (in: Seed=0x1f67fafc | out: Seed=0x1f67fafc) returned 0x7443852c [0079.008] SetFilePointerEx (in: hFile=0x13ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.008] ReadFile (in: hFile=0x13ac, lpBuffer=0x6ec8888, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1f67fad0, lpOverlapped=0x0 | out: lpBuffer=0x6ec8888*, lpNumberOfBytesRead=0x1f67fad0*=0xc800, lpOverlapped=0x0) returned 1 [0079.009] SetFilePointerEx (in: hFile=0x13ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.009] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x537b320 [0079.009] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5467a58 [0079.009] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9c38 [0079.009] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9c38) returned 1 [0079.010] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x6ed5090 [0079.014] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9c38 [0079.014] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9990 [0079.014] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9990) returned 1 [0079.014] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5467a58) returned 1 [0079.014] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b320) returned 1 [0079.014] WriteFile (in: hFile=0x13ac, lpBuffer=0x6ed5090*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1f67fad0, lpOverlapped=0x0 | out: lpBuffer=0x6ed5090*, lpNumberOfBytesWritten=0x1f67fad0*=0xc800, lpOverlapped=0x0) returned 1 [0082.283] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x6ed5090) Thread: id = 843 os_tid = 0xb24 [0079.015] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x5498468 [0079.015] wcscpy (in: _Dest=0x5498468, _Source="C:\\Users\\FD1HVy\\Documents\\Outlook Files" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Outlook Files") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files" [0079.015] wcscat (in: _Dest=0x5498468, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\" [0079.015] wcscat (in: _Dest=0x5498468, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*" [0079.015] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54186d0 [0079.015] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*", lpFindFileData=0x54186d0 | out: lpFindFileData=0x54186d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0082.276] wcscmp (_String1=".", _String2=".") returned 0 [0082.276] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x54186d0 | out: lpFindFileData=0x54186d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.276] wcscmp (_String1="..", _String2=".") returned 1 [0082.276] wcscmp (_String1="..", _String2="..") returned 0 [0082.276] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x54186d0 | out: lpFindFileData=0x54186d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddbf9d33, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 1 [0082.276] wcscmp (_String1="kkcie@kdj.kd.pst", _String2=".") returned 1 [0082.276] wcscmp (_String1="kkcie@kdj.kd.pst", _String2="..") returned 1 [0082.277] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x72) returned 0x38d09a0 [0082.277] wcscpy (in: _Dest=0x38d09a0, _Source="C:\\Users\\FD1HVy\\Documents\\Outlook Files" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Outlook Files") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files" [0082.277] wcscat (in: _Dest=0x38d09a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\" [0082.277] wcscat (in: _Dest=0x38d09a0, _Source="kkcie@kdj.kd.pst" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" [0082.277] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d09a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d90 [0082.277] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x54186d0 | out: lpFindFileData=0x54186d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddbf9d33, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 0 [0082.277] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0082.278] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54186d0) returned 1 [0082.278] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5498468) returned 1 [0082.278] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3900200) returned 1 Thread: id = 844 os_tid = 0xab0 [0079.016] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\oXptnEALZNCIx7qNkkii.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\oxptnealzncix7qnkkii.xlsx")) returned 0x20 [0079.016] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\oXptnEALZNCIx7qNkkii.xlsx", dwFileAttributes=0x20) returned 1 [0079.016] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\oXptnEALZNCIx7qNkkii.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\oxptnealzncix7qnkkii.xlsx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13b0 [0079.016] GetFileSizeEx (in: hFile=0x13b0, lpFileSize=0x1f77f75c | out: lpFileSize=0x1f77f75c*=99230) returned 1 [0079.016] SetFilePointerEx (in: hFile=0x13b0, liDistanceToMove=0x1839a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.016] ReadFile (in: hFile=0x13b0, lpBuffer=0x1f77f6e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f77f6dc, lpOverlapped=0x0 | out: lpBuffer=0x1f77f6e0*, lpNumberOfBytesRead=0x1f77f6dc*=0x4, lpOverlapped=0x0) returned 1 [0079.017] SetFilePointerEx (in: hFile=0x13b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.017] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9990 [0079.017] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55ca020 [0079.017] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55ca048 [0079.017] NtQuerySystemTime (in: CurrentTime=0x1f77f6bc | out: CurrentTime=0x1f77f6bc*=132260136361691876) returned 0x0 [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0x8ce78b1a [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0xf0def438 [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0x1b03aef5 [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0xdb3eb22b [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0x4ce3bc07 [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0xc052e017 [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0xbf6fbef8 [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0xe74f3add [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0x79f2f808 [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0x88b4a062 [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0x433a3660 [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0x60bf521e [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0xf71317d3 [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0x67fc2274 [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0x62c4df10 [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0x7fe76faa [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0xa63b1cc3 [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0x37a53a60 [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0xda6653e [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0x825893ab [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0xa268416a [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0xfeae0d8c [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0x84dc5585 [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0xfbb3a4df [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0xaef56c37 [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0x39985e6b [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0xb3d66d6 [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0x5622be09 [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0x97ebc41b [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0x97136d52 [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0x61b7ae55 [0079.017] RtlRandom (in: Seed=0x1f77f6c8 | out: Seed=0x1f77f6c8) returned 0xfa646a7a [0079.098] SetFilePointerEx (in: hFile=0x13b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.098] ReadFile (in: hFile=0x13b0, lpBuffer=0x6ee1898, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1f77f69c, lpOverlapped=0x0 | out: lpBuffer=0x6ee1898*, lpNumberOfBytesRead=0x1f77f69c*=0xc800, lpOverlapped=0x0) returned 1 [0079.098] SetFilePointerEx (in: hFile=0x13b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.099] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x537b320 [0079.099] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5467a58 [0079.099] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9990 [0079.099] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9990) returned 1 [0079.099] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x6eee0a0 [0079.104] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9990 [0079.104] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9fa8 [0079.104] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9fa8) returned 1 [0079.104] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5467a58) returned 1 [0079.104] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b320) returned 1 [0079.104] WriteFile (in: hFile=0x13b0, lpBuffer=0x6eee0a0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1f77f69c, lpOverlapped=0x0 | out: lpBuffer=0x6eee0a0*, lpNumberOfBytesWritten=0x1f77f69c*=0xc800, lpOverlapped=0x0) returned 1 [0082.286] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x6eee0a0) Thread: id = 845 os_tid = 0x7c8 [0079.104] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\pXaOgk9GE1upWx.csv" (normalized: "c:\\users\\fd1hvy\\documents\\pxaogk9ge1upwx.csv")) returned 0x20 [0079.104] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\pXaOgk9GE1upWx.csv", dwFileAttributes=0x20) returned 1 [0079.105] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\pXaOgk9GE1upWx.csv" (normalized: "c:\\users\\fd1hvy\\documents\\pxaogk9ge1upwx.csv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13b4 [0079.105] GetFileSizeEx (in: hFile=0x13b4, lpFileSize=0x1f7ffe14 | out: lpFileSize=0x1f7ffe14*=84978) returned 1 [0079.105] SetFilePointerEx (in: hFile=0x13b4, liDistanceToMove=0x14bee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.105] ReadFile (in: hFile=0x13b4, lpBuffer=0x1f7ffd98, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f7ffd94, lpOverlapped=0x0 | out: lpBuffer=0x1f7ffd98*, lpNumberOfBytesRead=0x1f7ffd94*=0x4, lpOverlapped=0x0) returned 1 [0079.105] SetFilePointerEx (in: hFile=0x13b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.105] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9f08 [0079.105] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55ca048 [0079.105] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55ca070 [0079.105] NtQuerySystemTime (in: CurrentTime=0x1f7ffd74 | out: CurrentTime=0x1f7ffd74*=132260136362629372) returned 0x0 [0079.105] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0xa0aa687f [0079.105] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0x4a324b76 [0079.105] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0xd85b7552 [0079.105] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0xc4bf5d73 [0079.105] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0xd8b6a04b [0079.105] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0x98250e1 [0079.105] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0x84c2c8dd [0079.105] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0xaca29d2 [0079.105] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0x51eb9bdc [0079.105] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0x4b2660c3 [0079.105] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0x35b8ef33 [0079.105] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0xeea7c913 [0079.105] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0x416fac2d [0079.105] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0x5f0c4a7e [0079.105] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0x9822662d [0079.105] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0x68f71771 [0079.105] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0xe1eab690 [0079.106] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0xcf61122e [0079.106] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0x4075bf29 [0079.106] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0x48f11e6f [0079.106] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0xd93759ed [0079.106] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0x62eeca41 [0079.106] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0x55645a0f [0079.106] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0x88809389 [0079.106] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0x1e519fb2 [0079.106] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0x89ce9970 [0079.106] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0x6b5cc59f [0079.106] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0x2a8e1138 [0079.106] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0x3d86006a [0079.106] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0x94be6b0d [0079.106] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0x6ac2625 [0079.106] RtlRandom (in: Seed=0x1f7ffd80 | out: Seed=0x1f7ffd80) returned 0x8d4fd57e [0079.116] SetFilePointerEx (in: hFile=0x13b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.116] ReadFile (in: hFile=0x13b4, lpBuffer=0x6efa8a8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1f7ffd54, lpOverlapped=0x0 | out: lpBuffer=0x6efa8a8*, lpNumberOfBytesRead=0x1f7ffd54*=0xc800, lpOverlapped=0x0) returned 1 [0079.116] SetFilePointerEx (in: hFile=0x13b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.116] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x537b320 [0079.116] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5467a58 [0079.116] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9f08 [0079.116] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9f08) returned 1 [0079.117] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x6f070b0 [0079.121] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9f80 [0079.121] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9fa8 [0079.121] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9fa8) returned 1 [0079.121] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5467a58) returned 1 [0079.121] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b320) returned 1 [0079.121] WriteFile (in: hFile=0x13b4, lpBuffer=0x6f070b0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1f7ffd54, lpOverlapped=0x0 | out: lpBuffer=0x6f070b0*, lpNumberOfBytesWritten=0x1f7ffd54*=0xc800, lpOverlapped=0x0) returned 1 [0082.288] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x6f070b0) Thread: id = 846 os_tid = 0xd90 [0079.163] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Q4_PNzrN.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\q4_pnzrn.pptx")) returned 0x20 [0079.163] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Q4_PNzrN.pptx", dwFileAttributes=0x20) returned 1 [0079.164] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Q4_PNzrN.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\q4_pnzrn.pptx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1410 [0079.164] GetFileSizeEx (in: hFile=0x1410, lpFileSize=0x1f87fe2c | out: lpFileSize=0x1f87fe2c*=55795) returned 1 [0079.164] SetFilePointerEx (in: hFile=0x1410, liDistanceToMove=0xd9ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.164] ReadFile (in: hFile=0x1410, lpBuffer=0x1f87fdb0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f87fdac, lpOverlapped=0x0 | out: lpBuffer=0x1f87fdb0*, lpNumberOfBytesRead=0x1f87fdac*=0x4, lpOverlapped=0x0) returned 1 [0079.164] SetFilePointerEx (in: hFile=0x1410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.164] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9fa8 [0079.164] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9f08 [0079.164] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9f58 [0079.164] NtQuerySystemTime (in: CurrentTime=0x1f87fd8c | out: CurrentTime=0x1f87fd8c*=132260136363254220) returned 0x0 [0079.164] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0x782185b [0079.164] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0x3eca187c [0079.164] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0xa815351 [0079.164] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0xbc019f87 [0079.164] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0xa870f89a [0079.164] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0xf5a3a14a [0079.164] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0xc4337d58 [0079.164] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0x4f55de5c [0079.164] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0xd6639ad5 [0079.164] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0x7e72dd45 [0079.164] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0x5e4046a8 [0079.164] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0x25c7734e [0079.164] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0xfdc9282 [0079.164] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0x13918cbf [0079.164] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0x8d715865 [0079.164] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0xeb651d73 [0079.164] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0x8eb2eb1c [0079.164] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0x8866992e [0079.165] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0x8a50867 [0079.165] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0xc352e852 [0079.165] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0x1b6ca8ae [0079.165] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0x47bdd5be [0079.165] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0x189b4c29 [0079.165] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0x74f247b3 [0079.165] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0x5819d049 [0079.165] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0x4540c16e [0079.165] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0xe93e6879 [0079.165] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0x1d640d53 [0079.165] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0xdaa93b73 [0079.165] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0x4629f42a [0079.165] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0xa101bc4 [0079.165] RtlRandom (in: Seed=0x1f87fd98 | out: Seed=0x1f87fd98) returned 0xaca6ca4c [0079.174] SetFilePointerEx (in: hFile=0x1410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.174] ReadFile (in: hFile=0x1410, lpBuffer=0x6f338c0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1f87fd6c, lpOverlapped=0x0 | out: lpBuffer=0x6f338c0*, lpNumberOfBytesRead=0x1f87fd6c*=0xc800, lpOverlapped=0x0) returned 1 [0079.175] SetFilePointerEx (in: hFile=0x1410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.175] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x537b7a0 [0079.175] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5467a58 [0079.175] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9f58 [0079.175] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9f58) returned 1 [0079.176] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x6f400c8 [0079.180] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9fa8 [0079.180] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9fd0 [0079.180] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c9fd0) returned 1 [0079.180] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5467a58) returned 1 [0079.180] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b7a0) returned 1 [0079.180] WriteFile (in: hFile=0x1410, lpBuffer=0x6f400c8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1f87fd6c, lpOverlapped=0x0 | out: lpBuffer=0x6f400c8*, lpNumberOfBytesWritten=0x1f87fd6c*=0xc800, lpOverlapped=0x0) returned 1 [0082.289] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x6f400c8) Thread: id = 847 os_tid = 0xd78 [0079.181] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\R4QR.xls" (normalized: "c:\\users\\fd1hvy\\documents\\r4qr.xls")) returned 0x20 [0079.181] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\R4QR.xls", dwFileAttributes=0x20) returned 1 [0079.181] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\R4QR.xls" (normalized: "c:\\users\\fd1hvy\\documents\\r4qr.xls"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1414 [0079.181] GetFileSizeEx (in: hFile=0x1414, lpFileSize=0x1f8ffb84 | out: lpFileSize=0x1f8ffb84*=42039) returned 1 [0079.181] SetFilePointerEx (in: hFile=0x1414, liDistanceToMove=0xa433, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.181] ReadFile (in: hFile=0x1414, lpBuffer=0x1f8ffb08, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f8ffb04, lpOverlapped=0x0 | out: lpBuffer=0x1f8ffb08*, lpNumberOfBytesRead=0x1f8ffb04*=0x4, lpOverlapped=0x0) returned 1 [0079.181] SetFilePointerEx (in: hFile=0x1414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.181] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9fd0 [0079.181] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9f58 [0079.181] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9ff8 [0079.181] NtQuerySystemTime (in: CurrentTime=0x1f8ffae4 | out: CurrentTime=0x1f8ffae4*=132260136363410840) returned 0x0 [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0x2a82bb81 [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0xd368dbb8 [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0x60da1670 [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0x65434c52 [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0x817137cf [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0xd0167d43 [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0x8c200e15 [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0x61c20279 [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0xd6187548 [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0x6fbb7e3f [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0xbe889b9b [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0x9a4440a5 [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0x14cf4134 [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0x3bc36af4 [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0x7adda484 [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0x8654084 [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0x9a5b1802 [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0x699004ab [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0xbcb1bddd [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0x68a9cb82 [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0xcc7facde [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0x28f7af3b [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0xa4f72c7c [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0xdee79dcf [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0xc13978ae [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0x9a749da4 [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0xf3b82d4f [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0xe1bbd85e [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0x4ea0dddc [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0x5286044b [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0xcd7a3e01 [0079.182] RtlRandom (in: Seed=0x1f8ffaf0 | out: Seed=0x1f8ffaf0) returned 0xbd70d90b [0079.193] ReadFile (in: hFile=0x1414, lpBuffer=0x6f4c8d0, nNumberOfBytesToRead=0xa437, lpNumberOfBytesRead=0x1f8ffae0, lpOverlapped=0x0 | out: lpBuffer=0x6f4c8d0*, lpNumberOfBytesRead=0x1f8ffae0*=0xa437, lpOverlapped=0x0) returned 1 [0079.194] SetFilePointerEx (in: hFile=0x1414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.194] WriteFile (in: hFile=0x1414, lpBuffer=0x6f590d8*, nNumberOfBytesToWrite=0xa437, lpNumberOfBytesWritten=0x1f8ffadc, lpOverlapped=0x0 | out: lpBuffer=0x6f590d8*, lpNumberOfBytesWritten=0x1f8ffadc*=0xa437, lpOverlapped=0x0) returned 1 [0082.297] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 848 os_tid = 0xbc4 [0079.195] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ThmgR4UeY.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\thmgr4uey.pptx")) returned 0x20 [0079.195] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ThmgR4UeY.pptx", dwFileAttributes=0x20) returned 1 [0079.195] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ThmgR4UeY.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\thmgr4uey.pptx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1418 [0079.195] GetFileSizeEx (in: hFile=0x1418, lpFileSize=0x1f97f854 | out: lpFileSize=0x1f97f854*=3356) returned 1 [0079.196] SetFilePointerEx (in: hFile=0x1418, liDistanceToMove=0xd18, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.196] ReadFile (in: hFile=0x1418, lpBuffer=0x1f97f7d8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f97f7d4, lpOverlapped=0x0 | out: lpBuffer=0x1f97f7d8*, lpNumberOfBytesRead=0x1f97f7d4*=0x4, lpOverlapped=0x0) returned 1 [0079.196] SetFilePointerEx (in: hFile=0x1418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.196] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9fd0 [0079.196] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9e40 [0079.196] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9ff8 [0079.196] NtQuerySystemTime (in: CurrentTime=0x1f97f7b4 | out: CurrentTime=0x1f97f7b4*=132260136363567076) returned 0x0 [0079.196] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0x95584654 [0079.196] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0xd3ecdd30 [0079.196] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0xe73931d6 [0079.196] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0xba2aa370 [0079.196] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0x9ce1f10b [0079.196] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0xff6e691e [0079.196] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0xf64716b9 [0079.196] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0x55dbdc86 [0079.196] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0x3da16c44 [0079.196] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0x5be55b8e [0079.196] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0xa650cfc4 [0079.196] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0x7b4ac028 [0079.196] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0x3fff1c73 [0079.196] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0x32c8d776 [0079.196] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0xf3a4274d [0079.196] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0x2fc300e1 [0079.196] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0x3345ed6c [0079.196] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0xa67d6234 [0079.196] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0xe4765b78 [0079.196] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0x20d30a5d [0079.196] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0xf674d954 [0079.196] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0x4654e88f [0079.196] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0x6a04547c [0079.196] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0xee5b81b5 [0079.196] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0x74e3c0d4 [0079.196] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0x66d0113a [0079.196] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0x841c64e9 [0079.196] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0xd0fc714f [0079.196] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0xb0e80c74 [0079.196] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0xf790ccfb [0079.197] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0x5f9eae96 [0079.197] RtlRandom (in: Seed=0x1f97f7c0 | out: Seed=0x1f97f7c0) returned 0x3bd6e2d3 [0079.207] ReadFile (in: hFile=0x1418, lpBuffer=0x6f658e0, nNumberOfBytesToRead=0xd1c, lpNumberOfBytesRead=0x1f97f7b0, lpOverlapped=0x0 | out: lpBuffer=0x6f658e0*, lpNumberOfBytesRead=0x1f97f7b0*=0xd1c, lpOverlapped=0x0) returned 1 [0079.207] SetFilePointerEx (in: hFile=0x1418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.207] WriteFile (in: hFile=0x1418, lpBuffer=0x6f720e8*, nNumberOfBytesToWrite=0xd1c, lpNumberOfBytesWritten=0x1f97f7ac, lpOverlapped=0x0 | out: lpBuffer=0x6f720e8*, lpNumberOfBytesWritten=0x1f97f7ac*=0xd1c, lpOverlapped=0x0) returned 1 [0082.296] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 849 os_tid = 0xf24 [0079.207] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\uOFkECuPU.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\uofkecupu.xlsx")) returned 0x20 [0079.208] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\uOFkECuPU.xlsx", dwFileAttributes=0x20) returned 1 [0079.208] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\uOFkECuPU.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\uofkecupu.xlsx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x141c [0079.208] GetFileSizeEx (in: hFile=0x141c, lpFileSize=0x1f9ffa2c | out: lpFileSize=0x1f9ffa2c*=34010) returned 1 [0079.208] SetFilePointerEx (in: hFile=0x141c, liDistanceToMove=0x84d6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.208] ReadFile (in: hFile=0x141c, lpBuffer=0x1f9ff9b0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f9ff9ac, lpOverlapped=0x0 | out: lpBuffer=0x1f9ff9b0*, lpNumberOfBytesRead=0x1f9ff9ac*=0x4, lpOverlapped=0x0) returned 1 [0079.208] SetFilePointerEx (in: hFile=0x141c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.208] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9fd0 [0079.208] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9ff8 [0079.208] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6358 [0079.208] NtQuerySystemTime (in: CurrentTime=0x1f9ff98c | out: CurrentTime=0x1f9ff98c*=132260136363723339) returned 0x0 [0079.208] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0xfff84b14 [0079.208] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0xe7bbe4d2 [0079.208] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0xccd35db5 [0079.208] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0xdf4abf56 [0079.208] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0x484a717 [0079.208] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0x9f387bba [0079.208] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0x484ac0a7 [0079.208] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0x239dac2 [0079.208] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0xf7b1b6d1 [0079.208] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0x2b4495d0 [0079.208] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0xb9987b3b [0079.208] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0xb43f6c2d [0079.208] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0x61520bff [0079.209] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0x26f7e70d [0079.209] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0x62fab31d [0079.209] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0xa5a4a819 [0079.209] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0xd4107606 [0079.209] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0xaedd07a2 [0079.209] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0x6807fa4f [0079.209] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0x75f432d5 [0079.209] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0x8c88cf14 [0079.209] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0x30ca291d [0079.209] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0x6bdf6385 [0079.209] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0x702c29d7 [0079.209] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0x52feb910 [0079.209] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0x577cd631 [0079.209] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0xf331b027 [0079.209] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0x9b0e8afd [0079.209] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0x14e21a68 [0079.209] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0x8f46dd2d [0079.209] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0xce0dfe46 [0079.209] RtlRandom (in: Seed=0x1f9ff998 | out: Seed=0x1f9ff998) returned 0x3e37f21e [0079.219] ReadFile (in: hFile=0x141c, lpBuffer=0x6f7e8f0, nNumberOfBytesToRead=0x84da, lpNumberOfBytesRead=0x1f9ff988, lpOverlapped=0x0 | out: lpBuffer=0x6f7e8f0*, lpNumberOfBytesRead=0x1f9ff988*=0x84da, lpOverlapped=0x0) returned 1 [0079.220] SetFilePointerEx (in: hFile=0x141c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.220] WriteFile (in: hFile=0x141c, lpBuffer=0x6f8b0f8*, nNumberOfBytesToWrite=0x84da, lpNumberOfBytesWritten=0x1f9ff984, lpOverlapped=0x0 | out: lpBuffer=0x6f8b0f8*, lpNumberOfBytesWritten=0x1f9ff984*=0x84da, lpOverlapped=0x0) returned 1 [0082.297] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 850 os_tid = 0xd1c [0079.221] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x6e958f8 [0079.221] wcscpy (in: _Dest=0x6e958f8, _Source="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD") returned="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD" [0079.221] wcscat (in: _Dest=0x6e958f8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\") returned="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\" [0079.221] wcscat (in: _Dest=0x6e958f8, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\*") returned="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\*" [0079.221] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5418938 [0079.221] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\*", lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66b14630, ftCreationTime.dwHighDateTime=0x1d5cf43, ftLastAccessTime.dwLowDateTime=0x438224d0, ftLastAccessTime.dwHighDateTime=0x1d5cb5c, ftLastWriteTime.dwLowDateTime=0x438224d0, ftLastWriteTime.dwHighDateTime=0x1d5cb5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba1270 [0079.221] wcscmp (_String1=".", _String2=".") returned 0 [0079.221] FindNextFileW (in: hFindFile=0x5ba1270, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66b14630, ftCreationTime.dwHighDateTime=0x1d5cf43, ftLastAccessTime.dwLowDateTime=0x438224d0, ftLastAccessTime.dwHighDateTime=0x1d5cb5c, ftLastWriteTime.dwLowDateTime=0x438224d0, ftLastWriteTime.dwHighDateTime=0x1d5cb5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.221] wcscmp (_String1="..", _String2=".") returned 1 [0079.221] wcscmp (_String1="..", _String2="..") returned 0 [0079.221] FindNextFileW (in: hFindFile=0x5ba1270, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf96bbf80, ftCreationTime.dwHighDateTime=0x1d5cf27, ftLastAccessTime.dwLowDateTime=0xb90718b0, ftLastAccessTime.dwHighDateTime=0x1d5d73b, ftLastWriteTime.dwLowDateTime=0xb90718b0, ftLastWriteTime.dwHighDateTime=0x1d5d73b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1FznT1aJ4sm", cAlternateFileName="1FZNT1~1")) returned 1 [0079.222] wcscmp (_String1="1FznT1aJ4sm", _String2=".") returned 1 [0079.222] wcscmp (_String1="1FznT1aJ4sm", _String2="..") returned 1 [0079.222] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x72) returned 0x38d0b20 [0079.222] wcscpy (in: _Dest=0x38d0b20, _Source="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD") returned="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD" [0079.222] wcscat (in: _Dest=0x38d0b20, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\") returned="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\" [0079.222] wcscat (in: _Dest=0x38d0b20, _Source="1FznT1aJ4sm" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm") returned="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm" [0080.546] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38d0b20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1474 [0080.546] FindNextFileW (in: hFindFile=0x5ba1270, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98061da0, ftCreationTime.dwHighDateTime=0x1d5d272, ftLastAccessTime.dwLowDateTime=0xc1111890, ftLastAccessTime.dwHighDateTime=0x1d5cdb7, ftLastWriteTime.dwLowDateTime=0xc1111890, ftLastWriteTime.dwHighDateTime=0x1d5cdb7, nFileSizeHigh=0x0, nFileSizeLow=0x12645, dwReserved0=0x0, dwReserved1=0x0, cFileName="BtPCfe9bjPyifgc5.doc", cAlternateFileName="BTPCFE~1.DOC")) returned 1 [0080.546] wcscmp (_String1="BtPCfe9bjPyifgc5.doc", _String2=".") returned 1 [0080.546] wcscmp (_String1="BtPCfe9bjPyifgc5.doc", _String2="..") returned 1 [0080.546] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x84) returned 0x549d298 [0080.546] wcscpy (in: _Dest=0x549d298, _Source="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD") returned="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD" [0080.546] wcscat (in: _Dest=0x549d298, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\") returned="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\" [0080.547] wcscat (in: _Dest=0x549d298, _Source="BtPCfe9bjPyifgc5.doc" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\BtPCfe9bjPyifgc5.doc") returned="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\BtPCfe9bjPyifgc5.doc" [0080.547] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549d298, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1584 [0080.547] FindNextFileW (in: hFindFile=0x5ba1270, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b6918d0, ftCreationTime.dwHighDateTime=0x1d5d1f0, ftLastAccessTime.dwLowDateTime=0xa0d3bcd0, ftLastAccessTime.dwHighDateTime=0x1d5d7ae, ftLastWriteTime.dwLowDateTime=0xa0d3bcd0, ftLastWriteTime.dwHighDateTime=0x1d5d7ae, nFileSizeHigh=0x0, nFileSizeLow=0xe47f, dwReserved0=0x0, dwReserved1=0x0, cFileName="l_SMVRBXvSWgYHn5.ots", cAlternateFileName="L_SMVR~1.OTS")) returned 1 [0080.547] wcscmp (_String1="l_SMVRBXvSWgYHn5.ots", _String2=".") returned 1 [0080.547] wcscmp (_String1="l_SMVRBXvSWgYHn5.ots", _String2="..") returned 1 [0080.547] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x84) returned 0x549d3b8 [0080.547] wcscpy (in: _Dest=0x549d3b8, _Source="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD") returned="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD" [0080.547] wcscat (in: _Dest=0x549d3b8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\") returned="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\" [0080.547] wcscat (in: _Dest=0x549d3b8, _Source="l_SMVRBXvSWgYHn5.ots" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\l_SMVRBXvSWgYHn5.ots") returned="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\l_SMVRBXvSWgYHn5.ots" [0080.547] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549d3b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1588 [0080.548] FindNextFileW (in: hFindFile=0x5ba1270, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca38c00, ftCreationTime.dwHighDateTime=0x1d5d5d1, ftLastAccessTime.dwLowDateTime=0xf9321bd0, ftLastAccessTime.dwHighDateTime=0x1d5c82a, ftLastWriteTime.dwLowDateTime=0xf9321bd0, ftLastWriteTime.dwHighDateTime=0x1d5c82a, nFileSizeHigh=0x0, nFileSizeLow=0x7972, dwReserved0=0x0, dwReserved1=0x0, cFileName="pPnX_7btvRw3eLL.rtf", cAlternateFileName="PPNX_7~1.RTF")) returned 1 [0080.548] wcscmp (_String1="pPnX_7btvRw3eLL.rtf", _String2=".") returned 1 [0080.548] wcscmp (_String1="pPnX_7btvRw3eLL.rtf", _String2="..") returned 1 [0080.548] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x82) returned 0x549cbd8 [0080.548] wcscpy (in: _Dest=0x549cbd8, _Source="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD") returned="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD" [0080.548] wcscat (in: _Dest=0x549cbd8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\") returned="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\" [0080.548] wcscat (in: _Dest=0x549cbd8, _Source="pPnX_7btvRw3eLL.rtf" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\pPnX_7btvRw3eLL.rtf") returned="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\pPnX_7btvRw3eLL.rtf" [0080.548] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549cbd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x158c [0080.549] FindNextFileW (in: hFindFile=0x5ba1270, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca38c00, ftCreationTime.dwHighDateTime=0x1d5d5d1, ftLastAccessTime.dwLowDateTime=0xf9321bd0, ftLastAccessTime.dwHighDateTime=0x1d5c82a, ftLastWriteTime.dwLowDateTime=0xf9321bd0, ftLastWriteTime.dwHighDateTime=0x1d5c82a, nFileSizeHigh=0x0, nFileSizeLow=0x7972, dwReserved0=0x0, dwReserved1=0x0, cFileName="pPnX_7btvRw3eLL.rtf", cAlternateFileName="PPNX_7~1.RTF")) returned 0 [0080.549] FindClose (in: hFindFile=0x5ba1270 | out: hFindFile=0x5ba1270) returned 1 [0080.549] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5418938) returned 1 [0080.549] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x6e958f8) returned 1 [0080.549] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38fd5b0) returned 1 Thread: id = 851 os_tid = 0x16b0 [0079.222] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\XIuM.docx" (normalized: "c:\\users\\fd1hvy\\documents\\xium.docx")) returned 0x20 [0079.223] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\XIuM.docx", dwFileAttributes=0x20) returned 1 [0079.223] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\XIuM.docx" (normalized: "c:\\users\\fd1hvy\\documents\\xium.docx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1424 [0079.223] GetFileSizeEx (in: hFile=0x1424, lpFileSize=0x1fcffb20 | out: lpFileSize=0x1fcffb20*=56288) returned 1 [0079.223] SetFilePointerEx (in: hFile=0x1424, liDistanceToMove=0xdbdc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.223] ReadFile (in: hFile=0x1424, lpBuffer=0x1fcffaa4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1fcffaa0, lpOverlapped=0x0 | out: lpBuffer=0x1fcffaa4*, lpNumberOfBytesRead=0x1fcffaa0*=0x4, lpOverlapped=0x0) returned 1 [0079.223] SetFilePointerEx (in: hFile=0x1424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.223] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba65d8 [0079.223] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6100 [0079.223] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba64e8 [0079.223] NtQuerySystemTime (in: CurrentTime=0x1fcffa80 | out: CurrentTime=0x1fcffa80*=132260136363879827) returned 0x0 [0079.223] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0xbe2391e7 [0079.223] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0xe671c1c7 [0079.223] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0xd24a36f8 [0079.223] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0x75e993cb [0079.223] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0x33bdb8ae [0079.223] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0x3ac707bc [0079.223] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0xdfe51d7 [0079.223] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0x58775f4 [0079.223] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0xd6342047 [0079.223] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0x636dab74 [0079.224] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0x91c1eb93 [0079.224] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0x8644620f [0079.224] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0x65464018 [0079.224] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0xa51f0ea1 [0079.224] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0x8b7ef6ee [0079.224] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0x722523f1 [0079.224] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0xddb7b78 [0079.224] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0x36a14be0 [0079.224] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0x2d6a931f [0079.224] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0x30182f24 [0079.224] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0xeae513f0 [0079.224] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0xabc79707 [0079.224] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0x18cd333e [0079.224] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0x48b7ae8f [0079.224] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0x26d472b8 [0079.224] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0xf1cf722c [0079.224] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0x74080656 [0079.224] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0xeced88d9 [0079.224] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0x7d8a4b3 [0079.224] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0x9e69a997 [0079.224] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0x7fb01bf2 [0079.224] RtlRandom (in: Seed=0x1fcffa8c | out: Seed=0x1fcffa8c) returned 0xfee9e3a2 [0079.233] SetFilePointerEx (in: hFile=0x1424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.234] ReadFile (in: hFile=0x1424, lpBuffer=0x6f97900, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1fcffa60, lpOverlapped=0x0 | out: lpBuffer=0x6f97900*, lpNumberOfBytesRead=0x1fcffa60*=0xc800, lpOverlapped=0x0) returned 1 [0079.234] SetFilePointerEx (in: hFile=0x1424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.234] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x537b560 [0079.234] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x38aa720 [0079.234] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6218 [0079.234] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba6218) returned 1 [0079.235] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x6fa4108 [0079.239] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba63f8 [0079.239] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6420 [0079.239] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba6420) returned 1 [0079.239] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38aa720) returned 1 [0079.239] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b560) returned 1 [0079.239] WriteFile (in: hFile=0x1424, lpBuffer=0x6fa4108*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1fcffa60, lpOverlapped=0x0 | out: lpBuffer=0x6fa4108*, lpNumberOfBytesWritten=0x1fcffa60*=0xc800, lpOverlapped=0x0) returned 1 [0082.299] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x6fa4108) Thread: id = 852 os_tid = 0x16b4 [0079.240] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\YGcP76-KczLAPYEvPx.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ygcp76-kczlapyevpx.pptx")) returned 0x20 [0079.240] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\YGcP76-KczLAPYEvPx.pptx", dwFileAttributes=0x20) returned 1 [0079.240] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\YGcP76-KczLAPYEvPx.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ygcp76-kczlapyevpx.pptx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1428 [0079.240] GetFileSizeEx (in: hFile=0x1428, lpFileSize=0x1fd7f8ec | out: lpFileSize=0x1fd7f8ec*=16403) returned 1 [0079.240] SetFilePointerEx (in: hFile=0x1428, liDistanceToMove=0x400f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.240] ReadFile (in: hFile=0x1428, lpBuffer=0x1fd7f870, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1fd7f86c, lpOverlapped=0x0 | out: lpBuffer=0x1fd7f870*, lpNumberOfBytesRead=0x1fd7f86c*=0x4, lpOverlapped=0x0) returned 1 [0079.241] SetFilePointerEx (in: hFile=0x1428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.241] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba64e8 [0079.241] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6510 [0079.241] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6358 [0079.241] NtQuerySystemTime (in: CurrentTime=0x1fd7f84c | out: CurrentTime=0x1fd7f84c*=132260136364042585) returned 0x0 [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0x2a3ebc7e [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0xd58e2620 [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0x849640ea [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0xb9cc620b [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0x94820218 [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0x71cbdd2b [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0x55b36749 [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0xa651ac10 [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0x7586a672 [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0xade1b36f [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0x2ceee5e0 [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0xea403385 [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0x3e60bd2f [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0x8f9dd5f9 [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0x5fd46766 [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0x226c8f7a [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0xcaf835b1 [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0xaeb55790 [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0x73781692 [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0xbc201701 [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0xd76e128d [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0x22c8cbb1 [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0xdf99bd5c [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0xe8a9e37c [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0x78b6543e [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0xeff22b10 [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0x1d18a6ae [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0xbe72e52e [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0x37ef4590 [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0xc6c4f81c [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0xcf0c6f54 [0079.241] RtlRandom (in: Seed=0x1fd7f858 | out: Seed=0x1fd7f858) returned 0x82243aec [0079.251] ReadFile (in: hFile=0x1428, lpBuffer=0x6fb0910, nNumberOfBytesToRead=0x4013, lpNumberOfBytesRead=0x1fd7f848, lpOverlapped=0x0 | out: lpBuffer=0x6fb0910*, lpNumberOfBytesRead=0x1fd7f848*=0x4013, lpOverlapped=0x0) returned 1 [0079.252] SetFilePointerEx (in: hFile=0x1428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.252] WriteFile (in: hFile=0x1428, lpBuffer=0x6fbd118*, nNumberOfBytesToWrite=0x4013, lpNumberOfBytesWritten=0x1fd7f844, lpOverlapped=0x0 | out: lpBuffer=0x6fbd118*, lpNumberOfBytesWritten=0x1fd7f844*=0x4013, lpOverlapped=0x0) returned 1 [0082.303] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 853 os_tid = 0x16bc [0079.252] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Z B5wY iscDO9GFwsKpM.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\z b5wy iscdo9gfwskpm.pptx")) returned 0x20 [0079.253] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Z B5wY iscDO9GFwsKpM.pptx", dwFileAttributes=0x20) returned 1 [0079.253] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Z B5wY iscDO9GFwsKpM.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\z b5wy iscdo9gfwskpm.pptx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x142c [0079.253] GetFileSizeEx (in: hFile=0x142c, lpFileSize=0x1fdffbd4 | out: lpFileSize=0x1fdffbd4*=83401) returned 1 [0079.253] SetFilePointerEx (in: hFile=0x142c, liDistanceToMove=0x145c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.253] ReadFile (in: hFile=0x142c, lpBuffer=0x1fdffb58, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1fdffb54, lpOverlapped=0x0 | out: lpBuffer=0x1fdffb58*, lpNumberOfBytesRead=0x1fdffb54*=0x4, lpOverlapped=0x0) returned 1 [0079.253] SetFilePointerEx (in: hFile=0x142c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.253] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba65d8 [0079.253] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6128 [0079.253] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba64e8 [0079.253] NtQuerySystemTime (in: CurrentTime=0x1fdffb34 | out: CurrentTime=0x1fdffb34*=132260136364192001) returned 0x0 [0079.253] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0x98e2ddeb [0079.253] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0x2fc05cbc [0079.254] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0xe61c0d6a [0079.254] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0x3bb8831e [0079.254] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0x172bf607 [0079.254] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0xaf4aba27 [0079.254] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0xab8dba75 [0079.254] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0xaa9fcb2e [0079.254] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0xc4f949dc [0079.254] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0x3bc6a231 [0079.254] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0x223655cb [0079.254] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0x8b7f1103 [0079.254] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0x8a5a4d84 [0079.254] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0xa8b82455 [0079.254] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0x5276508a [0079.254] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0x547805f [0079.254] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0x3309f847 [0079.254] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0xd52ffa3c [0079.254] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0xac4d0ebb [0079.254] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0x587fbee9 [0079.254] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0x3e8f5348 [0079.254] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0xec48c58e [0079.254] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0x4c0023b4 [0079.254] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0x6453ef76 [0079.254] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0x60cd741c [0079.254] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0x4974c370 [0079.254] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0xff47e2da [0079.254] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0x51d46e03 [0079.254] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0x4a739b44 [0079.254] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0x2956f8f1 [0079.254] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0x8f4e04a1 [0079.254] RtlRandom (in: Seed=0x1fdffb40 | out: Seed=0x1fdffb40) returned 0x5fffb02a [0079.264] SetFilePointerEx (in: hFile=0x142c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.264] ReadFile (in: hFile=0x142c, lpBuffer=0x6fc9920, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1fdffb14, lpOverlapped=0x0 | out: lpBuffer=0x6fc9920*, lpNumberOfBytesRead=0x1fdffb14*=0xc800, lpOverlapped=0x0) returned 1 [0079.264] SetFilePointerEx (in: hFile=0x142c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.264] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x537b560 [0079.264] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x38aa798 [0079.264] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6218 [0079.264] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba6218) returned 1 [0079.265] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x6fd6128 [0079.288] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6420 [0079.288] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba64e8 [0079.288] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba64e8) returned 1 [0079.288] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38aa798) returned 1 [0079.288] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b560) returned 1 [0079.288] WriteFile (in: hFile=0x142c, lpBuffer=0x6fd6128*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1fdffb14, lpOverlapped=0x0 | out: lpBuffer=0x6fd6128*, lpNumberOfBytesWritten=0x1fdffb14*=0xc800, lpOverlapped=0x0) returned 1 [0082.305] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x6fd6128) Thread: id = 854 os_tid = 0x16d4 [0079.289] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-P3XyyVavLec0sKG-bX9.ots" (normalized: "c:\\users\\fd1hvy\\desktop\\-p3xyyvavlec0skg-bx9.ots")) returned 0x20 [0079.289] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-P3XyyVavLec0sKG-bX9.ots", dwFileAttributes=0x20) returned 1 [0079.289] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-P3XyyVavLec0sKG-bX9.ots" (normalized: "c:\\users\\fd1hvy\\desktop\\-p3xyyvavlec0skg-bx9.ots"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1430 [0079.289] GetFileSizeEx (in: hFile=0x1430, lpFileSize=0x1fe7f7ec | out: lpFileSize=0x1fe7f7ec*=36795) returned 1 [0079.289] SetFilePointerEx (in: hFile=0x1430, liDistanceToMove=0x8fb7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.289] ReadFile (in: hFile=0x1430, lpBuffer=0x1fe7f770, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1fe7f76c, lpOverlapped=0x0 | out: lpBuffer=0x1fe7f770*, lpNumberOfBytesRead=0x1fe7f76c*=0x4, lpOverlapped=0x0) returned 1 [0079.290] SetFilePointerEx (in: hFile=0x1430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.290] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba65d8 [0079.290] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6150 [0079.290] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba64e8 [0079.290] NtQuerySystemTime (in: CurrentTime=0x1fe7f74c | out: CurrentTime=0x1fe7f74c*=132260136364504161) returned 0x0 [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0x479e9219 [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0xab3fc5ac [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0x2777329f [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0x8ab68128 [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0xa8883765 [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0xfe10c092 [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0x37ee92ec [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0x308cfcea [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0x8af6ef04 [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0x2372ab37 [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0x266fe122 [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0xa9ab746f [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0xa3e38772 [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0x53e529f9 [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0xdd11f899 [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0x3f335c1e [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0x64864b41 [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0x2789a023 [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0xe7e747cc [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0xc8f9f55c [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0x9e59011f [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0x8fe5ff52 [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0x53618a1d [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0x39ca543d [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0xc7dbf683 [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0x8fde6321 [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0x9719ebd [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0x724886ba [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0x9108b7e1 [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0xe4ba3e08 [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0x23a0ab83 [0079.290] RtlRandom (in: Seed=0x1fe7f758 | out: Seed=0x1fe7f758) returned 0x75298749 [0079.299] ReadFile (in: hFile=0x1430, lpBuffer=0x5bad008, nNumberOfBytesToRead=0x8fbb, lpNumberOfBytesRead=0x1fe7f748, lpOverlapped=0x0 | out: lpBuffer=0x5bad008*, lpNumberOfBytesRead=0x1fe7f748*=0x8fbb, lpOverlapped=0x0) returned 1 [0079.301] SetFilePointerEx (in: hFile=0x1430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.301] WriteFile (in: hFile=0x1430, lpBuffer=0x5bb9810*, nNumberOfBytesToWrite=0x8fbb, lpNumberOfBytesWritten=0x1fe7f744, lpOverlapped=0x0 | out: lpBuffer=0x5bb9810*, lpNumberOfBytesWritten=0x1fe7f744*=0x8fbb, lpOverlapped=0x0) returned 1 [0082.308] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 855 os_tid = 0x16dc [0079.301] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-zgrM9.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\-zgrm9.mp3")) returned 0x20 [0079.301] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-zgrM9.mp3", dwFileAttributes=0x20) returned 1 [0079.302] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-zgrM9.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\-zgrm9.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1434 [0079.302] GetFileSizeEx (in: hFile=0x1434, lpFileSize=0x1feff7a0 | out: lpFileSize=0x1feff7a0*=71133) returned 1 [0079.302] SetFilePointerEx (in: hFile=0x1434, liDistanceToMove=0x115d9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.302] ReadFile (in: hFile=0x1434, lpBuffer=0x1feff724, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1feff720, lpOverlapped=0x0 | out: lpBuffer=0x1feff724*, lpNumberOfBytesRead=0x1feff720*=0x4, lpOverlapped=0x0) returned 1 [0079.302] SetFilePointerEx (in: hFile=0x1434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.302] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba65d8 [0079.302] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba61c8 [0079.302] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba64e8 [0079.302] NtQuerySystemTime (in: CurrentTime=0x1feff700 | out: CurrentTime=0x1feff700*=132260136364660712) returned 0x0 [0079.302] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0x69ff7f2d [0079.302] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0xdfb90dbc [0079.302] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0x597a3449 [0079.302] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0xd347e41d [0079.302] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0x9f3c873d [0079.302] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0xdb05c9ef [0079.302] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0x396e28 [0079.302] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0xb81e6b1 [0079.302] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0x56d271cf [0079.302] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0x6345d930 [0079.302] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0x64d3f268 [0079.302] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0xc8342600 [0079.302] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0x6eb06e05 [0079.302] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0xfa651296 [0079.302] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0x92bb02f5 [0079.302] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0x52416ccd [0079.302] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0x3275edad [0079.302] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0x8b3d536 [0079.302] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0x39412e5e [0079.302] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0x16c20943 [0079.303] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0xc7e4aef8 [0079.303] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0x10468182 [0079.303] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0x91d323d8 [0079.303] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0xb4aa8bce [0079.303] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0xcaf70d3 [0079.303] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0x15409ef5 [0079.303] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0x59288114 [0079.303] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0xeae57558 [0079.303] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0x8076744d [0079.303] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0x9afb1b56 [0079.303] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0x5c7248a2 [0079.303] RtlRandom (in: Seed=0x1feff70c | out: Seed=0x1feff70c) returned 0x3c797200 [0079.312] SetFilePointerEx (in: hFile=0x1434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.312] ReadFile (in: hFile=0x1434, lpBuffer=0x6fe2930, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1feff6e0, lpOverlapped=0x0 | out: lpBuffer=0x6fe2930*, lpNumberOfBytesRead=0x1feff6e0*=0xc800, lpOverlapped=0x0) returned 1 [0079.313] SetFilePointerEx (in: hFile=0x1434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.313] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x537b5a8 [0079.313] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x38aa810 [0079.313] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6268 [0079.313] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba6268) returned 1 [0079.314] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x6fef138 [0079.318] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba64e8 [0079.318] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba65d8 [0079.318] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba65d8) returned 1 [0079.318] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38aa810) returned 1 [0079.318] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b5a8) returned 1 [0079.318] WriteFile (in: hFile=0x1434, lpBuffer=0x6fef138*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1feff6e0, lpOverlapped=0x0 | out: lpBuffer=0x6fef138*, lpNumberOfBytesWritten=0x1feff6e0*=0xc800, lpOverlapped=0x0) returned 1 [0082.309] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x6fef138) Thread: id = 856 os_tid = 0x16e0 [0079.319] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\32670RwV1Oxd5LF5.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\32670rwv1oxd5lf5.gif")) returned 0x20 [0079.319] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\32670RwV1Oxd5LF5.gif", dwFileAttributes=0x20) returned 1 [0079.320] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\32670RwV1Oxd5LF5.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\32670rwv1oxd5lf5.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1438 [0079.320] GetFileSizeEx (in: hFile=0x1438, lpFileSize=0x1ff7f86c | out: lpFileSize=0x1ff7f86c*=87528) returned 1 [0079.320] SetFilePointerEx (in: hFile=0x1438, liDistanceToMove=0x155e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.320] ReadFile (in: hFile=0x1438, lpBuffer=0x1ff7f7f0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ff7f7ec, lpOverlapped=0x0 | out: lpBuffer=0x1ff7f7f0*, lpNumberOfBytesRead=0x1ff7f7ec*=0x4, lpOverlapped=0x0) returned 1 [0079.320] SetFilePointerEx (in: hFile=0x1438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.320] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba65d8 [0079.320] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6268 [0079.320] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6290 [0079.320] NtQuerySystemTime (in: CurrentTime=0x1ff7f7cc | out: CurrentTime=0x1ff7f7cc*=132260136364830532) returned 0x0 [0079.320] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0x8da44c17 [0079.320] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0xb06d7bea [0079.320] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0x2328e5b [0079.320] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0x4bb00037 [0079.320] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0xb539f357 [0079.320] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0xdbfe5ded [0079.320] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0x48f28c8d [0079.320] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0x67ab61dc [0079.320] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0xa2f0326f [0079.320] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0x995e96ed [0079.320] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0x89cfb48a [0079.320] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0xfcf02f0b [0079.320] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0x53016085 [0079.320] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0x10b44933 [0079.320] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0x4c214a5b [0079.320] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0xea12e05a [0079.320] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0xc455e11d [0079.320] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0x484fee30 [0079.320] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0xfdad0411 [0079.321] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0x664e7398 [0079.321] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0xe07497aa [0079.321] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0xba1cf3cd [0079.321] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0xf0b5008 [0079.321] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0xd0f10f62 [0079.321] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0xde6b3eef [0079.321] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0x85f99797 [0079.321] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0xd233223b [0079.321] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0x774d1d61 [0079.321] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0x61a1fe7c [0079.321] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0x529f512 [0079.321] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0x17efd4f4 [0079.321] RtlRandom (in: Seed=0x1ff7f7d8 | out: Seed=0x1ff7f7d8) returned 0xc6e9ba51 [0079.330] SetFilePointerEx (in: hFile=0x1438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.330] ReadFile (in: hFile=0x1438, lpBuffer=0x6ffb940, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1ff7f7ac, lpOverlapped=0x0 | out: lpBuffer=0x6ffb940*, lpNumberOfBytesRead=0x1ff7f7ac*=0xc800, lpOverlapped=0x0) returned 1 [0079.331] SetFilePointerEx (in: hFile=0x1438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.331] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x537b5a8 [0079.331] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x38aa810 [0079.331] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6290 [0079.331] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba6290) returned 1 [0079.332] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x7008148 [0079.336] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba65d8 [0079.336] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6290 [0079.336] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba6290) returned 1 [0079.336] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38aa810) returned 1 [0079.336] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b5a8) returned 1 [0079.336] WriteFile (in: hFile=0x1438, lpBuffer=0x7008148*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1ff7f7ac, lpOverlapped=0x0 | out: lpBuffer=0x7008148*, lpNumberOfBytesWritten=0x1ff7f7ac*=0xc800, lpOverlapped=0x0) returned 1 [0082.310] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7008148) Thread: id = 857 os_tid = 0x16ec [0079.337] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\39E9.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\39e9.mkv")) returned 0x20 [0079.337] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\39E9.mkv", dwFileAttributes=0x20) returned 1 [0079.337] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\39E9.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\39e9.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x143c [0079.337] GetFileSizeEx (in: hFile=0x143c, lpFileSize=0x1ffffaac | out: lpFileSize=0x1ffffaac*=88695) returned 1 [0079.337] SetFilePointerEx (in: hFile=0x143c, liDistanceToMove=0x15a73, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.337] ReadFile (in: hFile=0x143c, lpBuffer=0x1ffffa30, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ffffa2c, lpOverlapped=0x0 | out: lpBuffer=0x1ffffa30*, lpNumberOfBytesRead=0x1ffffa2c*=0x4, lpOverlapped=0x0) returned 1 [0079.337] SetFilePointerEx (in: hFile=0x143c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.337] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6290 [0079.337] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6308 [0079.337] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6330 [0079.338] NtQuerySystemTime (in: CurrentTime=0x1ffffa0c | out: CurrentTime=0x1ffffa0c*=132260136364973884) returned 0x0 [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0x71c61cdc [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0xa18c532f [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0x76b4b612 [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0xac9a25b [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0x28970d3f [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0xe5b97eee [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0xea2a1639 [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0x82730e03 [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0xf68df167 [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0x71d0bb84 [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0xbe30c71d [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0x645cbe2d [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0x3dcfaa57 [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0x51954bc2 [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0xbce4d509 [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0x4e986cfc [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0xfca41ad5 [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0xe4468303 [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0x31e85ab9 [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0xe06210b0 [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0x96b041f7 [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0x2c5bbafb [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0x156da379 [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0xa9618e19 [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0x5a274174 [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0x78a46c1a [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0x16c2cdf2 [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0xe243e73a [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0x2abf495a [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0x14146967 [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0xc06d9c80 [0079.338] RtlRandom (in: Seed=0x1ffffa18 | out: Seed=0x1ffffa18) returned 0x30afe4ae [0079.348] SetFilePointerEx (in: hFile=0x143c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.349] ReadFile (in: hFile=0x143c, lpBuffer=0x7014950, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1ffff9ec, lpOverlapped=0x0 | out: lpBuffer=0x7014950*, lpNumberOfBytesRead=0x1ffff9ec*=0xc800, lpOverlapped=0x0) returned 1 [0079.349] SetFilePointerEx (in: hFile=0x143c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.349] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x537b5a8 [0079.349] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x38aa810 [0079.349] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6290 [0079.349] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba6290) returned 1 [0079.350] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x7021158 [0079.354] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6290 [0079.354] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6330 [0079.354] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba6330) returned 1 [0079.354] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38aa810) returned 1 [0079.354] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b5a8) returned 1 [0079.354] WriteFile (in: hFile=0x143c, lpBuffer=0x7021158*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1ffff9ec, lpOverlapped=0x0 | out: lpBuffer=0x7021158*, lpNumberOfBytesWritten=0x1ffff9ec*=0xc800, lpOverlapped=0x0) returned 1 [0082.313] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7021158) Thread: id = 858 os_tid = 0x16f0 [0079.354] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\3hcSRx6tHB844TPE-PH.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\3hcsrx6thb844tpe-ph.mkv")) returned 0x20 [0079.355] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\3hcSRx6tHB844TPE-PH.mkv", dwFileAttributes=0x20) returned 1 [0079.355] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\3hcSRx6tHB844TPE-PH.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\3hcsrx6thb844tpe-ph.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) Thread: id = 859 os_tid = 0x16fc [0079.357] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\3RTQUW2BS_.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\3rtquw2bs_.jpg")) returned 0x20 [0079.357] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\3RTQUW2BS_.jpg", dwFileAttributes=0x20) returned 1 [0079.357] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\3RTQUW2BS_.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\3rtquw2bs_.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1440 [0079.357] GetFileSizeEx (in: hFile=0x1440, lpFileSize=0x200ffb38 | out: lpFileSize=0x200ffb38*=54404) returned 1 [0079.358] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0xd480, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.358] ReadFile (in: hFile=0x1440, lpBuffer=0x200ffabc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x200ffab8, lpOverlapped=0x0 | out: lpBuffer=0x200ffabc*, lpNumberOfBytesRead=0x200ffab8*=0x4, lpOverlapped=0x0) returned 1 [0079.358] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.358] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6330 [0079.358] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba63a8 [0079.358] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba63d0 [0079.358] NtQuerySystemTime (in: CurrentTime=0x200ffa98 | out: CurrentTime=0x200ffa98*=132260136365130075) returned 0x0 [0079.358] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0x37ae5534 [0079.358] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0xd42bd581 [0079.358] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0xf6aae00d [0079.358] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0xdb4c0c3b [0079.358] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0xf3eaf19 [0079.358] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0xe74b580a [0079.358] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0xfc01f177 [0079.358] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0x5e18bdb3 [0079.358] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0x4610c037 [0079.358] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0x17c7a8d5 [0079.358] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0x2d63a3 [0079.358] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0x6d524f60 [0079.358] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0x162f1e54 [0079.358] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0xe5feb7fe [0079.358] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0x32236262 [0079.358] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0xa3f1ad2 [0079.358] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0xecebd1f [0079.358] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0x4d5b7eca [0079.358] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0x6024d29c [0079.358] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0x219c90c1 [0079.358] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0x2119fbe8 [0079.358] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0x65d09cdb [0079.358] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0x5971a02c [0079.358] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0x98b54865 [0079.358] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0xa0fe4f73 [0079.358] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0x141857e0 [0079.358] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0x9c010cc3 [0079.358] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0xf1c2be7c [0079.358] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0x287925b3 [0079.358] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0xdaafa05f [0079.359] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0x4a2ad70d [0079.359] RtlRandom (in: Seed=0x200ffaa4 | out: Seed=0x200ffaa4) returned 0x9a1b5cb5 [0079.368] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.368] ReadFile (in: hFile=0x1440, lpBuffer=0x702d960, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x200ffa78, lpOverlapped=0x0 | out: lpBuffer=0x702d960*, lpNumberOfBytesRead=0x200ffa78*=0xc800, lpOverlapped=0x0) returned 1 [0079.368] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.368] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x537b5a8 [0079.368] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x38aa810 [0079.369] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6330 [0079.369] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba6330) returned 1 [0079.369] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x703a168 [0079.373] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6330 [0079.373] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba63d0 [0079.373] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba63d0) returned 1 [0079.373] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38aa810) returned 1 [0079.374] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b5a8) returned 1 [0079.374] WriteFile (in: hFile=0x1440, lpBuffer=0x703a168*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x200ffa78, lpOverlapped=0x0 | out: lpBuffer=0x703a168*, lpNumberOfBytesWritten=0x200ffa78*=0xc800, lpOverlapped=0x0) returned 1 [0082.313] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x703a168) Thread: id = 860 os_tid = 0xde8 [0079.374] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6rJ4zuIO9I.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\6rj4zuio9i.wav")) returned 0x20 [0079.374] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6rJ4zuIO9I.wav", dwFileAttributes=0x20) returned 1 [0079.374] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6rJ4zuIO9I.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\6rj4zuio9i.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1444 [0079.374] GetFileSizeEx (in: hFile=0x1444, lpFileSize=0x2017f9bc | out: lpFileSize=0x2017f9bc*=38383) returned 1 [0079.374] SetFilePointerEx (in: hFile=0x1444, liDistanceToMove=0x95eb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.374] ReadFile (in: hFile=0x1444, lpBuffer=0x2017f940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2017f93c, lpOverlapped=0x0 | out: lpBuffer=0x2017f940*, lpNumberOfBytesRead=0x2017f93c*=0x4, lpOverlapped=0x0) returned 1 [0079.375] SetFilePointerEx (in: hFile=0x1444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.375] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba63d0 [0079.375] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6600 [0079.375] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6858 [0079.375] NtQuerySystemTime (in: CurrentTime=0x2017f91c | out: CurrentTime=0x2017f91c*=132260136365286354) returned 0x0 [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0x2f3f756c [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0xb5cb7fc0 [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0xc1b46567 [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0x38f8525f [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0x43b92bfb [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0xd992d356 [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0xf6ba93cf [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0x80a69910 [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0x97b6f261 [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0x2a1ff186 [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0x643de28 [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0x7b0e4b09 [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0x5d817f89 [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0x99bec5ab [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0x81aa27b [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0x8135dbec [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0x2634991e [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0xad0d9f70 [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0x2a48dac [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0x7425d7f8 [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0xd257f028 [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0x1fb999d [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0x3133628d [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0x5c0c6434 [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0x1ccc5940 [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0xa1490d74 [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0xac8a5ebd [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0xff6f20f7 [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0x573bf4c1 [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0xf26c444b [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0xcde8d967 [0079.375] RtlRandom (in: Seed=0x2017f928 | out: Seed=0x2017f928) returned 0x7cc6df01 [0079.386] ReadFile (in: hFile=0x1444, lpBuffer=0x7046970, nNumberOfBytesToRead=0x95ef, lpNumberOfBytesRead=0x2017f918, lpOverlapped=0x0 | out: lpBuffer=0x7046970*, lpNumberOfBytesRead=0x2017f918*=0x95ef, lpOverlapped=0x0) returned 1 [0079.387] SetFilePointerEx (in: hFile=0x1444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.387] WriteFile (in: hFile=0x1444, lpBuffer=0x7053178*, nNumberOfBytesToWrite=0x95ef, lpNumberOfBytesWritten=0x2017f914, lpOverlapped=0x0 | out: lpBuffer=0x7053178*, lpNumberOfBytesWritten=0x2017f914*=0x95ef, lpOverlapped=0x0) returned 1 [0082.314] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 861 os_tid = 0x1374 [0079.388] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9QLAhBRTqcQ.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\9qlahbrtqcq.flv")) returned 0x20 [0079.388] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9QLAhBRTqcQ.flv", dwFileAttributes=0x20) returned 1 [0079.388] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9QLAhBRTqcQ.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\9qlahbrtqcq.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1448 [0079.388] GetFileSizeEx (in: hFile=0x1448, lpFileSize=0x201ffd0c | out: lpFileSize=0x201ffd0c*=7946) returned 1 [0079.388] SetFilePointerEx (in: hFile=0x1448, liDistanceToMove=0x1f06, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.388] ReadFile (in: hFile=0x1448, lpBuffer=0x201ffc90, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x201ffc8c, lpOverlapped=0x0 | out: lpBuffer=0x201ffc90*, lpNumberOfBytesRead=0x201ffc8c*=0x4, lpOverlapped=0x0) returned 1 [0079.388] SetFilePointerEx (in: hFile=0x1448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.388] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba63d0 [0079.388] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6628 [0079.388] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6880 [0079.388] NtQuerySystemTime (in: CurrentTime=0x201ffc6c | out: CurrentTime=0x201ffc6c*=132260136365442207) returned 0x0 [0079.388] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0xfcf87c9f [0079.388] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0x9e22620b [0079.388] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0x44e502ac [0079.388] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0x27d07e55 [0079.388] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0xb085dad9 [0079.388] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0x9f051e74 [0079.388] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0x80e78207 [0079.388] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0xaec32d5 [0079.388] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0x2a00f15c [0079.389] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0x558997a5 [0079.389] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0xd8a2c9d6 [0079.389] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0xe39cedfd [0079.389] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0xce1f4d8f [0079.389] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0x46294fa3 [0079.389] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0x5f2b6812 [0079.389] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0x9bfeb19 [0079.389] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0xf89f6ab4 [0079.389] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0x934ceed7 [0079.389] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0x36b700c3 [0079.389] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0x1ec6a44d [0079.389] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0xb70af02e [0079.389] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0x7161357a [0079.389] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0x9e87b340 [0079.389] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0x67767b29 [0079.389] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0xe59a73d3 [0079.389] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0x31d10ec6 [0079.389] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0x7ea392c0 [0079.389] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0xdb6baa04 [0079.389] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0xb6c0e147 [0079.389] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0x811f957c [0079.389] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0x4363101a [0079.389] RtlRandom (in: Seed=0x201ffc78 | out: Seed=0x201ffc78) returned 0xaefec19a [0079.400] ReadFile (in: hFile=0x1448, lpBuffer=0x705f980, nNumberOfBytesToRead=0x1f0a, lpNumberOfBytesRead=0x201ffc68, lpOverlapped=0x0 | out: lpBuffer=0x705f980*, lpNumberOfBytesRead=0x201ffc68*=0x1f0a, lpOverlapped=0x0) returned 1 [0079.400] SetFilePointerEx (in: hFile=0x1448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.400] WriteFile (in: hFile=0x1448, lpBuffer=0x706c188*, nNumberOfBytesToWrite=0x1f0a, lpNumberOfBytesWritten=0x201ffc64, lpOverlapped=0x0 | out: lpBuffer=0x706c188*, lpNumberOfBytesWritten=0x201ffc64*=0x1f0a, lpOverlapped=0x0) returned 1 [0082.315] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 862 os_tid = 0xe84 [0079.401] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\aqaYC.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\aqayc.rtf")) returned 0x20 [0079.401] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\aqaYC.rtf", dwFileAttributes=0x20) returned 1 [0079.401] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\aqaYC.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\aqayc.rtf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x144c [0079.401] GetFileSizeEx (in: hFile=0x144c, lpFileSize=0x2027fda8 | out: lpFileSize=0x2027fda8*=26802) returned 1 [0079.401] SetFilePointerEx (in: hFile=0x144c, liDistanceToMove=0x68ae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.401] ReadFile (in: hFile=0x144c, lpBuffer=0x2027fd2c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2027fd28, lpOverlapped=0x0 | out: lpBuffer=0x2027fd2c*, lpNumberOfBytesRead=0x2027fd28*=0x4, lpOverlapped=0x0) returned 1 [0079.402] SetFilePointerEx (in: hFile=0x144c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.402] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba63d0 [0079.402] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6768 [0079.402] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6880 [0079.402] NtQuerySystemTime (in: CurrentTime=0x2027fd08 | out: CurrentTime=0x2027fd08*=132260136365598024) returned 0x0 [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0x8ebfcdb2 [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0x8b9ab7ba [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0x22c32eae [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0x2c10ca99 [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0x1cd8bd48 [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0x1fa73d82 [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0xe1cdae01 [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0xe9f88bfb [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0xea90b21c [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0x45b5418 [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0x28f16bdb [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0x84064bcf [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0xe613f4dd [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0x140ca1cf [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0x992dac19 [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0xd777c0b4 [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0xfffa972 [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0xebb76437 [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0xcb6d6ccd [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0xcf1e84b0 [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0xd09eda99 [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0xc1b3102f [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0xdddc0eca [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0xf18a96e [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0x5df0d147 [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0x79ef7815 [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0xa2417482 [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0x12964764 [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0xa9d9aad2 [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0xc94cacc4 [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0x10893ed8 [0079.402] RtlRandom (in: Seed=0x2027fd14 | out: Seed=0x2027fd14) returned 0xea985ead [0079.413] ReadFile (in: hFile=0x144c, lpBuffer=0x7078990, nNumberOfBytesToRead=0x68b2, lpNumberOfBytesRead=0x2027fd04, lpOverlapped=0x0 | out: lpBuffer=0x7078990*, lpNumberOfBytesRead=0x2027fd04*=0x68b2, lpOverlapped=0x0) returned 1 [0079.414] SetFilePointerEx (in: hFile=0x144c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.414] WriteFile (in: hFile=0x144c, lpBuffer=0x7085198*, nNumberOfBytesToWrite=0x68b2, lpNumberOfBytesWritten=0x2027fd00, lpOverlapped=0x0 | out: lpBuffer=0x7085198*, lpNumberOfBytesWritten=0x2027fd00*=0x68b2, lpOverlapped=0x0) returned 1 [0082.320] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 863 os_tid = 0x1388 [0079.414] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DkpjLP5M_k.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\dkpjlp5m_k.ppt")) returned 0x20 [0079.414] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DkpjLP5M_k.ppt", dwFileAttributes=0x20) returned 1 [0079.414] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DkpjLP5M_k.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\dkpjlp5m_k.ppt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1450 [0079.415] GetFileSizeEx (in: hFile=0x1450, lpFileSize=0x202ffbec | out: lpFileSize=0x202ffbec*=35749) returned 1 [0079.415] SetFilePointerEx (in: hFile=0x1450, liDistanceToMove=0x8ba1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.415] ReadFile (in: hFile=0x1450, lpBuffer=0x202ffb70, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x202ffb6c, lpOverlapped=0x0 | out: lpBuffer=0x202ffb70*, lpNumberOfBytesRead=0x202ffb6c*=0x4, lpOverlapped=0x0) returned 1 [0079.415] SetFilePointerEx (in: hFile=0x1450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.415] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba63d0 [0079.415] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6880 [0079.415] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6678 [0079.415] NtQuerySystemTime (in: CurrentTime=0x202ffb4c | out: CurrentTime=0x202ffb4c*=132260136365754925) returned 0x0 [0079.415] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0xc83f0b10 [0079.415] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0x1022d2e6 [0079.415] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0xf9aa2314 [0079.415] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0xb205e779 [0079.415] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0x137c2471 [0079.415] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0xcf1020a3 [0079.415] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0x64467ab3 [0079.415] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0x5970be02 [0079.415] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0x658727fa [0079.415] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0xb0a18a [0079.415] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0xb131e81c [0079.415] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0x4e3f6058 [0079.415] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0xc303ba28 [0079.415] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0x6a09c1c2 [0079.415] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0x72e3be28 [0079.415] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0x93292bf5 [0079.415] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0x87ba018b [0079.415] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0xf18a5467 [0079.415] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0x7d859115 [0079.415] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0x4bf4542e [0079.415] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0x400d69f0 [0079.415] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0xdfee480a [0079.415] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0x65bbae83 [0079.416] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0xcda8d34d [0079.416] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0xb633b627 [0079.416] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0x9cfef8ce [0079.416] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0x38dd8d81 [0079.416] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0x4c2ffa84 [0079.416] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0x7f420fa8 [0079.416] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0x1a3b7b8 [0079.416] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0x42e57faf [0079.416] RtlRandom (in: Seed=0x202ffb58 | out: Seed=0x202ffb58) returned 0xc7e2765 [0079.434] ReadFile (in: hFile=0x1450, lpBuffer=0x70919a0, nNumberOfBytesToRead=0x8ba5, lpNumberOfBytesRead=0x202ffb48, lpOverlapped=0x0 | out: lpBuffer=0x70919a0*, lpNumberOfBytesRead=0x202ffb48*=0x8ba5, lpOverlapped=0x0) returned 1 [0079.435] SetFilePointerEx (in: hFile=0x1450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.435] WriteFile (in: hFile=0x1450, lpBuffer=0x709e1a8*, nNumberOfBytesToWrite=0x8ba5, lpNumberOfBytesWritten=0x202ffb44, lpOverlapped=0x0 | out: lpBuffer=0x709e1a8*, lpNumberOfBytesWritten=0x202ffb44*=0x8ba5, lpOverlapped=0x0) returned 1 [0082.321] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 864 os_tid = 0x758 [0079.436] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\evwMKgOzdO2DlQHqbWE.png" (normalized: "c:\\users\\fd1hvy\\desktop\\evwmkgozdo2dlqhqbwe.png")) returned 0x20 [0079.436] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\evwMKgOzdO2DlQHqbWE.png", dwFileAttributes=0x20) returned 1 [0079.437] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\evwMKgOzdO2DlQHqbWE.png" (normalized: "c:\\users\\fd1hvy\\desktop\\evwmkgozdo2dlqhqbwe.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1454 [0079.437] GetFileSizeEx (in: hFile=0x1454, lpFileSize=0x2037fad0 | out: lpFileSize=0x2037fad0*=45143) returned 1 [0079.437] SetFilePointerEx (in: hFile=0x1454, liDistanceToMove=0xb053, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.437] ReadFile (in: hFile=0x1454, lpBuffer=0x2037fa54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2037fa50, lpOverlapped=0x0 | out: lpBuffer=0x2037fa54*, lpNumberOfBytesRead=0x2037fa50*=0x4, lpOverlapped=0x0) returned 1 [0079.437] SetFilePointerEx (in: hFile=0x1454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.437] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba63d0 [0079.437] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba6678 [0079.437] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba66f0 [0079.437] NtQuerySystemTime (in: CurrentTime=0x2037fa30 | out: CurrentTime=0x2037fa30*=132260136365910793) returned 0x0 [0079.437] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0x9a4ac399 [0079.437] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0xa152b567 [0079.437] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0xf9698ce [0079.437] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0x661a318a [0079.437] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0xeb570995 [0079.437] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0x1d849acf [0079.437] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0xdd87c394 [0079.437] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0x805fec7a [0079.437] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0xe0ac5fe9 [0079.437] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0x65f1dbaf [0079.437] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0xd2a6c3ba [0079.437] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0xf25a9cf5 [0079.437] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0xebb1dfcf [0079.437] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0x10639140 [0079.437] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0x29799fac [0079.437] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0x3285c1f9 [0079.437] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0x8f42d26c [0079.437] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0x9215fb8 [0079.437] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0x9cebfd0a [0079.437] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0x2f11c510 [0079.438] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0xc6bf13ff [0079.438] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0x82f39a8c [0079.438] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0x9df86ff [0079.438] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0x55f29b81 [0079.438] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0x5836bdfe [0079.438] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0x5770536 [0079.438] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0xabfd1bb8 [0079.438] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0x9f9c11cf [0079.438] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0xad415214 [0079.438] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0x6f493729 [0079.438] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0xc5ba5ae4 [0079.438] RtlRandom (in: Seed=0x2037fa3c | out: Seed=0x2037fa3c) returned 0x4e76ecc7 [0079.448] ReadFile (in: hFile=0x1454, lpBuffer=0x70aa9b0, nNumberOfBytesToRead=0xb057, lpNumberOfBytesRead=0x2037fa2c, lpOverlapped=0x0 | out: lpBuffer=0x70aa9b0*, lpNumberOfBytesRead=0x2037fa2c*=0xb057, lpOverlapped=0x0) returned 1 [0079.450] SetFilePointerEx (in: hFile=0x1454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.450] WriteFile (in: hFile=0x1454, lpBuffer=0x70b71b8*, nNumberOfBytesToWrite=0xb057, lpNumberOfBytesWritten=0x2037fa28, lpOverlapped=0x0 | out: lpBuffer=0x70b71b8*, lpNumberOfBytesWritten=0x2037fa28*=0xb057, lpOverlapped=0x0) returned 1 [0082.323] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 865 os_tid = 0x1700 [0079.450] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\F9cV.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\f9cv.bmp")) returned 0x20 [0079.450] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\F9cV.bmp", dwFileAttributes=0x20) returned 1 [0079.451] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\F9cV.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\f9cv.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1458 [0079.451] GetFileSizeEx (in: hFile=0x1458, lpFileSize=0x203ff948 | out: lpFileSize=0x203ff948*=43825) returned 1 [0079.451] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0xab2d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.451] ReadFile (in: hFile=0x1458, lpBuffer=0x203ff8cc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x203ff8c8, lpOverlapped=0x0 | out: lpBuffer=0x203ff8cc*, lpNumberOfBytesRead=0x203ff8c8*=0x4, lpOverlapped=0x0) returned 1 [0079.451] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.451] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba63d0 [0079.451] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5ba66f0 [0079.451] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9fd0 [0079.451] NtQuerySystemTime (in: CurrentTime=0x203ff8a8 | out: CurrentTime=0x203ff8a8*=132260136366066854) returned 0x0 [0079.451] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0x27b3340 [0079.451] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0xf0f46131 [0079.451] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0x64a7521 [0079.451] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0x6c362890 [0079.451] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0x935172e9 [0079.451] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0xe93223b1 [0079.451] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0x5b95bb75 [0079.451] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0xa4950461 [0079.451] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0xc471064c [0079.451] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0x7f82aed5 [0079.451] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0x7120b77c [0079.451] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0xa18b5246 [0079.451] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0x7eef7923 [0079.451] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0xd644de03 [0079.451] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0x9f73005c [0079.451] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0x7b47eed0 [0079.451] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0x9c016835 [0079.451] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0x7878e48c [0079.451] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0x5def1f2c [0079.451] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0xb5d7b078 [0079.452] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0x909eb684 [0079.452] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0x6d50f398 [0079.452] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0xda4a9c3e [0079.452] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0x118ad404 [0079.452] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0x759e72b2 [0079.452] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0xacfbf17 [0079.452] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0x1f2f0cc [0079.452] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0x39ad4d3 [0079.452] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0x1170b9f6 [0079.452] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0x1d9c1f2e [0079.452] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0xe7f5143 [0079.452] RtlRandom (in: Seed=0x203ff8b4 | out: Seed=0x203ff8b4) returned 0x80e3c2b [0079.462] ReadFile (in: hFile=0x1458, lpBuffer=0x70c39c0, nNumberOfBytesToRead=0xab31, lpNumberOfBytesRead=0x203ff8a4, lpOverlapped=0x0 | out: lpBuffer=0x70c39c0*, lpNumberOfBytesRead=0x203ff8a4*=0xab31, lpOverlapped=0x0) returned 1 [0079.463] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.464] WriteFile (in: hFile=0x1458, lpBuffer=0x70d01c8*, nNumberOfBytesToWrite=0xab31, lpNumberOfBytesWritten=0x203ff8a0, lpOverlapped=0x0 | out: lpBuffer=0x70d01c8*, lpNumberOfBytesWritten=0x203ff8a0*=0xab31, lpOverlapped=0x0) returned 1 [0082.322] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) Thread: id = 866 os_tid = 0x1704 [0079.464] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\g8rpcVHRizs14C.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\g8rpcvhrizs14c.avi")) returned 0x20 [0079.464] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\g8rpcVHRizs14C.avi", dwFileAttributes=0x20) returned 1 [0079.465] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\g8rpcVHRizs14C.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\g8rpcvhrizs14c.avi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x145c [0079.465] GetFileSizeEx (in: hFile=0x145c, lpFileSize=0x2047fc88 | out: lpFileSize=0x2047fc88*=57212) returned 1 [0079.465] SetFilePointerEx (in: hFile=0x145c, liDistanceToMove=0xdf78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.465] ReadFile (in: hFile=0x145c, lpBuffer=0x2047fc0c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2047fc08, lpOverlapped=0x0 | out: lpBuffer=0x2047fc0c*, lpNumberOfBytesRead=0x2047fc08*=0x4, lpOverlapped=0x0) returned 1 [0079.465] SetFilePointerEx (in: hFile=0x145c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.465] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee960 [0079.465] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee8e8 [0079.465] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eeeaa0 [0079.465] NtQuerySystemTime (in: CurrentTime=0x2047fbe8 | out: CurrentTime=0x2047fbe8*=132260136366223265) returned 0x0 [0079.465] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0xbf634476 [0079.465] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0xc023da5e [0079.465] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0x5f775138 [0079.465] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0xf44901d8 [0079.465] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0x9daf9c46 [0079.465] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0x55260f20 [0079.465] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0x1f07de90 [0079.465] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0xdf344d16 [0079.465] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0x34556d91 [0079.465] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0xca62ba7 [0079.465] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0x8ce3c5bf [0079.465] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0x5985e908 [0079.465] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0x96fe5107 [0079.465] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0x2333e7d1 [0079.465] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0x62674de5 [0079.465] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0x83d38e94 [0079.465] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0xe37045de [0079.465] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0x18d8d25a [0079.465] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0x2070d51b [0079.465] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0xac1c51cd [0079.465] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0x16378ebc [0079.465] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0x733b3992 [0079.465] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0x84ed4cfe [0079.466] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0x307b9848 [0079.466] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0x432ed63f [0079.466] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0x70ee18f [0079.466] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0xac0e2e65 [0079.466] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0xf3e54f63 [0079.466] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0x65174f2b [0079.466] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0x9e439920 [0079.466] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0xdae99a16 [0079.466] RtlRandom (in: Seed=0x2047fbf4 | out: Seed=0x2047fbf4) returned 0xc37202c0 [0079.476] SetFilePointerEx (in: hFile=0x145c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.476] ReadFile (in: hFile=0x145c, lpBuffer=0x70dc9d0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2047fbc8, lpOverlapped=0x0 | out: lpBuffer=0x70dc9d0*, lpNumberOfBytesRead=0x2047fbc8*=0xc800, lpOverlapped=0x0) returned 1 [0079.476] SetFilePointerEx (in: hFile=0x145c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.476] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x537b0e0 [0079.476] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5eed5e8 [0079.476] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee870 [0079.476] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee870) returned 1 [0079.477] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x70e91d8 [0079.481] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee960 [0079.481] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eeeaa0 [0079.481] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eeeaa0) returned 1 [0079.481] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eed5e8) returned 1 [0079.481] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b0e0) returned 1 [0079.481] WriteFile (in: hFile=0x145c, lpBuffer=0x70e91d8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2047fbc8, lpOverlapped=0x0 | out: lpBuffer=0x70e91d8*, lpNumberOfBytesWritten=0x2047fbc8*=0xc800, lpOverlapped=0x0) returned 1 [0082.325] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x70e91d8) Thread: id = 867 os_tid = 0x1168 [0079.482] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\GupI.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\gupi.avi")) returned 0x20 [0079.482] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\GupI.avi", dwFileAttributes=0x20) returned 1 [0079.482] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\GupI.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\gupi.avi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1460 [0079.482] GetFileSizeEx (in: hFile=0x1460, lpFileSize=0x204ffe4c | out: lpFileSize=0x204ffe4c*=60675) returned 1 [0079.482] SetFilePointerEx (in: hFile=0x1460, liDistanceToMove=0xecff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.482] ReadFile (in: hFile=0x1460, lpBuffer=0x204ffdd0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x204ffdcc, lpOverlapped=0x0 | out: lpBuffer=0x204ffdd0*, lpNumberOfBytesRead=0x204ffdcc*=0x4, lpOverlapped=0x0) returned 1 [0079.482] SetFilePointerEx (in: hFile=0x1460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.482] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eeea50 [0079.482] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee848 [0079.482] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee9b0 [0079.482] NtQuerySystemTime (in: CurrentTime=0x204ffdac | out: CurrentTime=0x204ffdac*=132260136366379929) returned 0x0 [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0x9e143c76 [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0x3d742d98 [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0x9ada4047 [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0xf6f1afbb [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0xf7cfed67 [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0x21aba26b [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0x14bbafd4 [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0x91e03bdd [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0x5dcd5191 [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0xe227517a [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0xa27306c1 [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0x3007afdc [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0x7f62eb56 [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0xe02c316f [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0x74554b5a [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0xbeadb545 [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0xa66925af [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0x663746c5 [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0x6776e438 [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0x4e4ce5f6 [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0x3f290b6a [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0x93db091c [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0x40a963da [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0xf595259d [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0xa1ba7ed9 [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0x9f9a855d [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0x82e57eb7 [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0x279d64f8 [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0xe64eec77 [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0xdc7365fb [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0xbaedb6d8 [0079.483] RtlRandom (in: Seed=0x204ffdb8 | out: Seed=0x204ffdb8) returned 0x57b10d0c [0079.493] SetFilePointerEx (in: hFile=0x1460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.493] ReadFile (in: hFile=0x1460, lpBuffer=0x70f59e0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x204ffd8c, lpOverlapped=0x0 | out: lpBuffer=0x70f59e0*, lpNumberOfBytesRead=0x204ffd8c*=0xc800, lpOverlapped=0x0) returned 1 [0079.493] SetFilePointerEx (in: hFile=0x1460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.493] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x537b0e0 [0079.493] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5eed390 [0079.493] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee9b0 [0079.493] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee9b0) returned 1 [0079.494] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x71021e8 [0079.495] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee8c0 [0079.495] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee898 [0079.495] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee898) returned 1 [0079.495] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eed390) returned 1 [0079.495] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b0e0) returned 1 [0079.495] WriteFile (in: hFile=0x1460, lpBuffer=0x71021e8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x204ffd8c, lpOverlapped=0x0 | out: lpBuffer=0x71021e8*, lpNumberOfBytesWritten=0x204ffd8c*=0xc800, lpOverlapped=0x0) returned 1 [0082.327] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x71021e8) returned 1 [0086.022] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x70f59e0) returned 1 [0091.866] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d) returned 0xe09a578 [0091.866] SetFilePointerEx (in: hFile=0x1460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.866] WriteFile (hFile=0x1460, lpBuffer=0x766a780, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0x204ffe0c, lpOverlapped=0x0) Thread: id = 868 os_tid = 0xd34 [0079.496] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\jx2O629A2-48Sx5.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\jx2o629a2-48sx5.mkv")) returned 0x20 [0079.496] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\jx2O629A2-48Sx5.mkv", dwFileAttributes=0x20) returned 1 [0079.496] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\jx2O629A2-48Sx5.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\jx2o629a2-48sx5.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1464 [0079.496] GetFileSizeEx (in: hFile=0x1464, lpFileSize=0x2057fba0 | out: lpFileSize=0x2057fba0*=26043) returned 1 [0079.496] SetFilePointerEx (in: hFile=0x1464, liDistanceToMove=0x65b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.496] ReadFile (in: hFile=0x1464, lpBuffer=0x2057fb24, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2057fb20, lpOverlapped=0x0 | out: lpBuffer=0x2057fb24*, lpNumberOfBytesRead=0x2057fb20*=0x4, lpOverlapped=0x0) returned 1 [0079.496] SetFilePointerEx (in: hFile=0x1464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.496] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eeea78 [0079.496] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee870 [0079.497] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eeea00 [0079.497] NtQuerySystemTime (in: CurrentTime=0x2057fb00 | out: CurrentTime=0x2057fb00*=132260136366535606) returned 0x0 [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0x98587270 [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0x19d40bda [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0x3d4fd002 [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0xaaae36b6 [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0xf2e8fe31 [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0x238457de [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0x2d7c470d [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0x606f3ab8 [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0x1003de1b [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0x2e806446 [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0xf158b016 [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0x621cd6eb [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0xa8975fad [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0x6d566679 [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0xa03a157 [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0xa3503090 [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0x4259db50 [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0xaf488b27 [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0x8b63bff2 [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0xe5a2ddff [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0x9cef6e6 [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0xfee03e14 [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0xc8300d63 [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0x7898fc2e [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0x39b3713a [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0xac5659fe [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0x2776955b [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0x3ab366f6 [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0xe06e97f2 [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0x4c875d01 [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0x8c928d25 [0079.497] RtlRandom (in: Seed=0x2057fb0c | out: Seed=0x2057fb0c) returned 0x4bee3d35 [0079.508] ReadFile (in: hFile=0x1464, lpBuffer=0x710e9f0, nNumberOfBytesToRead=0x65bb, lpNumberOfBytesRead=0x2057fafc, lpOverlapped=0x0 | out: lpBuffer=0x710e9f0*, lpNumberOfBytesRead=0x2057fafc*=0x65bb, lpOverlapped=0x0) returned 1 [0079.509] SetFilePointerEx (in: hFile=0x1464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.509] WriteFile (in: hFile=0x1464, lpBuffer=0x711b1f8*, nNumberOfBytesToWrite=0x65bb, lpNumberOfBytesWritten=0x2057faf8, lpOverlapped=0x0 | out: lpBuffer=0x711b1f8*, lpNumberOfBytesWritten=0x2057faf8*=0x65bb, lpOverlapped=0x0) returned 1 [0082.327] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282ca8 [0089.029] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282898 [0089.029] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282898) returned 1 [0089.029] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x711b1f8) returned 1 [0089.042] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x710e9f0) returned 1 [0089.045] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eed390) returned 1 [0089.045] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b0e0) returned 1 [0089.045] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x33) returned 0x7567f48 [0089.045] SetFilePointerEx (in: hFile=0x1464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.046] WriteFile (in: hFile=0x1464, lpBuffer=0x74d9950*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0x2057fb60, lpOverlapped=0x0 | out: lpBuffer=0x74d9950*, lpNumberOfBytesWritten=0x2057fb60*=0x117, lpOverlapped=0x0) returned 1 [0089.934] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74d9950) returned 1 [0089.934] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7567c48) returned 1 [0089.934] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282a28) returned 1 [0089.934] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7567f48) returned 1 [0089.934] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282ca8) returned 1 [0089.934] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee870) returned 1 [0089.934] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee9b0) returned 1 [0089.935] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eeea28) returned 1 [0089.935] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x98) returned 0x55c5d58 [0089.935] wcscpy (in: _Dest=0x55c5d58, _Source="C:\\Users\\FD1HVy\\Desktop\\jx2O629A2-48Sx5.mkv" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\jx2O629A2-48Sx5.mkv") returned="C:\\Users\\FD1HVy\\Desktop\\jx2O629A2-48Sx5.mkv" [0089.935] wcscat (in: _Dest=0x55c5d58, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\jx2O629A2-48Sx5.mkv.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\Desktop\\jx2O629A2-48Sx5.mkv.mailto[knoocknoo@cock.li].a0a70" [0089.935] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\Desktop\\jx2O629A2-48Sx5.mkv.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x2057fb18, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\Desktop\\jx2O629A2-48Sx5.mkv.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.935] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xae) returned 0x55c8f10 Thread: id = 869 os_tid = 0x1470 [0079.509] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\klYTOSp2nv3qCIKv.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\klytosp2nv3qcikv.m4a")) returned 0x20 [0079.509] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\klYTOSp2nv3qCIKv.m4a", dwFileAttributes=0x20) returned 1 [0079.509] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\klYTOSp2nv3qCIKv.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\klytosp2nv3qcikv.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1468 [0079.510] GetFileSizeEx (in: hFile=0x1468, lpFileSize=0x205ffd8c | out: lpFileSize=0x205ffd8c*=23031) returned 1 [0079.510] SetFilePointerEx (in: hFile=0x1468, liDistanceToMove=0x59f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.510] ReadFile (in: hFile=0x1468, lpBuffer=0x205ffd10, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x205ffd0c, lpOverlapped=0x0 | out: lpBuffer=0x205ffd10*, lpNumberOfBytesRead=0x205ffd0c*=0x4, lpOverlapped=0x0) returned 1 [0079.510] SetFilePointerEx (in: hFile=0x1468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.510] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eeeaa0 [0079.510] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee898 [0079.510] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eeea00 [0079.510] NtQuerySystemTime (in: CurrentTime=0x205ffcec | out: CurrentTime=0x205ffcec*=132260136366692623) returned 0x0 [0079.510] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0x63990d0a [0079.510] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0x46ba85ed [0079.510] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0x1bf8458f [0079.510] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0x7f8782c5 [0079.510] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0x2ebe0b81 [0079.510] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0x2aaee301 [0079.510] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0x9073b760 [0079.510] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0xb33fc6 [0079.510] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0xbb0df33 [0079.510] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0xd59198f6 [0079.510] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0x395c279e [0079.510] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0x5d1b037e [0079.510] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0x7444ad56 [0079.510] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0x109bcddc [0079.510] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0xcbae4c0e [0079.510] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0xfebd2955 [0079.510] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0x1a93e819 [0079.510] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0x318a6bf5 [0079.510] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0xf137309e [0079.510] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0x558be29b [0079.510] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0x7ac7a1c2 [0079.510] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0xec41c9a1 [0079.510] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0x325e3aa6 [0079.510] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0x2a3b867f [0079.510] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0x87347b41 [0079.510] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0xb1dc3bb3 [0079.511] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0xe1967ef8 [0079.511] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0xf467b964 [0079.511] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0xc78fc976 [0079.511] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0xe557e302 [0079.511] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0x314f4f11 [0079.511] RtlRandom (in: Seed=0x205ffcf8 | out: Seed=0x205ffcf8) returned 0xf5752458 [0079.521] ReadFile (in: hFile=0x1468, lpBuffer=0x7127a00, nNumberOfBytesToRead=0x59f7, lpNumberOfBytesRead=0x205ffce8, lpOverlapped=0x0 | out: lpBuffer=0x7127a00*, lpNumberOfBytesRead=0x205ffce8*=0x59f7, lpOverlapped=0x0) returned 1 [0079.522] SetFilePointerEx (in: hFile=0x1468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.522] WriteFile (in: hFile=0x1468, lpBuffer=0x7134208*, nNumberOfBytesToWrite=0x59f7, lpNumberOfBytesWritten=0x205ffce4, lpOverlapped=0x0 | out: lpBuffer=0x7134208*, lpNumberOfBytesWritten=0x205ffce4*=0x59f7, lpOverlapped=0x0) returned 1 [0082.331] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72810f8 [0086.021] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7280f40 [0086.021] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7280f40) returned 1 [0086.021] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7134208) returned 1 [0086.021] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7127a00) returned 1 [0086.021] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eed408) returned 1 [0086.021] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b128) returned 1 [0086.021] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x35) returned 0x389f080 [0086.021] SetFilePointerEx (in: hFile=0x1468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.021] WriteFile (in: hFile=0x1468, lpBuffer=0x74d94b0*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x205ffd4c, lpOverlapped=0x0 | out: lpBuffer=0x74d94b0*, lpNumberOfBytesWritten=0x205ffd4c*=0x119, lpOverlapped=0x0) returned 1 [0089.336] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74d94b0) returned 1 [0089.336] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389ef40) returned 1 [0089.336] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7280f18) returned 1 [0089.336] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f080) returned 1 [0089.336] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x72810f8) returned 1 [0089.336] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee898) returned 1 [0089.336] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eeea50) returned 1 [0089.336] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eeea78) returned 1 [0089.336] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9a) returned 0x54a2448 [0089.336] wcscpy (in: _Dest=0x54a2448, _Source="C:\\Users\\FD1HVy\\Desktop\\klYTOSp2nv3qCIKv.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\klYTOSp2nv3qCIKv.m4a") returned="C:\\Users\\FD1HVy\\Desktop\\klYTOSp2nv3qCIKv.m4a" [0089.336] wcscat (in: _Dest=0x54a2448, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\klYTOSp2nv3qCIKv.m4a.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\Desktop\\klYTOSp2nv3qCIKv.m4a.mailto[knoocknoo@cock.li].a0a70" [0089.336] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\Desktop\\klYTOSp2nv3qCIKv.m4a.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x205ffd04, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\Desktop\\klYTOSp2nv3qCIKv.m4a.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.336] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x55c8e58 Thread: id = 870 os_tid = 0x148c [0079.522] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\L6MUi p.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\l6mui p.flv")) returned 0x20 [0079.522] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\L6MUi p.flv", dwFileAttributes=0x20) returned 1 [0079.522] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\L6MUi p.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\l6mui p.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x146c [0079.522] GetFileSizeEx (in: hFile=0x146c, lpFileSize=0x2067f7cc | out: lpFileSize=0x2067f7cc*=8108) returned 1 [0079.523] SetFilePointerEx (in: hFile=0x146c, liDistanceToMove=0x1fa8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.523] ReadFile (in: hFile=0x146c, lpBuffer=0x2067f750, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2067f74c, lpOverlapped=0x0 | out: lpBuffer=0x2067f750*, lpNumberOfBytesRead=0x2067f74c*=0x4, lpOverlapped=0x0) returned 1 [0079.523] SetFilePointerEx (in: hFile=0x146c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.523] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eeea00 [0079.523] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eeeaa0 [0079.523] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee550 [0079.523] NtQuerySystemTime (in: CurrentTime=0x2067f72c | out: CurrentTime=0x2067f72c*=132260136366848303) returned 0x0 [0079.523] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0xb38b8c39 [0079.523] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0xf286277f [0079.523] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0x5e18d28b [0079.523] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0x7e7d1a31 [0079.523] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0xc0e39ed0 [0079.523] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0x3944066f [0079.523] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0xbbf26a52 [0079.523] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0xa2b41025 [0079.523] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0xf0c3d590 [0079.523] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0xbcf61d3b [0079.523] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0x801b7884 [0079.523] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0x896685ef [0079.523] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0x76b5cded [0079.523] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0x9790483a [0079.523] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0x503665a0 [0079.523] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0x6a1286f2 [0079.523] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0x62bd6503 [0079.523] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0x4f34adcb [0079.523] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0xcc14056e [0079.523] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0xed169992 [0079.523] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0xf9d1240 [0079.523] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0x70420ec6 [0079.523] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0x7d59e710 [0079.523] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0xcb881269 [0079.523] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0x6b709eea [0079.523] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0xd31f18fb [0079.523] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0xb1306a94 [0079.523] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0x58818644 [0079.523] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0x4e589d5d [0079.523] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0x5462de31 [0079.524] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0x3c8b6bd3 [0079.524] RtlRandom (in: Seed=0x2067f738 | out: Seed=0x2067f738) returned 0x9d1521f [0079.534] ReadFile (in: hFile=0x146c, lpBuffer=0x7140a10, nNumberOfBytesToRead=0x1fac, lpNumberOfBytesRead=0x2067f728, lpOverlapped=0x0 | out: lpBuffer=0x7140a10*, lpNumberOfBytesRead=0x2067f728*=0x1fac, lpOverlapped=0x0) returned 1 [0079.534] SetFilePointerEx (in: hFile=0x146c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.534] WriteFile (in: hFile=0x146c, lpBuffer=0x714d218*, nNumberOfBytesToWrite=0x1fac, lpNumberOfBytesWritten=0x2067f724, lpOverlapped=0x0 | out: lpBuffer=0x714d218*, lpNumberOfBytesWritten=0x2067f724*=0x1fac, lpOverlapped=0x0) returned 1 [0082.330] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72816d8 [0086.021] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281520 [0086.021] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7281520) returned 1 [0086.021] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x714d218) returned 1 [0086.021] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7140a10) returned 1 [0086.021] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eed480) returned 1 [0086.021] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b1b8) returned 1 [0086.021] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x23) returned 0x38a6910 [0086.021] SetFilePointerEx (in: hFile=0x146c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.021] WriteFile (in: hFile=0x146c, lpBuffer=0x7439510*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x2067f78c, lpOverlapped=0x0 | out: lpBuffer=0x7439510*, lpNumberOfBytesWritten=0x2067f78c*=0x107, lpOverlapped=0x0) returned 1 [0089.335] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7439510) returned 1 [0089.335] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6b80) returned 1 [0089.335] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7281520) returned 1 [0089.335] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6910) returned 1 [0089.335] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x72816d8) returned 1 [0089.335] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eeeaa0) returned 1 [0089.335] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee488) returned 1 [0089.335] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee4d8) returned 1 [0089.335] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x88) returned 0x549ccf8 [0089.335] wcscpy (in: _Dest=0x549ccf8, _Source="C:\\Users\\FD1HVy\\Desktop\\L6MUi p.flv" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\L6MUi p.flv") returned="C:\\Users\\FD1HVy\\Desktop\\L6MUi p.flv" [0089.335] wcscat (in: _Dest=0x549ccf8, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\L6MUi p.flv.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\Desktop\\L6MUi p.flv.mailto[knoocknoo@cock.li].a0a70" [0089.335] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\Desktop\\L6MUi p.flv.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x2067f744, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\Desktop\\L6MUi p.flv.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.335] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9e) returned 0x54a2100 Thread: id = 871 os_tid = 0x1494 [0079.535] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\lBoLBknioIKFwym.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\lbolbknioikfwym.jpg")) returned 0x20 [0079.535] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\lBoLBknioIKFwym.jpg", dwFileAttributes=0x20) returned 1 [0079.535] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\lBoLBknioIKFwym.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\lbolbknioikfwym.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1470 [0079.535] GetFileSizeEx (in: hFile=0x1470, lpFileSize=0x206ffbdc | out: lpFileSize=0x206ffbdc*=52423) returned 1 [0079.535] SetFilePointerEx (in: hFile=0x1470, liDistanceToMove=0xccc3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.535] ReadFile (in: hFile=0x1470, lpBuffer=0x206ffb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x206ffb5c, lpOverlapped=0x0 | out: lpBuffer=0x206ffb60*, lpNumberOfBytesRead=0x206ffb5c*=0x4, lpOverlapped=0x0) returned 1 [0079.536] SetFilePointerEx (in: hFile=0x1470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.536] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eeea00 [0079.536] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee7a8 [0079.536] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee550 [0079.536] NtQuerySystemTime (in: CurrentTime=0x206ffb3c | out: CurrentTime=0x206ffb3c*=132260136367004630) returned 0x0 [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0xc7c1fa54 [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0x805a161d [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0x32028848 [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0xf6f02fe1 [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0x97bb3dc4 [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0x6dd7359f [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0xc697fe86 [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0xa746ce8e [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0xd01f691d [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0xd8d384e7 [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0xe963b54a [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0xe4a19071 [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0xd427cdb4 [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0x3ca51e25 [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0xb214988e [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0xa65cb24a [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0x18d7f229 [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0xdb04e9fd [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0x48139ffc [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0x6c7b9458 [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0x8f0d5adb [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0xbbea6e54 [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0xa2f85a03 [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0x459aaf66 [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0x3154db65 [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0x5f19ca3d [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0xbd239e58 [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0xa49a366 [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0xf42990f9 [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0x1bb0bab1 [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0xe733464d [0079.536] RtlRandom (in: Seed=0x206ffb48 | out: Seed=0x206ffb48) returned 0xc5cd70e6 [0079.546] SetFilePointerEx (in: hFile=0x1470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.546] ReadFile (in: hFile=0x1470, lpBuffer=0x7159a20, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x206ffb1c, lpOverlapped=0x0 | out: lpBuffer=0x7159a20*, lpNumberOfBytesRead=0x206ffb1c*=0xc800, lpOverlapped=0x0) returned 1 [0079.546] SetFilePointerEx (in: hFile=0x1470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.546] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x537ba28 [0079.546] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5eed4f8 [0079.546] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eeea00 [0079.546] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eeea00) returned 1 [0079.547] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x7166228 [0079.551] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eeea00 [0079.551] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee398 [0079.552] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee398) returned 1 [0079.552] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eed4f8) returned 1 [0079.552] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537ba28) returned 1 [0079.552] WriteFile (in: hFile=0x1470, lpBuffer=0x7166228*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x206ffb1c, lpOverlapped=0x0 | out: lpBuffer=0x7166228*, lpNumberOfBytesWritten=0x206ffb1c*=0xc800, lpOverlapped=0x0) returned 1 [0082.333] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7166228) returned 1 [0086.020] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7159a20) returned 1 [0086.020] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x33) returned 0x389f180 [0086.020] SetFilePointerEx (in: hFile=0x1470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.020] WriteFile (in: hFile=0x1470, lpBuffer=0x74d9388*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0x206ffb9c, lpOverlapped=0x0 | out: lpBuffer=0x74d9388*, lpNumberOfBytesWritten=0x206ffb9c*=0x117, lpOverlapped=0x0) returned 1 [0089.329] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74d9388) returned 1 [0089.329] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389efc0) returned 1 [0089.329] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x727eda0) returned 1 [0091.524] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f180) returned 1 [0091.524] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eeea00) returned 1 [0091.524] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee7a8) returned 1 [0091.524] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee4b0) returned 1 [0091.524] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee500) returned 1 [0091.524] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x98) returned 0x55c5df8 [0091.524] wcscpy (in: _Dest=0x55c5df8, _Source="C:\\Users\\FD1HVy\\Desktop\\lBoLBknioIKFwym.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lBoLBknioIKFwym.jpg") returned="C:\\Users\\FD1HVy\\Desktop\\lBoLBknioIKFwym.jpg" [0091.524] wcscat (in: _Dest=0x55c5df8, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lBoLBknioIKFwym.jpg.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\Desktop\\lBoLBknioIKFwym.jpg.mailto[knoocknoo@cock.li].a0a70" [0091.524] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\Desktop\\lBoLBknioIKFwym.jpg.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x206ffb54, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\Desktop\\lBoLBknioIKFwym.jpg.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0091.524] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xae) returned 0x55c8fc8 Thread: id = 872 os_tid = 0x1498 [0079.552] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x5eeb458 [0079.552] wcscpy (in: _Dest=0x5eeb458, _Source="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W" [0079.552] wcscat (in: _Dest=0x5eeb458, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\" [0079.553] wcscat (in: _Dest=0x5eeb458, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\*") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\*" [0079.553] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3901bf8 [0079.553] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\*", lpFindFileData=0x3901bf8 | out: lpFindFileData=0x3901bf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3eb67570, ftCreationTime.dwHighDateTime=0x1d5ce9d, ftLastAccessTime.dwLowDateTime=0x350775a0, ftLastAccessTime.dwHighDateTime=0x1d5c85e, ftLastWriteTime.dwLowDateTime=0x350775a0, ftLastWriteTime.dwHighDateTime=0x1d5c85e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba12b0 [0079.553] wcscmp (_String1=".", _String2=".") returned 0 [0079.553] FindNextFileW (in: hFindFile=0x5ba12b0, lpFindFileData=0x3901bf8 | out: lpFindFileData=0x3901bf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3eb67570, ftCreationTime.dwHighDateTime=0x1d5ce9d, ftLastAccessTime.dwLowDateTime=0x350775a0, ftLastAccessTime.dwHighDateTime=0x1d5c85e, ftLastWriteTime.dwLowDateTime=0x350775a0, ftLastWriteTime.dwHighDateTime=0x1d5c85e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.553] wcscmp (_String1="..", _String2=".") returned 1 [0079.553] wcscmp (_String1="..", _String2="..") returned 0 [0079.553] FindNextFileW (in: hFindFile=0x5ba12b0, lpFindFileData=0x3901bf8 | out: lpFindFileData=0x3901bf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bc0cf90, ftCreationTime.dwHighDateTime=0x1d5d0d5, ftLastAccessTime.dwLowDateTime=0xfb743c10, ftLastAccessTime.dwHighDateTime=0x1d5d1cc, ftLastWriteTime.dwLowDateTime=0xfb743c10, ftLastWriteTime.dwHighDateTime=0x1d5d1cc, nFileSizeHigh=0x0, nFileSizeLow=0x1157b, dwReserved0=0x0, dwReserved1=0x0, cFileName="574tRWuFE4nB3ib5-Tp.gif", cAlternateFileName="574TRW~1.GIF")) returned 1 [0079.553] wcscmp (_String1="574tRWuFE4nB3ib5-Tp.gif", _String2=".") returned 1 [0079.553] wcscmp (_String1="574tRWuFE4nB3ib5-Tp.gif", _String2="..") returned 1 [0079.553] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5eed9a8 [0079.553] wcscpy (in: _Dest=0x5eed9a8, _Source="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W" [0079.553] wcscat (in: _Dest=0x5eed9a8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\" [0079.553] wcscat (in: _Dest=0x5eed9a8, _Source="574tRWuFE4nB3ib5-Tp.gif" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\574tRWuFE4nB3ib5-Tp.gif") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\574tRWuFE4nB3ib5-Tp.gif" [0080.538] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5eed9a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14a4 [0080.539] FindNextFileW (in: hFindFile=0x5ba12b0, lpFindFileData=0x3901bf8 | out: lpFindFileData=0x3901bf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a89c0, ftCreationTime.dwHighDateTime=0x1d5cc63, ftLastAccessTime.dwLowDateTime=0xe23bf0e0, ftLastAccessTime.dwHighDateTime=0x1d5c90b, ftLastWriteTime.dwLowDateTime=0xe23bf0e0, ftLastWriteTime.dwHighDateTime=0x1d5c90b, nFileSizeHigh=0x0, nFileSizeLow=0xf47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="5LyR-.m4a", cAlternateFileName="")) returned 1 [0080.539] wcscmp (_String1="5LyR-.m4a", _String2=".") returned 1 [0080.539] wcscmp (_String1="5LyR-.m4a", _String2="..") returned 1 [0080.539] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x543d5d8 [0080.539] wcscpy (in: _Dest=0x543d5d8, _Source="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W" [0080.539] wcscat (in: _Dest=0x543d5d8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\" [0080.539] wcscat (in: _Dest=0x543d5d8, _Source="5LyR-.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\5LyR-.m4a") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\5LyR-.m4a" [0080.539] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x543d5d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14ac [0080.539] FindNextFileW (in: hFindFile=0x5ba12b0, lpFindFileData=0x3901bf8 | out: lpFindFileData=0x3901bf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3140e0e0, ftCreationTime.dwHighDateTime=0x1d5ccb5, ftLastAccessTime.dwLowDateTime=0xf74cd830, ftLastAccessTime.dwHighDateTime=0x1d5d5ab, ftLastWriteTime.dwLowDateTime=0xf74cd830, ftLastWriteTime.dwHighDateTime=0x1d5d5ab, nFileSizeHigh=0x0, nFileSizeLow=0x2dba, dwReserved0=0x0, dwReserved1=0x0, cFileName="coo4EbVBHlZSJOyb7.pps", cAlternateFileName="COO4EB~1.PPS")) returned 1 [0080.540] wcscmp (_String1="coo4EbVBHlZSJOyb7.pps", _String2=".") returned 1 [0080.540] wcscmp (_String1="coo4EbVBHlZSJOyb7.pps", _String2="..") returned 1 [0080.540] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6c) returned 0x54679e0 [0080.540] wcscpy (in: _Dest=0x54679e0, _Source="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W" [0080.540] wcscat (in: _Dest=0x54679e0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\" [0080.540] wcscat (in: _Dest=0x54679e0, _Source="coo4EbVBHlZSJOyb7.pps" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\coo4EbVBHlZSJOyb7.pps") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\coo4EbVBHlZSJOyb7.pps" [0080.540] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54679e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a8 [0080.540] FindNextFileW (in: hFindFile=0x5ba12b0, lpFindFileData=0x3901bf8 | out: lpFindFileData=0x3901bf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f92e640, ftCreationTime.dwHighDateTime=0x1d5d2a9, ftLastAccessTime.dwLowDateTime=0x1b6d0040, ftLastAccessTime.dwHighDateTime=0x1d5cc61, ftLastWriteTime.dwLowDateTime=0x1b6d0040, ftLastWriteTime.dwHighDateTime=0x1d5cc61, nFileSizeHigh=0x0, nFileSizeLow=0x10fba, dwReserved0=0x0, dwReserved1=0x0, cFileName="kdektZvR.wav", cAlternateFileName="")) returned 1 [0080.540] wcscmp (_String1="kdektZvR.wav", _String2=".") returned 1 [0080.540] wcscmp (_String1="kdektZvR.wav", _String2="..") returned 1 [0080.540] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x6e95e40 [0080.540] wcscpy (in: _Dest=0x6e95e40, _Source="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W" [0080.540] wcscat (in: _Dest=0x6e95e40, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\" [0080.540] wcscat (in: _Dest=0x6e95e40, _Source="kdektZvR.wav" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\kdektZvR.wav") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\kdektZvR.wav" [0080.541] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x6e95e40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x840 [0080.541] FindNextFileW (in: hFindFile=0x5ba12b0, lpFindFileData=0x3901bf8 | out: lpFindFileData=0x3901bf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf404620, ftCreationTime.dwHighDateTime=0x1d5cf37, ftLastAccessTime.dwLowDateTime=0xb34c7240, ftLastAccessTime.dwHighDateTime=0x1d5d596, ftLastWriteTime.dwLowDateTime=0xb34c7240, ftLastWriteTime.dwHighDateTime=0x1d5d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NgMGpHjS", cAlternateFileName="")) returned 1 [0080.541] wcscmp (_String1="NgMGpHjS", _String2=".") returned 1 [0080.541] wcscmp (_String1="NgMGpHjS", _String2="..") returned 1 [0080.541] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x543d7b8 [0080.541] wcscpy (in: _Dest=0x543d7b8, _Source="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W" [0080.541] wcscat (in: _Dest=0x543d7b8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\" [0080.541] wcscat (in: _Dest=0x543d7b8, _Source="NgMGpHjS" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\NgMGpHjS") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\NgMGpHjS" [0080.541] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x543d7b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a4 [0080.542] FindNextFileW (in: hFindFile=0x5ba12b0, lpFindFileData=0x3901bf8 | out: lpFindFileData=0x3901bf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2feac8d0, ftCreationTime.dwHighDateTime=0x1d5d0bd, ftLastAccessTime.dwLowDateTime=0x2e6ea280, ftLastAccessTime.dwHighDateTime=0x1d5d412, ftLastWriteTime.dwLowDateTime=0x2e6ea280, ftLastWriteTime.dwHighDateTime=0x1d5d412, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pGOC85GxnNYiTp5YB", cAlternateFileName="PGOC85~1")) returned 1 [0080.542] wcscmp (_String1="pGOC85GxnNYiTp5YB", _String2=".") returned 1 [0080.542] wcscmp (_String1="pGOC85GxnNYiTp5YB", _String2="..") returned 1 [0080.542] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x5ba7968 [0080.542] wcscpy (in: _Dest=0x5ba7968, _Source="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W" [0080.542] wcscat (in: _Dest=0x5ba7968, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\" [0080.542] wcscat (in: _Dest=0x5ba7968, _Source="pGOC85GxnNYiTp5YB" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB" [0080.542] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba7968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc78 [0080.543] FindNextFileW (in: hFindFile=0x5ba12b0, lpFindFileData=0x3901bf8 | out: lpFindFileData=0x3901bf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c04e1a0, ftCreationTime.dwHighDateTime=0x1d5ccaf, ftLastAccessTime.dwLowDateTime=0xed0aa9c0, ftLastAccessTime.dwHighDateTime=0x1d5c8c1, ftLastWriteTime.dwLowDateTime=0xed0aa9c0, ftLastWriteTime.dwHighDateTime=0x1d5c8c1, nFileSizeHigh=0x0, nFileSizeLow=0xdaa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xs_PfQV6pA.mp3", cAlternateFileName="XS_PFQ~1.MP3")) returned 1 [0080.543] wcscmp (_String1="Xs_PfQV6pA.mp3", _String2=".") returned 1 [0080.543] wcscmp (_String1="Xs_PfQV6pA.mp3", _String2="..") returned 1 [0080.543] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x6e95f10 [0080.543] wcscpy (in: _Dest=0x6e95f10, _Source="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W" [0080.543] wcscat (in: _Dest=0x6e95f10, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\" [0080.543] wcscat (in: _Dest=0x6e95f10, _Source="Xs_PfQV6pA.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\Xs_PfQV6pA.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\Xs_PfQV6pA.mp3" [0080.543] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x6e95f10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x157c [0080.544] FindNextFileW (in: hFindFile=0x5ba12b0, lpFindFileData=0x3901bf8 | out: lpFindFileData=0x3901bf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49c6ab40, ftCreationTime.dwHighDateTime=0x1d5d642, ftLastAccessTime.dwLowDateTime=0xb1deb370, ftLastAccessTime.dwHighDateTime=0x1d5ce2d, ftLastWriteTime.dwLowDateTime=0xb1deb370, ftLastWriteTime.dwHighDateTime=0x1d5ce2d, nFileSizeHigh=0x0, nFileSizeLow=0x10087, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZoSDUSz3c59BTS.png", cAlternateFileName="ZOSDUS~1.PNG")) returned 1 [0080.544] wcscmp (_String1="ZoSDUSz3c59BTS.png", _String2=".") returned 1 [0080.544] wcscmp (_String1="ZoSDUSz3c59BTS.png", _String2="..") returned 1 [0080.544] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x5ba7508 [0080.544] wcscpy (in: _Dest=0x5ba7508, _Source="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W" [0080.544] wcscat (in: _Dest=0x5ba7508, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\" [0080.544] wcscat (in: _Dest=0x5ba7508, _Source="ZoSDUSz3c59BTS.png" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\ZoSDUSz3c59BTS.png") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\ZoSDUSz3c59BTS.png" [0080.544] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba7508, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1580 [0080.545] FindNextFileW (in: hFindFile=0x5ba12b0, lpFindFileData=0x3901bf8 | out: lpFindFileData=0x3901bf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49c6ab40, ftCreationTime.dwHighDateTime=0x1d5d642, ftLastAccessTime.dwLowDateTime=0xb1deb370, ftLastAccessTime.dwHighDateTime=0x1d5ce2d, ftLastWriteTime.dwLowDateTime=0xb1deb370, ftLastWriteTime.dwHighDateTime=0x1d5ce2d, nFileSizeHigh=0x0, nFileSizeLow=0x10087, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZoSDUSz3c59BTS.png", cAlternateFileName="ZOSDUS~1.PNG")) returned 0 [0080.545] FindClose (in: hFindFile=0x5ba12b0 | out: hFindFile=0x5ba12b0) returned 1 [0080.545] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3901bf8) returned 1 [0080.545] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eeb458) returned 1 [0080.545] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5bf0) returned 1 Thread: id = 873 os_tid = 0x14a0 [0079.553] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\MOTB.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\motb.wav")) returned 0x20 [0079.554] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\MOTB.wav", dwFileAttributes=0x20) returned 1 [0079.554] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\MOTB.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\motb.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1478 [0079.554] GetFileSizeEx (in: hFile=0x1478, lpFileSize=0x207ffd60 | out: lpFileSize=0x207ffd60*=38383) returned 1 [0079.554] SetFilePointerEx (in: hFile=0x1478, liDistanceToMove=0x95eb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.554] ReadFile (in: hFile=0x1478, lpBuffer=0x207ffce4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x207ffce0, lpOverlapped=0x0 | out: lpBuffer=0x207ffce4*, lpNumberOfBytesRead=0x207ffce0*=0x4, lpOverlapped=0x0) returned 1 [0079.554] SetFilePointerEx (in: hFile=0x1478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.554] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee6b8 [0079.554] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee7d0 [0079.554] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee550 [0079.554] NtQuerySystemTime (in: CurrentTime=0x207ffcc0 | out: CurrentTime=0x207ffcc0*=132260136367166101) returned 0x0 [0079.554] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0x36513267 [0079.554] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0x97e8161f [0079.554] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0x891f17ae [0079.554] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0xb903459e [0079.554] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0xad78f9c2 [0079.554] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0x3ffdc472 [0079.554] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0x40cca26d [0079.554] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0x4fccbd34 [0079.554] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0x93e035ce [0079.554] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0x9cf485a [0079.554] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0x8129d86e [0079.554] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0x4337de68 [0079.554] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0xacb168b4 [0079.554] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0xa9e1b056 [0079.555] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0xed82ba05 [0079.555] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0xa936abc3 [0079.555] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0x2fbdb299 [0079.555] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0x3a18d991 [0079.555] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0xf4e0531c [0079.555] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0xc52259a5 [0079.555] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0x1e15d04d [0079.555] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0xe8e7137f [0079.555] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0xc41bb936 [0079.555] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0xec0f0d26 [0079.555] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0x5a8be393 [0079.555] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0x578637ae [0079.555] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0x7870742b [0079.555] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0x705d197b [0079.555] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0xde9010e4 [0079.555] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0x30e0e42f [0079.555] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0x3c2950d7 [0079.555] RtlRandom (in: Seed=0x207ffccc | out: Seed=0x207ffccc) returned 0x3201ae95 [0079.565] ReadFile (in: hFile=0x1478, lpBuffer=0x7172a30, nNumberOfBytesToRead=0x95ef, lpNumberOfBytesRead=0x207ffcbc, lpOverlapped=0x0 | out: lpBuffer=0x7172a30*, lpNumberOfBytesRead=0x207ffcbc*=0x95ef, lpOverlapped=0x0) returned 1 [0079.566] SetFilePointerEx (in: hFile=0x1478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.566] WriteFile (in: hFile=0x1478, lpBuffer=0x717f238*, nNumberOfBytesToWrite=0x95ef, lpNumberOfBytesWritten=0x207ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x717f238*, lpNumberOfBytesWritten=0x207ffcb8*=0x95ef, lpOverlapped=0x0) returned 1 [0082.332] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x727f448 [0086.020] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x727f470 [0086.020] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x727f470) returned 1 [0086.020] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x717f238) returned 1 [0086.020] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7172a30) returned 1 [0086.020] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eed4f8) returned 1 [0086.020] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537ba28) returned 1 [0086.020] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d) returned 0x727f330 [0086.020] SetFilePointerEx (in: hFile=0x1478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.021] WriteFile (in: hFile=0x1478, lpBuffer=0x74393f8*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0x207ffd20, lpOverlapped=0x0 | out: lpBuffer=0x74393f8*, lpNumberOfBytesWritten=0x207ffd20*=0x101, lpOverlapped=0x0) returned 1 [0089.330] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74393f8) returned 1 [0089.331] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x727f6c8) returned 1 [0089.331] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x727f510) returned 1 [0089.331] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x727f330) returned 1 [0089.331] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x727f448) returned 1 [0091.523] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee7d0) returned 1 [0091.523] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee528) returned 1 [0091.523] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee578) returned 1 [0091.523] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x82) returned 0x549dc28 [0091.523] wcscpy (in: _Dest=0x549dc28, _Source="C:\\Users\\FD1HVy\\Desktop\\MOTB.wav" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\MOTB.wav") returned="C:\\Users\\FD1HVy\\Desktop\\MOTB.wav" [0091.523] wcscat (in: _Dest=0x549dc28, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\MOTB.wav.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\Desktop\\MOTB.wav.mailto[knoocknoo@cock.li].a0a70" [0091.523] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\Desktop\\MOTB.wav.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x207ffcd8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\Desktop\\MOTB.wav.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0091.523] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x98) returned 0x55c5998 Thread: id = 874 os_tid = 0x14a4 [0079.567] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Q6neBp9.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\q6nebp9.mp3")) returned 0x20 [0079.567] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Q6neBp9.mp3", dwFileAttributes=0x20) returned 1 [0079.567] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Q6neBp9.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\q6nebp9.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x147c [0079.567] GetFileSizeEx (in: hFile=0x147c, lpFileSize=0x2087f7cc | out: lpFileSize=0x2087f7cc*=23335) returned 1 [0079.567] SetFilePointerEx (in: hFile=0x147c, liDistanceToMove=0x5b23, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.567] ReadFile (in: hFile=0x147c, lpBuffer=0x2087f750, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2087f74c, lpOverlapped=0x0 | out: lpBuffer=0x2087f750*, lpNumberOfBytesRead=0x2087f74c*=0x4, lpOverlapped=0x0) returned 1 [0079.568] SetFilePointerEx (in: hFile=0x147c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.568] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee6b8 [0079.568] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee7f8 [0079.568] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee550 [0079.568] NtQuerySystemTime (in: CurrentTime=0x2087f72c | out: CurrentTime=0x2087f72c*=132260136367331734) returned 0x0 [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0xe7ff48ff [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0x68b509c8 [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0x5a4674ce [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0x6a071fa2 [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0x8173b357 [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0x662cb88f [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0x6ae6e236 [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0x43159d66 [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0x8f7a88ce [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0xe75e30fd [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0x6945e603 [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0xf8f3f73 [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0x9d3f89e8 [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0x2942fc73 [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0x5f48e36e [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0xc311ca62 [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0xc0788d69 [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0x68e7e1eb [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0x25f64cfd [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0x8c4a5085 [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0xdb164885 [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0xbacbe957 [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0xc63006e8 [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0x7f00eb0 [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0x5328bd1b [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0xf725508f [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0x362a1164 [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0x3d2af551 [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0x32a88b07 [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0x33e96f3b [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0x60c56e09 [0079.568] RtlRandom (in: Seed=0x2087f738 | out: Seed=0x2087f738) returned 0x8441b1a0 [0079.579] ReadFile (in: hFile=0x147c, lpBuffer=0x718ba40, nNumberOfBytesToRead=0x5b27, lpNumberOfBytesRead=0x2087f728, lpOverlapped=0x0 | out: lpBuffer=0x718ba40*, lpNumberOfBytesRead=0x2087f728*=0x5b27, lpOverlapped=0x0) returned 1 [0079.579] SetFilePointerEx (in: hFile=0x147c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.579] WriteFile (in: hFile=0x147c, lpBuffer=0x7198248*, nNumberOfBytesToWrite=0x5b27, lpNumberOfBytesWritten=0x2087f724, lpOverlapped=0x0 | out: lpBuffer=0x7198248*, lpNumberOfBytesWritten=0x2087f724*=0x5b27, lpOverlapped=0x0) returned 1 [0082.336] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x727d8e8 [0086.012] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x727d9b0 [0086.012] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x727d9b0) returned 1 [0086.012] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7198248) returned 1 [0086.012] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x718ba40) returned 1 [0086.012] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eed5e8) returned 1 [0086.012] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537ba70) returned 1 [0086.012] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x23) returned 0x38a69d0 [0086.012] SetFilePointerEx (in: hFile=0x147c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.012] WriteFile (in: hFile=0x147c, lpBuffer=0x743a460*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x2087f78c, lpOverlapped=0x0 | out: lpBuffer=0x743a460*, lpNumberOfBytesWritten=0x2087f78c*=0x107, lpOverlapped=0x0) returned 1 [0089.332] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x743a460) returned 1 [0089.332] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6b50) returned 1 [0089.332] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x727d9d8) returned 1 [0089.332] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a69d0) returned 1 [0089.332] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x727d8e8) returned 1 [0091.522] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee7f8) returned 1 [0091.522] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee5a0) returned 1 [0091.522] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee5c8) returned 1 [0091.523] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x88) returned 0x549db98 [0091.523] wcscpy (in: _Dest=0x549db98, _Source="C:\\Users\\FD1HVy\\Desktop\\Q6neBp9.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\Q6neBp9.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\Q6neBp9.mp3" [0091.523] wcscat (in: _Dest=0x549db98, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\Q6neBp9.mp3.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\Desktop\\Q6neBp9.mp3.mailto[knoocknoo@cock.li].a0a70" [0091.523] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\Desktop\\Q6neBp9.mp3.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x2087f744, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\Desktop\\Q6neBp9.mp3.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0091.523] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9e) returned 0x38ac100 Thread: id = 875 os_tid = 0x14ac [0079.580] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\rSTGLb40SzTKhhfO.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\rstglb40sztkhhfo.gif")) returned 0x20 [0079.580] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\rSTGLb40SzTKhhfO.gif", dwFileAttributes=0x20) returned 1 [0079.580] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\rSTGLb40SzTKhhfO.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\rstglb40sztkhhfo.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1480 [0079.580] GetFileSizeEx (in: hFile=0x1480, lpFileSize=0x208ff8e8 | out: lpFileSize=0x208ff8e8*=32233) returned 1 [0079.580] SetFilePointerEx (in: hFile=0x1480, liDistanceToMove=0x7de5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.580] ReadFile (in: hFile=0x1480, lpBuffer=0x208ff86c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x208ff868, lpOverlapped=0x0 | out: lpBuffer=0x208ff86c*, lpNumberOfBytesRead=0x208ff868*=0x4, lpOverlapped=0x0) returned 1 [0079.580] SetFilePointerEx (in: hFile=0x1480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.580] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee6b8 [0079.580] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee320 [0079.581] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee550 [0079.581] NtQuerySystemTime (in: CurrentTime=0x208ff848 | out: CurrentTime=0x208ff848*=132260136367331734) returned 0x0 [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0x757936db [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0x8fc0fb1c [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0x567896a4 [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0x24e7bcbb [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0xdfe3687b [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0xdd5c8a5b [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0xdad34f12 [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0xf6d9a3c9 [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0x5ac95f07 [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0xd63f6989 [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0x596cec21 [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0x922d8ab0 [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0x8afd5472 [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0x624e7271 [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0x5e670e17 [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0x5a571c9 [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0x45130738 [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0xc08f2c4c [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0x41f094cc [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0xfc169d9e [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0x22eae24e [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0xb414ba00 [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0x90f3ebb6 [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0x41158853 [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0xcb5d9413 [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0x4d0a25b9 [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0xb40c84c6 [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0xa186ea69 [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0xc90e34bc [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0xcc43eff6 [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0x5248ba0a [0079.581] RtlRandom (in: Seed=0x208ff854 | out: Seed=0x208ff854) returned 0x1f5d4116 [0079.592] ReadFile (in: hFile=0x1480, lpBuffer=0x71a4a50, nNumberOfBytesToRead=0x7de9, lpNumberOfBytesRead=0x208ff844, lpOverlapped=0x0 | out: lpBuffer=0x71a4a50*, lpNumberOfBytesRead=0x208ff844*=0x7de9, lpOverlapped=0x0) returned 1 [0079.593] SetFilePointerEx (in: hFile=0x1480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.593] WriteFile (in: hFile=0x1480, lpBuffer=0x71b1258*, nNumberOfBytesToWrite=0x7de9, lpNumberOfBytesWritten=0x208ff840, lpOverlapped=0x0 | out: lpBuffer=0x71b1258*, lpNumberOfBytesWritten=0x208ff840*=0x7de9, lpOverlapped=0x0) returned 1 [0082.334] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x727ee18 [0086.013] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x727f070 [0086.013] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x727f070) returned 1 [0086.013] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x71b1258) returned 1 [0086.019] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x71a4a50) returned 1 [0086.019] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eed660) returned 1 [0086.020] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537bb90) returned 1 [0086.020] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x35) returned 0x389f280 [0086.020] SetFilePointerEx (in: hFile=0x1480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.020] WriteFile (in: hFile=0x1480, lpBuffer=0x54bcce0*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x208ff8a8, lpOverlapped=0x0 | out: lpBuffer=0x54bcce0*, lpNumberOfBytesWritten=0x208ff8a8*=0x119, lpOverlapped=0x0) returned 1 [0089.328] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bcce0) returned 1 [0089.328] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389ef00) returned 1 [0089.328] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x727eee0) returned 1 [0089.328] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f280) returned 1 [0089.328] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x727ee18) returned 1 [0089.328] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee320) returned 1 [0089.328] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee5f0) returned 1 [0089.328] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee618) returned 1 [0089.328] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9a) returned 0x54a2a30 [0089.328] wcscpy (in: _Dest=0x54a2a30, _Source="C:\\Users\\FD1HVy\\Desktop\\rSTGLb40SzTKhhfO.gif" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\rSTGLb40SzTKhhfO.gif") returned="C:\\Users\\FD1HVy\\Desktop\\rSTGLb40SzTKhhfO.gif" [0089.328] wcscat (in: _Dest=0x54a2a30, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\rSTGLb40SzTKhhfO.gif.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\Desktop\\rSTGLb40SzTKhhfO.gif.mailto[knoocknoo@cock.li].a0a70" [0089.328] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\Desktop\\rSTGLb40SzTKhhfO.gif.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x208ff860, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\Desktop\\rSTGLb40SzTKhhfO.gif.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.328] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x55c8da0 Thread: id = 876 os_tid = 0x14b0 [0079.593] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\T6vFQ-8_OByh97WPG8n.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\t6vfq-8_obyh97wpg8n.mp4")) returned 0x20 [0079.593] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\T6vFQ-8_OByh97WPG8n.mp4", dwFileAttributes=0x20) returned 1 [0079.593] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\T6vFQ-8_OByh97WPG8n.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\t6vfq-8_obyh97wpg8n.mp4"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1484 [0079.594] GetFileSizeEx (in: hFile=0x1484, lpFileSize=0x2097f854 | out: lpFileSize=0x2097f854*=1723) returned 1 [0079.594] SetFilePointerEx (in: hFile=0x1484, liDistanceToMove=0x6b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.594] ReadFile (in: hFile=0x1484, lpBuffer=0x2097f7d8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2097f7d4, lpOverlapped=0x0 | out: lpBuffer=0x2097f7d8*, lpNumberOfBytesRead=0x2097f7d4*=0x4, lpOverlapped=0x0) returned 1 [0079.594] SetFilePointerEx (in: hFile=0x1484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.594] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee6b8 [0079.594] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee348 [0079.594] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee550 [0079.594] NtQuerySystemTime (in: CurrentTime=0x2097f7b4 | out: CurrentTime=0x2097f7b4*=132260136367473284) returned 0x0 [0079.594] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0x521f89d5 [0079.594] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0xf0d0457e [0079.594] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0x7b1ab5cd [0079.594] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0x517bc20a [0079.594] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0x241015cb [0079.594] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0x5daf59 [0079.594] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0xeead8515 [0079.594] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0x6c00095e [0079.594] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0x7e3fec3f [0079.594] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0x6f360feb [0079.594] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0x2bd1c6f0 [0079.594] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0xe11c3c2d [0079.594] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0x2b166af0 [0079.594] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0x732b90ea [0079.594] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0x2f74234a [0079.594] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0xf7c44633 [0079.594] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0x84aa0852 [0079.594] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0x65f15a7f [0079.594] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0xd5ed1b69 [0079.594] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0x2ccd1b82 [0079.594] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0xba0899ce [0079.594] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0xdf1c3b36 [0079.594] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0xcb5f7d59 [0079.594] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0x161e1a16 [0079.594] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0x76f5e346 [0079.594] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0x47c3d5e9 [0079.594] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0x25210c52 [0079.594] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0x2b7f8fcb [0079.595] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0x137f812 [0079.595] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0xf436d405 [0079.595] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0x51012298 [0079.595] RtlRandom (in: Seed=0x2097f7c0 | out: Seed=0x2097f7c0) returned 0xb2a19c6d [0079.606] ReadFile (in: hFile=0x1484, lpBuffer=0x71bda60, nNumberOfBytesToRead=0x6bb, lpNumberOfBytesRead=0x2097f7b0, lpOverlapped=0x0 | out: lpBuffer=0x71bda60*, lpNumberOfBytesRead=0x2097f7b0*=0x6bb, lpOverlapped=0x0) returned 1 [0079.606] SetFilePointerEx (in: hFile=0x1484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.606] WriteFile (in: hFile=0x1484, lpBuffer=0x71ca268*, nNumberOfBytesToWrite=0x6bb, lpNumberOfBytesWritten=0x2097f7ac, lpOverlapped=0x0 | out: lpBuffer=0x71ca268*, lpNumberOfBytesWritten=0x2097f7ac*=0x6bb, lpOverlapped=0x0) returned 1 [0082.336] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x727c818 [0086.012] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x727c980 [0086.012] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x727c980) returned 1 [0086.012] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x71ca268) returned 1 [0086.012] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x71bda60) returned 1 [0086.012] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eed750) returned 1 [0086.012] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537bcb0) returned 1 [0086.012] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3b) returned 0x5ba8b10 [0086.012] SetFilePointerEx (in: hFile=0x1484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.012] WriteFile (in: hFile=0x1484, lpBuffer=0x54bca90*, nNumberOfBytesToWrite=0x11f, lpNumberOfBytesWritten=0x2097f814, lpOverlapped=0x0 | out: lpBuffer=0x54bca90*, lpNumberOfBytesWritten=0x2097f814*=0x11f, lpOverlapped=0x0) returned 1 [0089.325] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bca90) returned 1 [0089.325] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8b58) returned 1 [0089.325] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x727c9d0) returned 1 [0089.325] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8b10) returned 1 [0089.325] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x727c818) returned 1 [0091.525] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee348) returned 1 [0091.525] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee640) returned 1 [0091.525] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee668) returned 1 [0091.525] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa0) returned 0x38ac4f0 [0091.525] wcscpy (in: _Dest=0x38ac4f0, _Source="C:\\Users\\FD1HVy\\Desktop\\T6vFQ-8_OByh97WPG8n.mp4" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\T6vFQ-8_OByh97WPG8n.mp4") returned="C:\\Users\\FD1HVy\\Desktop\\T6vFQ-8_OByh97WPG8n.mp4" [0091.525] wcscat (in: _Dest=0x38ac4f0, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\T6vFQ-8_OByh97WPG8n.mp4.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\Desktop\\T6vFQ-8_OByh97WPG8n.mp4.mailto[knoocknoo@cock.li].a0a70" [0091.525] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\Desktop\\T6vFQ-8_OByh97WPG8n.mp4.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x2097f7cc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\Desktop\\T6vFQ-8_OByh97WPG8n.mp4.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0091.525] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb6) returned 0x5b16490 Thread: id = 877 os_tid = 0x14b4 [0079.606] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\TvaZaKnck05q.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\tvazaknck05q.mp3")) returned 0x20 [0079.607] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\TvaZaKnck05q.mp3", dwFileAttributes=0x20) returned 1 [0079.607] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\TvaZaKnck05q.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\tvazaknck05q.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1488 [0079.607] GetFileSizeEx (in: hFile=0x1488, lpFileSize=0x209ffae4 | out: lpFileSize=0x209ffae4*=40838) returned 1 [0079.607] SetFilePointerEx (in: hFile=0x1488, liDistanceToMove=0x9f82, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.607] ReadFile (in: hFile=0x1488, lpBuffer=0x209ffa68, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x209ffa64, lpOverlapped=0x0 | out: lpBuffer=0x209ffa68*, lpNumberOfBytesRead=0x209ffa64*=0x4, lpOverlapped=0x0) returned 1 [0079.607] SetFilePointerEx (in: hFile=0x1488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.607] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee6b8 [0079.607] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee370 [0079.607] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee550 [0079.607] NtQuerySystemTime (in: CurrentTime=0x209ffa44 | out: CurrentTime=0x209ffa44*=132260136367630148) returned 0x0 [0079.607] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0xa9a606c7 [0079.607] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0x4dc2d3a [0079.607] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0xe57b434e [0079.607] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0x651e607a [0079.607] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0xfb36ac81 [0079.607] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0xc8ed96cb [0079.607] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0x1e034e31 [0079.607] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0xf073b37f [0079.607] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0x9e20929f [0079.607] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0x46caed23 [0079.607] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0xfacde493 [0079.608] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0xeda1e9bc [0079.608] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0xfe77a25c [0079.608] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0x1858e619 [0079.608] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0x2fa7493c [0079.608] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0xd6013a25 [0079.608] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0x2687c5ab [0079.608] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0x1f44903d [0079.608] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0x3b01e6e8 [0079.608] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0xa22385b5 [0079.608] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0xbc28a077 [0079.608] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0x89004b04 [0079.608] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0x7afc03c0 [0079.608] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0xccfd9fc8 [0079.608] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0xb4993123 [0079.608] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0x86a384d1 [0079.608] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0xfa661658 [0079.608] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0x6303e937 [0079.608] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0xc0fdaa44 [0079.608] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0xbd6a2f94 [0079.608] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0x3edc7552 [0079.608] RtlRandom (in: Seed=0x209ffa50 | out: Seed=0x209ffa50) returned 0x3528f14c [0079.618] ReadFile (in: hFile=0x1488, lpBuffer=0x71d6a70, nNumberOfBytesToRead=0x9f86, lpNumberOfBytesRead=0x209ffa40, lpOverlapped=0x0 | out: lpBuffer=0x71d6a70*, lpNumberOfBytesRead=0x209ffa40*=0x9f86, lpOverlapped=0x0) returned 1 [0079.620] SetFilePointerEx (in: hFile=0x1488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.620] WriteFile (in: hFile=0x1488, lpBuffer=0x71e3278*, nNumberOfBytesToWrite=0x9f86, lpNumberOfBytesWritten=0x209ffa3c, lpOverlapped=0x0 | out: lpBuffer=0x71e3278*, lpNumberOfBytesWritten=0x209ffa3c*=0x9f86, lpOverlapped=0x0) returned 1 [0082.338] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x727b8d8 [0086.011] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x727bc70 [0086.011] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x727bc70) returned 1 [0086.011] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x71e3278) returned 1 [0086.011] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x71d6a70) returned 1 [0086.011] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eed7c8) returned 1 [0086.011] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537bd40) returned 1 [0086.011] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2d) returned 0x38b4268 [0086.011] SetFilePointerEx (in: hFile=0x1488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.011] WriteFile (in: hFile=0x1488, lpBuffer=0x54bc968*, nNumberOfBytesToWrite=0x111, lpNumberOfBytesWritten=0x209ffaa4, lpOverlapped=0x0 | out: lpBuffer=0x54bc968*, lpNumberOfBytesWritten=0x209ffaa4*=0x111, lpOverlapped=0x0) returned 1 [0089.324] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bc968) returned 1 [0089.324] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b42a0) returned 1 [0089.324] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x727b9c8) returned 1 [0089.324] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b4268) returned 1 [0089.324] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x727b8d8) returned 1 [0091.525] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee370) returned 1 [0091.525] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee690) returned 1 [0091.525] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee6e0) returned 1 [0091.525] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x92) returned 0x55c5e98 [0091.525] wcscpy (in: _Dest=0x55c5e98, _Source="C:\\Users\\FD1HVy\\Desktop\\TvaZaKnck05q.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\TvaZaKnck05q.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\TvaZaKnck05q.mp3" [0091.525] wcscat (in: _Dest=0x55c5e98, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\TvaZaKnck05q.mp3.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\Desktop\\TvaZaKnck05q.mp3.mailto[knoocknoo@cock.li].a0a70" [0091.525] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\Desktop\\TvaZaKnck05q.mp3.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x209ffa5c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\Desktop\\TvaZaKnck05q.mp3.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0091.525] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa8) returned 0x388f3b0 Thread: id = 878 os_tid = 0x1554 [0079.620] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\TWTBg90RE6bO.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\twtbg90re6bo.m4a")) returned 0x20 [0079.621] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\TWTBg90RE6bO.m4a", dwFileAttributes=0x20) returned 1 [0079.621] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\TWTBg90RE6bO.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\twtbg90re6bo.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x148c [0079.621] GetFileSizeEx (in: hFile=0x148c, lpFileSize=0x20a7f95c | out: lpFileSize=0x20a7f95c*=89516) returned 1 [0079.621] SetFilePointerEx (in: hFile=0x148c, liDistanceToMove=0x15da8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.621] ReadFile (in: hFile=0x148c, lpBuffer=0x20a7f8e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x20a7f8dc, lpOverlapped=0x0 | out: lpBuffer=0x20a7f8e0*, lpNumberOfBytesRead=0x20a7f8dc*=0x4, lpOverlapped=0x0) returned 1 [0079.621] SetFilePointerEx (in: hFile=0x148c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.621] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee6b8 [0079.621] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee398 [0079.621] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee550 [0079.621] NtQuerySystemTime (in: CurrentTime=0x20a7f8bc | out: CurrentTime=0x20a7f8bc*=132260136367792784) returned 0x0 [0079.621] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0xe0be128f [0079.621] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0xedc87070 [0079.621] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0x127decca [0079.621] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0x6962cd16 [0079.621] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0xf2665c71 [0079.621] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0x6c65f639 [0079.621] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0xc314917 [0079.621] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0x9820a68 [0079.621] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0x6500ac28 [0079.621] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0x681d7e0f [0079.621] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0xc51c3b2f [0079.621] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0xd58be284 [0079.621] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0x84afdbc0 [0079.621] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0x389b9ec9 [0079.621] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0xd427b9dc [0079.621] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0xb10447da [0079.622] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0xda254c83 [0079.622] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0x64aa0c87 [0079.622] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0x2fb901a [0079.622] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0x13c2689b [0079.622] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0xa8174f82 [0079.622] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0xb52089cb [0079.622] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0x7651ca93 [0079.622] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0xba4bd07a [0079.622] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0x3cfba7b4 [0079.622] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0xfdbd2ff8 [0079.622] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0x95614924 [0079.622] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0x129f385b [0079.622] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0x8c48ac90 [0079.622] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0xfc14a11c [0079.622] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0x4071718c [0079.622] RtlRandom (in: Seed=0x20a7f8c8 | out: Seed=0x20a7f8c8) returned 0xf23a280b [0079.632] SetFilePointerEx (in: hFile=0x148c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.632] ReadFile (in: hFile=0x148c, lpBuffer=0x71efa80, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x20a7f89c, lpOverlapped=0x0 | out: lpBuffer=0x71efa80*, lpNumberOfBytesRead=0x20a7f89c*=0xc800, lpOverlapped=0x0) returned 1 [0079.632] SetFilePointerEx (in: hFile=0x148c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.632] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x537bd88 [0079.632] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5eed840 [0079.632] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee550 [0079.632] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee550) returned 1 [0079.633] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x71fc288 [0079.637] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee3e8 [0079.637] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee3c0 [0079.637] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee3c0) returned 1 [0079.637] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eed840) returned 1 [0079.637] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537bd88) returned 1 [0079.637] WriteFile (in: hFile=0x148c, lpBuffer=0x71fc288*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x20a7f89c, lpOverlapped=0x0 | out: lpBuffer=0x71fc288*, lpNumberOfBytesWritten=0x20a7f89c*=0xc800, lpOverlapped=0x0) returned 1 [0082.339] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x71fc288) returned 1 [0086.011] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x71efa80) returned 1 [0086.011] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2d) returned 0x38b41f8 [0086.011] SetFilePointerEx (in: hFile=0x148c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.011] WriteFile (in: hFile=0x148c, lpBuffer=0x54bc840*, nNumberOfBytesToWrite=0x111, lpNumberOfBytesWritten=0x20a7f91c, lpOverlapped=0x0 | out: lpBuffer=0x54bc840*, lpNumberOfBytesWritten=0x20a7f91c*=0x111, lpOverlapped=0x0) returned 1 [0089.322] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bc840) returned 1 [0089.322] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b4230) returned 1 [0089.322] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7304d58) returned 1 [0091.526] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b41f8) returned 1 [0091.526] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee3e8) returned 1 [0091.526] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee398) returned 1 [0091.526] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee708) returned 1 [0091.526] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee730) returned 1 [0091.526] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x92) returned 0x55c5178 [0091.526] wcscpy (in: _Dest=0x55c5178, _Source="C:\\Users\\FD1HVy\\Desktop\\TWTBg90RE6bO.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\TWTBg90RE6bO.m4a") returned="C:\\Users\\FD1HVy\\Desktop\\TWTBg90RE6bO.m4a" [0091.526] wcscat (in: _Dest=0x55c5178, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\TWTBg90RE6bO.m4a.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\Desktop\\TWTBg90RE6bO.m4a.mailto[knoocknoo@cock.li].a0a70" [0091.526] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\Desktop\\TWTBg90RE6bO.m4a.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x20a7f8d4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\Desktop\\TWTBg90RE6bO.m4a.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0091.526] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa8) returned 0x388ec20 Thread: id = 879 os_tid = 0x15c8 [0079.638] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ugpXae-w 2NSYG_.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\ugpxae-w 2nsyg_.wav")) returned 0x20 [0079.638] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ugpXae-w 2NSYG_.wav", dwFileAttributes=0x20) returned 1 [0079.638] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ugpXae-w 2NSYG_.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\ugpxae-w 2nsyg_.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1490 [0079.638] GetFileSizeEx (in: hFile=0x1490, lpFileSize=0x20affe4c | out: lpFileSize=0x20affe4c*=19075) returned 1 [0079.638] SetFilePointerEx (in: hFile=0x1490, liDistanceToMove=0x4a7f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.638] ReadFile (in: hFile=0x1490, lpBuffer=0x20affdd0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x20affdcc, lpOverlapped=0x0 | out: lpBuffer=0x20affdd0*, lpNumberOfBytesRead=0x20affdcc*=0x4, lpOverlapped=0x0) returned 1 [0079.638] SetFilePointerEx (in: hFile=0x1490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.638] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee6b8 [0079.638] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee3c0 [0079.638] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee550 [0079.638] NtQuerySystemTime (in: CurrentTime=0x20affdac | out: CurrentTime=0x20affdac*=132260136367942541) returned 0x0 [0079.638] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0x20d35e1b [0079.638] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0xfeef2a64 [0079.638] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0xe93c0350 [0079.638] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0x4f7f66ea [0079.638] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0x29b00b67 [0079.638] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0x416d1118 [0079.638] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0x2e9dcd3a [0079.638] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0x55b6b4ec [0079.638] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0x639ea5bd [0079.638] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0xe631b890 [0079.638] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0x5f541c32 [0079.638] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0x957cf73b [0079.639] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0x69f3ffa0 [0079.639] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0x363a8c24 [0079.639] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0x2e0f4715 [0079.639] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0xc30bf859 [0079.639] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0xb7d69663 [0079.639] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0x2d1b2f42 [0079.639] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0xf30386ef [0079.639] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0x97f3836f [0079.639] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0x9c5133d2 [0079.639] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0x2b9a3fb4 [0079.639] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0xbca7886d [0079.639] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0x95149eaf [0079.639] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0x3c03d704 [0079.639] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0xf4ae15c8 [0079.639] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0xe22b2d9c [0079.639] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0x52052ccd [0079.639] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0x46f6e929 [0079.639] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0x13bebbc0 [0079.639] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0x46d96a3b [0079.639] RtlRandom (in: Seed=0x20affdb8 | out: Seed=0x20affdb8) returned 0x91cea9ce [0079.649] ReadFile (in: hFile=0x1490, lpBuffer=0x7208a90, nNumberOfBytesToRead=0x4a83, lpNumberOfBytesRead=0x20affda8, lpOverlapped=0x0 | out: lpBuffer=0x7208a90*, lpNumberOfBytesRead=0x20affda8*=0x4a83, lpOverlapped=0x0) returned 1 [0079.650] SetFilePointerEx (in: hFile=0x1490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.650] WriteFile (in: hFile=0x1490, lpBuffer=0x7215298*, nNumberOfBytesToWrite=0x4a83, lpNumberOfBytesWritten=0x20affda4, lpOverlapped=0x0 | out: lpBuffer=0x7215298*, lpNumberOfBytesWritten=0x20affda4*=0x4a83, lpOverlapped=0x0) returned 1 [0082.469] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7304d80 [0086.010] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7304f60 [0086.010] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7304f60) returned 1 [0086.010] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7215298) returned 1 [0086.010] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7208a90) returned 1 [0086.010] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eed840) returned 1 [0086.010] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537bd88) returned 1 [0086.010] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x33) returned 0x389f400 [0086.011] SetFilePointerEx (in: hFile=0x1490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.011] WriteFile (in: hFile=0x1490, lpBuffer=0x54bd3d0*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0x20affe0c, lpOverlapped=0x0 | out: lpBuffer=0x54bd3d0*, lpNumberOfBytesWritten=0x20affe0c*=0x117, lpOverlapped=0x0) returned 1 [0089.318] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bd3d0) returned 1 [0089.318] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f640) returned 1 [0089.318] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7304e98) returned 1 [0089.318] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f400) returned 1 [0089.318] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7304d80) returned 1 [0089.318] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee3c0) returned 1 [0089.319] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee758) returned 1 [0089.319] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee780) returned 1 [0089.319] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x98) returned 0x55c5ad8 [0089.319] wcscpy (in: _Dest=0x55c5ad8, _Source="C:\\Users\\FD1HVy\\Desktop\\ugpXae-w 2NSYG_.wav" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ugpXae-w 2NSYG_.wav") returned="C:\\Users\\FD1HVy\\Desktop\\ugpXae-w 2NSYG_.wav" [0089.319] wcscat (in: _Dest=0x55c5ad8, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ugpXae-w 2NSYG_.wav.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\Desktop\\ugpXae-w 2NSYG_.wav.mailto[knoocknoo@cock.li].a0a70" [0089.319] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\Desktop\\ugpXae-w 2NSYG_.wav.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x20affdc4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\Desktop\\ugpXae-w 2NSYG_.wav.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.319] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xae) returned 0x55c8ce8 Thread: id = 880 os_tid = 0x15d4 [0079.650] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\UTlC-SqWY_RcPFlrdtX9.png" (normalized: "c:\\users\\fd1hvy\\desktop\\utlc-sqwy_rcpflrdtx9.png")) returned 0x20 [0079.651] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\UTlC-SqWY_RcPFlrdtX9.png", dwFileAttributes=0x20) returned 1 [0079.651] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\UTlC-SqWY_RcPFlrdtX9.png" (normalized: "c:\\users\\fd1hvy\\desktop\\utlc-sqwy_rcpflrdtx9.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1494 [0079.651] GetFileSizeEx (in: hFile=0x1494, lpFileSize=0x20b7f800 | out: lpFileSize=0x20b7f800*=21023) returned 1 [0079.651] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0x521b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.651] ReadFile (in: hFile=0x1494, lpBuffer=0x20b7f784, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x20b7f780, lpOverlapped=0x0 | out: lpBuffer=0x20b7f784*, lpNumberOfBytesRead=0x20b7f780*=0x4, lpOverlapped=0x0) returned 1 [0079.651] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.651] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee6b8 [0079.651] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee410 [0079.651] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee550 [0079.651] NtQuerySystemTime (in: CurrentTime=0x20b7f760 | out: CurrentTime=0x20b7f760*=132260136368098767) returned 0x0 [0079.651] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0xcbbf9e19 [0079.651] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0x35cbcaa4 [0079.651] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0x86eb0d3e [0079.651] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0xd9b5170d [0079.651] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0x828619ae [0079.651] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0x340b521d [0079.651] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0x6e7bcd9a [0079.651] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0xadfbca96 [0079.651] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0x2d5c64b6 [0079.651] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0x8004f53c [0079.651] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0x2ae8dc1a [0079.651] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0x6fcd687a [0079.651] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0x86eb3d12 [0079.651] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0x515ebae9 [0079.651] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0x380b7e54 [0079.651] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0x312c8505 [0079.651] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0x7427137e [0079.651] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0xdd5c07da [0079.652] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0xc0c01b18 [0079.652] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0xc9ec58a2 [0079.652] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0xa4925160 [0079.652] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0x43ecd57e [0079.652] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0x1e5f8414 [0079.652] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0x83ecd954 [0079.652] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0x79ff494a [0079.652] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0xce50c25d [0079.652] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0xf3b6d6b2 [0079.652] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0x305359fd [0079.652] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0x3954fa5 [0079.652] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0x6da0af3a [0079.652] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0xdebd04d2 [0079.652] RtlRandom (in: Seed=0x20b7f76c | out: Seed=0x20b7f76c) returned 0x96e80426 [0079.707] ReadFile (in: hFile=0x1494, lpBuffer=0x7221aa0, nNumberOfBytesToRead=0x521f, lpNumberOfBytesRead=0x20b7f75c, lpOverlapped=0x0 | out: lpBuffer=0x7221aa0*, lpNumberOfBytesRead=0x20b7f75c*=0x521f, lpOverlapped=0x0) returned 1 [0079.708] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.708] WriteFile (in: hFile=0x1494, lpBuffer=0x722e2a8*, nNumberOfBytesToWrite=0x521f, lpNumberOfBytesWritten=0x20b7f758, lpOverlapped=0x0 | out: lpBuffer=0x722e2a8*, lpNumberOfBytesWritten=0x20b7f758*=0x521f, lpOverlapped=0x0) returned 1 [0082.486] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x766b148 [0086.008] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x766b3a0 [0086.009] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x766b3a0) returned 1 [0086.009] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x722e2a8) returned 1 [0086.009] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7221aa0) returned 1 [0086.009] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eed8b8) returned 1 [0086.009] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537bdd0) returned 1 [0086.009] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3d) returned 0x5ba89f0 [0086.009] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.009] WriteFile (in: hFile=0x1494, lpBuffer=0x7587528*, nNumberOfBytesToWrite=0x121, lpNumberOfBytesWritten=0x20b7f7c0, lpOverlapped=0x0 | out: lpBuffer=0x7587528*, lpNumberOfBytesWritten=0x20b7f7c0*=0x121, lpOverlapped=0x0) returned 1 [0089.320] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7587528) returned 1 [0089.320] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8a80) returned 1 [0089.320] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x766b120) returned 1 [0089.320] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba89f0) returned 1 [0089.320] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x766b148) returned 1 [0091.526] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee410) returned 1 [0091.526] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee438) returned 1 [0091.526] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee460) returned 1 [0091.526] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa2) returned 0x388dd00 [0091.526] wcscpy (in: _Dest=0x388dd00, _Source="C:\\Users\\FD1HVy\\Desktop\\UTlC-SqWY_RcPFlrdtX9.png" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\UTlC-SqWY_RcPFlrdtX9.png") returned="C:\\Users\\FD1HVy\\Desktop\\UTlC-SqWY_RcPFlrdtX9.png" [0091.526] wcscat (in: _Dest=0x388dd00, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\UTlC-SqWY_RcPFlrdtX9.png.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\Desktop\\UTlC-SqWY_RcPFlrdtX9.png.mailto[knoocknoo@cock.li].a0a70" [0091.527] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\Desktop\\UTlC-SqWY_RcPFlrdtX9.png.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x20b7f778, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\Desktop\\UTlC-SqWY_RcPFlrdtX9.png.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0091.527] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb8) returned 0x5b16550 Thread: id = 881 os_tid = 0x1750 [0079.709] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vdQMRI5Mhw6nRn2.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\vdqmri5mhw6nrn2.mp3")) returned 0x20 [0079.709] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vdQMRI5Mhw6nRn2.mp3", dwFileAttributes=0x20) returned 1 [0079.709] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vdQMRI5Mhw6nRn2.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\vdqmri5mhw6nrn2.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1498 [0079.709] GetFileSizeEx (in: hFile=0x1498, lpFileSize=0x20bff798 | out: lpFileSize=0x20bff798*=1783) returned 1 [0079.709] SetFilePointerEx (in: hFile=0x1498, liDistanceToMove=0x6f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.709] ReadFile (in: hFile=0x1498, lpBuffer=0x20bff71c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x20bff718, lpOverlapped=0x0 | out: lpBuffer=0x20bff71c*, lpNumberOfBytesRead=0x20bff718*=0x4, lpOverlapped=0x0) returned 1 [0079.709] SetFilePointerEx (in: hFile=0x1498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.709] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee6b8 [0079.709] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x5eee550 [0079.709] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x55c9fd0 [0079.709] NtQuerySystemTime (in: CurrentTime=0x20bff6f8 | out: CurrentTime=0x20bff6f8*=132260136368723707) returned 0x0 [0079.709] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0x827d9f21 [0079.709] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0x2c5dc474 [0079.709] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0xdd6b4f5b [0079.710] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0x83ff882e [0079.710] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0xcb3c146 [0079.710] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0x425bd3f0 [0079.710] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0xea436b0e [0079.710] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0x3c77cf69 [0079.710] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0x2119388a [0079.710] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0xc843505d [0079.710] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0x961dec50 [0079.710] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0x2863f6e4 [0079.710] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0x977b56e9 [0079.710] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0x999d7482 [0079.710] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0x418c0c3a [0079.710] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0x8edcca9e [0079.710] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0xbe0a104a [0079.710] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0xbfdf94fd [0079.710] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0xbb2b07b8 [0079.710] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0xa155bced [0079.710] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0x7ef918f5 [0079.710] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0x48c9e976 [0079.710] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0x5ec8a801 [0079.710] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0x55c79913 [0079.710] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0x6afc85ff [0079.710] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0x8576b6bf [0079.710] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0x479e27c1 [0079.710] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0x3e64cfc6 [0079.710] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0xadd815b6 [0079.710] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0x1e16be86 [0079.710] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0x7d7157d2 [0079.710] RtlRandom (in: Seed=0x20bff704 | out: Seed=0x20bff704) returned 0x52dcd2a1 [0079.720] ReadFile (in: hFile=0x1498, lpBuffer=0x723aab0, nNumberOfBytesToRead=0x6f7, lpNumberOfBytesRead=0x20bff6f4, lpOverlapped=0x0 | out: lpBuffer=0x723aab0*, lpNumberOfBytesRead=0x20bff6f4*=0x6f7, lpOverlapped=0x0) returned 1 [0079.720] SetFilePointerEx (in: hFile=0x1498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.720] WriteFile (in: hFile=0x1498, lpBuffer=0x72472b8*, nNumberOfBytesToWrite=0x6f7, lpNumberOfBytesWritten=0x20bff6f0, lpOverlapped=0x0 | out: lpBuffer=0x72472b8*, lpNumberOfBytesWritten=0x20bff6f0*=0x6f7, lpOverlapped=0x0) returned 1 [0082.485] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x766d180 [0086.010] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x766cf28 [0086.010] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x766cf28) returned 1 [0086.010] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x72472b8) returned 1 [0086.010] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x723aab0) returned 1 [0086.010] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eed930) returned 1 [0086.010] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537be18) returned 1 [0086.010] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x33) returned 0x389ef80 [0086.010] SetFilePointerEx (in: hFile=0x1498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.010] WriteFile (in: hFile=0x1498, lpBuffer=0x54bd620*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0x20bff758, lpOverlapped=0x0 | out: lpBuffer=0x54bd620*, lpNumberOfBytesWritten=0x20bff758*=0x117, lpOverlapped=0x0) returned 1 [0089.318] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bd620) returned 1 [0089.318] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389f680) returned 1 [0089.318] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x766d1d0) returned 1 [0089.318] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389ef80) returned 1 [0089.318] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x766d180) returned 1 [0091.527] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eee550) returned 1 [0091.527] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba63d0) returned 1 [0091.527] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e248) returned 1 [0091.527] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x98) returned 0x55c5a38 [0091.527] wcscpy (in: _Dest=0x55c5a38, _Source="C:\\Users\\FD1HVy\\Desktop\\vdQMRI5Mhw6nRn2.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\vdQMRI5Mhw6nRn2.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\vdQMRI5Mhw6nRn2.mp3" [0091.527] wcscat (in: _Dest=0x55c5a38, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\vdQMRI5Mhw6nRn2.mp3.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\Desktop\\vdQMRI5Mhw6nRn2.mp3.mailto[knoocknoo@cock.li].a0a70" [0091.527] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\Desktop\\vdQMRI5Mhw6nRn2.mp3.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x20bff710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\Desktop\\vdQMRI5Mhw6nRn2.mp3.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0091.527] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xae) returned 0x55c8898 Thread: id = 882 os_tid = 0x1c04 [0079.721] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Xfbjc ztk.ods" (normalized: "c:\\users\\fd1hvy\\desktop\\xfbjc ztk.ods")) returned 0x20 [0079.721] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Xfbjc ztk.ods", dwFileAttributes=0x20) returned 1 [0079.721] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Xfbjc ztk.ods" (normalized: "c:\\users\\fd1hvy\\desktop\\xfbjc ztk.ods"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x149c [0079.721] GetFileSizeEx (in: hFile=0x149c, lpFileSize=0x20c7fe90 | out: lpFileSize=0x20c7fe90*=44566) returned 1 [0079.721] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0xae12, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.721] ReadFile (in: hFile=0x149c, lpBuffer=0x20c7fe14, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x20c7fe10, lpOverlapped=0x0 | out: lpBuffer=0x20c7fe14*, lpNumberOfBytesRead=0x20c7fe10*=0x4, lpOverlapped=0x0) returned 1 [0079.722] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.722] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e3d8 [0079.722] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e4c8 [0079.722] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e270 [0079.722] NtQuerySystemTime (in: CurrentTime=0x20c7fdf0 | out: CurrentTime=0x20c7fdf0*=132260136368879513) returned 0x0 [0079.722] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0x1f593a6a [0079.722] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0x9b7c3240 [0079.722] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0x9bd8c96c [0079.722] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0x4bb3a988 [0079.722] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0xba7196e3 [0079.722] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0xd62b3809 [0079.722] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0x3a02819 [0079.722] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0xbc395d42 [0079.722] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0x1aa471fd [0079.722] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0xce92e99f [0079.722] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0xbaeb72d5 [0079.722] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0x5ed54703 [0079.722] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0x16b54b79 [0079.722] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0x4bcf31e4 [0079.722] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0x83359d35 [0079.722] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0xcd54d495 [0079.722] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0xca141ed6 [0079.722] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0xb97455cc [0079.722] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0x35e7dec4 [0079.722] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0x451c3e31 [0079.722] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0xcac556d1 [0079.722] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0x8cf45933 [0079.722] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0x6a0cf777 [0079.723] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0xefff3720 [0079.723] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0x2c18ce1 [0079.723] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0x50c98bd7 [0079.723] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0x375b0fab [0079.723] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0x8d43160a [0079.723] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0xfa3bda82 [0079.723] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0xb370694b [0079.723] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0xdd3337a7 [0079.723] RtlRandom (in: Seed=0x20c7fdfc | out: Seed=0x20c7fdfc) returned 0xf0034519 [0079.733] ReadFile (in: hFile=0x149c, lpBuffer=0x7253ac0, nNumberOfBytesToRead=0xae16, lpNumberOfBytesRead=0x20c7fdec, lpOverlapped=0x0 | out: lpBuffer=0x7253ac0*, lpNumberOfBytesRead=0x20c7fdec*=0xae16, lpOverlapped=0x0) returned 1 [0079.734] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.734] WriteFile (in: hFile=0x149c, lpBuffer=0x72602c8*, nNumberOfBytesToWrite=0xae16, lpNumberOfBytesWritten=0x20c7fde8, lpOverlapped=0x0 | out: lpBuffer=0x72602c8*, lpNumberOfBytesWritten=0x20c7fde8*=0xae16, lpOverlapped=0x0) returned 1 [0082.485] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x766c010 [0086.009] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x766c308 [0086.009] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x766c308) returned 1 [0086.009] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x72602c8) returned 1 [0086.009] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7253ac0) returned 1 [0086.009] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eeda20) returned 1 [0086.009] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537be60) returned 1 [0086.009] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x27) returned 0x38a6670 [0086.009] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.009] WriteFile (in: hFile=0x149c, lpBuffer=0x743a348*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x20c7fe50, lpOverlapped=0x0 | out: lpBuffer=0x743a348*, lpNumberOfBytesWritten=0x20c7fe50*=0x10b, lpOverlapped=0x0) returned 1 [0089.316] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x743a348) returned 1 [0089.316] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6b20) returned 1 [0089.316] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x766c128) returned 1 [0089.316] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6670) returned 1 [0089.316] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x766c010) returned 1 [0091.527] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e4c8) returned 1 [0091.527] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e1a8) returned 1 [0091.527] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e1f8) returned 1 [0091.527] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8c) returned 0x54a07d0 [0091.527] wcscpy (in: _Dest=0x54a07d0, _Source="C:\\Users\\FD1HVy\\Desktop\\Xfbjc ztk.ods" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\Xfbjc ztk.ods") returned="C:\\Users\\FD1HVy\\Desktop\\Xfbjc ztk.ods" [0091.528] wcscat (in: _Dest=0x54a07d0, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\Xfbjc ztk.ods.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\Desktop\\Xfbjc ztk.ods.mailto[knoocknoo@cock.li].a0a70" [0091.528] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\Desktop\\Xfbjc ztk.ods.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x20c7fe08, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\Desktop\\Xfbjc ztk.ods.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0091.528] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa2) returned 0x388e8b0 Thread: id = 883 os_tid = 0x1c08 [0079.735] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\YZDkWQoGFHYXs.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\yzdkwqogfhyxs.gif")) returned 0x20 [0079.735] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\YZDkWQoGFHYXs.gif", dwFileAttributes=0x20) returned 1 [0079.735] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\YZDkWQoGFHYXs.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\yzdkwqogfhyxs.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14a0 [0079.735] GetFileSizeEx (in: hFile=0x14a0, lpFileSize=0x20cffb94 | out: lpFileSize=0x20cffb94*=70331) returned 1 [0079.735] SetFilePointerEx (in: hFile=0x14a0, liDistanceToMove=0x112b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.735] ReadFile (in: hFile=0x14a0, lpBuffer=0x20cffb18, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x20cffb14, lpOverlapped=0x0 | out: lpBuffer=0x20cffb18*, lpNumberOfBytesRead=0x20cffb14*=0x4, lpOverlapped=0x0) returned 1 [0079.736] SetFilePointerEx (in: hFile=0x14a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.736] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e3d8 [0079.736] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e4f0 [0079.736] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e270 [0079.736] NtQuerySystemTime (in: CurrentTime=0x20cffaf4 | out: CurrentTime=0x20cffaf4*=132260136368879513) returned 0x0 [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0x8322f104 [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0xcab94ba2 [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0xff5cfe96 [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0xe5f61eb5 [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0x4fc73597 [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0x29f4f335 [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0x9b026e44 [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0x2abad38a [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0xd720eb54 [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0x1dcfcea0 [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0xc3fe1d10 [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0xe49ab573 [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0x8655365 [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0x883f3f47 [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0xa93385ef [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0x55b2b668 [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0x5722740e [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0xc9930b2e [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0xe3fb2875 [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0x230b3d1a [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0x38672064 [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0x7ca012ef [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0xde049969 [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0x8ae50fdc [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0x7155c3b3 [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0x4284da2a [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0xafad15df [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0xbc5f279d [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0x39c1d00c [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0x1f6d05de [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0xf46569d3 [0079.736] RtlRandom (in: Seed=0x20cffb00 | out: Seed=0x20cffb00) returned 0x9e5d6231 [0079.746] SetFilePointerEx (in: hFile=0x14a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.746] ReadFile (in: hFile=0x14a0, lpBuffer=0x726cad0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x20cffad4, lpOverlapped=0x0 | out: lpBuffer=0x726cad0*, lpNumberOfBytesRead=0x20cffad4*=0xc800, lpOverlapped=0x0) returned 1 [0079.747] SetFilePointerEx (in: hFile=0x14a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.747] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x537bf80 [0079.747] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5eeda98 [0079.747] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e4a0 [0079.747] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e4a0) returned 1 [0079.748] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x72792d8 [0079.752] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e518 [0079.752] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e450 [0079.752] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e450) returned 1 [0079.752] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eeda98) returned 1 [0079.752] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537bf80) returned 1 [0079.752] WriteFile (in: hFile=0x14a0, lpBuffer=0x72792d8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x20cffad4, lpOverlapped=0x0 | out: lpBuffer=0x72792d8*, lpNumberOfBytesWritten=0x20cffad4*=0xc800, lpOverlapped=0x0) returned 1 [0082.490] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x72792d8) returned 1 [0086.007] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x726cad0) returned 1 [0086.007] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2f) returned 0x38b41c0 [0086.007] SetFilePointerEx (in: hFile=0x14a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.007] WriteFile (in: hFile=0x14a0, lpBuffer=0x54bd2a8*, nNumberOfBytesToWrite=0x113, lpNumberOfBytesWritten=0x20cffb54, lpOverlapped=0x0 | out: lpBuffer=0x54bd2a8*, lpNumberOfBytesWritten=0x20cffb54*=0x113, lpOverlapped=0x0) returned 1 [0089.314] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bd2a8) returned 1 [0089.314] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b4188) returned 1 [0089.314] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7669ad8) returned 1 [0091.528] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b41c0) returned 1 [0091.528] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e518) returned 1 [0091.528] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e4f0) returned 1 [0091.528] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e1d0) returned 1 [0091.528] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e220) returned 1 [0091.528] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x94) returned 0x55c52b8 [0091.528] wcscpy (in: _Dest=0x55c52b8, _Source="C:\\Users\\FD1HVy\\Desktop\\YZDkWQoGFHYXs.gif" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\YZDkWQoGFHYXs.gif") returned="C:\\Users\\FD1HVy\\Desktop\\YZDkWQoGFHYXs.gif" [0091.528] wcscat (in: _Dest=0x55c52b8, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\YZDkWQoGFHYXs.gif.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\Desktop\\YZDkWQoGFHYXs.gif.mailto[knoocknoo@cock.li].a0a70" [0091.528] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\Desktop\\YZDkWQoGFHYXs.gif.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x20cffb0c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\Desktop\\YZDkWQoGFHYXs.gif.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0091.528] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xaa) returned 0x55c8950 Thread: id = 884 os_tid = 0x1c0c [0079.752] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0082.490] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0082.490] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.490] GetLastError () returned 0x5 [0082.490] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0082.491] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396f5c8) returned 1 Thread: id = 885 os_tid = 0x1c10 [0079.755] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0087.548] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0087.548] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.548] GetLastError () returned 0x5 [0087.548] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0087.548] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396eb78) returned 1 Thread: id = 886 os_tid = 0x1c14 [0079.756] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0087.547] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0087.549] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.549] GetLastError () returned 0x5 [0087.549] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0087.549] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393f498) returned 1 Thread: id = 887 os_tid = 0x1c18 [0079.756] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x54b1ff8 [0079.756] wcscpy (in: _Dest=0x54b1ff8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets" [0079.756] wcscat (in: _Dest=0x54b1ff8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\" [0079.756] wcscat (in: _Dest=0x54b1ff8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\*" [0079.756] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3904010 [0079.756] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x3904010 | out: lpFindFileData=0x3904010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e4fcf04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa7d9181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2e4fcf04, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7567688 [0087.550] wcscmp (_String1=".", _String2=".") returned 0 [0087.550] FindNextFileW (hFindFile=0x7567688, lpFindFileData=0x3904010) Thread: id = 888 os_tid = 0x1c1c [0079.757] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x54063b8 [0079.757] wcscpy (in: _Dest=0x54063b8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata" [0079.757] wcscat (in: _Dest=0x54063b8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0079.757] wcscat (in: _Dest=0x54063b8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0079.757] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3900650 [0079.757] FindFirstFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x3900650) Thread: id = 889 os_tid = 0x1c20 [0079.758] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri")) returned 0x20 [0087.551] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0087.551] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.551] GetLastError () returned 0x5 [0087.551] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0087.551] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396f898) returned 1 Thread: id = 890 os_tid = 0x1c24 [0079.767] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x5498708 [0079.767] wcscpy (in: _Dest=0x5498708, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\bin" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\bin") returned="C:\\Program Files\\Java\\jre1.8.0_144\\bin" [0079.767] wcscat (in: _Dest=0x5498708, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" [0079.767] wcscat (in: _Dest=0x5498708, _Source="*" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\*") returned="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\*" [0079.767] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3904278 [0079.767] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\*", lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba1370 [0079.768] wcscmp (_String1=".", _String2=".") returned 0 [0079.768] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.771] wcscmp (_String1="..", _String2=".") returned 1 [0079.771] wcscmp (_String1="..", _String2="..") returned 0 [0079.771] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x172440, dwReserved0=0x0, dwReserved1=0x0, cFileName="awt.dll", cAlternateFileName="")) returned 1 [0079.771] wcscmp (_String1="awt.dll", _String2=".") returned 1 [0079.771] wcscmp (_String1="awt.dll", _String2="..") returned 1 [0079.771] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bci.dll", cAlternateFileName="")) returned 1 [0079.771] wcscmp (_String1="bci.dll", _String2=".") returned 1 [0079.771] wcscmp (_String1="bci.dll", _String2="..") returned 1 [0079.771] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x27040, dwReserved0=0x0, dwReserved1=0x0, cFileName="dcpr.dll", cAlternateFileName="")) returned 1 [0079.771] wcscmp (_String1="dcpr.dll", _String2=".") returned 1 [0079.771] wcscmp (_String1="dcpr.dll", _String2="..") returned 1 [0079.771] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15040, dwReserved0=0x0, dwReserved1=0x0, cFileName="decora_sse.dll", cAlternateFileName="DECORA~1.DLL")) returned 1 [0079.771] wcscmp (_String1="decora_sse.dll", _String2=".") returned 1 [0079.771] wcscmp (_String1="decora_sse.dll", _String2="..") returned 1 [0079.771] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8f840, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.dll", cAlternateFileName="")) returned 1 [0079.771] wcscmp (_String1="deploy.dll", _String2=".") returned 1 [0079.771] wcscmp (_String1="deploy.dll", _String2="..") returned 1 [0079.771] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dtplugin", cAlternateFileName="")) returned 1 [0079.771] wcscmp (_String1="dtplugin", _String2=".") returned 1 [0079.771] wcscmp (_String1="dtplugin", _String2="..") returned 1 [0079.771] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x6e95c38 [0079.771] wcscpy (in: _Dest=0x6e95c38, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\bin" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\bin") returned="C:\\Program Files\\Java\\jre1.8.0_144\\bin" [0079.771] wcscat (in: _Dest=0x6e95c38, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" [0079.771] wcscat (in: _Dest=0x6e95c38, _Source="dtplugin" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin") returned="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin" [0080.517] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x6e95c38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14b4 [0080.518] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1 [0080.518] wcscmp (_String1="dt_shmem.dll", _String2=".") returned 1 [0080.518] wcscmp (_String1="dt_shmem.dll", _String2="..") returned 1 [0080.518] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6040, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_socket.dll", cAlternateFileName="DT_SOC~1.DLL")) returned 1 [0080.518] wcscmp (_String1="dt_socket.dll", _String2=".") returned 1 [0080.518] wcscmp (_String1="dt_socket.dll", _String2="..") returned 1 [0080.518] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x21440, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.dll", cAlternateFileName="")) returned 1 [0080.518] wcscmp (_String1="eula.dll", _String2=".") returned 1 [0080.518] wcscmp (_String1="eula.dll", _String2="..") returned 1 [0080.519] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x43040, dwReserved0=0x0, dwReserved1=0x0, cFileName="fontmanager.dll", cAlternateFileName="FONTMA~1.DLL")) returned 1 [0080.519] wcscmp (_String1="fontmanager.dll", _String2=".") returned 1 [0080.519] wcscmp (_String1="fontmanager.dll", _String2="..") returned 1 [0080.519] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2da40, dwReserved0=0x0, dwReserved1=0x0, cFileName="fxplugins.dll", cAlternateFileName="FXPLUG~1.DLL")) returned 1 [0080.519] wcscmp (_String1="fxplugins.dll", _String2=".") returned 1 [0080.519] wcscmp (_String1="fxplugins.dll", _String2="..") returned 1 [0080.519] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x40e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="glass.dll", cAlternateFileName="")) returned 1 [0080.519] wcscmp (_String1="glass.dll", _String2=".") returned 1 [0080.519] wcscmp (_String1="glass.dll", _String2="..") returned 1 [0080.519] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6f440, dwReserved0=0x0, dwReserved1=0x0, cFileName="glib-lite.dll", cAlternateFileName="GLIB-L~1.DLL")) returned 1 [0080.519] wcscmp (_String1="glib-lite.dll", _String2=".") returned 1 [0080.519] wcscmp (_String1="glib-lite.dll", _String2="..") returned 1 [0080.519] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x97440, dwReserved0=0x0, dwReserved1=0x0, cFileName="gstreamer-lite.dll", cAlternateFileName="GSTREA~1.DLL")) returned 1 [0080.519] wcscmp (_String1="gstreamer-lite.dll", _String2=".") returned 1 [0080.519] wcscmp (_String1="gstreamer-lite.dll", _String2="..") returned 1 [0080.519] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x26a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="hprof.dll", cAlternateFileName="")) returned 1 [0080.519] wcscmp (_String1="hprof.dll", _String2=".") returned 1 [0080.519] wcscmp (_String1="hprof.dll", _String2="..") returned 1 [0080.519] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1e240, dwReserved0=0x0, dwReserved1=0x0, cFileName="instrument.dll", cAlternateFileName="INSTRU~1.DLL")) returned 1 [0080.519] wcscmp (_String1="instrument.dll", _String2=".") returned 1 [0080.519] wcscmp (_String1="instrument.dll", _String2="..") returned 1 [0080.519] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="j2pcsc.dll", cAlternateFileName="")) returned 1 [0080.519] wcscmp (_String1="j2pcsc.dll", _String2=".") returned 1 [0080.519] wcscmp (_String1="j2pcsc.dll", _String2="..") returned 1 [0080.519] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf840, dwReserved0=0x0, dwReserved1=0x0, cFileName="j2pkcs11.dll", cAlternateFileName="")) returned 1 [0080.519] wcscmp (_String1="j2pkcs11.dll", _String2=".") returned 1 [0080.519] wcscmp (_String1="j2pkcs11.dll", _String2="..") returned 1 [0080.519] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5240, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaas_nt.dll", cAlternateFileName="")) returned 1 [0080.519] wcscmp (_String1="jaas_nt.dll", _String2=".") returned 1 [0080.519] wcscmp (_String1="jaas_nt.dll", _String2="..") returned 1 [0080.519] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8640, dwReserved0=0x0, dwReserved1=0x0, cFileName="jabswitch.exe", cAlternateFileName="JABSWI~1.EXE")) returned 1 [0080.519] wcscmp (_String1="jabswitch.exe", _String2=".") returned 1 [0080.519] wcscmp (_String1="jabswitch.exe", _String2="..") returned 1 [0080.519] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="java-rmi.exe", cAlternateFileName="")) returned 1 [0080.520] wcscmp (_String1="java-rmi.exe", _String2=".") returned 1 [0080.520] wcscmp (_String1="java-rmi.exe", _String2="..") returned 1 [0080.520] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x27040, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.dll", cAlternateFileName="")) returned 1 [0080.520] wcscmp (_String1="java.dll", _String2=".") returned 1 [0080.520] wcscmp (_String1="java.dll", _String2="..") returned 1 [0080.520] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.exe", cAlternateFileName="")) returned 1 [0080.520] wcscmp (_String1="java.exe", _String2=".") returned 1 [0080.520] wcscmp (_String1="java.exe", _String2="..") returned 1 [0080.520] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x22c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="JavaAccessBridge-64.dll", cAlternateFileName="JAVAAC~1.DLL")) returned 1 [0080.520] wcscmp (_String1="JavaAccessBridge-64.dll", _String2=".") returned 1 [0080.520] wcscmp (_String1="JavaAccessBridge-64.dll", _String2="..") returned 1 [0080.520] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2dc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="javacpl.cpl", cAlternateFileName="")) returned 1 [0080.520] wcscmp (_String1="javacpl.cpl", _String2=".") returned 1 [0080.520] wcscmp (_String1="javacpl.cpl", _String2="..") returned 1 [0080.520] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="javacpl.exe", cAlternateFileName="")) returned 1 [0080.520] wcscmp (_String1="javacpl.exe", _String2=".") returned 1 [0080.520] wcscmp (_String1="javacpl.exe", _String2="..") returned 1 [0080.520] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx_font.dll", cAlternateFileName="JAVAFX~1.DLL")) returned 1 [0080.520] wcscmp (_String1="javafx_font.dll", _String2=".") returned 1 [0080.520] wcscmp (_String1="javafx_font.dll", _String2="..") returned 1 [0080.520] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x83640, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx_font_t2k.dll", cAlternateFileName="JAVAFX~2.DLL")) returned 1 [0080.520] wcscmp (_String1="javafx_font_t2k.dll", _String2=".") returned 1 [0080.520] wcscmp (_String1="javafx_font_t2k.dll", _String2="..") returned 1 [0080.520] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1f440, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx_iio.dll", cAlternateFileName="JAVAFX~3.DLL")) returned 1 [0080.520] wcscmp (_String1="javafx_iio.dll", _String2=".") returned 1 [0080.520] wcscmp (_String1="javafx_iio.dll", _String2="..") returned 1 [0080.520] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaw.exe", cAlternateFileName="")) returned 1 [0080.520] wcscmp (_String1="javaw.exe", _String2=".") returned 1 [0080.520] wcscmp (_String1="javaw.exe", _String2="..") returned 1 [0080.520] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 1 [0080.520] wcscmp (_String1="javaws.exe", _String2=".") returned 1 [0080.520] wcscmp (_String1="javaws.exe", _String2="..") returned 1 [0080.520] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x0, cFileName="java_crw_demo.dll", cAlternateFileName="JAVA_C~1.DLL")) returned 1 [0080.520] wcscmp (_String1="java_crw_demo.dll", _String2=".") returned 1 [0080.520] wcscmp (_String1="java_crw_demo.dll", _String2="..") returned 1 [0080.521] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3840, dwReserved0=0x0, dwReserved1=0x0, cFileName="jawt.dll", cAlternateFileName="")) returned 1 [0080.521] wcscmp (_String1="jawt.dll", _String2=".") returned 1 [0080.521] wcscmp (_String1="jawt.dll", _String2="..") returned 1 [0080.521] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="JAWTAccessBridge-64.dll", cAlternateFileName="JAWTAC~1.DLL")) returned 1 [0080.522] wcscmp (_String1="JAWTAccessBridge-64.dll", _String2=".") returned 1 [0080.522] wcscmp (_String1="JAWTAccessBridge-64.dll", _String2="..") returned 1 [0080.522] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x31440, dwReserved0=0x0, dwReserved1=0x0, cFileName="jdwp.dll", cAlternateFileName="")) returned 1 [0080.522] wcscmp (_String1="jdwp.dll", _String2=".") returned 1 [0080.522] wcscmp (_String1="jdwp.dll", _String2="..") returned 1 [0080.522] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6840, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.dll", cAlternateFileName="")) returned 1 [0080.522] wcscmp (_String1="jfr.dll", _String2=".") returned 1 [0080.522] wcscmp (_String1="jfr.dll", _String2="..") returned 1 [0080.522] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x22240, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfxmedia.dll", cAlternateFileName="")) returned 1 [0080.523] wcscmp (_String1="jfxmedia.dll", _String2=".") returned 1 [0080.523] wcscmp (_String1="jfxmedia.dll", _String2="..") returned 1 [0080.523] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7511d3f, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7511d3f, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa75aa64d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2794a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfxwebkit.dll", cAlternateFileName="JFXWEB~1.DLL")) returned 1 [0080.523] wcscmp (_String1="jfxwebkit.dll", _String2=".") returned 1 [0080.523] wcscmp (_String1="jfxwebkit.dll", _String2="..") returned 1 [0080.523] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa75aa64d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jjs.exe", cAlternateFileName="")) returned 1 [0080.523] wcscmp (_String1="jjs.exe", _String2=".") returned 1 [0080.523] wcscmp (_String1="jjs.exe", _String2="..") returned 1 [0080.523] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa75aa64d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2aa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jli.dll", cAlternateFileName="")) returned 1 [0080.523] wcscmp (_String1="jli.dll", _String2=".") returned 1 [0080.523] wcscmp (_String1="jli.dll", _String2="..") returned 1 [0080.523] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa897bfc2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x48440, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2iexp.dll", cAlternateFileName="")) returned 1 [0080.523] wcscmp (_String1="jp2iexp.dll", _String2=".") returned 1 [0080.523] wcscmp (_String1="jp2iexp.dll", _String2="..") returned 1 [0080.523] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa897bfc2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa897bfc2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89a2223, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1b640, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2launcher.exe", cAlternateFileName="JP2LAU~1.EXE")) returned 1 [0080.523] wcscmp (_String1="jp2launcher.exe", _String2=".") returned 1 [0080.523] wcscmp (_String1="jp2launcher.exe", _String2="..") returned 1 [0080.523] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89a2223, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89a2223, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89a2223, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2native.dll", cAlternateFileName="JP2NAT~1.DLL")) returned 1 [0080.523] wcscmp (_String1="jp2native.dll", _String2=".") returned 1 [0080.523] wcscmp (_String1="jp2native.dll", _String2="..") returned 1 [0080.523] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89a2223, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89a2223, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89a2223, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39840, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2ssv.dll", cAlternateFileName="")) returned 1 [0080.523] wcscmp (_String1="jp2ssv.dll", _String2=".") returned 1 [0080.523] wcscmp (_String1="jp2ssv.dll", _String2="..") returned 1 [0080.523] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89a2223, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89a2223, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2d640, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpeg.dll", cAlternateFileName="")) returned 1 [0080.523] wcscmp (_String1="jpeg.dll", _String2=".") returned 1 [0080.523] wcscmp (_String1="jpeg.dll", _String2="..") returned 1 [0080.523] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4840, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsdt.dll", cAlternateFileName="")) returned 1 [0080.523] wcscmp (_String1="jsdt.dll", _String2=".") returned 1 [0080.523] wcscmp (_String1="jsdt.dll", _String2="..") returned 1 [0080.523] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsound.dll", cAlternateFileName="")) returned 1 [0080.523] wcscmp (_String1="jsound.dll", _String2=".") returned 1 [0080.523] wcscmp (_String1="jsound.dll", _String2="..") returned 1 [0080.523] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsoundds.dll", cAlternateFileName="")) returned 1 [0080.523] wcscmp (_String1="jsoundds.dll", _String2=".") returned 1 [0080.523] wcscmp (_String1="jsoundds.dll", _String2="..") returned 1 [0080.524] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x35e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="kcms.dll", cAlternateFileName="")) returned 1 [0080.524] wcscmp (_String1="kcms.dll", _String2=".") returned 1 [0080.524] wcscmp (_String1="kcms.dll", _String2="..") returned 1 [0080.524] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="keytool.exe", cAlternateFileName="")) returned 1 [0080.524] wcscmp (_String1="keytool.exe", _String2=".") returned 1 [0080.524] wcscmp (_String1="keytool.exe", _String2="..") returned 1 [0080.524] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="kinit.exe", cAlternateFileName="")) returned 1 [0080.524] wcscmp (_String1="kinit.exe", _String2=".") returned 1 [0080.524] wcscmp (_String1="kinit.exe", _String2="..") returned 1 [0080.524] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="klist.exe", cAlternateFileName="")) returned 1 [0080.524] wcscmp (_String1="klist.exe", _String2=".") returned 1 [0080.524] wcscmp (_String1="klist.exe", _String2="..") returned 1 [0080.524] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="ktab.exe", cAlternateFileName="")) returned 1 [0080.524] wcscmp (_String1="ktab.exe", _String2=".") returned 1 [0080.524] wcscmp (_String1="ktab.exe", _String2="..") returned 1 [0080.524] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39040, dwReserved0=0x0, dwReserved1=0x0, cFileName="lcms.dll", cAlternateFileName="")) returned 1 [0080.524] wcscmp (_String1="lcms.dll", _String2=".") returned 1 [0080.524] wcscmp (_String1="lcms.dll", _String2="..") returned 1 [0080.524] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x9040, dwReserved0=0x0, dwReserved1=0x0, cFileName="management.dll", cAlternateFileName="MANAGE~1.DLL")) returned 1 [0080.524] wcscmp (_String1="management.dll", _String2=".") returned 1 [0080.524] wcscmp (_String1="management.dll", _String2="..") returned 1 [0080.524] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x9fa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="mlib_image.dll", cAlternateFileName="MLIB_I~1.DLL")) returned 1 [0080.524] wcscmp (_String1="mlib_image.dll", _String2=".") returned 1 [0080.524] wcscmp (_String1="mlib_image.dll", _String2="..") returned 1 [0080.524] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa12a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1 [0080.524] wcscmp (_String1="msvcp120.dll", _String2=".") returned 1 [0080.524] wcscmp (_String1="msvcp120.dll", _String2="..") returned 1 [0080.524] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xca750, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr100.dll", cAlternateFileName="")) returned 1 [0080.524] wcscmp (_String1="msvcr100.dll", _String2=".") returned 1 [0080.524] wcscmp (_String1="msvcr100.dll", _String2="..") returned 1 [0080.524] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xeb2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1 [0080.524] wcscmp (_String1="msvcr120.dll", _String2=".") returned 1 [0080.524] wcscmp (_String1="msvcr120.dll", _String2="..") returned 1 [0080.524] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="net.dll", cAlternateFileName="")) returned 1 [0080.524] wcscmp (_String1="net.dll", _String2=".") returned 1 [0080.525] wcscmp (_String1="net.dll", _String2="..") returned 1 [0080.525] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xec40, dwReserved0=0x0, dwReserved1=0x0, cFileName="nio.dll", cAlternateFileName="")) returned 1 [0080.525] wcscmp (_String1="nio.dll", _String2=".") returned 1 [0080.525] wcscmp (_String1="nio.dll", _String2="..") returned 1 [0080.525] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="npt.dll", cAlternateFileName="")) returned 1 [0080.525] wcscmp (_String1="npt.dll", _String2=".") returned 1 [0080.525] wcscmp (_String1="npt.dll", _String2="..") returned 1 [0080.525] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="orbd.exe", cAlternateFileName="")) returned 1 [0080.525] wcscmp (_String1="orbd.exe", _String2=".") returned 1 [0080.525] wcscmp (_String1="orbd.exe", _String2="..") returned 1 [0080.525] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="pack200.exe", cAlternateFileName="")) returned 1 [0080.525] wcscmp (_String1="pack200.exe", _String2=".") returned 1 [0080.525] wcscmp (_String1="pack200.exe", _String2="..") returned 1 [0080.525] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2a2bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin2", cAlternateFileName="")) returned 1 [0080.525] wcscmp (_String1="plugin2", _String2=".") returned 1 [0080.525] wcscmp (_String1="plugin2", _String2="..") returned 1 [0080.525] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x6e95960 [0080.525] wcscpy (in: _Dest=0x6e95960, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\bin" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\bin") returned="C:\\Program Files\\Java\\jre1.8.0_144\\bin" [0080.525] wcscat (in: _Dest=0x6e95960, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" [0080.525] wcscat (in: _Dest=0x6e95960, _Source="plugin2" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2") returned="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2" [0080.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x6e95960, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b4 [0080.526] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="policytool.exe", cAlternateFileName="POLICY~1.EXE")) returned 1 [0080.526] wcscmp (_String1="policytool.exe", _String2=".") returned 1 [0080.526] wcscmp (_String1="policytool.exe", _String2="..") returned 1 [0080.526] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe040, dwReserved0=0x0, dwReserved1=0x0, cFileName="prism_common.dll", cAlternateFileName="PRISM_~1.DLL")) returned 1 [0080.526] wcscmp (_String1="prism_common.dll", _String2=".") returned 1 [0080.526] wcscmp (_String1="prism_common.dll", _String2="..") returned 1 [0080.526] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a148fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1fe40, dwReserved0=0x0, dwReserved1=0x0, cFileName="prism_d3d.dll", cAlternateFileName="PRISM_~2.DLL")) returned 1 [0080.531] wcscmp (_String1="prism_d3d.dll", _String2=".") returned 1 [0080.531] wcscmp (_String1="prism_d3d.dll", _String2="..") returned 1 [0080.531] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a148fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="prism_sw.dll", cAlternateFileName="")) returned 1 [0080.531] wcscmp (_String1="prism_sw.dll", _String2=".") returned 1 [0080.531] wcscmp (_String1="prism_sw.dll", _String2="..") returned 1 [0080.531] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a148fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.dll", cAlternateFileName="")) returned 1 [0080.531] wcscmp (_String1="resource.dll", _String2=".") returned 1 [0080.531] wcscmp (_String1="resource.dll", _String2="..") returned 1 [0080.531] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a148fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="rmid.exe", cAlternateFileName="")) returned 1 [0080.531] wcscmp (_String1="rmid.exe", _String2=".") returned 1 [0080.531] wcscmp (_String1="rmid.exe", _String2="..") returned 1 [0080.531] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8af971e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="rmiregistry.exe", cAlternateFileName="RMIREG~1.EXE")) returned 1 [0080.531] wcscmp (_String1="rmiregistry.exe", _String2=".") returned 1 [0080.531] wcscmp (_String1="rmiregistry.exe", _String2="..") returned 1 [0080.531] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8af971e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2b6c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xab35b530, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="server", cAlternateFileName="")) returned 1 [0080.531] wcscmp (_String1="server", _String2=".") returned 1 [0080.531] wcscmp (_String1="server", _String2="..") returned 1 [0080.531] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x6e95dd8 [0080.531] wcscpy (in: _Dest=0x6e95dd8, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\bin" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\bin") returned="C:\\Program Files\\Java\\jre1.8.0_144\\bin" [0080.531] wcscat (in: _Dest=0x6e95dd8, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\" [0080.531] wcscat (in: _Dest=0x6e95dd8, _Source="server" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server") returned="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server" [0080.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x6e95dd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14a8 [0080.532] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="servertool.exe", cAlternateFileName="SERVER~1.EXE")) returned 1 [0080.532] wcscmp (_String1="servertool.exe", _String2=".") returned 1 [0080.532] wcscmp (_String1="servertool.exe", _String2="..") returned 1 [0080.532] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32040, dwReserved0=0x0, dwReserved1=0x0, cFileName="splashscreen.dll", cAlternateFileName="SPLASH~1.DLL")) returned 1 [0080.532] wcscmp (_String1="splashscreen.dll", _String2=".") returned 1 [0080.532] wcscmp (_String1="splashscreen.dll", _String2="..") returned 1 [0080.532] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8ba40, dwReserved0=0x0, dwReserved1=0x0, cFileName="ssv.dll", cAlternateFileName="")) returned 1 [0080.532] wcscmp (_String1="ssv.dll", _String2=".") returned 1 [0080.532] wcscmp (_String1="ssv.dll", _String2="..") returned 1 [0080.532] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="ssvagent.exe", cAlternateFileName="")) returned 1 [0080.532] wcscmp (_String1="ssvagent.exe", _String2=".") returned 1 [0080.532] wcscmp (_String1="ssvagent.exe", _String2="..") returned 1 [0080.532] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x21240, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunec.dll", cAlternateFileName="")) returned 1 [0080.532] wcscmp (_String1="sunec.dll", _String2=".") returned 1 [0080.532] wcscmp (_String1="sunec.dll", _String2="..") returned 1 [0080.532] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunmscapi.dll", cAlternateFileName="SUNMSC~1.DLL")) returned 1 [0080.532] wcscmp (_String1="sunmscapi.dll", _String2=".") returned 1 [0080.532] wcscmp (_String1="sunmscapi.dll", _String2="..") returned 1 [0080.533] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e440, dwReserved0=0x0, dwReserved1=0x0, cFileName="t2k.dll", cAlternateFileName="")) returned 1 [0080.533] wcscmp (_String1="t2k.dll", _String2=".") returned 1 [0080.533] wcscmp (_String1="t2k.dll", _String2="..") returned 1 [0080.533] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="tnameserv.exe", cAlternateFileName="TNAMES~1.EXE")) returned 1 [0080.533] wcscmp (_String1="tnameserv.exe", _String2=".") returned 1 [0080.533] wcscmp (_String1="tnameserv.exe", _String2="..") returned 1 [0080.533] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13840, dwReserved0=0x0, dwReserved1=0x0, cFileName="unpack.dll", cAlternateFileName="")) returned 1 [0080.533] wcscmp (_String1="unpack.dll", _String2=".") returned 1 [0080.533] wcscmp (_String1="unpack.dll", _String2="..") returned 1 [0080.533] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x30240, dwReserved0=0x0, dwReserved1=0x0, cFileName="unpack200.exe", cAlternateFileName="UNPACK~1.EXE")) returned 1 [0080.533] wcscmp (_String1="unpack200.exe", _String2=".") returned 1 [0080.533] wcscmp (_String1="unpack200.exe", _String2="..") returned 1 [0080.533] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc040, dwReserved0=0x0, dwReserved1=0x0, cFileName="verify.dll", cAlternateFileName="")) returned 1 [0080.533] wcscmp (_String1="verify.dll", _String2=".") returned 1 [0080.533] wcscmp (_String1="verify.dll", _String2="..") returned 1 [0080.533] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="w2k_lsa_auth.dll", cAlternateFileName="W2K_LS~1.DLL")) returned 1 [0080.533] wcscmp (_String1="w2k_lsa_auth.dll", _String2=".") returned 1 [0080.533] wcscmp (_String1="w2k_lsa_auth.dll", _String2="..") returned 1 [0080.533] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1ae40, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsAccessBridge-64.dll", cAlternateFileName="WINDOW~1.DLL")) returned 1 [0080.533] wcscmp (_String1="WindowsAccessBridge-64.dll", _String2=".") returned 1 [0080.533] wcscmp (_String1="WindowsAccessBridge-64.dll", _String2="..") returned 1 [0080.533] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2f040, dwReserved0=0x0, dwReserved1=0x0, cFileName="wsdetect.dll", cAlternateFileName="")) returned 1 [0080.533] wcscmp (_String1="wsdetect.dll", _String2=".") returned 1 [0080.533] wcscmp (_String1="wsdetect.dll", _String2="..") returned 1 [0080.533] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13040, dwReserved0=0x0, dwReserved1=0x0, cFileName="zip.dll", cAlternateFileName="")) returned 1 [0080.533] wcscmp (_String1="zip.dll", _String2=".") returned 1 [0080.533] wcscmp (_String1="zip.dll", _String2="..") returned 1 [0080.533] FindNextFileW (in: hFindFile=0x5ba1370, lpFindFileData=0x3904278 | out: lpFindFileData=0x3904278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13040, dwReserved0=0x0, dwReserved1=0x0, cFileName="zip.dll", cAlternateFileName="")) returned 0 [0080.533] FindClose (in: hFindFile=0x5ba1370 | out: hFindFile=0x5ba1370) returned 1 [0080.534] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3904278) returned 1 [0080.534] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5498708) returned 1 [0080.534] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ffde0) returned 1 Thread: id = 891 os_tid = 0x1c28 [0079.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 0x20 [0079.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT", dwFileAttributes=0x20) returned 1 [0079.769] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14b0 [0079.769] GetFileSizeEx (in: hFile=0x14b0, lpFileSize=0x210ffbec | out: lpFileSize=0x210ffbec*=3244) returned 1 [0079.769] SetFilePointerEx (in: hFile=0x14b0, liDistanceToMove=0xca8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.770] ReadFile (in: hFile=0x14b0, lpBuffer=0x210ffb70, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x210ffb6c, lpOverlapped=0x0 | out: lpBuffer=0x210ffb70*, lpNumberOfBytesRead=0x210ffb6c*=0x4, lpOverlapped=0x0) returned 1 [0079.772] SetFilePointerEx (in: hFile=0x14b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.772] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e360 [0079.772] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e2c0 [0079.772] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e180 [0079.772] NtQuerySystemTime (in: CurrentTime=0x210ffb4c | out: CurrentTime=0x210ffb4c*=132260136369347859) returned 0x0 [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0xd2538704 [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0xbe4d6610 [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0x6fc02104 [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0x6829d8df [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0xc7042f53 [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0x22b18b11 [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0x7ce6ebeb [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0x76b4ec65 [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0x9b38b753 [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0xaa840567 [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0xca09e7c9 [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0x459f6707 [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0x7eb7fe52 [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0x2b7df6ad [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0x6428c68a [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0x2eba8571 [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0x23fec90d [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0x2edc639c [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0x45623e38 [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0xe08621c1 [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0x5a96c2f4 [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0xd44895ed [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0x41b772ca [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0x17683d34 [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0xe3228c2d [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0x47f6e461 [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0x4dcfd946 [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0xfb38f9d8 [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0x8732421 [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0xf3c21599 [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0xf3125234 [0079.772] RtlRandom (in: Seed=0x210ffb58 | out: Seed=0x210ffb58) returned 0xa6f20f5b [0079.783] ReadFile (in: hFile=0x14b0, lpBuffer=0x7287c08, nNumberOfBytesToRead=0xcac, lpNumberOfBytesRead=0x210ffb48, lpOverlapped=0x0 | out: lpBuffer=0x7287c08*, lpNumberOfBytesRead=0x210ffb48*=0xcac, lpOverlapped=0x0) returned 1 [0079.783] SetFilePointerEx (in: hFile=0x14b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.783] WriteFile (in: hFile=0x14b0, lpBuffer=0x7294410*, nNumberOfBytesToWrite=0xcac, lpNumberOfBytesWritten=0x210ffb44, lpOverlapped=0x0 | out: lpBuffer=0x7294410*, lpNumberOfBytesWritten=0x210ffb44*=0xcac, lpOverlapped=0x0) returned 1 [0087.558] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032c98 [0087.558] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032dd8 [0087.558] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe032dd8) returned 1 [0087.558] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7294410) Thread: id = 892 os_tid = 0x1c2c [0079.783] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x5498768 [0079.783] wcscpy (in: _Dest=0x5498768, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0079.783] wcscat (in: _Dest=0x5498768, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0079.783] wcscat (in: _Dest=0x5498768, _Source="*" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\*") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\*" [0079.783] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x39008b8 [0079.783] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\*", lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe1f09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba1430 [0079.786] wcscmp (_String1=".", _String2=".") returned 0 [0079.786] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe1f09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.787] wcscmp (_String1="..", _String2=".") returned 1 [0079.787] wcscmp (_String1="..", _String2="..") returned 0 [0079.787] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.properties", cAlternateFileName="ACCESS~1.PRO")) returned 1 [0079.787] wcscmp (_String1="accessibility.properties", _String2=".") returned 1 [0079.787] wcscmp (_String1="accessibility.properties", _String2="..") returned 1 [0079.787] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x80) returned 0x3977f68 [0079.787] wcscpy (in: _Dest=0x3977f68, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0079.787] wcscat (in: _Dest=0x3977f68, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0079.787] wcscat (in: _Dest=0x3977f68, _Source="accessibility.properties" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" [0080.474] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3977f68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa0 [0080.475] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe451d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="amd64", cAlternateFileName="")) returned 1 [0080.475] wcscmp (_String1="amd64", _String2=".") returned 1 [0080.475] wcscmp (_String1="amd64", _String2="..") returned 1 [0080.475] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x6e963f0 [0080.475] wcscpy (in: _Dest=0x6e963f0, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.475] wcscat (in: _Dest=0x6e963f0, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.475] wcscat (in: _Dest=0x6e963f0, _Source="amd64" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64" [0080.475] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x6e963f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14d0 [0080.476] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="applet", cAlternateFileName="")) returned 1 [0080.476] wcscmp (_String1="applet", _String2=".") returned 1 [0080.476] wcscmp (_String1="applet", _String2="..") returned 1 [0080.476] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x6e96458 [0080.476] wcscpy (in: _Dest=0x6e96458, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.476] wcscat (in: _Dest=0x6e96458, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.476] wcscat (in: _Dest=0x6e96458, _Source="applet" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\applet") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\applet" [0080.476] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x6e96458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x560 [0080.477] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendars.properties", cAlternateFileName="CALEND~1.PRO")) returned 1 [0080.477] wcscmp (_String1="calendars.properties", _String2=".") returned 1 [0080.477] wcscmp (_String1="calendars.properties", _String2="..") returned 1 [0080.477] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x78) returned 0x38d0e20 [0080.477] wcscpy (in: _Dest=0x38d0e20, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.477] wcscat (in: _Dest=0x38d0e20, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.477] wcscat (in: _Dest=0x38d0e20, _Source="calendars.properties" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" [0080.477] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d0e20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a0 [0080.478] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa7bbd53, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xaa7bbd53, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2e56fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="charsets.jar", cAlternateFileName="")) returned 1 [0080.478] wcscmp (_String1="charsets.jar", _String2=".") returned 1 [0080.478] wcscmp (_String1="charsets.jar", _String2="..") returned 1 [0080.478] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x68) returned 0x38b2488 [0080.478] wcscpy (in: _Dest=0x38b2488, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.478] wcscat (in: _Dest=0x38b2488, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.478] wcscat (in: _Dest=0x38b2488, _Source="charsets.jar" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" [0080.478] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b2488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c [0080.478] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x14983, dwReserved0=0x0, dwReserved1=0x0, cFileName="classlist", cAlternateFileName="CLASSL~1")) returned 1 [0080.478] wcscmp (_String1="classlist", _String2=".") returned 1 [0080.478] wcscmp (_String1="classlist", _String2="..") returned 1 [0080.479] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x38b2648 [0080.479] wcscpy (in: _Dest=0x38b2648, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.479] wcscat (in: _Dest=0x38b2648, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.479] wcscat (in: _Dest=0x38b2648, _Source="classlist" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" [0080.479] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38b2648, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a4 [0080.479] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105e2a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cmm", cAlternateFileName="")) returned 1 [0080.479] wcscmp (_String1="cmm", _String2=".") returned 1 [0080.479] wcscmp (_String1="cmm", _String2="..") returned 1 [0080.479] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x38b6068 [0080.479] wcscpy (in: _Dest=0x38b6068, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.479] wcscat (in: _Dest=0x38b6068, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.479] wcscat (in: _Dest=0x38b6068, _Source="cmm" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm" [0080.479] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b6068, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7fc [0080.480] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-types.properties", cAlternateFileName="CONTEN~1.PRO")) returned 1 [0080.480] wcscmp (_String1="content-types.properties", _String2=".") returned 1 [0080.480] wcscmp (_String1="content-types.properties", _String2="..") returned 1 [0080.480] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x80) returned 0x3977ff0 [0080.480] wcscpy (in: _Dest=0x3977ff0, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.480] wcscat (in: _Dest=0x3977ff0, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.480] wcscat (in: _Dest=0x3977ff0, _Source="content-types.properties" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" [0080.480] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3977ff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f8 [0080.481] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x101a, dwReserved0=0x0, dwReserved1=0x0, cFileName="currency.data", cAlternateFileName="CURREN~1.DAT")) returned 1 [0080.481] wcscmp (_String1="currency.data", _String2=".") returned 1 [0080.481] wcscmp (_String1="currency.data", _String2="..") returned 1 [0080.481] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6a) returned 0x5eede58 [0080.481] wcscpy (in: _Dest=0x5eede58, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.481] wcscat (in: _Dest=0x5eede58, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.481] wcscat (in: _Dest=0x5eede58, _Source="currency.data" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" [0080.481] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5eede58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7cc [0080.482] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa10e432c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy", cAlternateFileName="")) returned 1 [0080.482] wcscmp (_String1="deploy", _String2=".") returned 1 [0080.482] wcscmp (_String1="deploy", _String2="..") returned 1 [0080.482] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x6e964c0 [0080.482] wcscpy (in: _Dest=0x6e964c0, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.482] wcscat (in: _Dest=0x6e964c0, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.482] wcscat (in: _Dest=0x6e964c0, _Source="deploy" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy" [0080.482] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x6e964c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c0 [0080.483] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ed9405, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8ed9405, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa900a6f7, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ce7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.jar", cAlternateFileName="")) returned 1 [0080.483] wcscmp (_String1="deploy.jar", _String2=".") returned 1 [0080.483] wcscmp (_String1="deploy.jar", _String2="..") returned 1 [0080.483] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x396df80 [0080.483] wcscpy (in: _Dest=0x396df80, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.483] wcscat (in: _Dest=0x396df80, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.483] wcscat (in: _Dest=0x396df80, _Source="deploy.jar" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" [0080.483] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396df80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x76c [0080.483] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa11bdb26, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa8ed01b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ext", cAlternateFileName="")) returned 1 [0080.483] wcscmp (_String1="ext", _String2=".") returned 1 [0080.483] wcscmp (_String1="ext", _String2="..") returned 1 [0080.483] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x38b6368 [0080.483] wcscpy (in: _Dest=0x38b6368, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.483] wcscat (in: _Dest=0x38b6368, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.483] wcscat (in: _Dest=0x38b6368, _Source="ext" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext" [0080.484] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b6368, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x764 [0080.484] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="flavormap.properties", cAlternateFileName="FLAVOR~1.PRO")) returned 1 [0080.484] wcscmp (_String1="flavormap.properties", _String2=".") returned 1 [0080.484] wcscmp (_String1="flavormap.properties", _String2="..") returned 1 [0080.484] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x78) returned 0x38d0ea0 [0080.484] wcscpy (in: _Dest=0x38d0ea0, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.484] wcscat (in: _Dest=0x38d0ea0, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.484] wcscat (in: _Dest=0x38d0ea0, _Source="flavormap.properties" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" [0080.484] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d0ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x720 [0080.485] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xeba, dwReserved0=0x0, dwReserved1=0x0, cFileName="fontconfig.bfc", cAlternateFileName="FONTCO~1.BFC")) returned 1 [0080.485] wcscmp (_String1="fontconfig.bfc", _String2=".") returned 1 [0080.485] wcscmp (_String1="fontconfig.bfc", _String2="..") returned 1 [0080.485] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6c) returned 0x5eee0b0 [0080.485] wcscpy (in: _Dest=0x5eee0b0, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.485] wcscat (in: _Dest=0x5eee0b0, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.485] wcscat (in: _Dest=0x5eee0b0, _Source="fontconfig.bfc" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" [0080.485] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5eee0b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x718 [0080.486] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2948, dwReserved0=0x0, dwReserved1=0x0, cFileName="fontconfig.properties.src", cAlternateFileName="FONTCO~1.SRC")) returned 1 [0080.486] wcscmp (_String1="fontconfig.properties.src", _String2=".") returned 1 [0080.486] wcscmp (_String1="fontconfig.properties.src", _String2="..") returned 1 [0080.486] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x82) returned 0x549d208 [0080.486] wcscpy (in: _Dest=0x549d208, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.486] wcscat (in: _Dest=0x549d208, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.486] wcscat (in: _Dest=0x549d208, _Source="fontconfig.properties.src" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" [0080.486] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549d208, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x710 [0080.487] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa122f229, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fonts", cAlternateFileName="")) returned 1 [0080.487] wcscmp (_String1="fonts", _String2=".") returned 1 [0080.487] wcscmp (_String1="fonts", _String2="..") returned 1 [0080.487] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x6e95ca0 [0080.487] wcscpy (in: _Dest=0x6e95ca0, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.487] wcscat (in: _Dest=0x6e95ca0, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.487] wcscat (in: _Dest=0x6e95ca0, _Source="fonts" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts" [0080.487] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x6e95ca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x70c [0080.488] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x368a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hijrah-config-umalqura.properties", cAlternateFileName="HIJRAH~1.PRO")) returned 1 [0080.488] wcscmp (_String1="hijrah-config-umalqura.properties", _String2=".") returned 1 [0080.488] wcscmp (_String1="hijrah-config-umalqura.properties", _String2="..") returned 1 [0080.488] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x92) returned 0x55c67f8 [0080.488] wcscpy (in: _Dest=0x55c67f8, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.488] wcscat (in: _Dest=0x55c67f8, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.488] wcscat (in: _Dest=0x55c67f8, _Source="hijrah-config-umalqura.properties" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" [0080.488] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55c67f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x700 [0080.489] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa12313ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0080.489] wcscmp (_String1="images", _String2=".") returned 1 [0080.489] wcscmp (_String1="images", _String2="..") returned 1 [0080.489] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x6e96528 [0080.489] wcscpy (in: _Dest=0x6e96528, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.489] wcscat (in: _Dest=0x6e96528, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.489] wcscat (in: _Dest=0x6e96528, _Source="images" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images" [0080.489] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x6e96528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c4 [0080.489] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx.properties", cAlternateFileName="JAVAFX~1.PRO")) returned 1 [0080.489] wcscmp (_String1="javafx.properties", _String2=".") returned 1 [0080.489] wcscmp (_String1="javafx.properties", _String2="..") returned 1 [0080.489] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x72) returned 0x38d0f20 [0080.489] wcscpy (in: _Dest=0x38d0f20, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.490] wcscat (in: _Dest=0x38d0f20, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.490] wcscat (in: _Dest=0x38d0f20, _Source="javafx.properties" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" [0080.490] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d0f20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6cc [0080.490] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8e40a9d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8e40a9d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8e66d0e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe6827, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.jar", cAlternateFileName="")) returned 1 [0080.490] wcscmp (_String1="javaws.jar", _String2=".") returned 1 [0080.490] wcscmp (_String1="javaws.jar", _String2="..") returned 1 [0080.490] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x396e370 [0080.490] wcscpy (in: _Dest=0x396e370, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.490] wcscat (in: _Dest=0x396e370, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.490] wcscat (in: _Dest=0x396e370, _Source="javaws.jar" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" [0080.490] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396e370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6dc [0080.491] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1c6de, dwReserved0=0x0, dwReserved1=0x0, cFileName="jce.jar", cAlternateFileName="")) returned 1 [0080.491] wcscmp (_String1="jce.jar", _String2=".") returned 1 [0080.491] wcscmp (_String1="jce.jar", _String2="..") returned 1 [0080.491] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x6e95d08 [0080.491] wcscpy (in: _Dest=0x6e95d08, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.491] wcscat (in: _Dest=0x6e95d08, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.491] wcscat (in: _Dest=0x6e95d08, _Source="jce.jar" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" [0080.491] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x6e95d08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0080.492] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1295634, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr", cAlternateFileName="")) returned 1 [0080.492] wcscmp (_String1="jfr", _String2=".") returned 1 [0080.492] wcscmp (_String1="jfr", _String2="..") returned 1 [0080.492] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x543d338 [0080.492] wcscpy (in: _Dest=0x543d338, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.492] wcscat (in: _Dest=0x543d338, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.492] wcscat (in: _Dest=0x543d338, _Source="jfr" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr" [0080.492] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x543d338, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x69c [0080.493] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x88dc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.jar", cAlternateFileName="")) returned 1 [0080.493] wcscmp (_String1="jfr.jar", _String2=".") returned 1 [0080.493] wcscmp (_String1="jfr.jar", _String2="..") returned 1 [0080.493] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x6e960b0 [0080.493] wcscpy (in: _Dest=0x6e960b0, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.493] wcscat (in: _Dest=0x6e960b0, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.493] wcscat (in: _Dest=0x6e960b0, _Source="jfr.jar" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" [0080.493] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x6e960b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x374 [0080.494] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x848c, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfxswt.jar", cAlternateFileName="")) returned 1 [0080.494] wcscmp (_String1="jfxswt.jar", _String2=".") returned 1 [0080.494] wcscmp (_String1="jfxswt.jar", _String2="..") returned 1 [0080.494] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x396da40 [0080.494] wcscpy (in: _Dest=0x396da40, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.494] wcscat (in: _Dest=0x396da40, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.494] wcscat (in: _Dest=0x396da40, _Source="jfxswt.jar" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" [0080.494] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396da40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x548 [0080.494] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa76f896, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xaa76f896, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xaa76f896, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8eb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsse.jar", cAlternateFileName="")) returned 1 [0080.494] wcscmp (_String1="jsse.jar", _String2=".") returned 1 [0080.494] wcscmp (_String1="jsse.jar", _String2="..") returned 1 [0080.494] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x6e96388 [0080.495] wcscpy (in: _Dest=0x6e96388, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.495] wcscat (in: _Dest=0x6e96388, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.495] wcscat (in: _Dest=0x6e96388, _Source="jsse.jar" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" [0080.495] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x6e96388, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x670 [0080.495] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1082, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvm.hprof.txt", cAlternateFileName="JVMHPR~1.TXT")) returned 1 [0080.495] wcscmp (_String1="jvm.hprof.txt", _String2=".") returned 1 [0080.495] wcscmp (_String1="jvm.hprof.txt", _String2="..") returned 1 [0080.495] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6a) returned 0x5eeded0 [0080.495] wcscpy (in: _Dest=0x5eeded0, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.496] wcscat (in: _Dest=0x5eeded0, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.496] wcscat (in: _Dest=0x5eeded0, _Source="jvm.hprof.txt" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" [0080.496] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5eeded0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x914 [0080.498] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x997, dwReserved0=0x0, dwReserved1=0x0, cFileName="logging.properties", cAlternateFileName="LOGGIN~1.PRO")) returned 1 [0080.498] wcscmp (_String1="logging.properties", _String2=".") returned 1 [0080.498] wcscmp (_String1="logging.properties", _String2="..") returned 1 [0080.498] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x74) returned 0x38d1320 [0080.498] wcscpy (in: _Dest=0x38d1320, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.498] wcscat (in: _Dest=0x38d1320, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.498] wcscat (in: _Dest=0x38d1320, _Source="logging.properties" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" [0080.498] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d1320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a8 [0080.499] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1389711, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="management", cAlternateFileName="MANAGE~1")) returned 1 [0080.499] wcscmp (_String1="management", _String2=".") returned 1 [0080.499] wcscmp (_String1="management", _String2="..") returned 1 [0080.499] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x396dab0 [0080.499] wcscpy (in: _Dest=0x396dab0, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.499] wcscat (in: _Dest=0x396dab0, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.499] wcscat (in: _Dest=0x396dab0, _Source="management" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management" [0080.499] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x396dab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588 [0080.500] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="management-agent.jar", cAlternateFileName="MANAGE~1.JAR")) returned 1 [0080.500] wcscmp (_String1="management-agent.jar", _String2=".") returned 1 [0080.500] wcscmp (_String1="management-agent.jar", _String2="..") returned 1 [0080.500] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x78) returned 0x38d0fa0 [0080.500] wcscpy (in: _Dest=0x38d0fa0, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.500] wcscat (in: _Dest=0x38d0fa0, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.500] wcscat (in: _Dest=0x38d0fa0, _Source="management-agent.jar" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" [0080.500] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d0fa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b8 [0080.501] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x84e, dwReserved0=0x0, dwReserved1=0x0, cFileName="meta-index", cAlternateFileName="META-I~1")) returned 1 [0080.501] wcscmp (_String1="meta-index", _String2=".") returned 1 [0080.501] wcscmp (_String1="meta-index", _String2="..") returned 1 [0080.501] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x54685c0 [0080.501] wcscpy (in: _Dest=0x54685c0, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.501] wcscat (in: _Dest=0x54685c0, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.501] wcscat (in: _Dest=0x54685c0, _Source="meta-index" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" [0080.501] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54685c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0080.501] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1170, dwReserved0=0x0, dwReserved1=0x0, cFileName="net.properties", cAlternateFileName="NET~1.PRO")) returned 1 [0080.501] wcscmp (_String1="net.properties", _String2=".") returned 1 [0080.501] wcscmp (_String1="net.properties", _String2="..") returned 1 [0080.501] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6c) returned 0x5eedf48 [0080.502] wcscpy (in: _Dest=0x5eedf48, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.502] wcscat (in: _Dest=0x5eedf48, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.502] wcscat (in: _Dest=0x5eedf48, _Source="net.properties" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" [0080.502] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5eedf48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x498 [0080.502] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8d81efe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d81efe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8df45fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1d588b, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin.jar", cAlternateFileName="")) returned 1 [0080.502] wcscmp (_String1="plugin.jar", _String2=".") returned 1 [0080.502] wcscmp (_String1="plugin.jar", _String2="..") returned 1 [0080.502] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x5468400 [0080.502] wcscpy (in: _Dest=0x5468400, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.502] wcscat (in: _Dest=0x5468400, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.502] wcscat (in: _Dest=0x5468400, _Source="plugin.jar" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" [0080.502] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5468400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x368 [0080.504] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xaec, dwReserved0=0x0, dwReserved1=0x0, cFileName="psfont.properties.ja", cAlternateFileName="PSFONT~1.JA")) returned 1 [0080.504] wcscmp (_String1="psfont.properties.ja", _String2=".") returned 1 [0080.504] wcscmp (_String1="psfont.properties.ja", _String2="..") returned 1 [0080.504] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x78) returned 0x38d14a0 [0080.504] wcscpy (in: _Dest=0x38d14a0, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.504] wcscat (in: _Dest=0x38d14a0, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.504] wcscat (in: _Dest=0x38d14a0, _Source="psfont.properties.ja" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" [0080.504] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d14a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x36c [0080.505] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2899, dwReserved0=0x0, dwReserved1=0x0, cFileName="psfontj2d.properties", cAlternateFileName="PSFONT~1.PRO")) returned 1 [0080.505] wcscmp (_String1="psfontj2d.properties", _String2=".") returned 1 [0080.505] wcscmp (_String1="psfontj2d.properties", _String2="..") returned 1 [0080.505] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x78) returned 0x38d1520 [0080.505] wcscpy (in: _Dest=0x38d1520, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.505] wcscat (in: _Dest=0x38d1520, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.505] wcscat (in: _Dest=0x38d1520, _Source="psfontj2d.properties" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" [0080.505] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d1520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384 [0080.505] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x354add, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.jar", cAlternateFileName="RESOUR~1.JAR")) returned 1 [0080.505] wcscmp (_String1="resources.jar", _String2=".") returned 1 [0080.505] wcscmp (_String1="resources.jar", _String2="..") returned 1 [0080.505] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6a) returned 0x5eedfc0 [0080.505] wcscpy (in: _Dest=0x5eedfc0, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.506] wcscat (in: _Dest=0x5eedfc0, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.506] wcscat (in: _Dest=0x5eedfc0, _Source="resources.jar" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" [0080.506] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5eedfc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x398 [0080.506] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa90a30aa, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa90a30aa, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xaa7233eb, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x340865b, dwReserved0=0x0, dwReserved1=0x0, cFileName="rt.jar", cAlternateFileName="")) returned 1 [0080.506] wcscmp (_String1="rt.jar", _String2=".") returned 1 [0080.506] wcscmp (_String1="rt.jar", _String2="..") returned 1 [0080.506] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x6e95d70 [0080.506] wcscpy (in: _Dest=0x6e95d70, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.506] wcscat (in: _Dest=0x6e95d70, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.506] wcscat (in: _Dest=0x6e95d70, _Source="rt.jar" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" [0080.507] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x6e95d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x48c [0080.507] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1418338, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="security", cAlternateFileName="")) returned 1 [0080.507] wcscmp (_String1="security", _String2=".") returned 1 [0080.507] wcscmp (_String1="security", _String2="..") returned 1 [0080.507] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x6e95890 [0080.507] wcscpy (in: _Dest=0x6e95890, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.507] wcscat (in: _Dest=0x6e95890, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.507] wcscat (in: _Dest=0x6e95890, _Source="security" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security" [0080.507] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x6e95890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x39c [0080.508] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="sound.properties", cAlternateFileName="SOUND~1.PRO")) returned 1 [0080.508] wcscmp (_String1="sound.properties", _String2=".") returned 1 [0080.508] wcscmp (_String1="sound.properties", _String2="..") returned 1 [0080.508] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5eee218 [0080.508] wcscpy (in: _Dest=0x5eee218, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.508] wcscat (in: _Dest=0x5eee218, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.508] wcscat (in: _Dest=0x5eee218, _Source="sound.properties" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" [0080.508] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5eee218, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0 [0080.509] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x19c1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="tzdb.dat", cAlternateFileName="")) returned 1 [0080.509] wcscmp (_String1="tzdb.dat", _String2=".") returned 1 [0080.509] wcscmp (_String1="tzdb.dat", _String2="..") returned 1 [0080.509] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x6e95ea8 [0080.509] wcscpy (in: _Dest=0x6e95ea8, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.509] wcscat (in: _Dest=0x6e95ea8, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.509] wcscat (in: _Dest=0x6e95ea8, _Source="tzdb.dat" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" [0080.509] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x6e95ea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x394 [0080.510] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x20d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tzmappings", cAlternateFileName="TZMAPP~1")) returned 1 [0080.510] wcscmp (_String1="tzmappings", _String2=".") returned 1 [0080.510] wcscmp (_String1="tzmappings", _String2="..") returned 1 [0080.510] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x5ba7ab8 [0080.514] wcscpy (in: _Dest=0x5ba7ab8, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib" [0080.515] wcscat (in: _Dest=0x5ba7ab8, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\" [0080.515] wcscat (in: _Dest=0x5ba7ab8, _Source="tzmappings" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" [0080.515] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba7ab8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a0 [0080.515] FindNextFileW (in: hFindFile=0x5ba1430, lpFindFileData=0x39008b8 | out: lpFindFileData=0x39008b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x20d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tzmappings", cAlternateFileName="TZMAPP~1")) returned 0 [0080.515] FindClose (in: hFindFile=0x5ba1430 | out: hFindFile=0x5ba1430) returned 1 [0080.516] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39008b8) returned 1 [0080.516] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5498768) returned 1 [0080.516] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39003b8) returned 1 Thread: id = 893 os_tid = 0x1c30 [0079.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 0x20 [0079.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE", dwFileAttributes=0x20) returned 1 [0079.787] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14b8 [0079.787] GetFileSizeEx (in: hFile=0x14b8, lpFileSize=0x211ff8a8 | out: lpFileSize=0x211ff8a8*=40) returned 1 [0079.787] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e360 [0079.787] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e310 [0079.787] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e180 [0079.787] NtQuerySystemTime (in: CurrentTime=0x211ff808 | out: CurrentTime=0x211ff808*=132260136369504217) returned 0x0 [0079.787] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0xfd806ec3 [0079.788] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0xea814fdd [0079.788] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0x2f7df688 [0079.788] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0x76d7ed9b [0079.788] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0x98952201 [0079.788] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0x6f7c9b03 [0079.788] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0x9db9a293 [0079.788] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0x3b2c1365 [0079.788] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0xd303c278 [0079.788] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0x698d31c4 [0079.788] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0x83aa2e17 [0079.788] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0x15b1b214 [0079.788] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0x9d0f6d28 [0079.788] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0xe15dc776 [0079.788] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0xd8f8f4a9 [0079.788] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0x1f2bd74a [0079.788] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0xd53bc81b [0079.788] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0xf378f06c [0079.788] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0xc34b971a [0079.788] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0xaa591449 [0079.788] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0xfac05dc4 [0079.788] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0xa4e03ef5 [0079.788] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0x4735db96 [0079.788] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0xc73dab2e [0079.788] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0x70eb67e2 [0079.788] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0xe0dc5283 [0079.788] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0x1d329cf7 [0079.788] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0x7d59d74d [0079.788] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0x2c168826 [0079.788] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0x76b9a931 [0079.788] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0xa3f71a5d [0079.788] RtlRandom (in: Seed=0x211ff814 | out: Seed=0x211ff814) returned 0xed0b9365 [0079.798] ReadFile (in: hFile=0x14b8, lpBuffer=0x72a0c18, nNumberOfBytesToRead=0x28, lpNumberOfBytesRead=0x211ff804, lpOverlapped=0x0 | out: lpBuffer=0x72a0c18*, lpNumberOfBytesRead=0x211ff804*=0x28, lpOverlapped=0x0) returned 1 [0079.799] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.799] WriteFile (in: hFile=0x14b8, lpBuffer=0x72ad420*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x211ff800, lpOverlapped=0x0 | out: lpBuffer=0x72ad420*, lpNumberOfBytesWritten=0x211ff800*=0x28, lpOverlapped=0x0) returned 1 [0082.495] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7669548 [0086.006] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x76696d8 [0086.006] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x76696d8) returned 1 [0086.006] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x72ad420) returned 1 [0086.006] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x72a0c18) returned 1 [0086.006] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eedb10) returned 1 [0086.006] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537bbd8) returned 1 [0086.006] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1b) returned 0x7669570 [0086.006] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.006] WriteFile (in: hFile=0x14b8, lpBuffer=0x549aa78*, nNumberOfBytesToWrite=0xff, lpNumberOfBytesWritten=0x211ff868, lpOverlapped=0x0 | out: lpBuffer=0x549aa78*, lpNumberOfBytesWritten=0x211ff868*=0xff, lpOverlapped=0x0) returned 1 [0089.310] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549aa78) returned 1 [0089.310] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x76697f0) returned 1 [0089.310] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7669610) returned 1 [0089.310] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7669570) returned 1 [0089.310] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7669548) returned 1 [0091.529] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e310) returned 1 [0091.529] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e0e0) returned 1 [0091.529] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e338) returned 1 [0091.529] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x96) returned 0x55c5f38 [0091.529] wcscpy (in: _Dest=0x55c5f38, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" [0091.529] wcscat (in: _Dest=0x55c5f38, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.mailto[knoocknoo@cock.li].a0a70" [0091.529] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x211ff820, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0091.529] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xac) returned 0x55c8ac0 Thread: id = 894 os_tid = 0x1c34 [0079.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 0x20 [0079.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt", dwFileAttributes=0x20) returned 1 [0079.801] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14bc [0079.801] GetFileSizeEx (in: hFile=0x14bc, lpFileSize=0x2127fd04 | out: lpFileSize=0x2127fd04*=46) returned 1 [0079.801] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e360 [0079.801] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e388 [0079.801] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e180 [0079.801] NtQuerySystemTime (in: CurrentTime=0x2127fc64 | out: CurrentTime=0x2127fc64*=132260136369660818) returned 0x0 [0079.801] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0xc5c36a4d [0079.801] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0x6f92579c [0079.801] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0x87649ed1 [0079.801] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0x5eb28ee6 [0079.801] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0xc33b0026 [0079.801] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0x172b4c69 [0079.801] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0x322163c4 [0079.801] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0x4e70af30 [0079.801] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0x68f82862 [0079.801] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0xd45b5e28 [0079.801] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0x4bfdd3ac [0079.801] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0xda9a2791 [0079.801] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0xb7a3df1a [0079.801] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0x9ff62e4e [0079.801] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0xd87e946a [0079.801] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0xf19eb01d [0079.801] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0x34426409 [0079.801] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0xb0f2062d [0079.801] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0xb5515123 [0079.801] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0x4a00845 [0079.802] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0x7f4247c3 [0079.802] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0x4e5bc3dc [0079.802] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0x6a05315e [0079.802] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0x4d514b0e [0079.802] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0x687215dc [0079.802] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0x4cf68292 [0079.802] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0xcd574bb [0079.802] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0x79f203ba [0079.802] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0x82ed8dff [0079.802] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0x1e24c233 [0079.802] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0xd91254a7 [0079.802] RtlRandom (in: Seed=0x2127fc70 | out: Seed=0x2127fc70) returned 0xbebb2db9 [0079.812] ReadFile (in: hFile=0x14bc, lpBuffer=0x72b9c28, nNumberOfBytesToRead=0x2e, lpNumberOfBytesRead=0x2127fc60, lpOverlapped=0x0 | out: lpBuffer=0x72b9c28*, lpNumberOfBytesRead=0x2127fc60*=0x2e, lpOverlapped=0x0) returned 1 [0079.813] SetFilePointerEx (in: hFile=0x14bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.813] WriteFile (in: hFile=0x14bc, lpBuffer=0x72c6430*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x2127fc5c, lpOverlapped=0x0 | out: lpBuffer=0x72c6430*, lpNumberOfBytesWritten=0x2127fc5c*=0x2e, lpOverlapped=0x0) returned 1 [0082.494] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7669b00 [0086.007] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7669d08 [0086.007] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7669d08) returned 1 [0086.007] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x72c6430) returned 1 [0086.007] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x72b9c28) returned 1 [0086.007] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eedb88) returned 1 [0086.007] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537bf80) returned 1 [0086.007] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x21) returned 0x38a6880 [0086.007] SetFilePointerEx (in: hFile=0x14bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.007] WriteFile (in: hFile=0x14bc, lpBuffer=0x743a230*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x2127fcc4, lpOverlapped=0x0 | out: lpBuffer=0x743a230*, lpNumberOfBytesWritten=0x2127fcc4*=0x105, lpOverlapped=0x0) returned 1 [0089.311] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x743a230) returned 1 [0089.312] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6af0) returned 1 [0089.312] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7669c18) returned 1 [0089.312] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6880) returned 1 [0089.312] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7669b00) returned 1 [0089.312] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e388) returned 1 [0089.312] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e108) returned 1 [0089.312] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e3b0) returned 1 [0089.312] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9c) returned 0x54a28e0 [0089.312] wcscpy (in: _Dest=0x54a28e0, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" [0089.312] wcscat (in: _Dest=0x54a28e0, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.mailto[knoocknoo@cock.li].a0a70" [0089.312] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x2127fc7c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.312] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb2) returned 0x5b16010 Thread: id = 895 os_tid = 0x1c38 [0079.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 0x20 [0079.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release", dwFileAttributes=0x20) returned 1 [0079.815] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14c0 [0079.815] GetFileSizeEx (in: hFile=0x14c0, lpFileSize=0x212ffe84 | out: lpFileSize=0x212ffe84*=528) returned 1 [0079.815] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x20c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.815] ReadFile (in: hFile=0x14c0, lpBuffer=0x212ffe08, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x212ffe04, lpOverlapped=0x0 | out: lpBuffer=0x212ffe08*, lpNumberOfBytesRead=0x212ffe04*=0x4, lpOverlapped=0x0) returned 1 [0079.816] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.816] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e360 [0079.816] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e3d8 [0079.816] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e180 [0079.816] NtQuerySystemTime (in: CurrentTime=0x212ffde4 | out: CurrentTime=0x212ffde4*=132260136369816624) returned 0x0 [0079.816] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0x495fa3b3 [0079.816] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0x36a8c593 [0079.816] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0x8885a6d6 [0079.816] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0x180319dc [0079.816] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0x6f02a88d [0079.816] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0x981d7c18 [0079.816] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0x764d6bb4 [0079.816] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0x39c4a256 [0079.816] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0xa42f7998 [0079.816] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0x4a8f11a5 [0079.816] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0xbadf7c01 [0079.816] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0x2ed8475c [0079.816] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0xd0881628 [0079.816] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0x47852951 [0079.816] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0x53476a65 [0079.816] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0xc5f2f336 [0079.816] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0xc0fcc3a5 [0079.816] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0x63dd3e0b [0079.816] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0xf161a224 [0079.816] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0x9f2bd45c [0079.816] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0x93566377 [0079.816] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0xf4d587e0 [0079.816] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0x64bc9177 [0079.817] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0x5bdc2afb [0079.817] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0x877db168 [0079.817] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0xd3c6a081 [0079.817] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0x25989113 [0079.817] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0xdb90eb9a [0079.817] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0x19052be8 [0079.817] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0x546e019 [0079.817] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0x6bf50e6b [0079.817] RtlRandom (in: Seed=0x212ffdf0 | out: Seed=0x212ffdf0) returned 0xbbe5debb [0079.827] ReadFile (in: hFile=0x14c0, lpBuffer=0x72d2c38, nNumberOfBytesToRead=0x210, lpNumberOfBytesRead=0x212ffde0, lpOverlapped=0x0 | out: lpBuffer=0x72d2c38*, lpNumberOfBytesRead=0x212ffde0*=0x210, lpOverlapped=0x0) returned 1 [0079.827] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.827] WriteFile (in: hFile=0x14c0, lpBuffer=0x72df440*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x212ffddc, lpOverlapped=0x0 | out: lpBuffer=0x72df440*, lpNumberOfBytesWritten=0x212ffddc*=0x210, lpOverlapped=0x0) returned 1 [0082.496] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe538378 [0086.006] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe538620 [0086.006] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe538620) returned 1 [0086.006] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x72df440) returned 1 [0086.006] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x72d2c38) returned 1 [0086.006] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eedc00) returned 1 [0086.006] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a58d8) returned 1 [0086.006] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1b) returned 0xe538490 [0086.006] SetFilePointerEx (in: hFile=0x14c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.006] WriteFile (in: hFile=0x14c0, lpBuffer=0x549a970*, nNumberOfBytesToWrite=0xff, lpNumberOfBytesWritten=0x212ffe44, lpOverlapped=0x0 | out: lpBuffer=0x549a970*, lpNumberOfBytesWritten=0x212ffe44*=0xff, lpOverlapped=0x0) returned 1 [0089.308] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549a970) returned 1 [0089.308] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe538670) returned 1 [0089.308] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe5384b8) returned 1 [0089.308] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe538490) returned 1 [0089.308] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe538378) returned 1 [0089.309] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e3d8) returned 1 [0089.309] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e130) returned 1 [0089.309] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e400) returned 1 [0089.309] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x96) returned 0x55c58f8 [0089.309] wcscpy (in: _Dest=0x55c58f8, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\release" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned="C:\\Program Files\\Java\\jre1.8.0_144\\release" [0089.309] wcscat (in: _Dest=0x55c58f8, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\release.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Program Files\\Java\\jre1.8.0_144\\release.mailto[knoocknoo@cock.li].a0a70" [0089.309] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Java\\jre1.8.0_144\\release.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x212ffdfc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Java\\jre1.8.0_144\\release.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.309] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xac) returned 0x55c8c30 Thread: id = 896 os_tid = 0x1c3c [0079.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 0x20 [0079.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt", dwFileAttributes=0x20) returned 1 [0079.827] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14c4 [0079.828] GetFileSizeEx (in: hFile=0x14c4, lpFileSize=0x2137fbc8 | out: lpFileSize=0x2137fbc8*=63933) returned 1 [0079.828] SetFilePointerEx (in: hFile=0x14c4, liDistanceToMove=0xf9b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.828] ReadFile (in: hFile=0x14c4, lpBuffer=0x2137fb4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2137fb48, lpOverlapped=0x0 | out: lpBuffer=0x2137fb4c*, lpNumberOfBytesRead=0x2137fb48*=0x4, lpOverlapped=0x0) returned 1 [0079.829] SetFilePointerEx (in: hFile=0x14c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.829] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e360 [0079.829] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e428 [0079.829] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e180 [0079.829] NtQuerySystemTime (in: CurrentTime=0x2137fb28 | out: CurrentTime=0x2137fb28*=132260136369816624) returned 0x0 [0079.829] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0xbc3689c0 [0079.829] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0xa7b29117 [0079.830] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0x89ba44bc [0079.830] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0x541688e [0079.830] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0xe5679758 [0079.830] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0x51d2042 [0079.830] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0xbd6ff18a [0079.830] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0x9a2ec350 [0079.830] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0x756fd6f1 [0079.830] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0x9af2cfcf [0079.830] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0xc7c6c9c2 [0079.830] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0x15a462b1 [0079.830] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0x50329554 [0079.830] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0xa468c398 [0079.830] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0xb3e976c3 [0079.830] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0x27601a8 [0079.830] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0xab46cea8 [0079.830] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0x70279cd5 [0079.830] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0x5332216a [0079.830] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0x9bc36528 [0079.830] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0xe3ddd355 [0079.830] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0xff952875 [0079.830] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0x2814dc5 [0079.830] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0x3365cc50 [0079.830] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0x59b66e91 [0079.830] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0x2272c4e5 [0079.830] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0x5a1daf41 [0079.830] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0xbeffcbed [0079.830] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0x967c2ecc [0079.830] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0xcbac2c6f [0079.830] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0xfb61cace [0079.830] RtlRandom (in: Seed=0x2137fb34 | out: Seed=0x2137fb34) returned 0x78665e53 [0079.840] SetFilePointerEx (in: hFile=0x14c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.840] ReadFile (in: hFile=0x14c4, lpBuffer=0x72ebc48, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2137fb08, lpOverlapped=0x0 | out: lpBuffer=0x72ebc48*, lpNumberOfBytesRead=0x2137fb08*=0xc800, lpOverlapped=0x0) returned 1 [0079.841] SetFilePointerEx (in: hFile=0x14c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.841] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5b18 [0079.841] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5eedc78 [0079.841] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e4a0 [0079.841] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e4a0) returned 1 [0079.842] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x72f8450 [0079.846] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e040 [0079.846] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e478 [0079.846] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e478) returned 1 [0079.846] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eedc78) returned 1 [0079.846] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5b18) returned 1 [0079.846] WriteFile (in: hFile=0x14c4, lpBuffer=0x72f8450*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2137fb08, lpOverlapped=0x0 | out: lpBuffer=0x72f8450*, lpNumberOfBytesWritten=0x2137fb08*=0xc800, lpOverlapped=0x0) returned 1 [0087.561] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x72f8450) Thread: id = 897 os_tid = 0x1c40 [0079.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 0x20 [0079.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt", dwFileAttributes=0x20) returned 1 [0079.846] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14c8 [0079.846] GetFileSizeEx (in: hFile=0x14c8, lpFileSize=0x213ff7c8 | out: lpFileSize=0x213ff7c8*=145180) returned 1 [0079.847] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x23718, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.847] ReadFile (in: hFile=0x14c8, lpBuffer=0x213ff74c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x213ff748, lpOverlapped=0x0 | out: lpBuffer=0x213ff74c*, lpNumberOfBytesRead=0x213ff748*=0x4, lpOverlapped=0x0) returned 1 [0079.848] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.848] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e360 [0079.848] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e478 [0079.848] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e180 [0079.848] NtQuerySystemTime (in: CurrentTime=0x213ff728 | out: CurrentTime=0x213ff728*=132260136370129431) returned 0x0 [0079.848] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0xf52cf734 [0079.848] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0x60ddd3af [0079.849] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0x156fd576 [0079.849] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0x6867939e [0079.849] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0x141896b7 [0079.849] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0x147faa54 [0079.849] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0x110dcaab [0079.849] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0x3e8e400f [0079.849] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0xd2b0b554 [0079.849] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0x66852641 [0079.849] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0x9f492d34 [0079.849] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0x299de666 [0079.849] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0x3613ebde [0079.849] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0xc52fa2a [0079.849] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0xd6e2cbcc [0079.849] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0xe5b3d278 [0079.849] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0x7f885cfc [0079.849] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0xde038677 [0079.849] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0x9fe57d1d [0079.849] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0xe3d4811a [0079.849] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0x20ee7955 [0079.849] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0xf431652a [0079.849] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0xc016f7b2 [0079.849] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0xb0b0f174 [0079.849] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0xf9f3049b [0079.849] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0x40d2aab4 [0079.849] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0x1a2baa03 [0079.849] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0x46bdf93c [0079.849] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0x9e792ab8 [0079.849] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0x9246b535 [0079.849] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0x42dbce58 [0079.849] RtlRandom (in: Seed=0x213ff734 | out: Seed=0x213ff734) returned 0x116f8f8b [0079.859] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.859] ReadFile (in: hFile=0x14c8, lpBuffer=0x7304c58, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x213ff708, lpOverlapped=0x0 | out: lpBuffer=0x7304c58*, lpNumberOfBytesRead=0x213ff708*=0xc800, lpOverlapped=0x0) returned 1 [0079.860] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.860] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x38a5b18 [0079.860] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x5eedc78 [0079.860] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e068 [0079.860] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e068) returned 1 [0079.861] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x7311460 [0079.865] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e068 [0079.865] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e090 [0079.865] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e090) returned 1 [0079.865] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eedc78) returned 1 [0079.865] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5b18) returned 1 [0079.865] WriteFile (in: hFile=0x14c8, lpBuffer=0x7311460*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x213ff708, lpOverlapped=0x0 | out: lpBuffer=0x7311460*, lpNumberOfBytesWritten=0x213ff708*=0xc800, lpOverlapped=0x0) returned 1 [0082.621] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7311460) returned 1 [0085.992] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7304c58) returned 1 [0085.992] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x43) returned 0x38b3368 [0085.993] SetFilePointerEx (in: hFile=0x14c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.993] WriteFile (in: hFile=0x14c8, lpBuffer=0x7586f10*, nNumberOfBytesToWrite=0x127, lpNumberOfBytesWritten=0x213ff788, lpOverlapped=0x0 | out: lpBuffer=0x7586f10*, lpNumberOfBytesWritten=0x213ff788*=0x127, lpOverlapped=0x0) returned 1 [0092.132] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7586f10) returned 1 [0092.132] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b3408) returned 1 [0092.132] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe556eb0) returned 1 [0092.133] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b3368) returned 1 [0092.133] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e068) returned 1 [0092.133] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e478) returned 1 [0092.133] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e270) returned 1 [0092.133] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e4a0) returned 1 [0092.133] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53e8cb0 [0092.133] wcscpy (in: _Dest=0x53e8cb0, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" [0092.133] wcscat (in: _Dest=0x53e8cb0, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.mailto[knoocknoo@cock.li].a0a70" [0092.133] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x213ff740, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.133] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd4) returned 0x7333928 Thread: id = 898 os_tid = 0x1c44 [0079.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 0x20 [0079.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html", dwFileAttributes=0x20) returned 1 [0079.866] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14cc [0079.866] GetFileSizeEx (in: hFile=0x14cc, lpFileSize=0x2147fea0 | out: lpFileSize=0x2147fea0*=955) returned 1 [0079.866] SetFilePointerEx (in: hFile=0x14cc, liDistanceToMove=0x3b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.866] ReadFile (in: hFile=0x14cc, lpBuffer=0x2147fe24, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2147fe20, lpOverlapped=0x0 | out: lpBuffer=0x2147fe24*, lpNumberOfBytesRead=0x2147fe20*=0x4, lpOverlapped=0x0) returned 1 [0079.868] SetFilePointerEx (in: hFile=0x14cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.868] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e360 [0079.868] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e090 [0079.868] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x566e180 [0079.868] NtQuerySystemTime (in: CurrentTime=0x2147fe00 | out: CurrentTime=0x2147fe00*=132260136370300980) returned 0x0 [0079.868] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0xbe0a9c9b [0079.868] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0xb7f13432 [0079.868] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0x932fb82e [0079.868] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0xdf357210 [0079.868] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0xe1e3c273 [0079.868] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0x70ff9294 [0079.868] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0x14e2e44c [0079.868] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0x6bdd85ca [0079.868] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0xee3e00f0 [0079.868] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0x6d9380b7 [0079.868] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0xd022e0e0 [0079.868] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0x1be27a87 [0079.868] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0x505d523f [0079.868] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0x2785f0ed [0079.868] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0xe1918b2c [0079.868] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0x30cc933e [0079.868] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0x37bd016d [0079.868] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0x7e64f7dd [0079.868] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0x8d05fd49 [0079.868] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0x9544adcc [0079.868] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0xb08aa4e5 [0079.868] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0xeb31b6d7 [0079.868] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0xc271cd30 [0079.868] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0xcc36b294 [0079.868] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0xed157d7d [0079.868] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0x3ac7a581 [0079.868] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0xe893a190 [0079.868] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0x92b77d05 [0079.868] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0x10aa7129 [0079.868] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0x2484c899 [0079.869] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0x3c840a48 [0079.869] RtlRandom (in: Seed=0x2147fe0c | out: Seed=0x2147fe0c) returned 0x45dd55c4 [0079.879] ReadFile (in: hFile=0x14cc, lpBuffer=0x731dc68, nNumberOfBytesToRead=0x3bb, lpNumberOfBytesRead=0x2147fdfc, lpOverlapped=0x0 | out: lpBuffer=0x731dc68*, lpNumberOfBytesRead=0x2147fdfc*=0x3bb, lpOverlapped=0x0) returned 1 [0079.879] SetFilePointerEx (in: hFile=0x14cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.879] WriteFile (in: hFile=0x14cc, lpBuffer=0x732a470*, nNumberOfBytesToWrite=0x3bb, lpNumberOfBytesWritten=0x2147fdf8, lpOverlapped=0x0 | out: lpBuffer=0x732a470*, lpNumberOfBytesWritten=0x2147fdf8*=0x3bb, lpOverlapped=0x0) returned 1 [0082.615] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74b52d0 [0085.993] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74b52f8 [0085.993] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b52f8) returned 1 [0085.993] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x732a470) returned 1 [0085.993] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x731dc68) returned 1 [0085.993] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eedc78) returned 1 [0085.993] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a5b18) returned 1 [0085.993] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x25) returned 0x38a6850 [0085.993] SetFilePointerEx (in: hFile=0x14cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.993] WriteFile (in: hFile=0x14cc, lpBuffer=0x743a118*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x2147fe60, lpOverlapped=0x0 | out: lpBuffer=0x743a118*, lpNumberOfBytesWritten=0x2147fe60*=0x109, lpOverlapped=0x0) returned 1 [0089.304] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x743a118) returned 1 [0089.305] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6ac0) returned 1 [0089.305] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b5050) returned 1 [0089.305] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6850) returned 1 [0089.305] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b52d0) returned 1 [0089.305] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e090) returned 1 [0089.305] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e298) returned 1 [0089.305] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x566e6a8) returned 1 [0089.305] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa0) returned 0x54a24f0 [0089.305] wcscpy (in: _Dest=0x54a24f0, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" [0089.305] wcscat (in: _Dest=0x54a24f0, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.mailto[knoocknoo@cock.li].a0a70" [0089.305] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x2147fe18, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0089.305] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb6) returned 0x5b16cd0 Thread: id = 899 os_tid = 0x1c48 [0079.879] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0082.499] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0082.499] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.499] GetLastError () returned 0x5 [0082.499] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0082.499] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f1600) returned 1 Thread: id = 900 os_tid = 0x1c4c [0079.880] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0082.565] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0082.577] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.590] GetLastError () returned 0x5 [0082.590] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0082.606] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f16e8) returned 1 Thread: id = 901 os_tid = 0x1c50 [0079.881] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd6) returned 0x54b2298 [0079.881] wcscpy (in: _Dest=0x54b2298, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0079.881] wcscat (in: _Dest=0x54b2298, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0079.881] wcscat (in: _Dest=0x54b2298, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*" [0079.881] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3900b20 [0079.881] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x3900b20 | out: lpFindFileData=0x3900b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62aca818, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc4070c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62aca818, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445740 [0082.540] wcscmp (_String1=".", _String2=".") returned 0 [0082.540] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x3900b20 | out: lpFindFileData=0x3900b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62aca818, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc4070c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62aca818, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.540] wcscmp (_String1="..", _String2=".") returned 1 [0082.540] wcscmp (_String1="..", _String2="..") returned 0 [0082.540] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x3900b20 | out: lpFindFileData=0x3900b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62aca818, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x62aca818, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x62aca818, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x5880, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1 [0082.540] wcscmp (_String1="CodeIntegrity.cat", _String2=".") returned 1 [0082.540] wcscmp (_String1="CodeIntegrity.cat", _String2="..") returned 1 [0082.540] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf6) returned 0x5ba2ef8 [0082.540] wcscpy (in: _Dest=0x5ba2ef8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0082.540] wcscat (in: _Dest=0x5ba2ef8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0082.540] wcscat (in: _Dest=0x5ba2ef8, _Source="CodeIntegrity.cat" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" [0082.540] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba2ef8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ed0 [0082.541] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x3900b20 | out: lpFindFileData=0x3900b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62aca818, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x62aca818, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x62aca818, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x5880, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 0 [0082.541] FindClose (in: hFindFile=0x5445740 | out: hFindFile=0x5445740) returned 1 [0082.541] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3900b20) returned 1 [0082.541] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b2298) returned 1 [0082.541] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39348e8) returned 1 Thread: id = 902 os_tid = 0x1c54 [0079.881] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0082.630] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0082.640] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.650] GetLastError () returned 0x5 [0082.650] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0082.655] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f17d0) returned 1 Thread: id = 903 os_tid = 0x1c58 [0079.882] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\FilesystemMetadata.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\filesystemmetadata.xml")) returned 0x20 [0082.645] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\FilesystemMetadata.xml", dwFileAttributes=0x20) returned 0 [0082.649] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\FilesystemMetadata.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\filesystemmetadata.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.651] GetLastError () returned 0x5 [0082.651] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\FilesystemMetadata.xml", dwFileAttributes=0x20) returned 0 [0082.656] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396ee48) returned 1 Thread: id = 904 os_tid = 0x1c5c [0079.882] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\FilesystemMetadata.xml.md" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\filesystemmetadata.xml.md")) returned 0x20 [0082.649] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\FilesystemMetadata.xml.md", dwFileAttributes=0x20) returned 0 [0082.651] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\FilesystemMetadata.xml.md" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\filesystemmetadata.xml.md"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.657] GetLastError () returned 0x5 [0082.657] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\FilesystemMetadata.xml.md", dwFileAttributes=0x20) returned 0 [0082.660] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393e8f8) returned 1 Thread: id = 905 os_tid = 0x1c60 [0079.883] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xca) returned 0x39729e0 [0079.883] wcscpy (in: _Dest=0x39729e0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images" [0079.883] wcscat (in: _Dest=0x39729e0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\" [0079.883] wcscat (in: _Dest=0x39729e0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\*" [0079.883] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3900d88 [0079.883] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\*", lpFindFileData=0x3900d88 | out: lpFindFileData=0x3900d88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62baf63d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc41746, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62c6e205, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ba1470 [0079.884] wcscmp (_String1=".", _String2=".") returned 0 [0079.884] FindNextFileW (in: hFindFile=0x5ba1470, lpFindFileData=0x3900d88 | out: lpFindFileData=0x3900d88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62baf63d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc41746, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62c6e205, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.884] wcscmp (_String1="..", _String2=".") returned 1 [0079.884] wcscmp (_String1="..", _String2="..") returned 0 [0079.884] FindNextFileW (in: hFindFile=0x5ba1470, lpFindFileData=0x3900d88 | out: lpFindFileData=0x3900d88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62baf63d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x62baf63d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x62baf63d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x30e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeHubLogo_150x150.png", cAlternateFileName="")) returned 1 [0079.884] wcscmp (_String1="OfficeHubLogo_150x150.png", _String2=".") returned 1 [0079.884] wcscmp (_String1="OfficeHubLogo_150x150.png", _String2="..") returned 1 [0079.884] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfa) returned 0x54997e8 [0079.884] wcscpy (in: _Dest=0x54997e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images" [0079.884] wcscat (in: _Dest=0x54997e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\" [0079.884] wcscat (in: _Dest=0x54997e8, _Source="OfficeHubLogo_150x150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_150x150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_150x150.png" [0080.466] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54997e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xff8 [0080.467] FindNextFileW (in: hFindFile=0x5ba1470, lpFindFileData=0x3900d88 | out: lpFindFileData=0x3900d88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62baf63d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x62baf63d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x62baf63d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeHubLogo_310x150.png", cAlternateFileName="")) returned 1 [0080.467] wcscmp (_String1="OfficeHubLogo_310x150.png", _String2=".") returned 1 [0080.467] wcscmp (_String1="OfficeHubLogo_310x150.png", _String2="..") returned 1 [0080.467] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfa) returned 0x5499d10 [0080.467] wcscpy (in: _Dest=0x5499d10, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images" [0080.467] wcscat (in: _Dest=0x5499d10, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\" [0080.467] wcscat (in: _Dest=0x5499d10, _Source="OfficeHubLogo_310x150.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_310x150.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_310x150.png" [0080.467] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5499d10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcd8 [0080.468] FindNextFileW (in: hFindFile=0x5ba1470, lpFindFileData=0x3900d88 | out: lpFindFileData=0x3900d88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62baf63d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x62bd5897, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x62bd5897, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x65e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeHubLogo_310x310.png", cAlternateFileName="")) returned 1 [0080.468] wcscmp (_String1="OfficeHubLogo_310x310.png", _String2=".") returned 1 [0080.468] wcscmp (_String1="OfficeHubLogo_310x310.png", _String2="..") returned 1 [0080.468] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfa) returned 0x5499f20 [0080.468] wcscpy (in: _Dest=0x5499f20, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images" [0080.468] wcscat (in: _Dest=0x5499f20, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\" [0080.468] wcscat (in: _Dest=0x5499f20, _Source="OfficeHubLogo_310x310.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_310x310.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_310x310.png" [0080.468] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5499f20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc2c [0080.468] FindNextFileW (in: hFindFile=0x5ba1470, lpFindFileData=0x3900d88 | out: lpFindFileData=0x3900d88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bd5897, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x62bd5897, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x62bd5897, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeHubLogo_44x44.png", cAlternateFileName="")) returned 1 [0080.468] wcscmp (_String1="OfficeHubLogo_44x44.png", _String2=".") returned 1 [0080.468] wcscmp (_String1="OfficeHubLogo_44x44.png", _String2="..") returned 1 [0080.468] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf6) returned 0x5ba27f8 [0080.469] wcscpy (in: _Dest=0x5ba27f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images" [0080.469] wcscat (in: _Dest=0x5ba27f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\" [0080.469] wcscat (in: _Dest=0x5ba27f8, _Source="OfficeHubLogo_44x44.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_44x44.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_44x44.png" [0080.469] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba27f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc28 [0080.469] FindNextFileW (in: hFindFile=0x5ba1470, lpFindFileData=0x3900d88 | out: lpFindFileData=0x3900d88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c47fa2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x62c47fa2, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x62c47fa2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x216, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeHubLogo_71x71.png", cAlternateFileName="")) returned 1 [0080.469] wcscmp (_String1="OfficeHubLogo_71x71.png", _String2=".") returned 1 [0080.469] wcscmp (_String1="OfficeHubLogo_71x71.png", _String2="..") returned 1 [0080.469] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf6) returned 0x5ba34f8 [0080.469] wcscpy (in: _Dest=0x5ba34f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images" [0080.469] wcscat (in: _Dest=0x5ba34f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\" [0080.469] wcscat (in: _Dest=0x5ba34f8, _Source="OfficeHubLogo_71x71.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_71x71.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_71x71.png" [0080.470] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba34f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc24 [0080.470] FindNextFileW (in: hFindFile=0x5ba1470, lpFindFileData=0x3900d88 | out: lpFindFileData=0x3900d88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c47fa2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x62c6e205, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x62c6e205, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeHubLogo_Splash.png", cAlternateFileName="")) returned 1 [0080.470] wcscmp (_String1="OfficeHubLogo_Splash.png", _String2=".") returned 1 [0080.470] wcscmp (_String1="OfficeHubLogo_Splash.png", _String2="..") returned 1 [0080.470] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf8) returned 0x5ba36f8 [0080.470] wcscpy (in: _Dest=0x5ba36f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images" [0080.470] wcscat (in: _Dest=0x5ba36f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\" [0080.470] wcscat (in: _Dest=0x5ba36f8, _Source="OfficeHubLogo_Splash.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_Splash.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_Splash.png" [0080.470] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba36f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbbc [0080.471] FindNextFileW (in: hFindFile=0x5ba1470, lpFindFileData=0x3900d88 | out: lpFindFileData=0x3900d88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c6e205, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x62c6e205, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x62c6e205, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x129, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeIcon.png", cAlternateFileName="")) returned 1 [0080.471] wcscmp (_String1="OfficeIcon.png", _String2=".") returned 1 [0080.471] wcscmp (_String1="OfficeIcon.png", _String2="..") returned 1 [0080.471] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe4) returned 0x54b8bf8 [0080.471] wcscpy (in: _Dest=0x54b8bf8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images" [0080.471] wcscat (in: _Dest=0x54b8bf8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\" [0080.471] wcscat (in: _Dest=0x54b8bf8, _Source="OfficeIcon.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeIcon.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeIcon.png" [0080.471] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54b8bf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb4c [0080.472] FindNextFileW (in: hFindFile=0x5ba1470, lpFindFileData=0x3900d88 | out: lpFindFileData=0x3900d88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c6e205, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x62c6e205, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x62c6e205, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x129, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeIcon.png", cAlternateFileName="")) returned 0 [0080.472] FindClose (in: hFindFile=0x5ba1470 | out: hFindFile=0x5ba1470) returned 1 [0080.473] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3900d88) returned 1 [0080.473] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39729e0) returned 1 [0080.473] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3971980) returned 1 Thread: id = 906 os_tid = 0x1c64 [0079.884] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x55fd608 [0079.884] wcscpy (in: _Dest=0x55fd608, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\loc" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\loc") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\loc" [0079.884] wcscat (in: _Dest=0x55fd608, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\loc\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\loc\\" [0079.885] wcscat (in: _Dest=0x55fd608, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\loc\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\loc\\*" [0079.885] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3900ff0 [0079.885] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\loc\\*", lpFindFileData=0x3900ff0 | out: lpFindFileData=0x3900ff0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62c6e205, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc423fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62c6e205, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445800 [0082.578] wcscmp (_String1=".", _String2=".") returned 0 [0082.578] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x3900ff0 | out: lpFindFileData=0x3900ff0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62c6e205, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc423fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62c6e205, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.578] wcscmp (_String1="..", _String2=".") returned 1 [0082.578] wcscmp (_String1="..", _String2="..") returned 0 [0082.578] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x3900ff0 | out: lpFindFileData=0x3900ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c6e205, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x62c9445e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x62c9445e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x274f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifestLoc.16.en-us.xml", cAlternateFileName="")) returned 1 [0082.578] wcscmp (_String1="AppXManifestLoc.16.en-us.xml", _String2=".") returned 1 [0082.578] wcscmp (_String1="AppXManifestLoc.16.en-us.xml", _String2="..") returned 1 [0082.578] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfa) returned 0x7581ad8 [0082.578] wcscpy (in: _Dest=0x7581ad8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\loc" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\loc") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\loc" [0082.578] wcscat (in: _Dest=0x7581ad8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\loc\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\loc\\" [0082.578] wcscat (in: _Dest=0x7581ad8, _Source="AppXManifestLoc.16.en-us.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\loc\\AppXManifestLoc.16.en-us.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\loc\\AppXManifestLoc.16.en-us.xml" [0082.578] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7581ad8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f0c [0082.579] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x3900ff0 | out: lpFindFileData=0x3900ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c6e205, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x62c9445e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x62c9445e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x274f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifestLoc.16.en-us.xml", cAlternateFileName="")) returned 0 [0082.579] FindClose (in: hFindFile=0x5445800 | out: hFindFile=0x5445800) returned 1 [0082.579] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3900ff0) returned 1 [0082.579] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55fd608) returned 1 [0082.579] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3974f50) returned 1 Thread: id = 907 os_tid = 0x1c68 [0079.885] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100) returned 0x549a448 [0079.885] wcscpy (in: _Dest=0x549a448, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0079.885] wcscat (in: _Dest=0x549a448, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0079.885] wcscat (in: _Dest=0x549a448, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0079.885] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b3358 [0079.885] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x53b3358 | out: lpFindFileData=0x53b3358*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc3123ced, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc3123ced, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc3123ced, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445900 [0082.653] wcscmp (_String1=".", _String2=".") returned 0 [0082.653] FindNextFileW (in: hFindFile=0x5445900, lpFindFileData=0x53b3358 | out: lpFindFileData=0x53b3358*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc3123ced, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc3123ced, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc3123ced, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.653] wcscmp (_String1="..", _String2=".") returned 1 [0082.653] wcscmp (_String1="..", _String2="..") returned 0 [0082.653] FindNextFileW (in: hFindFile=0x5445900, lpFindFileData=0x53b3358 | out: lpFindFileData=0x53b3358*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc3123ced, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc3123ced, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc3123ced, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0082.654] FindClose (in: hFindFile=0x5445900 | out: hFindFile=0x5445900) returned 1 [0082.654] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b3358) returned 1 [0082.654] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549a448) returned 1 [0082.654] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x550baa0) returned 1 Thread: id = 908 os_tid = 0x1c6c [0079.886] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\office.odf" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\office.odf")) returned 0x20 [0082.658] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\office.odf", dwFileAttributes=0x20) returned 0 [0082.661] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\office.odf" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\office.odf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.666] GetLastError () returned 0x5 [0082.666] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\office.odf", dwFileAttributes=0x20) returned 0 [0082.670] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39739e8) returned 1 Thread: id = 909 os_tid = 0x1c70 [0079.886] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x3972b90 [0079.886] wcscpy (in: _Dest=0x3972b90, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Office16" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Office16") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Office16" [0079.886] wcscat (in: _Dest=0x3972b90, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Office16\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Office16\\" [0079.886] wcscat (in: _Dest=0x3972b90, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Office16\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Office16\\*" [0079.886] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b35c0 [0079.886] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Office16\\*", lpFindFileData=0x53b35c0 | out: lpFindFileData=0x53b35c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x636ae280, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc4357d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x63720995, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445800 [0082.592] wcscmp (_String1=".", _String2=".") returned 0 [0082.592] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b35c0 | out: lpFindFileData=0x53b35c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x636ae280, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc4357d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x63720995, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.592] wcscmp (_String1="..", _String2=".") returned 1 [0082.592] wcscmp (_String1="..", _String2="..") returned 0 [0082.592] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b35c0 | out: lpFindFileData=0x53b35c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x636ae280, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc4416c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x636ae280, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0082.592] wcscmp (_String1="1033", _String2=".") returned 1 [0082.592] wcscmp (_String1="1033", _String2="..") returned 1 [0082.592] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd4) returned 0x53fcbe0 [0082.592] wcscpy (in: _Dest=0x53fcbe0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Office16" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Office16") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Office16" [0082.592] wcscat (in: _Dest=0x53fcbe0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Office16\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Office16\\" [0082.592] wcscat (in: _Dest=0x53fcbe0, _Source="1033" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Office16\\1033") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Office16\\1033" [0082.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53fcbe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f10 [0082.593] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b35c0 | out: lpFindFileData=0x53b35c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636d44de, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x636fa737, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x636fa737, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x68cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeHubBackgroundTask.dll", cAlternateFileName="")) returned 1 [0082.593] wcscmp (_String1="OfficeHubBackgroundTask.dll", _String2=".") returned 1 [0082.593] wcscmp (_String1="OfficeHubBackgroundTask.dll", _String2="..") returned 1 [0082.593] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b35c0 | out: lpFindFileData=0x53b35c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636fa737, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x636fa737, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x636fa737, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x8ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeHubTaskHost.exe", cAlternateFileName="")) returned 1 [0082.593] wcscmp (_String1="OfficeHubTaskHost.exe", _String2=".") returned 1 [0082.593] wcscmp (_String1="OfficeHubTaskHost.exe", _String2="..") returned 1 [0082.593] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b35c0 | out: lpFindFileData=0x53b35c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63720995, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x638057b6, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x638057b6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1e18c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeHubWin32.exe", cAlternateFileName="")) returned 1 [0082.593] wcscmp (_String1="OfficeHubWin32.exe", _String2=".") returned 1 [0082.593] wcscmp (_String1="OfficeHubWin32.exe", _String2="..") returned 1 [0082.593] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b35c0 | out: lpFindFileData=0x53b35c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63720995, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x638057b6, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x638057b6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1e18c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeHubWin32.exe", cAlternateFileName="")) returned 0 [0082.593] FindClose (in: hFindFile=0x5445800 | out: hFindFile=0x5445800) returned 1 [0082.593] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b35c0) returned 1 [0082.593] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3972b90) returned 1 [0082.593] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3974180) returned 1 Thread: id = 910 os_tid = 0x1c74 [0079.889] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Officehub_Base_PriConfig.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\officehub_base_priconfig.xml")) returned 0x20 [0082.666] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Officehub_Base_PriConfig.xml", dwFileAttributes=0x20) returned 0 [0082.666] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Officehub_Base_PriConfig.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\officehub_base_priconfig.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.671] GetLastError () returned 0x5 [0082.671] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Officehub_Base_PriConfig.xml", dwFileAttributes=0x20) returned 0 [0082.758] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a4d00) returned 1 Thread: id = 911 os_tid = 0x1c78 [0079.889] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\officeimm.odf" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\officeimm.odf")) returned 0x20 [0082.668] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\officeimm.odf", dwFileAttributes=0x20) returned 0 [0082.671] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\officeimm.odf" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\officeimm.odf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.760] GetLastError () returned 0x5 [0082.760] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\officeimm.odf", dwFileAttributes=0x20) returned 0 [0082.766] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39349c8) returned 1 Thread: id = 912 os_tid = 0x1c7c [0079.890] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Offihub_Base_PriInfo.pri.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\offihub_base_priinfo.pri.xml")) returned 0x20 [0082.758] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Offihub_Base_PriInfo.pri.xml", dwFileAttributes=0x20) returned 0 [0082.760] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Offihub_Base_PriInfo.pri.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\offihub_base_priinfo.pri.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.766] GetLastError () returned 0x5 [0082.766] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Offihub_Base_PriInfo.pri.xml", dwFileAttributes=0x20) returned 0 [0082.771] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a3400) returned 1 Thread: id = 913 os_tid = 0x1c80 [0079.890] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Registry.dat" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\registry.dat")) returned 0x20 [0082.762] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Registry.dat", dwFileAttributes=0x20) returned 0 [0082.767] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Registry.dat" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\registry.dat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.772] GetLastError () returned 0x5 [0082.772] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Registry.dat", dwFileAttributes=0x20) returned 0 [0082.778] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3934aa8) returned 1 Thread: id = 914 os_tid = 0x1c84 [0079.891] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\resources.pri")) returned 0x20 [0082.771] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0082.772] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.781] GetLastError () returned 0x5 [0082.781] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0082.788] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3934b88) returned 1 Thread: id = 915 os_tid = 0x1c88 [0079.891] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\StreamMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\streammap.xml")) returned 0x20 [0082.784] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\StreamMap.xml", dwFileAttributes=0x20) returned 0 [0082.820] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\StreamMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\streammap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.825] GetLastError () returned 0x5 [0082.825] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\StreamMap.xml", dwFileAttributes=0x20) returned 0 [0082.825] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3934c68) returned 1 Thread: id = 916 os_tid = 0x1c8c [0079.894] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x3972c68 [0079.895] wcscpy (in: _Dest=0x3972c68, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\strings" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\strings") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\strings" [0079.895] wcscat (in: _Dest=0x3972c68, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\strings\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\strings\\" [0079.895] wcscat (in: _Dest=0x3972c68, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\strings\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\strings\\*" [0079.895] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b5508 [0079.895] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\strings\\*", lpFindFileData=0x53b5508 | out: lpFindFileData=0x53b5508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6395ccec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc44b63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6395ccec, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54459c0 [0082.775] wcscmp (_String1=".", _String2=".") returned 0 [0082.775] FindNextFileW (in: hFindFile=0x54459c0, lpFindFileData=0x53b5508 | out: lpFindFileData=0x53b5508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6395ccec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc44b63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6395ccec, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.775] wcscmp (_String1="..", _String2=".") returned 1 [0082.775] wcscmp (_String1="..", _String2="..") returned 0 [0082.775] FindNextFileW (in: hFindFile=0x54459c0, lpFindFileData=0x53b5508 | out: lpFindFileData=0x53b5508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6395ccec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x6395ccec, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x6395ccec, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1933, dwReserved0=0x0, dwReserved1=0x0, cFileName="officehubintl.lang-en-us.resw", cAlternateFileName="")) returned 1 [0082.775] wcscmp (_String1="officehubintl.lang-en-us.resw", _String2=".") returned 1 [0082.775] wcscmp (_String1="officehubintl.lang-en-us.resw", _String2="..") returned 1 [0082.775] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x104) returned 0x549c2e0 [0082.775] wcscpy (in: _Dest=0x549c2e0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\strings" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\strings") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\strings" [0082.775] wcscat (in: _Dest=0x549c2e0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\strings\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\strings\\" [0082.775] wcscat (in: _Dest=0x549c2e0, _Source="officehubintl.lang-en-us.resw" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\strings\\officehubintl.lang-en-us.resw") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\strings\\officehubintl.lang-en-us.resw" [0082.775] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\strings\\officehubintl.lang-en-us.resw" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\strings\\officehubintl.lang-en-us.resw")) returned 0x20 [0085.979] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\strings\\officehubintl.lang-en-us.resw", dwFileAttributes=0x20) returned 0 [0085.979] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\strings\\officehubintl.lang-en-us.resw" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\strings\\officehubintl.lang-en-us.resw"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0085.979] GetLastError () returned 0x5 [0085.979] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\strings\\officehubintl.lang-en-us.resw", dwFileAttributes=0x20) returned 0 [0085.979] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549c2e0) returned 1 [0085.979] FindNextFileW (in: hFindFile=0x54459c0, lpFindFileData=0x53b5508 | out: lpFindFileData=0x53b5508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6395ccec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x6395ccec, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x6395ccec, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1933, dwReserved0=0x0, dwReserved1=0x0, cFileName="officehubintl.lang-en-us.resw", cAlternateFileName="")) returned 0 [0085.980] FindClose (in: hFindFile=0x54459c0 | out: hFindFile=0x54459c0) returned 1 [0085.980] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b5508) returned 1 [0085.980] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3972c68) returned 1 [0085.980] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3971a50) returned 1 Thread: id = 917 os_tid = 0x1c90 [0079.895] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x55fd6d8 [0079.896] wcscpy (in: _Dest=0x55fd6d8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS" [0079.896] wcscat (in: _Dest=0x55fd6d8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\" [0079.896] wcscat (in: _Dest=0x55fd6d8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\*" [0079.896] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b18e0 [0079.896] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\*", lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6395ccec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc45469, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x662a39a5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54452c0 [0082.786] wcscmp (_String1=".", _String2=".") returned 0 [0082.786] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6395ccec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc45469, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x662a39a5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.786] wcscmp (_String1="..", _String2=".") returned 1 [0082.786] wcscmp (_String1="..", _String2="..") returned 0 [0082.786] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x6395ccec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd7feb3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x6395ccec, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="ProgramFilesCommonX64", cAlternateFileName="PROGRA~1")) returned 1 [0082.786] wcscmp (_String1="ProgramFilesCommonX64", _String2=".") returned 1 [0082.786] wcscmp (_String1="ProgramFilesCommonX64", _String2="..") returned 1 [0082.786] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x54500d0 [0082.786] wcscpy (in: _Dest=0x54500d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS" [0082.786] wcscat (in: _Dest=0x54500d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\" [0082.786] wcscat (in: _Dest=0x54500d0, _Source="ProgramFilesCommonX64" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64" [0082.786] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x5450d68 [0082.786] wcscpy (in: _Dest=0x5450d68, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64" [0082.786] wcscat (in: _Dest=0x5450d68, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\" [0082.786] wcscat (in: _Dest=0x5450d68, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\*" [0082.786] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542d998 [0082.786] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\*", lpFindFileData=0x542d998 | out: lpFindFileData=0x542d998*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6395ccec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd7feb3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x6395ccec, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54453c0 [0082.792] wcscmp (_String1=".", _String2=".") returned 0 [0082.792] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x542d998 | out: lpFindFileData=0x542d998*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6395ccec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd7feb3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x6395ccec, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.792] wcscmp (_String1="..", _String2=".") returned 1 [0082.792] wcscmp (_String1="..", _String2="..") returned 0 [0082.792] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x542d998 | out: lpFindFileData=0x542d998*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x6395ccec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd7feb3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x6395ccec, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0082.793] wcscmp (_String1="Microsoft Shared", _String2=".") returned 1 [0082.793] wcscmp (_String1="Microsoft Shared", _String2="..") returned 1 [0082.793] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x74b3880 [0085.973] wcscpy (in: _Dest=0x74b3880, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64" [0085.973] wcscat (in: _Dest=0x74b3880, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\" [0085.973] wcscat (in: _Dest=0x74b3880, _Source="Microsoft Shared" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared" [0088.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x74b3880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbc8 [0088.744] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x542d998 | out: lpFindFileData=0x542d998*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x6395ccec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd7feb3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x6395ccec, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 0 [0088.744] FindClose (in: hFindFile=0x54453c0 | out: hFindFile=0x54453c0) returned 1 [0088.744] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542d998) returned 1 [0088.744] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5450d68) returned 1 [0088.744] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54500d0) returned 1 [0088.744] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x662a39a5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd7feb3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x663ae9ff, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemX64", cAlternateFileName="SYSTEM~1")) returned 1 [0088.744] wcscmp (_String1="SystemX64", _String2=".") returned 1 [0088.744] wcscmp (_String1="SystemX64", _String2="..") returned 1 [0088.744] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd4) returned 0x3934c68 [0088.744] wcscpy (in: _Dest=0x3934c68, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS" [0088.744] wcscat (in: _Dest=0x3934c68, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\" [0088.744] wcscat (in: _Dest=0x3934c68, _Source="SystemX64" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\SystemX64") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\SystemX64" [0088.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3934c68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f84 [0088.745] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x53b18e0 | out: lpFindFileData=0x53b18e0*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x662a39a5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd7feb3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x663ae9ff, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemX64", cAlternateFileName="SYSTEM~1")) returned 0 [0088.745] FindClose (in: hFindFile=0x54452c0 | out: hFindFile=0x54452c0) returned 1 [0088.745] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b18e0) returned 1 [0088.745] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55fd6d8) returned 1 [0088.745] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3976148) returned 1 Thread: id = 918 os_tid = 0x1c94 [0079.896] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x54b1818 [0079.896] wcscpy (in: _Dest=0x54b1818, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys" [0079.896] wcscat (in: _Dest=0x54b1818, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\" [0079.896] wcscat (in: _Dest=0x54b1818, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\*" [0079.896] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b2280 [0079.896] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\*", lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x663d4c5d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabd372f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6644736d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445800 [0082.609] wcscmp (_String1=".", _String2=".") returned 0 [0082.609] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x663d4c5d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabd372f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6644736d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.610] wcscmp (_String1="..", _String2=".") returned 1 [0082.610] wcscmp (_String1="..", _String2="..") returned 0 [0082.610] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x663d4c5d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x663faeb6, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x663faeb6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4d695, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys_OffVer11.xml", cAlternateFileName="")) returned 1 [0082.610] wcscmp (_String1="Keys_OffVer11.xml", _String2=".") returned 1 [0082.610] wcscmp (_String1="Keys_OffVer11.xml", _String2="..") returned 1 [0082.610] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba2df8 [0082.610] wcscpy (in: _Dest=0x5ba2df8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys" [0082.610] wcscat (in: _Dest=0x5ba2df8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\" [0082.610] wcscat (in: _Dest=0x5ba2df8, _Source="Keys_OffVer11.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\Keys_OffVer11.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\Keys_OffVer11.xml" [0082.610] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba2df8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f28 [0082.610] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x663faeb6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x66421114, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x66421114, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x275b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys_OffVer12.xml", cAlternateFileName="")) returned 1 [0082.610] wcscmp (_String1="Keys_OffVer12.xml", _String2=".") returned 1 [0082.611] wcscmp (_String1="Keys_OffVer12.xml", _String2="..") returned 1 [0082.611] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba3ef8 [0082.611] wcscpy (in: _Dest=0x5ba3ef8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys" [0082.611] wcscat (in: _Dest=0x5ba3ef8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\" [0082.611] wcscat (in: _Dest=0x5ba3ef8, _Source="Keys_OffVer12.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\Keys_OffVer12.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\Keys_OffVer12.xml" [0082.611] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba3ef8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f2c [0082.611] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66421114, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x66421114, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x66421114, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4d89, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys_OffVer14.xml", cAlternateFileName="")) returned 1 [0082.611] wcscmp (_String1="Keys_OffVer14.xml", _String2=".") returned 1 [0082.611] wcscmp (_String1="Keys_OffVer14.xml", _String2="..") returned 1 [0082.611] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba3ff8 [0082.611] wcscpy (in: _Dest=0x5ba3ff8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys" [0082.611] wcscat (in: _Dest=0x5ba3ff8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\" [0082.611] wcscat (in: _Dest=0x5ba3ff8, _Source="Keys_OffVer14.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\Keys_OffVer14.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\Keys_OffVer14.xml" [0082.611] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba3ff8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f30 [0082.612] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66421114, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x66421114, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x66421114, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys_OffVer15.xml", cAlternateFileName="")) returned 1 [0082.612] wcscmp (_String1="Keys_OffVer15.xml", _String2=".") returned 1 [0082.612] wcscmp (_String1="Keys_OffVer15.xml", _String2="..") returned 1 [0082.612] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba38f8 [0082.612] wcscpy (in: _Dest=0x5ba38f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys" [0082.612] wcscat (in: _Dest=0x5ba38f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\" [0082.612] wcscat (in: _Dest=0x5ba38f8, _Source="Keys_OffVer15.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\Keys_OffVer15.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\Keys_OffVer15.xml" [0082.614] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba38f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f34 [0082.615] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66421114, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x66421114, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x66421114, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x67ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys_OffVer16.xml", cAlternateFileName="")) returned 1 [0082.615] wcscmp (_String1="Keys_OffVer16.xml", _String2=".") returned 1 [0082.615] wcscmp (_String1="Keys_OffVer16.xml", _String2="..") returned 1 [0082.615] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba3af8 [0082.616] wcscpy (in: _Dest=0x5ba3af8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys" [0082.616] wcscat (in: _Dest=0x5ba3af8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\" [0082.616] wcscat (in: _Dest=0x5ba3af8, _Source="Keys_OffVer16.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\Keys_OffVer16.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\Keys_OffVer16.xml" [0082.616] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba3af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f38 [0082.616] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66421114, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x6644736d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x6644736d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x140b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys_OffVer365.xml", cAlternateFileName="")) returned 1 [0082.616] wcscmp (_String1="Keys_OffVer365.xml", _String2=".") returned 1 [0082.616] wcscmp (_String1="Keys_OffVer365.xml", _String2="..") returned 1 [0082.616] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf4) returned 0x5ba3bf8 [0082.616] wcscpy (in: _Dest=0x5ba3bf8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys" [0082.616] wcscat (in: _Dest=0x5ba3bf8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\" [0082.616] wcscat (in: _Dest=0x5ba3bf8, _Source="Keys_OffVer365.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\Keys_OffVer365.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\Keys_OffVer365.xml" [0082.616] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba3bf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f3c [0082.617] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6644736d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x6646d5cb, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x6646d5cb, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x8b59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys_OffVerOOBE.xml", cAlternateFileName="")) returned 1 [0082.617] wcscmp (_String1="Keys_OffVerOOBE.xml", _String2=".") returned 1 [0082.617] wcscmp (_String1="Keys_OffVerOOBE.xml", _String2="..") returned 1 [0082.617] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf6) returned 0x5ba3cf8 [0082.617] wcscpy (in: _Dest=0x5ba3cf8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys" [0082.617] wcscat (in: _Dest=0x5ba3cf8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\" [0082.617] wcscat (in: _Dest=0x5ba3cf8, _Source="Keys_OffVerOOBE.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\Keys_OffVerOOBE.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\Keys_OffVerOOBE.xml" [0082.617] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba3cf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f40 [0082.618] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6644736d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x6646d5cb, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x6646d5cb, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x8b59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys_OffVerOOBE.xml", cAlternateFileName="")) returned 0 [0082.618] FindClose (in: hFindFile=0x5445800 | out: hFindFile=0x5445800) returned 1 [0082.618] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53b2280) returned 1 [0082.619] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b1818) returned 1 [0082.619] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39734d8) returned 1 Thread: id = 919 os_tid = 0x1c98 [0079.897] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0082.515] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0082.515] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.515] GetLastError () returned 0x5 [0082.515] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0082.515] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3934488) returned 1 Thread: id = 920 os_tid = 0x1c9c [0079.898] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0082.865] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0082.867] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.867] GetLastError () returned 0x5 [0082.867] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0082.868] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3935528) returned 1 Thread: id = 921 os_tid = 0x1ca0 [0079.898] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd4) returned 0x54b18f8 [0079.898] wcscpy (in: _Dest=0x54b18f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0079.898] wcscat (in: _Dest=0x54b18f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0079.898] wcscat (in: _Dest=0x54b18f8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*" [0079.898] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54071c8 [0079.898] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x54071c8 | out: lpFindFileData=0x54071c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac2ea82c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabba0d3c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac2ea82c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445300 [0082.851] wcscmp (_String1=".", _String2=".") returned 0 [0082.851] FindNextFileW (in: hFindFile=0x5445300, lpFindFileData=0x54071c8 | out: lpFindFileData=0x54071c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac2ea82c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabba0d3c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac2ea82c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.860] wcscmp (_String1="..", _String2=".") returned 1 [0082.862] wcscmp (_String1="..", _String2="..") returned 0 [0082.862] FindNextFileW (in: hFindFile=0x5445300, lpFindFileData=0x54071c8 | out: lpFindFileData=0x54071c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2ea82c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac2ea82c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac2ea82c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x30da, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1 [0082.862] wcscmp (_String1="CodeIntegrity.cat", _String2=".") returned 1 [0082.862] wcscmp (_String1="CodeIntegrity.cat", _String2="..") returned 1 [0082.864] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf4) returned 0x5ba42f8 [0082.864] wcscpy (in: _Dest=0x5ba42f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0082.864] wcscat (in: _Dest=0x5ba42f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0082.864] wcscat (in: _Dest=0x5ba42f8, _Source="CodeIntegrity.cat" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" [0082.864] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat")) returned 0x20 [0082.866] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0082.866] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.866] GetLastError () returned 0x5 [0082.866] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0082.866] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba42f8) returned 1 [0082.866] FindNextFileW (in: hFindFile=0x5445300, lpFindFileData=0x54071c8 | out: lpFindFileData=0x54071c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2ea82c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac2ea82c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac2ea82c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x30da, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 0 [0082.866] FindClose (in: hFindFile=0x5445300 | out: hFindFile=0x5445300) returned 1 [0082.866] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54071c8) returned 1 [0082.866] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b18f8) returned 1 [0082.867] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39735b0) returned 1 Thread: id = 922 os_tid = 0x1ca4 [0079.899] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0082.836] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0082.836] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.836] GetLastError () returned 0x5 [0082.836] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0082.837] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f18b8) returned 1 Thread: id = 923 os_tid = 0x1ca8 [0079.899] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x55fd7a8 [0079.899] wcscpy (in: _Dest=0x55fd7a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets" [0079.899] wcscat (in: _Dest=0x55fd7a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\" [0079.899] wcscat (in: _Dest=0x55fd7a8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\*" [0079.899] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5407430 [0079.899] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x5407430 | out: lpFindFileData=0x5407430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac526b7e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabba158a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac59928e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445980 [0082.851] wcscmp (_String1=".", _String2=".") returned 0 [0082.851] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x5407430 | out: lpFindFileData=0x5407430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac526b7e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabba158a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac59928e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.851] wcscmp (_String1="..", _String2=".") returned 1 [0082.851] wcscmp (_String1="..", _String2="..") returned 0 [0082.851] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x5407430 | out: lpFindFileData=0x5407430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac526b7e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac526b7e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac526b7e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x0, cFileName="dev-config.json", cAlternateFileName="")) returned 1 [0082.851] wcscmp (_String1="dev-config.json", _String2=".") returned 1 [0082.851] wcscmp (_String1="dev-config.json", _String2="..") returned 1 [0082.851] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe4) returned 0x38b04c8 [0082.851] wcscpy (in: _Dest=0x38b04c8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets" [0082.851] wcscat (in: _Dest=0x38b04c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\" [0082.851] wcscat (in: _Dest=0x38b04c8, _Source="dev-config.json" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\dev-config.json") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\dev-config.json" [0082.851] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\dev-config.json" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\assets\\dev-config.json")) returned 0x20 [0082.852] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\dev-config.json", dwFileAttributes=0x20) returned 0 [0082.852] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\dev-config.json" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\assets\\dev-config.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.852] GetLastError () returned 0x5 [0082.852] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\dev-config.json", dwFileAttributes=0x20) returned 0 [0082.852] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b04c8) returned 1 [0082.852] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x5407430 | out: lpFindFileData=0x5407430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac526b7e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabba219f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac526b7e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0082.852] wcscmp (_String1="Fonts", _String2=".") returned 1 [0082.852] wcscmp (_String1="Fonts", _String2="..") returned 1 [0082.852] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x75805d0 [0082.852] wcscpy (in: _Dest=0x75805d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets" [0082.852] wcscat (in: _Dest=0x75805d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\" [0082.853] wcscat (in: _Dest=0x75805d0, _Source="Fonts" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Fonts") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Fonts" [0082.853] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd4) returned 0x53fc860 [0082.853] wcscpy (in: _Dest=0x53fc860, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Fonts" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Fonts") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Fonts" [0082.853] wcscat (in: _Dest=0x53fc860, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Fonts\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Fonts\\" [0082.853] wcscat (in: _Dest=0x53fc860, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Fonts\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Fonts\\*" [0082.853] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542ecd8 [0082.853] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Fonts\\*", lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac526b7e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabba219f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac526b7e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445580 [0082.853] wcscmp (_String1=".", _String2=".") returned 0 [0082.853] FindNextFileW (in: hFindFile=0x5445580, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac526b7e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabba219f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac526b7e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.853] wcscmp (_String1="..", _String2=".") returned 1 [0082.853] wcscmp (_String1="..", _String2="..") returned 0 [0082.853] FindNextFileW (in: hFindFile=0x5445580, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac526b7e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac54cddc, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac54cddc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x714c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BhaiMDL2.ttf", cAlternateFileName="")) returned 1 [0082.853] wcscmp (_String1="BhaiMDL2.ttf", _String2=".") returned 1 [0082.853] wcscmp (_String1="BhaiMDL2.ttf", _String2="..") returned 1 [0082.853] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xea) returned 0x5450b78 [0082.853] wcscpy (in: _Dest=0x5450b78, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Fonts" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Fonts") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Fonts" [0082.853] wcscat (in: _Dest=0x5450b78, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Fonts\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Fonts\\" [0082.853] wcscat (in: _Dest=0x5450b78, _Source="BhaiMDL2.ttf" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Fonts\\BhaiMDL2.ttf") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Fonts\\BhaiMDL2.ttf" [0082.853] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Fonts\\BhaiMDL2.ttf" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\assets\\fonts\\bhaimdl2.ttf")) returned 0x20 [0082.854] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Fonts\\BhaiMDL2.ttf", dwFileAttributes=0x20) returned 0 [0082.854] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Fonts\\BhaiMDL2.ttf" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\assets\\fonts\\bhaimdl2.ttf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.854] GetLastError () returned 0x5 [0082.854] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Fonts\\BhaiMDL2.ttf", dwFileAttributes=0x20) returned 0 [0082.854] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5450b78) returned 1 [0082.854] FindNextFileW (in: hFindFile=0x5445580, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac526b7e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac54cddc, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac54cddc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x714c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BhaiMDL2.ttf", cAlternateFileName="")) returned 0 [0082.854] FindClose (in: hFindFile=0x5445580 | out: hFindFile=0x5445580) returned 1 [0082.854] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542ecd8) returned 1 [0082.854] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fc860) returned 1 [0082.854] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75805d0) returned 1 [0082.854] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x5407430 | out: lpFindFileData=0x5407430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac54cddc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabba2cef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac54cddc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Images", cAlternateFileName="")) returned 1 [0082.854] wcscmp (_String1="Images", _String2=".") returned 1 [0082.854] wcscmp (_String1="Images", _String2="..") returned 1 [0082.854] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x53fce80 [0082.854] wcscpy (in: _Dest=0x53fce80, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets" [0082.854] wcscat (in: _Dest=0x53fce80, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\" [0082.854] wcscat (in: _Dest=0x53fce80, _Source="Images" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images" [0082.855] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd6) returned 0x53fc860 [0082.855] wcscpy (in: _Dest=0x53fc860, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images" [0082.855] wcscat (in: _Dest=0x53fc860, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\" [0082.855] wcscat (in: _Dest=0x53fc860, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\*" [0082.855] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542ecd8 [0082.855] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\*", lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac54cddc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabba2cef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac54cddc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445580 [0082.855] wcscmp (_String1=".", _String2=".") returned 0 [0082.855] FindNextFileW (in: hFindFile=0x5445580, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac54cddc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabba2cef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac54cddc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.855] wcscmp (_String1="..", _String2=".") returned 1 [0082.855] wcscmp (_String1="..", _String2="..") returned 0 [0082.855] FindNextFileW (in: hFindFile=0x5445580, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac54cddc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabbf3417, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac59928e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tiles", cAlternateFileName="")) returned 1 [0082.855] wcscmp (_String1="Tiles", _String2=".") returned 1 [0082.855] wcscmp (_String1="Tiles", _String2="..") returned 1 [0082.855] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xde) returned 0x54f16e8 [0082.855] wcscpy (in: _Dest=0x54f16e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images" [0082.855] wcscat (in: _Dest=0x54f16e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\" [0082.855] wcscat (in: _Dest=0x54f16e8, _Source="Tiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles" [0082.855] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x38b04c8 [0082.855] wcscpy (in: _Dest=0x38b04c8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles" [0082.856] wcscat (in: _Dest=0x38b04c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\" [0082.856] wcscat (in: _Dest=0x38b04c8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\*" [0082.856] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542e5a0 [0082.856] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\*", lpFindFileData=0x542e5a0 | out: lpFindFileData=0x542e5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac54cddc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabbf3417, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac59928e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54455c0 [0082.856] wcscmp (_String1=".", _String2=".") returned 0 [0082.856] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x542e5a0 | out: lpFindFileData=0x542e5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac54cddc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabbf3417, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac59928e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.857] wcscmp (_String1="..", _String2=".") returned 1 [0082.857] wcscmp (_String1="..", _String2="..") returned 0 [0082.857] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x542e5a0 | out: lpFindFileData=0x542e5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac54cddc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac54cddc, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac54cddc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1e90, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.scale-200.png", cAlternateFileName="")) returned 1 [0082.857] wcscmp (_String1="SplashScreen.scale-200.png", _String2=".") returned 1 [0082.857] wcscmp (_String1="SplashScreen.scale-200.png", _String2="..") returned 1 [0082.857] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x114) returned 0x7584640 [0082.857] wcscpy (in: _Dest=0x7584640, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles" [0082.857] wcscat (in: _Dest=0x7584640, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\" [0082.857] wcscat (in: _Dest=0x7584640, _Source="SplashScreen.scale-200.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\SplashScreen.scale-200.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\SplashScreen.scale-200.png" [0082.857] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\SplashScreen.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\assets\\images\\tiles\\splashscreen.scale-200.png")) returned 0x20 [0082.859] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\SplashScreen.scale-200.png", dwFileAttributes=0x20) returned 0 [0082.859] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\SplashScreen.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\assets\\images\\tiles\\splashscreen.scale-200.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.860] GetLastError () returned 0x5 [0082.860] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\SplashScreen.scale-200.png", dwFileAttributes=0x20) returned 0 [0082.860] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7584640) returned 1 [0082.860] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x542e5a0 | out: lpFindFileData=0x542e5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac54cddc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac54cddc, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac54cddc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1142, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square150x150Logo.scale-200.png", cAlternateFileName="")) returned 1 [0082.860] wcscmp (_String1="Square150x150Logo.scale-200.png", _String2=".") returned 1 [0082.860] wcscmp (_String1="Square150x150Logo.scale-200.png", _String2="..") returned 1 [0082.860] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11e) returned 0x7584640 [0082.860] wcscpy (in: _Dest=0x7584640, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles" [0082.860] wcscat (in: _Dest=0x7584640, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\" [0082.860] wcscat (in: _Dest=0x7584640, _Source="Square150x150Logo.scale-200.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Square150x150Logo.scale-200.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Square150x150Logo.scale-200.png" [0082.860] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Square150x150Logo.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\assets\\images\\tiles\\square150x150logo.scale-200.png")) returned 0x20 [0082.861] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Square150x150Logo.scale-200.png", dwFileAttributes=0x20) returned 0 [0082.861] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Square150x150Logo.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\assets\\images\\tiles\\square150x150logo.scale-200.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.861] GetLastError () returned 0x5 [0082.861] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Square150x150Logo.scale-200.png", dwFileAttributes=0x20) returned 0 [0082.861] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7584640) returned 1 [0082.861] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x542e5a0 | out: lpFindFileData=0x542e5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac54cddc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac573035, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac573035, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2442, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square310x310Logo.scale-200.png", cAlternateFileName="")) returned 1 [0082.861] wcscmp (_String1="Square310x310Logo.scale-200.png", _String2=".") returned 1 [0082.861] wcscmp (_String1="Square310x310Logo.scale-200.png", _String2="..") returned 1 [0082.861] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11e) returned 0x7585d60 [0082.861] wcscpy (in: _Dest=0x7585d60, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles" [0082.861] wcscat (in: _Dest=0x7585d60, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\" [0082.861] wcscat (in: _Dest=0x7585d60, _Source="Square310x310Logo.scale-200.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Square310x310Logo.scale-200.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Square310x310Logo.scale-200.png" [0082.862] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Square310x310Logo.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\assets\\images\\tiles\\square310x310logo.scale-200.png")) returned 0x20 [0082.863] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Square310x310Logo.scale-200.png", dwFileAttributes=0x20) returned 0 [0082.863] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Square310x310Logo.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\assets\\images\\tiles\\square310x310logo.scale-200.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.863] GetLastError () returned 0x5 [0082.863] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Square310x310Logo.scale-200.png", dwFileAttributes=0x20) returned 0 [0082.863] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7585d60) returned 1 [0082.863] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x542e5a0 | out: lpFindFileData=0x542e5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac573035, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac573035, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac573035, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x9ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square44x44Logo.scale-200.png", cAlternateFileName="")) returned 1 [0082.863] wcscmp (_String1="Square44x44Logo.scale-200.png", _String2=".") returned 1 [0082.863] wcscmp (_String1="Square44x44Logo.scale-200.png", _String2="..") returned 1 [0082.863] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11a) returned 0x7584ae0 [0082.863] wcscpy (in: _Dest=0x7584ae0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles" [0082.863] wcscat (in: _Dest=0x7584ae0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\" [0082.863] wcscat (in: _Dest=0x7584ae0, _Source="Square44x44Logo.scale-200.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Square44x44Logo.scale-200.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Square44x44Logo.scale-200.png" [0082.863] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Square44x44Logo.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\assets\\images\\tiles\\square44x44logo.scale-200.png")) returned 0x20 [0082.863] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Square44x44Logo.scale-200.png", dwFileAttributes=0x20) returned 0 [0082.863] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Square44x44Logo.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\assets\\images\\tiles\\square44x44logo.scale-200.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.864] GetLastError () returned 0x5 [0082.864] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Square44x44Logo.scale-200.png", dwFileAttributes=0x20) returned 0 [0082.864] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7584ae0) returned 1 [0082.864] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x542e5a0 | out: lpFindFileData=0x542e5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac573035, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac573035, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac573035, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square44x44Logo.targetsize-24_altform-unplated.png", cAlternateFileName="")) returned 1 [0082.864] wcscmp (_String1="Square44x44Logo.targetsize-24_altform-unplated.png", _String2=".") returned 1 [0082.864] wcscmp (_String1="Square44x44Logo.targetsize-24_altform-unplated.png", _String2="..") returned 1 [0082.864] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x144) returned 0x54bddc0 [0085.970] wcscpy (in: _Dest=0x54bddc0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles" [0085.971] wcscat (in: _Dest=0x54bddc0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\" [0085.971] wcscat (in: _Dest=0x54bddc0, _Source="Square44x44Logo.targetsize-24_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Square44x44Logo.targetsize-24_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Square44x44Logo.targetsize-24_altform-unplated.png" [0088.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bddc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x188c [0088.778] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x542e5a0 | out: lpFindFileData=0x542e5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac573035, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac573035, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac573035, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x8a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square71x71Logo.scale-200.png", cAlternateFileName="")) returned 1 [0088.778] wcscmp (_String1="Square71x71Logo.scale-200.png", _String2=".") returned 1 [0088.778] wcscmp (_String1="Square71x71Logo.scale-200.png", _String2="..") returned 1 [0088.778] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11a) returned 0x74d9828 [0088.778] wcscpy (in: _Dest=0x74d9828, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles" [0088.778] wcscat (in: _Dest=0x74d9828, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\" [0088.778] wcscat (in: _Dest=0x74d9828, _Source="Square71x71Logo.scale-200.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Square71x71Logo.scale-200.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Square71x71Logo.scale-200.png" [0088.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74d9828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1888 [0088.779] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x542e5a0 | out: lpFindFileData=0x542e5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac573035, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac59928e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac59928e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x6a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.png", cAlternateFileName="")) returned 1 [0088.779] wcscmp (_String1="StoreLogo.png", _String2=".") returned 1 [0088.779] wcscmp (_String1="StoreLogo.png", _String2="..") returned 1 [0088.779] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfa) returned 0x7582000 [0088.779] wcscpy (in: _Dest=0x7582000, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles" [0088.779] wcscat (in: _Dest=0x7582000, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\" [0088.779] wcscat (in: _Dest=0x7582000, _Source="StoreLogo.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\StoreLogo.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\StoreLogo.png" [0088.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7582000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1884 [0088.779] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x542e5a0 | out: lpFindFileData=0x542e5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac59928e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac59928e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac59928e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x12e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wide310x150Logo.scale-200.png", cAlternateFileName="")) returned 1 [0088.779] wcscmp (_String1="Wide310x150Logo.scale-200.png", _String2=".") returned 1 [0088.779] wcscmp (_String1="Wide310x150Logo.scale-200.png", _String2="..") returned 1 [0088.780] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11a) returned 0x74daf48 [0088.780] wcscpy (in: _Dest=0x74daf48, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles" [0088.780] wcscat (in: _Dest=0x74daf48, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\" [0088.780] wcscat (in: _Dest=0x74daf48, _Source="Wide310x150Logo.scale-200.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Wide310x150Logo.scale-200.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Wide310x150Logo.scale-200.png" [0088.780] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74daf48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1878 [0088.781] FindNextFileW (in: hFindFile=0x54455c0, lpFindFileData=0x542e5a0 | out: lpFindFileData=0x542e5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac59928e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac59928e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac59928e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x12e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wide310x150Logo.scale-200.png", cAlternateFileName="")) returned 0 [0088.781] FindClose (in: hFindFile=0x54455c0 | out: hFindFile=0x54455c0) returned 1 [0088.782] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542e5a0) returned 1 [0088.782] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b04c8) returned 1 [0088.782] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f16e8) returned 1 [0088.782] FindNextFileW (in: hFindFile=0x5445580, lpFindFileData=0x542ecd8 | out: lpFindFileData=0x542ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac54cddc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabbf3417, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac59928e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tiles", cAlternateFileName="")) returned 0 [0088.782] FindClose (in: hFindFile=0x5445580 | out: hFindFile=0x5445580) returned 1 [0088.782] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542ecd8) returned 1 [0088.782] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fc860) returned 1 [0088.782] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fce80) returned 1 [0088.782] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x5407430 | out: lpFindFileData=0x5407430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac59928e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac59928e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac59928e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x0, dwReserved1=0x0, cFileName="release-config.json", cAlternateFileName="")) returned 1 [0088.782] wcscmp (_String1="release-config.json", _String2=".") returned 1 [0088.782] wcscmp (_String1="release-config.json", _String2="..") returned 1 [0088.782] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x393ecd8 [0088.782] wcscpy (in: _Dest=0x393ecd8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets" [0088.782] wcscat (in: _Dest=0x393ecd8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.782] wcscat (in: _Dest=0x393ecd8, _Source="release-config.json" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\release-config.json") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\release-config.json" [0088.782] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x393ecd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f90 [0088.783] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x5407430 | out: lpFindFileData=0x5407430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac59928e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabbf429c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac657e5b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Viewer", cAlternateFileName="")) returned 1 [0088.783] wcscmp (_String1="Viewer", _String2=".") returned 1 [0088.783] wcscmp (_String1="Viewer", _String2="..") returned 1 [0088.783] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x3933a08 [0088.783] wcscpy (in: _Dest=0x3933a08, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets" [0088.783] wcscat (in: _Dest=0x3933a08, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.783] wcscat (in: _Dest=0x3933a08, _Source="Viewer" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Viewer") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Viewer" [0088.783] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3933a08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f94 [0088.784] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x5407430 | out: lpFindFileData=0x5407430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac59928e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabbf429c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac657e5b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Viewer", cAlternateFileName="")) returned 0 [0088.784] FindClose (in: hFindFile=0x5445980 | out: hFindFile=0x5445980) returned 1 [0088.784] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5407430) returned 1 [0088.784] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55fd7a8) returned 1 [0088.784] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3970a10) returned 1 Thread: id = 924 os_tid = 0x1cac [0079.900] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Beihai_Common_Diagnostics.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\beihai_common_diagnostics.winmd")) returned 0x20 [0082.840] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Beihai_Common_Diagnostics.winmd", dwFileAttributes=0x20) returned 0 [0082.840] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Beihai_Common_Diagnostics.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\beihai_common_diagnostics.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.840] GetLastError () returned 0x5 [0082.840] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Beihai_Common_Diagnostics.winmd", dwFileAttributes=0x20) returned 0 [0082.840] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a4700) returned 1 Thread: id = 925 os_tid = 0x1cb0 [0079.900] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Lift.Engine.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\lift.engine.winmd")) returned 0x20 [0082.868] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Lift.Engine.winmd", dwFileAttributes=0x20) returned 0 [0082.869] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Lift.Engine.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\lift.engine.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.869] GetLastError () returned 0x5 [0082.869] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Lift.Engine.winmd", dwFileAttributes=0x20) returned 0 [0082.869] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f0698) returned 1 Thread: id = 926 os_tid = 0x1cb4 [0079.901] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Lift.Transcoding.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\lift.transcoding.winmd")) returned 0x20 [0082.849] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Lift.Transcoding.winmd", dwFileAttributes=0x20) returned 0 [0082.850] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Lift.Transcoding.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\lift.transcoding.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.850] GetLastError () returned 0x5 [0082.850] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Lift.Transcoding.winmd", dwFileAttributes=0x20) returned 0 [0082.850] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396f988) returned 1 Thread: id = 927 os_tid = 0x1cb8 [0079.901] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfe) returned 0x549aa78 [0079.901] wcscpy (in: _Dest=0x549aa78, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0079.901] wcscat (in: _Dest=0x549aa78, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0079.901] wcscat (in: _Dest=0x549aa78, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0079.901] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5407698 [0079.901] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbed30aaa, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xabbf4c99, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbed30aaa, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445980 [0082.844] wcscmp (_String1=".", _String2=".") returned 0 [0082.845] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbed30aaa, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xabbf4c99, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbed30aaa, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.845] wcscmp (_String1="..", _String2=".") returned 1 [0082.848] wcscmp (_String1="..", _String2="..") returned 0 [0082.848] FindNextFileW (in: hFindFile=0x5445980, lpFindFileData=0x5407698 | out: lpFindFileData=0x5407698*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbed30aaa, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xabbf4c99, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbed30aaa, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0082.848] FindClose (in: hFindFile=0x5445980 | out: hFindFile=0x5445980) returned 1 [0082.849] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5407698) returned 1 [0082.849] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549aa78) returned 1 [0082.849] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x550b470) returned 1 Thread: id = 928 os_tid = 0x1cbc [0079.903] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\resources.pri")) returned 0x20 [0079.904] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0079.904] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0079.904] GetLastError () returned 0x5 [0079.904] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0079.904] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3935288) returned 1 Thread: id = 929 os_tid = 0x1cc0 [0079.905] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x38fd7f8 [0079.905] wcscpy (in: _Dest=0x38fd7f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources" [0079.905] wcscat (in: _Dest=0x38fd7f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources\\" [0079.905] wcscat (in: _Dest=0x38fd7f8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources\\*" [0079.905] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393d3b0 [0079.905] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac310a85, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabba02f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac310a85, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445300 [0082.838] wcscmp (_String1=".", _String2=".") returned 0 [0082.838] FindNextFileW (in: hFindFile=0x5445300, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac310a85, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabba02f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac310a85, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.838] wcscmp (_String1="..", _String2=".") returned 1 [0082.838] wcscmp (_String1="..", _String2="..") returned 0 [0082.838] FindNextFileW (in: hFindFile=0x5445300, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac310a85, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac310a85, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac310a85, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.rsrc", cAlternateFileName="")) returned 1 [0082.838] wcscmp (_String1="0.rsrc", _String2=".") returned 1 [0082.838] wcscmp (_String1="0.rsrc", _String2="..") returned 1 [0082.838] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x54f16e8 [0082.838] wcscpy (in: _Dest=0x54f16e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources" [0082.838] wcscat (in: _Dest=0x54f16e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources\\" [0082.838] wcscat (in: _Dest=0x54f16e8, _Source="0.rsrc" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc" [0082.838] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_resources\\0.rsrc")) returned 0x20 [0082.841] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc", dwFileAttributes=0x20) returned 0 [0082.841] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_resources\\0.rsrc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.841] GetLastError () returned 0x5 [0082.841] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc", dwFileAttributes=0x20) returned 0 [0082.842] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f16e8) returned 1 [0082.842] FindNextFileW (in: hFindFile=0x5445300, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac310a85, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac310a85, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac310a85, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1ce4, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.rsrc", cAlternateFileName="")) returned 1 [0082.842] wcscmp (_String1="1.rsrc", _String2=".") returned 1 [0082.842] wcscmp (_String1="1.rsrc", _String2="..") returned 1 [0082.842] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x54f16e8 [0082.842] wcscpy (in: _Dest=0x54f16e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources" [0082.842] wcscat (in: _Dest=0x54f16e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources\\" [0082.842] wcscat (in: _Dest=0x54f16e8, _Source="1.rsrc" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources\\1.rsrc") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources\\1.rsrc" [0082.842] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources\\1.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_resources\\1.rsrc")) returned 0x20 [0082.843] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources\\1.rsrc", dwFileAttributes=0x20) returned 0 [0082.843] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources\\1.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_resources\\1.rsrc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.843] GetLastError () returned 0x5 [0082.843] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources\\1.rsrc", dwFileAttributes=0x20) returned 0 [0082.843] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f16e8) returned 1 [0082.843] FindNextFileW (in: hFindFile=0x5445300, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac310a85, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac310a85, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac310a85, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.txt", cAlternateFileName="")) returned 1 [0082.843] wcscmp (_String1="index.txt", _String2=".") returned 1 [0082.843] wcscmp (_String1="index.txt", _String2="..") returned 1 [0082.843] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54f16e8 [0082.843] wcscpy (in: _Dest=0x54f16e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources" [0082.843] wcscat (in: _Dest=0x54f16e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources\\" [0082.843] wcscat (in: _Dest=0x54f16e8, _Source="index.txt" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt" [0082.843] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_resources\\index.txt")) returned 0x20 [0082.847] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt", dwFileAttributes=0x20) returned 0 [0082.847] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_resources\\index.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.847] GetLastError () returned 0x5 [0082.847] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt", dwFileAttributes=0x20) returned 0 [0082.847] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f16e8) returned 1 [0082.847] FindNextFileW (in: hFindFile=0x5445300, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac310a85, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac310a85, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac310a85, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.txt", cAlternateFileName="")) returned 0 [0082.847] FindClose (in: hFindFile=0x5445300 | out: hFindFile=0x5445300) returned 1 [0082.847] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393d3b0) returned 1 [0082.848] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38fd7f8) returned 1 [0082.848] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3973688) returned 1 Thread: id = 930 os_tid = 0x1cc4 [0079.906] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x7285b08 [0079.906] wcscpy (in: _Dest=0x7285b08, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black" [0079.906] wcscat (in: _Dest=0x7285b08, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\" [0079.906] wcscat (in: _Dest=0x7285b08, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\*" [0079.906] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393be08 [0079.906] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\*", lpFindFileData=0x393be08 | out: lpFindFileData=0x393be08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97326c19, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9a18213, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9739a738, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7567588 [0087.468] wcscmp (_String1=".", _String2=".") returned 0 [0087.468] FindNextFileW (hFindFile=0x7567588, lpFindFileData=0x393be08) Thread: id = 931 os_tid = 0x1cc8 [0079.907] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x7285c00 [0079.907] wcscpy (in: _Dest=0x7285c00, _Source="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white" [0079.907] wcscat (in: _Dest=0x7285c00, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\" [0079.907] wcscat (in: _Dest=0x7285c00, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\*" [0079.907] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53cf018 [0079.907] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\*", lpFindFileData=0x53cf018 | out: lpFindFileData=0x53cf018*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9739a738, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9a9f7f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x974330d0, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7567708 [0087.644] wcscmp (_String1=".", _String2=".") returned 0 [0087.644] FindNextFileW (hFindFile=0x7567708, lpFindFileData=0x53cf018) Thread: id = 932 os_tid = 0x1ccc [0079.907] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\icon.targetsize-16.png")) returned 0x20 [0088.194] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-16.png", dwFileAttributes=0x20) returned 0 [0088.194] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\icon.targetsize-16.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0088.194] GetLastError () returned 0x5 [0088.194] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-16.png", dwFileAttributes=0x20) returned 0 [0088.194] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x550b578) returned 1 Thread: id = 933 os_tid = 0x1cd0 [0079.908] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\icon.targetsize-256.png")) returned 0x20 [0088.192] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-256.png", dwFileAttributes=0x20) returned 0 [0088.193] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\icon.targetsize-256.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0088.193] GetLastError () returned 0x5 [0088.193] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-256.png", dwFileAttributes=0x20) returned 0 [0088.193] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x550b680) returned 1 Thread: id = 934 os_tid = 0x1cd4 [0079.908] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\icon.targetsize-32.png")) returned 0x20 [0088.191] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-32.png", dwFileAttributes=0x20) returned 0 [0088.191] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\icon.targetsize-32.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0088.191] GetLastError () returned 0x5 [0088.191] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-32.png", dwFileAttributes=0x20) returned 0 [0088.191] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x550b998) returned 1 Thread: id = 935 os_tid = 0x1cd8 [0079.909] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\icon.targetsize-48.png")) returned 0x20 [0088.189] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-48.png", dwFileAttributes=0x20) returned 0 [0088.190] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\icon.targetsize-48.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0088.190] GetLastError () returned 0x5 [0088.190] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-48.png", dwFileAttributes=0x20) returned 0 [0088.190] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x550b788) returned 1 Thread: id = 936 os_tid = 0x1cdc [0079.909] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\splashscreen.scale-100.png")) Thread: id = 937 os_tid = 0x1ce0 [0079.911] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square150x150Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\square150x150logo.scale-100.png")) Thread: id = 938 os_tid = 0x1ce4 [0079.912] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square310x150Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\square310x150logo.scale-100.png")) Thread: id = 939 os_tid = 0x1ce8 [0079.912] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square310x310Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\square310x310logo.scale-100.png")) Thread: id = 940 os_tid = 0x1cec [0079.913] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\square44x44logo.scale-100.png")) Thread: id = 941 os_tid = 0x1cf0 [0079.913] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\square44x44logo.targetsize-16.png")) Thread: id = 942 os_tid = 0x1cf4 [0079.914] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-16_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\square44x44logo.targetsize-16_altform-unplated.png")) Thread: id = 943 os_tid = 0x1cf8 [0079.917] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\square44x44logo.targetsize-24.png")) Thread: id = 944 os_tid = 0x1cfc [0079.917] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-24_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\square44x44logo.targetsize-24_altform-unplated.png")) Thread: id = 945 os_tid = 0x1d00 [0079.918] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\square44x44logo.targetsize-256.png")) Thread: id = 946 os_tid = 0x1d04 [0079.918] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-256_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\square44x44logo.targetsize-256_altform-unplated.png")) Thread: id = 947 os_tid = 0x1d08 [0079.919] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\square44x44logo.targetsize-48.png")) Thread: id = 948 os_tid = 0x1d0c [0079.919] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-48_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\square44x44logo.targetsize-48_altform-unplated.png")) Thread: id = 949 os_tid = 0x1d10 [0079.920] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square71x71Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\square71x71logo.scale-100.png")) returned 0x20 [0088.184] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square71x71Logo.scale-100.png", dwFileAttributes=0x20) returned 0 [0088.184] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square71x71Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\square71x71logo.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0088.185] GetLastError () returned 0x5 [0088.185] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square71x71Logo.scale-100.png", dwFileAttributes=0x20) returned 0 [0088.185] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5499390) Thread: id = 950 os_tid = 0x1d14 [0080.411] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\StoreLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\storelogo.scale-100.png")) returned 0x20 [0088.183] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\StoreLogo.scale-100.png", dwFileAttributes=0x20) returned 0 [0088.183] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\StoreLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\storelogo.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0088.183] GetLastError () returned 0x5 [0088.183] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\StoreLogo.scale-100.png", dwFileAttributes=0x20) returned 0 [0088.183] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x550b890) returned 1 Thread: id = 951 os_tid = 0x1d18 [0080.411] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xac) returned 0x55c7f40 [0080.411] wcscpy (in: _Dest=0x55c7f40, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App" [0080.411] wcscat (in: _Dest=0x55c7f40, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\" [0080.411] wcscat (in: _Dest=0x55c7f40, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\*") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\*" [0080.411] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d0a90 [0080.411] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\*", lpFindFileData=0x53d0a90 | out: lpFindFileData=0x53d0a90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x229e4b3b, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa95725d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x22a0ae1c, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7567788 [0087.663] wcscmp (_String1=".", _String2=".") returned 0 [0087.663] FindNextFileW (hFindFile=0x7567788, lpFindFileData=0x53d0a90) Thread: id = 952 os_tid = 0x1d1c [0080.412] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\list.scale-100.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\list.scale-100.png")) returned 0x20 [0089.916] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\list.scale-100.png", dwFileAttributes=0x20) returned 0 [0089.916] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\list.scale-100.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\list.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.916] GetLastError () returned 0x5 [0089.916] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\list.scale-100.png", dwFileAttributes=0x20) returned 0 [0089.917] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3971b20) returned 1 Thread: id = 953 os_tid = 0x1d20 [0080.412] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\list.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\list.scale-100_contrast-black.png")) returned 0x20 [0089.917] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\list.scale-100_contrast-black.png", dwFileAttributes=0x20) returned 0 [0089.917] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\list.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\list.scale-100_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.917] GetLastError () returned 0x5 [0089.918] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\list.scale-100_contrast-black.png", dwFileAttributes=0x20) returned 0 [0089.918] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396ec68) returned 1 Thread: id = 954 os_tid = 0x1d24 [0080.413] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\list.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\list.scale-100_contrast-white.png")) returned 0x20 [0089.903] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\list.scale-100_contrast-white.png", dwFileAttributes=0x20) returned 0 [0089.903] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\list.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\list.scale-100_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.915] GetLastError () returned 0x5 [0089.915] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\list.scale-100_contrast-white.png", dwFileAttributes=0x20) returned 0 [0089.915] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3970018) returned 1 Thread: id = 955 os_tid = 0x1d28 [0080.413] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb8) returned 0x5b16550 [0080.413] wcscpy (in: _Dest=0x5b16550, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope" [0080.413] wcscat (in: _Dest=0x5b16550, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\" [0080.413] wcscat (in: _Dest=0x5b16550, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\*") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\*" [0080.413] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542d4c8 [0080.413] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\*", lpFindFileData=0x542d4c8 | out: lpFindFileData=0x542d4c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22a31024, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa95a0375, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x22a572ca, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54452c0 [0089.904] wcscmp (_String1=".", _String2=".") returned 0 [0089.904] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x542d4c8 | out: lpFindFileData=0x542d4c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22a31024, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa95a0375, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x22a572ca, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.904] wcscmp (_String1="..", _String2=".") returned 1 [0089.904] wcscmp (_String1="..", _String2="..") returned 0 [0089.904] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x542d4c8 | out: lpFindFileData=0x542d4c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a31024, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a31024, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x3a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="heart.png", cAlternateFileName="")) returned 1 [0089.904] wcscmp (_String1="heart.png", _String2=".") returned 1 [0089.904] wcscmp (_String1="heart.png", _String2="..") returned 1 [0089.904] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x53f7470 [0089.904] wcscpy (in: _Dest=0x53f7470, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope" [0089.904] wcscat (in: _Dest=0x53f7470, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\" [0089.904] wcscat (in: _Dest=0x53f7470, _Source="heart.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\heart.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\heart.png" [0089.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53f7470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x46c [0089.906] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x542d4c8 | out: lpFindFileData=0x542d4c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a572ca, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a572ca, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x8607, dwReserved0=0x0, dwReserved1=0x0, cFileName="periscope-logo-white-text-nobg.png", cAlternateFileName="PE203D~1.PNG")) returned 1 [0089.906] wcscmp (_String1="periscope-logo-white-text-nobg.png", _String2=".") returned 1 [0089.906] wcscmp (_String1="periscope-logo-white-text-nobg.png", _String2="..") returned 1 [0089.906] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfa) returned 0x7582c60 [0089.906] wcscpy (in: _Dest=0x7582c60, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope" [0089.906] wcscat (in: _Dest=0x7582c60, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\" [0089.906] wcscat (in: _Dest=0x7582c60, _Source="periscope-logo-white-text-nobg.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\periscope-logo-white-text-nobg.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\periscope-logo-white-text-nobg.png" [0089.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7582c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620 [0089.907] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x542d4c8 | out: lpFindFileData=0x542d4c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a31024, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a31024, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x4b1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Periscope_logo.png", cAlternateFileName="PERISC~1.PNG")) returned 1 [0089.907] wcscmp (_String1="Periscope_logo.png", _String2=".") returned 1 [0089.907] wcscmp (_String1="Periscope_logo.png", _String2="..") returned 1 [0089.907] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x54f0950 [0089.907] wcscpy (in: _Dest=0x54f0950, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope" [0089.907] wcscat (in: _Dest=0x54f0950, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\" [0089.907] wcscat (in: _Dest=0x54f0950, _Source="Periscope_logo.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo.png" [0089.907] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f0950, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1644 [0089.907] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x542d4c8 | out: lpFindFileData=0x542d4c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a31024, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a31024, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x4fb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Periscope_logo_bw.png", cAlternateFileName="PERISC~2.PNG")) returned 1 [0089.907] wcscmp (_String1="Periscope_logo_bw.png", _String2=".") returned 1 [0089.907] wcscmp (_String1="Periscope_logo_bw.png", _String2="..") returned 1 [0089.907] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54f0fa8 [0089.907] wcscpy (in: _Dest=0x54f0fa8, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope" [0089.907] wcscat (in: _Dest=0x54f0fa8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\" [0089.908] wcscat (in: _Dest=0x54f0fa8, _Source="Periscope_logo_bw.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_bw.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_bw.png" [0089.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f0fa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13e0 [0089.908] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x542d4c8 | out: lpFindFileData=0x542d4c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a572ca, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a572ca, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0xdb8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Periscope_logo_color.png", cAlternateFileName="PERISC~3.PNG")) returned 1 [0089.908] wcscmp (_String1="Periscope_logo_color.png", _String2=".") returned 1 [0089.908] wcscmp (_String1="Periscope_logo_color.png", _String2="..") returned 1 [0089.908] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe6) returned 0x54b9558 [0089.908] wcscpy (in: _Dest=0x54b9558, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope" [0089.908] wcscat (in: _Dest=0x54b9558, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\" [0089.908] wcscat (in: _Dest=0x54b9558, _Source="Periscope_logo_color.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_color.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_color.png" [0089.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54b9558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1638 [0089.909] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x542d4c8 | out: lpFindFileData=0x542d4c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a572ca, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a572ca, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x8ead, dwReserved0=0x0, dwReserved1=0x0, cFileName="Periscope_logo_color_circle.png", cAlternateFileName="PERISC~4.PNG")) returned 1 [0089.909] wcscmp (_String1="Periscope_logo_color_circle.png", _String2=".") returned 1 [0089.909] wcscmp (_String1="Periscope_logo_color_circle.png", _String2="..") returned 1 [0089.909] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf4) returned 0x5ba44f8 [0089.909] wcscpy (in: _Dest=0x5ba44f8, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope" [0089.909] wcscat (in: _Dest=0x5ba44f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\" [0089.909] wcscat (in: _Dest=0x5ba44f8, _Source="Periscope_logo_color_circle.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_color_circle.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_color_circle.png" [0089.909] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba44f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x162c [0089.910] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x542d4c8 | out: lpFindFileData=0x542d4c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a572ca, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a572ca, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x4aa94, dwReserved0=0x0, dwReserved1=0x0, cFileName="Periscope_logo_color_rounded_corners.png", cAlternateFileName="PEEC32~1.PNG")) returned 1 [0089.910] wcscmp (_String1="Periscope_logo_color_rounded_corners.png", _String2=".") returned 1 [0089.910] wcscmp (_String1="Periscope_logo_color_rounded_corners.png", _String2="..") returned 1 [0089.910] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x7589560 [0089.910] wcscpy (in: _Dest=0x7589560, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope" [0089.910] wcscat (in: _Dest=0x7589560, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\" [0089.910] wcscat (in: _Dest=0x7589560, _Source="Periscope_logo_color_rounded_corners.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_color_rounded_corners.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_color_rounded_corners.png" [0089.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7589560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1624 [0089.911] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x542d4c8 | out: lpFindFileData=0x542d4c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a572ca, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a572ca, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x1ec3, dwReserved0=0x0, dwReserved1=0x0, cFileName="periscope_logo_icon.png", cAlternateFileName="PE2861~1.PNG")) returned 1 [0089.911] wcscmp (_String1="periscope_logo_icon.png", _String2=".") returned 1 [0089.911] wcscmp (_String1="periscope_logo_icon.png", _String2="..") returned 1 [0089.911] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe4) returned 0x54b9be8 [0089.911] wcscpy (in: _Dest=0x54b9be8, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope" [0089.911] wcscat (in: _Dest=0x54b9be8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\" [0089.911] wcscat (in: _Dest=0x54b9be8, _Source="periscope_logo_icon.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\periscope_logo_icon.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\periscope_logo_icon.png" [0089.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54b9be8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x161c [0089.911] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x542d4c8 | out: lpFindFileData=0x542d4c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a572ca, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a572ca, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x27f, dwReserved0=0x0, dwReserved1=0x0, cFileName="viewers_icon.png", cAlternateFileName="VIEWER~1.PNG")) returned 1 [0089.911] wcscmp (_String1="viewers_icon.png", _String2=".") returned 1 [0089.911] wcscmp (_String1="viewers_icon.png", _String2="..") returned 1 [0089.911] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd6) returned 0x3934d48 [0089.912] wcscpy (in: _Dest=0x3934d48, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope" [0089.912] wcscat (in: _Dest=0x3934d48, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\" [0089.912] wcscat (in: _Dest=0x3934d48, _Source="viewers_icon.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\viewers_icon.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\viewers_icon.png" [0089.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3934d48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1610 [0089.912] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x542d4c8 | out: lpFindFileData=0x542d4c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a572ca, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a572ca, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x1fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="viewers_icon_grey.png", cAlternateFileName="VIEWER~2.PNG")) returned 1 [0089.912] wcscmp (_String1="viewers_icon_grey.png", _String2=".") returned 1 [0089.912] wcscmp (_String1="viewers_icon_grey.png", _String2="..") returned 1 [0089.912] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54f1b70 [0089.912] wcscpy (in: _Dest=0x54f1b70, _Source="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope" [0089.912] wcscat (in: _Dest=0x54f1b70, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\" [0089.912] wcscat (in: _Dest=0x54f1b70, _Source="viewers_icon_grey.png" | out: _Dest="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\viewers_icon_grey.png") returned="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\viewers_icon_grey.png" [0089.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f1b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1608 [0089.913] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x542d4c8 | out: lpFindFileData=0x542d4c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a572ca, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a572ca, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x1fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="viewers_icon_grey.png", cAlternateFileName="VIEWER~2.PNG")) returned 0 [0089.913] FindClose (in: hFindFile=0x54452c0 | out: hFindFile=0x54452c0) returned 1 [0089.914] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542d4c8) returned 1 [0089.914] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5b16550) returned 1 [0089.914] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3904d20) returned 1 Thread: id = 956 os_tid = 0x1d2c [0080.414] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\search.scale-100.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\search.scale-100.png")) returned 0x20 [0089.901] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\search.scale-100.png", dwFileAttributes=0x20) returned 0 [0089.901] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\search.scale-100.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\search.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.901] GetLastError () returned 0x5 [0089.901] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\search.scale-100.png", dwFileAttributes=0x20) returned 0 [0089.902] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3973b98) returned 1 Thread: id = 957 os_tid = 0x1d30 [0080.414] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\search.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\search.scale-100_contrast-black.png")) returned 0x20 [0089.900] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\search.scale-100_contrast-black.png", dwFileAttributes=0x20) returned 0 [0089.900] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\search.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\search.scale-100_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.900] GetLastError () returned 0x5 [0089.900] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\search.scale-100_contrast-black.png", dwFileAttributes=0x20) returned 0 [0089.901] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396fa78) returned 1 Thread: id = 958 os_tid = 0x1d34 [0080.415] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\search.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\search.scale-100_contrast-white.png")) returned 0x20 [0089.899] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\search.scale-100_contrast-white.png", dwFileAttributes=0x20) returned 0 [0089.899] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\search.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\search.scale-100_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.899] GetLastError () returned 0x5 [0089.899] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\search.scale-100_contrast-white.png", dwFileAttributes=0x20) returned 0 [0089.899] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396ef38) returned 1 Thread: id = 959 os_tid = 0x1d38 [0080.415] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\StoreLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\storelogo.scale-100.png")) returned 0x20 [0089.898] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\StoreLogo.scale-100.png", dwFileAttributes=0x20) returned 0 [0089.898] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\StoreLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\storelogo.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.898] GetLastError () returned 0x5 [0089.898] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\StoreLogo.scale-100.png", dwFileAttributes=0x20) returned 0 [0089.898] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3973760) returned 1 Thread: id = 960 os_tid = 0x1d3c [0080.416] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\StoreLogo.scale-140.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\storelogo.scale-140.png")) returned 0x20 [0089.897] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\StoreLogo.scale-140.png", dwFileAttributes=0x20) returned 0 [0089.897] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\StoreLogo.scale-140.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\storelogo.scale-140.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.897] GetLastError () returned 0x5 [0089.897] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\StoreLogo.scale-140.png", dwFileAttributes=0x20) returned 0 [0089.897] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3973c70) returned 1 Thread: id = 961 os_tid = 0x1d40 [0080.416] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\StoreLogo.scale-180.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\storelogo.scale-180.png")) returned 0x20 [0089.896] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\StoreLogo.scale-180.png", dwFileAttributes=0x20) returned 0 [0089.896] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\StoreLogo.scale-180.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\storelogo.scale-180.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.896] GetLastError () returned 0x5 [0089.896] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\StoreLogo.scale-180.png", dwFileAttributes=0x20) returned 0 [0089.896] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3973838) returned 1 Thread: id = 962 os_tid = 0x1d44 [0080.416] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-100.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-100.png")) returned 0x20 [0089.895] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-100.png", dwFileAttributes=0x20) returned 0 [0089.895] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-100.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.895] GetLastError () returned 0x5 [0089.895] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-100.png", dwFileAttributes=0x20) returned 0 [0089.895] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f1b70) returned 1 Thread: id = 963 os_tid = 0x1d48 [0080.417] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-100_contrast-black.png")) returned 0x20 [0089.894] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-100_contrast-black.png", dwFileAttributes=0x20) returned 0 [0089.894] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-100_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.894] GetLastError () returned 0x5 [0089.894] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-100_contrast-black.png", dwFileAttributes=0x20) returned 0 [0089.894] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a3d00) returned 1 Thread: id = 964 os_tid = 0x1d4c [0080.417] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-100_contrast-white.png")) returned 0x20 [0089.893] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-100_contrast-white.png", dwFileAttributes=0x20) returned 0 [0089.893] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-100_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.893] GetLastError () returned 0x5 [0089.893] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-100_contrast-white.png", dwFileAttributes=0x20) returned 0 [0089.893] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a3500) returned 1 Thread: id = 965 os_tid = 0x1d50 [0080.418] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-125.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-125.png")) returned 0x20 [0089.891] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-125.png", dwFileAttributes=0x20) returned 0 [0089.892] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-125.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-125.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.892] GetLastError () returned 0x5 [0089.892] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-125.png", dwFileAttributes=0x20) returned 0 [0089.892] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f0950) returned 1 Thread: id = 966 os_tid = 0x1d54 [0080.418] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-125_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-125_contrast-black.png")) returned 0x20 [0089.890] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-125_contrast-black.png", dwFileAttributes=0x20) returned 0 [0089.890] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-125_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-125_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.891] GetLastError () returned 0x5 [0089.891] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-125_contrast-black.png", dwFileAttributes=0x20) returned 0 [0089.891] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a3e00) returned 1 Thread: id = 967 os_tid = 0x1d58 [0080.418] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-125_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-125_contrast-white.png")) returned 0x20 [0089.889] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-125_contrast-white.png", dwFileAttributes=0x20) returned 0 [0089.889] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-125_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-125_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.889] GetLastError () returned 0x5 [0089.889] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-125_contrast-white.png", dwFileAttributes=0x20) returned 0 [0089.890] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a4400) returned 1 Thread: id = 968 os_tid = 0x1d5c [0080.419] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-150.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-150.png")) returned 0x20 [0089.888] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-150.png", dwFileAttributes=0x20) returned 0 [0089.888] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-150.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.888] GetLastError () returned 0x5 [0089.888] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-150.png", dwFileAttributes=0x20) returned 0 [0089.888] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f1348) returned 1 Thread: id = 969 os_tid = 0x1d60 [0080.419] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-150_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-150_contrast-black.png")) returned 0x20 [0089.887] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-150_contrast-black.png", dwFileAttributes=0x20) returned 0 [0089.887] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-150_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-150_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.887] GetLastError () returned 0x5 [0089.887] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-150_contrast-black.png", dwFileAttributes=0x20) returned 0 [0089.887] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a3000) returned 1 Thread: id = 970 os_tid = 0x1d64 [0080.420] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-150_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-150_contrast-white.png")) returned 0x20 [0089.886] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-150_contrast-white.png", dwFileAttributes=0x20) returned 0 [0089.886] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-150_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-150_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.886] GetLastError () returned 0x5 [0089.886] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-150_contrast-white.png", dwFileAttributes=0x20) returned 0 [0089.886] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a3f00) returned 1 Thread: id = 971 os_tid = 0x1d68 [0080.420] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-200.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-200.png")) returned 0x20 [0089.885] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-200.png", dwFileAttributes=0x20) returned 0 [0089.885] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-200.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-200.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.885] GetLastError () returned 0x5 [0089.885] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-200.png", dwFileAttributes=0x20) returned 0 [0089.885] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f1430) returned 1 Thread: id = 972 os_tid = 0x1d6c [0080.421] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-200_contrast-black.png")) returned 0x20 [0089.884] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-200_contrast-black.png", dwFileAttributes=0x20) returned 0 [0089.884] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-200_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.884] GetLastError () returned 0x5 [0089.884] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-200_contrast-black.png", dwFileAttributes=0x20) returned 0 [0089.884] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a4000) returned 1 Thread: id = 973 os_tid = 0x1d70 [0080.421] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-200_contrast-white.png")) returned 0x20 [0089.882] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-200_contrast-white.png", dwFileAttributes=0x20) returned 0 [0089.883] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-200_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.883] GetLastError () returned 0x5 [0089.883] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-200_contrast-white.png", dwFileAttributes=0x20) returned 0 [0089.883] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a3200) returned 1 Thread: id = 974 os_tid = 0x1d74 [0080.421] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-400.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-400.png")) returned 0x20 [0089.881] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-400.png", dwFileAttributes=0x20) returned 0 [0089.881] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-400.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-400.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.881] GetLastError () returned 0x5 [0089.881] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-400.png", dwFileAttributes=0x20) returned 0 [0089.881] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f0c08) returned 1 Thread: id = 975 os_tid = 0x1d78 [0080.422] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-400_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-400_contrast-black.png")) returned 0x20 [0089.880] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-400_contrast-black.png", dwFileAttributes=0x20) returned 0 [0089.880] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-400_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-400_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.880] GetLastError () returned 0x5 [0089.880] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-400_contrast-black.png", dwFileAttributes=0x20) returned 0 [0089.880] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a4500) returned 1 Thread: id = 976 os_tid = 0x1d7c [0080.422] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-400_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-400_contrast-white.png")) returned 0x20 [0089.879] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-400_contrast-white.png", dwFileAttributes=0x20) returned 0 [0089.879] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-400_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-400_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.879] GetLastError () returned 0x5 [0089.879] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-400_contrast-white.png", dwFileAttributes=0x20) returned 0 [0089.879] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a4b00) returned 1 Thread: id = 977 os_tid = 0x1d80 [0080.423] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-16.png")) returned 0x20 [0089.878] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16.png", dwFileAttributes=0x20) returned 0 [0089.878] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-16.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.878] GetLastError () returned 0x5 [0089.878] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16.png", dwFileAttributes=0x20) returned 0 [0089.878] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3970108) returned 1 Thread: id = 978 os_tid = 0x1d84 [0080.423] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-16_altform-unplated.png")) returned 0x20 [0091.430] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0091.430] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-16_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.430] GetLastError () returned 0x5 [0091.430] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0091.430] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3979ed8) returned 1 Thread: id = 979 os_tid = 0x1d88 [0080.424] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-16_contrast-black.png")) returned 0x20 [0089.876] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16_contrast-black.png", dwFileAttributes=0x20) returned 0 [0089.876] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-16_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.877] GetLastError () returned 0x5 [0089.877] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16_contrast-black.png", dwFileAttributes=0x20) returned 0 [0089.877] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549ab80) returned 1 Thread: id = 980 os_tid = 0x1d8c [0080.424] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-16_contrast-white.png")) returned 0x20 [0089.875] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16_contrast-white.png", dwFileAttributes=0x20) returned 0 [0089.875] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-16_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.875] GetLastError () returned 0x5 [0089.875] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16_contrast-white.png", dwFileAttributes=0x20) returned 0 [0089.875] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549a760) returned 1 Thread: id = 981 os_tid = 0x1d90 [0080.436] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-20.png")) returned 0x20 [0089.874] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20.png", dwFileAttributes=0x20) returned 0 [0089.874] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-20.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.874] GetLastError () returned 0x5 [0089.874] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20.png", dwFileAttributes=0x20) returned 0 [0089.874] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396f028) returned 1 Thread: id = 982 os_tid = 0x1d94 [0080.436] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-20_altform-unplated.png")) returned 0x20 [0089.873] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0089.873] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-20_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.873] GetLastError () returned 0x5 [0089.873] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0089.874] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549b4b0) returned 1 Thread: id = 983 os_tid = 0x1d98 [0080.437] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-20_contrast-black.png")) returned 0x20 [0089.872] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20_contrast-black.png", dwFileAttributes=0x20) returned 0 [0089.872] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-20_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.872] GetLastError () returned 0x5 [0089.872] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20_contrast-black.png", dwFileAttributes=0x20) returned 0 [0089.872] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549ad90) returned 1 Thread: id = 984 os_tid = 0x1d9c [0080.437] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-20_contrast-white.png")) returned 0x20 [0089.871] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20_contrast-white.png", dwFileAttributes=0x20) returned 0 [0089.871] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-20_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.871] GetLastError () returned 0x5 [0089.871] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20_contrast-white.png", dwFileAttributes=0x20) returned 0 [0089.871] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5499e18) returned 1 Thread: id = 985 os_tid = 0x1da0 [0080.438] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-24.png")) returned 0x20 [0089.870] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24.png", dwFileAttributes=0x20) returned 0 [0089.870] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-24.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.870] GetLastError () returned 0x5 [0089.870] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24.png", dwFileAttributes=0x20) returned 0 [0089.870] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39702e8) returned 1 Thread: id = 986 os_tid = 0x1da4 [0080.438] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-24_altform-unplated.png")) returned 0x20 [0089.869] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0089.870] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-24_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.870] GetLastError () returned 0x5 [0089.870] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0089.870] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549b5c0) returned 1 Thread: id = 987 os_tid = 0x1da8 [0080.439] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-24_contrast-black.png")) returned 0x20 [0089.868] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24_contrast-black.png", dwFileAttributes=0x20) returned 0 [0089.868] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-24_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.869] GetLastError () returned 0x5 [0089.869] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24_contrast-black.png", dwFileAttributes=0x20) returned 0 [0089.869] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54998f0) returned 1 Thread: id = 988 os_tid = 0x1dac [0080.440] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-24_contrast-white.png")) returned 0x20 [0089.867] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24_contrast-white.png", dwFileAttributes=0x20) returned 0 [0089.867] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-24_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.867] GetLastError () returned 0x5 [0089.867] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24_contrast-white.png", dwFileAttributes=0x20) returned 0 [0089.868] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549a340) returned 1 Thread: id = 989 os_tid = 0x1db0 [0080.441] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-256.png")) returned 0x20 [0089.866] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256.png", dwFileAttributes=0x20) returned 0 [0089.866] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-256.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.866] GetLastError () returned 0x5 [0089.866] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256.png", dwFileAttributes=0x20) returned 0 [0089.866] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396f208) returned 1 Thread: id = 990 os_tid = 0x1db4 [0080.441] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-256_altform-unplated.png")) returned 0x20 [0089.866] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0089.866] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-256_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.866] GetLastError () returned 0x5 [0089.866] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0089.866] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549b6d0) returned 1 Thread: id = 991 os_tid = 0x1db8 [0080.441] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-256_contrast-black.png")) returned 0x20 [0089.865] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256_contrast-black.png", dwFileAttributes=0x20) returned 0 [0089.865] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-256_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.865] GetLastError () returned 0x5 [0089.865] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256_contrast-black.png", dwFileAttributes=0x20) returned 0 [0089.866] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549b7e0) returned 1 Thread: id = 992 os_tid = 0x1dbc [0080.442] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-256_contrast-white.png")) returned 0x20 [0089.865] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256_contrast-white.png", dwFileAttributes=0x20) returned 0 [0089.865] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-256_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.865] GetLastError () returned 0x5 [0089.865] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256_contrast-white.png", dwFileAttributes=0x20) returned 0 [0089.865] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549b8f0) returned 1 Thread: id = 993 os_tid = 0x1dc0 [0080.442] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-30.png")) returned 0x20 [0089.863] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30.png", dwFileAttributes=0x20) returned 0 [0089.863] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-30.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.863] GetLastError () returned 0x5 [0089.864] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30.png", dwFileAttributes=0x20) returned 0 [0089.864] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39701f8) returned 1 Thread: id = 994 os_tid = 0x1dc4 [0080.443] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-30_altform-unplated.png")) returned 0x20 [0089.863] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0089.863] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-30_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.863] GetLastError () returned 0x5 [0089.863] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0089.863] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549ba00) returned 1 Thread: id = 995 os_tid = 0x1dc8 [0082.883] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-30_contrast-black.png")) returned 0x20 [0091.428] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.429] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-30_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.429] GetLastError () returned 0x5 [0091.429] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.429] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549a868) returned 1 Thread: id = 996 os_tid = 0x1dd4 [0082.884] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x5ba7ea8 [0082.884] wcscpy (in: _Dest=0x5ba7ea8, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0082.884] wcscat (in: _Dest=0x5ba7ea8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0082.884] wcscat (in: _Dest=0x5ba7ea8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\*" [0082.884] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542f8e0 [0082.884] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\*", lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc9faaa23, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xc9faaa23, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ec40 [0085.969] wcscmp (_String1=".", _String2=".") returned 0 [0085.969] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc9faaa23, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xc9faaa23, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.971] wcscmp (_String1="..", _String2=".") returned 1 [0085.971] wcscmp (_String1="..", _String2="..") returned 0 [0085.971] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91d4f8ee, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x91d4f8ee, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x91d4f8ee, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x0, dwReserved1=0x0, cFileName="1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml", cAlternateFileName="1527C7~1.XML")) returned 1 [0085.971] wcscmp (_String1="1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml", _String2=".") returned 1 [0085.971] wcscmp (_String1="1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml", _String2="..") returned 1 [0085.971] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0x74e2968 [0085.971] wcscpy (in: _Dest=0x74e2968, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0085.971] wcscat (in: _Dest=0x74e2968, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0085.972] wcscat (in: _Dest=0x74e2968, _Source="1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml" [0088.760] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e2968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd0 [0088.761] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2176a3b0, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x2176a3b0, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2189b6d0, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x1f13, dwReserved0=0x0, dwReserved1=0x0, cFileName="9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm.xml", cAlternateFileName="9E2F88~1.XML")) returned 1 [0088.761] wcscmp (_String1="9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm.xml", _String2=".") returned 1 [0088.761] wcscmp (_String1="9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm.xml", _String2="..") returned 1 [0088.761] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x3975e28 [0088.761] wcscpy (in: _Dest=0x3975e28, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.761] wcscat (in: _Dest=0x3975e28, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.761] wcscat (in: _Dest=0x3975e28, _Source="9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm.xml" [0088.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3975e28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9dc [0088.762] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x935998d9, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x935998d9, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x935998d9, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0xbe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml", cAlternateFileName="C5E252~1.XML")) returned 1 [0088.762] wcscmp (_String1="c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml", _String2=".") returned 1 [0088.762] wcscmp (_String1="c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml", _String2="..") returned 1 [0088.762] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x74b0a40 [0088.762] wcscpy (in: _Dest=0x74b0a40, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.762] wcscat (in: _Dest=0x74b0a40, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.762] wcscat (in: _Dest=0x74b0a40, _Source="c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" [0088.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b0a40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f74 [0088.763] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9402e007, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x9402e007, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x9402e007, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x1261, dwReserved0=0x0, dwReserved1=0x0, cFileName="CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml", cAlternateFileName="CORTAN~1.XML")) returned 1 [0088.763] wcscmp (_String1="CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml", _String2=".") returned 1 [0088.763] wcscmp (_String1="CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml", _String2="..") returned 1 [0088.763] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd4) returned 0x3933bc8 [0088.763] wcscpy (in: _Dest=0x3933bc8, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.763] wcscat (in: _Dest=0x3933bc8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.763] wcscat (in: _Dest=0x3933bc8, _Source="CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml" [0088.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3933bc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f70 [0088.763] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94b81300, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x94b81300, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x94b81300, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x1a4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml", cAlternateFileName="DESKTO~1.XML")) returned 1 [0088.763] wcscmp (_String1="DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml", _String2=".") returned 1 [0088.763] wcscmp (_String1="DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml", _String2="..") returned 1 [0088.764] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x3933ca8 [0088.764] wcscpy (in: _Dest=0x3933ca8, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.764] wcscat (in: _Dest=0x3933ca8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.764] wcscat (in: _Dest=0x3933ca8, _Source="DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml" [0088.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3933ca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e4 [0088.765] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95530c1d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x95530c1d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x95530c1d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x8ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml", cAlternateFileName="DESKTO~2.XML")) returned 1 [0088.765] wcscmp (_String1="DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml", _String2=".") returned 1 [0088.765] wcscmp (_String1="DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml", _String2="..") returned 1 [0088.765] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x3933f48 [0088.765] wcscpy (in: _Dest=0x3933f48, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.765] wcscat (in: _Dest=0x3933f48, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.765] wcscat (in: _Dest=0x3933f48, _Source="DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" [0088.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3933f48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e0 [0088.765] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b49b215, ftCreationTime.dwHighDateTime=0x1d32793, ftLastAccessTime.dwLowDateTime=0x7b4c1487, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x7b4c1487, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downlevel", cAlternateFileName="DOWNLE~1")) returned 1 [0088.765] wcscmp (_String1="Downlevel", _String2=".") returned 1 [0088.765] wcscmp (_String1="Downlevel", _String2="..") returned 1 [0088.765] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x72) returned 0x38d06a0 [0088.765] wcscpy (in: _Dest=0x38d06a0, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.765] wcscat (in: _Dest=0x38d06a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.766] wcscat (in: _Dest=0x38d06a0, _Source="Downlevel" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Downlevel") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Downlevel" [0088.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38d06a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18dc [0088.766] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x960d03e8, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x960d03e8, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x960d03e8, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0xa73, dwReserved0=0x0, dwReserved1=0x0, cFileName="E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml", cAlternateFileName="E2A4F9~1.XML")) returned 1 [0088.766] wcscmp (_String1="E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml", _String2=".") returned 1 [0088.766] wcscmp (_String1="E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml", _String2="..") returned 1 [0088.766] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0x74b0b58 [0088.766] wcscpy (in: _Dest=0x74b0b58, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.766] wcscat (in: _Dest=0x74b0b58, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.766] wcscat (in: _Dest=0x74b0b58, _Source="E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml" [0088.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b0b58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1224 [0088.767] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b8ad52, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x96b8ad52, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x96b8ad52, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x994, dwReserved0=0x0, dwReserved1=0x0, cFileName="EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml", cAlternateFileName="ENVIRO~1.XML")) returned 1 [0088.767] wcscmp (_String1="EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml", _String2=".") returned 1 [0088.767] wcscmp (_String1="EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml", _String2="..") returned 1 [0088.767] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x757fd60 [0088.767] wcscpy (in: _Dest=0x757fd60, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.767] wcscat (in: _Dest=0x757fd60, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.767] wcscat (in: _Dest=0x757fd60, _Source="EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml" [0088.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x757fd60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1228 [0088.768] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe702f6a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Families", cAlternateFileName="")) returned 1 [0088.768] wcscmp (_String1="Families", _String2=".") returned 1 [0088.768] wcscmp (_String1="Families", _String2="..") returned 1 [0088.768] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x74b00a8 [0088.768] wcscpy (in: _Dest=0x74b00a8, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.768] wcscat (in: _Dest=0x74b00a8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.768] wcscat (in: _Dest=0x74b00a8, _Source="Families" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Families") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Families" [0088.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x74b00a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d8 [0088.769] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9775076f, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x9775076f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x9775076f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x2443, dwReserved0=0x0, dwReserved1=0x0, cFileName="HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy.xml", cAlternateFileName="HOLOCA~1.XML")) returned 1 [0088.769] wcscmp (_String1="HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy.xml", _String2=".") returned 1 [0088.769] wcscmp (_String1="HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy.xml", _String2="..") returned 1 [0088.769] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x3976148 [0088.769] wcscpy (in: _Dest=0x3976148, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.769] wcscat (in: _Dest=0x3976148, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.769] wcscat (in: _Dest=0x3976148, _Source="HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy.xml" [0088.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3976148, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x122c [0088.769] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x982a3a59, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x982a3a59, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x982a3a59, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x1284, dwReserved0=0x0, dwReserved1=0x0, cFileName="HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy.xml", cAlternateFileName="HOLOIT~1.XML")) returned 1 [0088.769] wcscmp (_String1="HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy.xml", _String2=".") returned 1 [0088.769] wcscmp (_String1="HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy.xml", _String2="..") returned 1 [0088.769] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x53f7a20 [0088.769] wcscpy (in: _Dest=0x53f7a20, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.770] wcscat (in: _Dest=0x53f7a20, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.770] wcscat (in: _Dest=0x53f7a20, _Source="HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy.xml" [0088.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53f7a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1280 [0088.770] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98dd0af7, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x98dd0af7, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x98dd0af7, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x67ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy.xml", cAlternateFileName="HOLOSH~1.XML")) returned 1 [0088.770] wcscmp (_String1="HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy.xml", _String2=".") returned 1 [0088.770] wcscmp (_String1="HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy.xml", _String2="..") returned 1 [0088.770] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x53f6f90 [0088.770] wcscpy (in: _Dest=0x53f6f90, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.770] wcscat (in: _Dest=0x53f6f90, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.770] wcscat (in: _Dest=0x53f6f90, _Source="HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy.xml" [0088.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53f6f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1288 [0088.771] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefbfc5d3, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xefbfc5d3, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xefbfc5d3, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x3ff1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI0C82~1.XML")) returned 1 [0088.771] wcscmp (_String1="Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0088.771] wcscmp (_String1="Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0088.771] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x3934e28 [0088.771] wcscpy (in: _Dest=0x3934e28, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.771] wcscat (in: _Dest=0x3934e28, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.771] wcscat (in: _Dest=0x3934e28, _Source="Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml" [0088.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3934e28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a8 [0088.772] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb36a65a0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb36a65a0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb36a65a0, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x345, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml", cAlternateFileName="MI064A~1.XML")) returned 1 [0088.772] wcscmp (_String1="Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0088.772] wcscmp (_String1="Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0088.772] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf4) returned 0x5ba2ef8 [0088.772] wcscpy (in: _Dest=0x5ba2ef8, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.772] wcscat (in: _Dest=0x5ba2ef8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.772] wcscat (in: _Dest=0x5ba2ef8, _Source="Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml" [0088.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba2ef8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a4 [0088.772] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb38bc697, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb38bc697, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb38bc697, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x345, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml", cAlternateFileName="MI615A~1.XML")) returned 1 [0088.772] wcscmp (_String1="Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0088.773] wcscmp (_String1="Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0088.773] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf4) returned 0x5ba20f8 [0088.773] wcscpy (in: _Dest=0x5ba20f8, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.773] wcscat (in: _Dest=0x5ba20f8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.773] wcscat (in: _Dest=0x5ba20f8, _Source="Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml" [0088.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba20f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a0 [0088.773] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb30b0778, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb30b0778, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb30b0778, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x46bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MIE657~1.XML")) returned 1 [0088.773] wcscmp (_String1="Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0088.773] wcscmp (_String1="Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0088.773] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x3933928 [0088.773] wcscpy (in: _Dest=0x3933928, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.773] wcscat (in: _Dest=0x3933928, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.773] wcscat (in: _Dest=0x3933928, _Source="Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml" [0088.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3933928, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x189c [0088.774] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb34b6700, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb34b6700, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb34b6700, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x13a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI4032~1.XML")) returned 1 [0088.774] wcscmp (_String1="Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml", _String2=".") returned 1 [0088.774] wcscmp (_String1="Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml", _String2="..") returned 1 [0088.774] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x757fc88 [0088.774] wcscpy (in: _Dest=0x757fc88, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.774] wcscat (in: _Dest=0x757fc88, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.774] wcscat (in: _Dest=0x757fc88, _Source="Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml" [0088.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x757fc88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1890 [0088.775] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9999651d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x9999651d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x9999651d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0xc82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0088.798] wcscmp (_String1="Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml", _String2=".") returned 1 [0088.798] wcscmp (_String1="Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml", _String2="..") returned 1 [0088.798] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf6) returned 0x5ba23f8 [0088.798] wcscpy (in: _Dest=0x5ba23f8, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.798] wcscat (in: _Dest=0x5ba23f8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.798] wcscat (in: _Dest=0x5ba23f8, _Source="Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" [0088.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba23f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1540 [0088.799] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4049eb, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x9a4049eb, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x9a4049eb, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x3678, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy.xml", cAlternateFileName="MICROS~2.XML")) returned 1 [0088.799] wcscmp (_String1="Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy.xml", _String2=".") returned 1 [0088.799] wcscmp (_String1="Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy.xml", _String2="..") returned 1 [0088.799] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe6) returned 0x54ba458 [0088.799] wcscpy (in: _Dest=0x54ba458, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.799] wcscat (in: _Dest=0x54ba458, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.799] wcscat (in: _Dest=0x54ba458, _Source="Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy.xml" [0088.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54ba458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x153c [0088.799] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4861de0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb4861de0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb4861de0, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0xf40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MIC406~1.XML")) returned 1 [0088.799] wcscmp (_String1="Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe.xml", _String2=".") returned 1 [0088.799] wcscmp (_String1="Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe.xml", _String2="..") returned 1 [0088.799] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x54f0210 [0088.799] wcscpy (in: _Dest=0x54f0210, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.799] wcscat (in: _Dest=0x54f0210, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.800] wcscat (in: _Dest=0x54f0210, _Source="Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe.xml" [0088.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f0210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1538 [0088.800] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb50e0420, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb50e0420, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb50e0420, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0xf40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe.xml", cAlternateFileName="MI930E~1.XML")) returned 1 [0088.800] wcscmp (_String1="Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe.xml", _String2=".") returned 1 [0088.800] wcscmp (_String1="Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe.xml", _String2="..") returned 1 [0088.800] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x54f1518 [0088.800] wcscpy (in: _Dest=0x54f1518, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.800] wcscat (in: _Dest=0x54f1518, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.800] wcscat (in: _Dest=0x54f1518, _Source="Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe.xml" [0088.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f1518, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x830 [0088.801] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a70a46, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xf0a70a46, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xf0ae31f1, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0xab8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe.xml", cAlternateFileName="MID251~1.XML")) returned 1 [0088.801] wcscmp (_String1="Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe.xml", _String2=".") returned 1 [0088.801] wcscmp (_String1="Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe.xml", _String2="..") returned 1 [0088.801] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x3934028 [0088.801] wcscpy (in: _Dest=0x3934028, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.801] wcscat (in: _Dest=0x3934028, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.801] wcscat (in: _Dest=0x3934028, _Source="Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe.xml" [0088.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3934028, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x186c [0088.802] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf080e498, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xf080e498, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xf080e498, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x6b98, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MIB577~1.XML")) returned 1 [0088.802] wcscmp (_String1="Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0088.802] wcscmp (_String1="Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0088.802] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x54ba548 [0088.802] wcscpy (in: _Dest=0x54ba548, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.802] wcscat (in: _Dest=0x54ba548, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.802] wcscat (in: _Dest=0x54ba548, _Source="Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe.xml" [0088.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54ba548, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1860 [0088.802] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2b7dd80, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd2b7dd80, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd2b7dd80, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml", cAlternateFileName="MI5448~1.XML")) returned 1 [0088.802] wcscmp (_String1="Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0088.803] wcscmp (_String1="Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0088.803] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba2ff8 [0088.803] wcscpy (in: _Dest=0x5ba2ff8, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.803] wcscat (in: _Dest=0x5ba2ff8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.803] wcscat (in: _Dest=0x5ba2ff8, _Source="Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" [0088.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba2ff8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x185c [0088.803] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1c06024, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xf1c06024, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xf1c06024, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x65eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI8EAA~1.XML")) returned 1 [0088.803] wcscmp (_String1="Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0088.803] wcscmp (_String1="Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0088.803] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd6) returned 0x3934aa8 [0088.803] wcscpy (in: _Dest=0x3934aa8, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.803] wcscat (in: _Dest=0x3934aa8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.803] wcscat (in: _Dest=0x3934aa8, _Source="Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" [0088.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3934aa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1858 [0088.804] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1fbfb11, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xf1fbfb11, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xf1fbfb11, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x2072, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe.xml", cAlternateFileName="MIE223~1.XML")) returned 1 [0088.804] wcscmp (_String1="Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe.xml", _String2=".") returned 1 [0088.804] wcscmp (_String1="Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe.xml", _String2="..") returned 1 [0088.804] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x75800c0 [0088.804] wcscpy (in: _Dest=0x75800c0, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.804] wcscat (in: _Dest=0x75800c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.804] wcscat (in: _Dest=0x75800c0, _Source="Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe.xml" [0088.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x75800c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1854 [0088.805] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4270832, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd4270832, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd4270832, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x34b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingNews_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml", cAlternateFileName="MI29A4~1.XML")) returned 1 [0088.805] wcscmp (_String1="Microsoft.BingNews_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0088.805] wcscmp (_String1="Microsoft.BingNews_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0088.805] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x393e138 [0088.805] wcscpy (in: _Dest=0x393e138, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.805] wcscat (in: _Dest=0x393e138, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.805] wcscat (in: _Dest=0x393e138, _Source="Microsoft.BingNews_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" [0088.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x393e138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1848 [0088.806] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2cdca4e, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xf2cdca4e, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xf2cdca4e, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x643a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI61C2~1.XML")) returned 1 [0088.806] wcscmp (_String1="Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0088.806] wcscmp (_String1="Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0088.806] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x757f418 [0088.806] wcscpy (in: _Dest=0x757f418, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.806] wcscat (in: _Dest=0x757f418, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.806] wcscat (in: _Dest=0x757f418, _Source="Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" [0088.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x757f418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1844 [0088.806] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf30702c7, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xf30702c7, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xf30702c7, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x2092, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe.xml", cAlternateFileName="MIA5ED~1.XML")) returned 1 [0088.806] wcscmp (_String1="Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe.xml", _String2=".") returned 1 [0088.806] wcscmp (_String1="Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe.xml", _String2="..") returned 1 [0088.806] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x53f83e0 [0088.806] wcscpy (in: _Dest=0x53f83e0, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.806] wcscat (in: _Dest=0x53f83e0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.806] wcscat (in: _Dest=0x53f83e0, _Source="Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe.xml" [0088.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53f83e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1840 [0088.807] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf41b9410, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xf41b9410, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xf41b9410, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x650b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI06CF~1.XML")) returned 1 [0088.807] wcscmp (_String1="Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0088.807] wcscmp (_String1="Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0088.807] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd4) returned 0x3934f08 [0088.807] wcscpy (in: _Dest=0x3934f08, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.807] wcscat (in: _Dest=0x3934f08, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.807] wcscat (in: _Dest=0x3934f08, _Source="Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" [0088.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3934f08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x183c [0088.808] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf46a41c8, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xf46a41c8, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xf46a41c8, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x2088, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe.xml", cAlternateFileName="MI83E9~1.XML")) returned 1 [0088.808] wcscmp (_String1="Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe.xml", _String2=".") returned 1 [0088.808] wcscmp (_String1="Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe.xml", _String2="..") returned 1 [0088.808] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xca) returned 0x757f4f0 [0088.808] wcscpy (in: _Dest=0x757f4f0, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.808] wcscat (in: _Dest=0x757f4f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.808] wcscat (in: _Dest=0x757f4f0, _Source="Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe.xml" [0088.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x757f4f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12cc [0088.809] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb74a395d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb74a395d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb74a395d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", cAlternateFileName="MI9E16~1.XML")) returned 1 [0088.809] wcscmp (_String1="Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0088.809] wcscmp (_String1="Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0088.809] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba24f8 [0088.809] wcscpy (in: _Dest=0x5ba24f8, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.809] wcscat (in: _Dest=0x5ba24f8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.809] wcscat (in: _Dest=0x5ba24f8, _Source="Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" [0088.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba24f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1838 [0088.809] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb76dfcd5, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb76dfcd5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb76dfcd5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingWeather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe.xml", cAlternateFileName="MIEDB5~1.XML")) returned 1 [0088.809] wcscmp (_String1="Microsoft.BingWeather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0088.809] wcscmp (_String1="Microsoft.BingWeather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0088.810] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba2af8 [0088.810] wcscpy (in: _Dest=0x5ba2af8, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.810] wcscat (in: _Dest=0x5ba2af8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.810] wcscat (in: _Dest=0x5ba2af8, _Source="Microsoft.BingWeather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe.xml" [0088.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba2af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1834 [0088.810] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6e3b40e, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb6e3b40e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb6e3b40e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x7511, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MID8D3~1.XML")) returned 1 [0088.810] wcscmp (_String1="Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0088.810] wcscmp (_String1="Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0088.810] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd6) returned 0x39351a8 [0088.810] wcscpy (in: _Dest=0x39351a8, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.810] wcscat (in: _Dest=0x39351a8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.810] wcscat (in: _Dest=0x39351a8, _Source="Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe.xml" [0088.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x39351a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1830 [0088.811] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7267611, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb7267611, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7267611, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x26ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MIC7E0~1.XML")) returned 1 [0088.811] wcscmp (_String1="Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe.xml", _String2=".") returned 1 [0088.811] wcscmp (_String1="Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe.xml", _String2="..") returned 1 [0088.811] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x7580198 [0088.811] wcscpy (in: _Dest=0x7580198, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0088.811] wcscat (in: _Dest=0x7580198, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0088.812] wcscat (in: _Dest=0x7580198, _Source="Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe.xml" [0088.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7580198, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x182c [0088.812] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5a03408, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xf5a03408, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xf5a03408, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x6580, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MIF36F~1.XML")) returned 1 [0090.683] wcscmp (_String1="Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0090.683] wcscmp (_String1="Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0090.683] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd6) returned 0x54b1818 [0090.683] wcscpy (in: _Dest=0x54b1818, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.683] wcscat (in: _Dest=0x54b1818, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.683] wcscat (in: _Dest=0x54b1818, _Source="Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" [0090.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54b1818, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x920 [0090.684] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af0b81d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x9af0b81d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x9af0b81d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0xd78, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy.xml", cAlternateFileName="MICROS~3.XML")) returned 1 [0090.684] wcscmp (_String1="Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy.xml", _String2=".") returned 1 [0090.684] wcscmp (_String1="Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy.xml", _String2="..") returned 1 [0090.684] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xde) returned 0x54f0c08 [0090.684] wcscpy (in: _Dest=0x54f0c08, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.684] wcscat (in: _Dest=0x54f0c08, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.684] wcscat (in: _Dest=0x54f0c08, _Source="Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy.xml" [0090.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f0c08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d4 [0090.685] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf70372ea, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xf70372ea, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xf70372ea, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x39a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", cAlternateFileName="MI2ED2~1.XML")) returned 1 [0090.685] wcscmp (_String1="Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0090.685] wcscmp (_String1="Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0090.685] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf6) returned 0x5ba29f8 [0090.685] wcscpy (in: _Dest=0x5ba29f8, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.685] wcscat (in: _Dest=0x5ba29f8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.685] wcscat (in: _Dest=0x5ba29f8, _Source="Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" [0090.685] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba29f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x818 [0090.685] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a414cd, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xf6a414cd, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xf6a414cd, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x4306, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MID396~1.XML")) returned 1 [0090.685] wcscmp (_String1="Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0090.685] wcscmp (_String1="Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0090.685] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x54f1f10 [0090.685] wcscpy (in: _Dest=0x54f1f10, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.685] wcscat (in: _Dest=0x54f1f10, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.686] wcscat (in: _Dest=0x54f1f10, _Source="Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe.xml" [0090.686] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f1f10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ec [0090.686] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e211e4, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xf6e211e4, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xf6e211e4, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x276d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI2880~1.XML")) returned 1 [0090.686] wcscmp (_String1="Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe.xml", _String2=".") returned 1 [0090.686] wcscmp (_String1="Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe.xml", _String2="..") returned 1 [0090.686] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x757f6a0 [0090.686] wcscpy (in: _Dest=0x757f6a0, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.686] wcscat (in: _Dest=0x757f6a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.686] wcscat (in: _Dest=0x757f6a0, _Source="Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe.xml" [0090.686] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x757f6a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f0 [0090.687] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7b8a5d5, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xf7b8a5d5, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xf7bb08dc, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x726b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI9710~1.XML")) returned 1 [0090.687] wcscmp (_String1="Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0090.687] wcscmp (_String1="Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0090.687] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe4) returned 0x396ef38 [0090.687] wcscpy (in: _Dest=0x396ef38, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.687] wcscat (in: _Dest=0x396ef38, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.687] wcscat (in: _Dest=0x396ef38, _Source="Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe.xml" [0090.687] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396ef38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e0 [0090.688] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7ed19a3, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xf7ed19a3, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xf7ed19a3, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0xd4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI426C~1.XML")) returned 1 [0090.688] wcscmp (_String1="Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe.xml", _String2=".") returned 1 [0090.688] wcscmp (_String1="Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe.xml", _String2="..") returned 1 [0090.688] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x54f1e28 [0090.688] wcscpy (in: _Dest=0x54f1e28, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.688] wcscat (in: _Dest=0x54f1e28, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.688] wcscat (in: _Dest=0x54f1e28, _Source="Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe.xml" [0090.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f1e28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d8 [0090.688] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b99ff66, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x9b99ff66, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x9b99ff66, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x717, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy.xml", cAlternateFileName="MICROS~4.XML")) returned 1 [0090.689] wcscmp (_String1="Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy.xml", _String2=".") returned 1 [0090.689] wcscmp (_String1="Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy.xml", _String2="..") returned 1 [0090.689] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54f1d40 [0090.689] wcscpy (in: _Dest=0x54f1d40, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.689] wcscat (in: _Dest=0x54f1d40, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.689] wcscat (in: _Dest=0x54f1d40, _Source="Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy.xml" [0090.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f1d40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d4 [0090.689] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8e1ec23, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb8e1ec23, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb8e1ec23, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x349, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", cAlternateFileName="MI2012~1.XML")) returned 1 [0090.689] wcscmp (_String1="Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0090.689] wcscmp (_String1="Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0090.689] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x74dbc30 [0090.689] wcscpy (in: _Dest=0x74dbc30, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.689] wcscat (in: _Dest=0x74dbc30, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.689] wcscat (in: _Dest=0x74dbc30, _Source="Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" [0090.690] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74dbc30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d0 [0090.690] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8fe88c8, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb8fe88c8, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb8fe88c8, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x349, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe.xml", cAlternateFileName="MIDFEB~1.XML")) returned 1 [0090.690] wcscmp (_String1="Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0090.690] wcscmp (_String1="Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0090.690] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x74db488 [0090.690] wcscpy (in: _Dest=0x74db488, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.690] wcscat (in: _Dest=0x74db488, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.690] wcscat (in: _Dest=0x74db488, _Source="Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" [0090.690] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74db488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a0 [0090.691] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c54fe1, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb8c54fe1, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb8c54fe1, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0xff4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MIDD39~1.XML")) returned 1 [0090.691] wcscmp (_String1="Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe.xml", _String2=".") returned 1 [0090.691] wcscmp (_String1="Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe.xml", _String2="..") returned 1 [0090.691] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54bae98 [0090.691] wcscpy (in: _Dest=0x54bae98, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.691] wcscat (in: _Dest=0x54bae98, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.691] wcscat (in: _Dest=0x54bae98, _Source="Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe.xml" [0090.691] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bae98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x79c [0090.692] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb890dc01, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb890dc01, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb890dc01, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x4097, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI3B11~1.XML")) returned 1 [0090.692] wcscmp (_String1="Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0090.692] wcscmp (_String1="Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0090.692] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xea) returned 0x54502c0 [0090.692] wcscpy (in: _Dest=0x54502c0, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.692] wcscat (in: _Dest=0x54502c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.692] wcscat (in: _Dest=0x54502c0, _Source="Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe.xml" [0090.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54502c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x798 [0090.692] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8ee980c, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xf8ee980c, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xf8ee980c, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x406d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MIF830~1.XML")) returned 1 [0090.693] wcscmp (_String1="Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0090.693] wcscmp (_String1="Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0090.693] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x7580780 [0090.693] wcscpy (in: _Dest=0x7580780, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.693] wcscat (in: _Dest=0x7580780, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.693] wcscat (in: _Dest=0x7580780, _Source="Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe.xml" [0090.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7580780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x794 [0090.693] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba9affd9, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xba9affd9, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xba9affd9, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x39f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe.xml", cAlternateFileName="MI1858~1.XML")) returned 1 [0090.693] wcscmp (_String1="Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0090.693] wcscmp (_String1="Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0090.693] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x5450d68 [0090.693] wcscpy (in: _Dest=0x5450d68, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.694] wcscat (in: _Dest=0x5450d68, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.694] wcscat (in: _Dest=0x5450d68, _Source="Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" [0090.694] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5450d68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x77c [0090.694] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba42c935, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xba42c935, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xba42c935, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x406d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI6E97~1.XML")) returned 1 [0090.694] wcscmp (_String1="Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0090.694] wcscmp (_String1="Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0090.694] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x757f268 [0090.694] wcscpy (in: _Dest=0x757f268, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.694] wcscat (in: _Dest=0x757f268, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.694] wcscat (in: _Dest=0x757f268, _Source="Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe.xml" [0090.694] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x757f268, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa38 [0090.695] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba7e63a1, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xba7e63a1, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xba7e63a1, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x15b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI709A~1.XML")) returned 1 [0090.695] wcscmp (_String1="Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe.xml", _String2=".") returned 1 [0090.695] wcscmp (_String1="Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe.xml", _String2="..") returned 1 [0090.695] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x53f8170 [0090.695] wcscpy (in: _Dest=0x53f8170, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.695] wcscat (in: _Dest=0x53f8170, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.695] wcscat (in: _Dest=0x53f8170, _Source="Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe.xml" [0090.695] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53f8170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa54 [0090.696] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c565993, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x9c565993, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x9c565993, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x8e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml", cAlternateFileName="MIDE50~1.XML")) returned 1 [0090.696] wcscmp (_String1="Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml", _String2=".") returned 1 [0090.696] wcscmp (_String1="Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml", _String2="..") returned 1 [0090.696] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x54b19d8 [0090.696] wcscpy (in: _Dest=0x54b19d8, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.696] wcscat (in: _Dest=0x54b19d8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.696] wcscat (in: _Dest=0x54b19d8, _Source="Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml" [0090.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54b19d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa5c [0090.696] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfba6c7dc, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xfba6c7dc, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xfba6c7dc, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x399, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Messaging_1.10.22012.0_neutral_split.scale-150_8wekyb3d8bbwe.xml", cAlternateFileName="MI969C~1.XML")) returned 1 [0090.696] wcscmp (_String1="Microsoft.Messaging_1.10.22012.0_neutral_split.scale-150_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0090.696] wcscmp (_String1="Microsoft.Messaging_1.10.22012.0_neutral_split.scale-150_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0090.697] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf4) returned 0x5ba22f8 [0090.697] wcscpy (in: _Dest=0x5ba22f8, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.697] wcscat (in: _Dest=0x5ba22f8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.697] wcscat (in: _Dest=0x5ba22f8, _Source="Microsoft.Messaging_1.10.22012.0_neutral_split.scale-150_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_1.10.22012.0_neutral_split.scale-150_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_1.10.22012.0_neutral_split.scale-150_8wekyb3d8bbwe.xml" [0090.697] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba22f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3fc [0090.697] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb2143df, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xfb2143df, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xfb23a740, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x41a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI6857~1.XML")) returned 1 [0090.703] wcscmp (_String1="Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0090.703] wcscmp (_String1="Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0090.703] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x54b1f18 [0090.703] wcscpy (in: _Dest=0x54b1f18, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.703] wcscat (in: _Dest=0x54b1f18, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.703] wcscat (in: _Dest=0x54b1f18, _Source="Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe.xml" [0090.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54b1f18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcfc [0090.703] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcecaa41, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbcecaa41, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbcecaa41, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x4246, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI7741~1.XML")) returned 1 [0090.703] wcscmp (_String1="Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0090.703] wcscmp (_String1="Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0090.704] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd6) returned 0x54b18f8 [0090.704] wcscpy (in: _Dest=0x54b18f8, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.704] wcscat (in: _Dest=0x54b18f8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.704] wcscat (in: _Dest=0x54b18f8, _Source="Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe.xml" [0090.704] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54b18f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd10 [0090.704] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd4743c1, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbd4743c1, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd4743c1, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x334, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe.xml", cAlternateFileName="MI3B96~1.XML")) returned 1 [0090.704] wcscmp (_String1="Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0090.704] wcscmp (_String1="Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0090.704] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf4) returned 0x5ba2cf8 [0090.704] wcscpy (in: _Dest=0x5ba2cf8, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.704] wcscat (in: _Dest=0x5ba2cf8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.704] wcscat (in: _Dest=0x5ba2cf8, _Source="Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe.xml" [0090.704] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba2cf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20b0 [0090.705] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd25e2d3, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbd25e2d3, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd25e2d3, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x7bc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI70B5~1.XML")) returned 1 [0090.705] wcscmp (_String1="Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe.xml", _String2=".") returned 1 [0090.705] wcscmp (_String1="Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe.xml", _String2="..") returned 1 [0090.705] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x757f778 [0090.705] wcscpy (in: _Dest=0x757f778, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.705] wcscat (in: _Dest=0x757f778, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.705] wcscat (in: _Dest=0x757f778, _Source="Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe.xml" [0090.705] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x757f778, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20ac [0090.706] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe81faba, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbe81faba, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbe81faba, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x1dde, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI88E8~1.XML")) returned 1 [0090.706] wcscmp (_String1="Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0090.706] wcscmp (_String1="Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0090.706] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x54503b8 [0090.706] wcscpy (in: _Dest=0x54503b8, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.706] wcscat (in: _Dest=0x54503b8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.706] wcscat (in: _Dest=0x54503b8, _Source="Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe.xml" [0090.706] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54503b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20b8 [0090.707] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbeb1a9c0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbeb1a9c0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbeb1a9c0, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x2a17, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MIC3B1~1.XML")) returned 1 [0090.707] wcscmp (_String1="Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe.xml", _String2=".") returned 1 [0090.707] wcscmp (_String1="Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe.xml", _String2="..") returned 1 [0090.707] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x396fb68 [0090.707] wcscpy (in: _Dest=0x396fb68, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.707] wcscat (in: _Dest=0x396fb68, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.707] wcscat (in: _Dest=0x396fb68, _Source="Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe.xml" [0090.707] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396fb68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x47c [0090.707] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d2828c5, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x9d2828c5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x9d2828c5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x5276, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe.xml", cAlternateFileName="MID973~1.XML")) returned 1 [0090.707] wcscmp (_String1="Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe.xml", _String2=".") returned 1 [0090.707] wcscmp (_String1="Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe.xml", _String2="..") returned 1 [0090.708] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xde) returned 0x54baf80 [0090.708] wcscpy (in: _Dest=0x54baf80, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.708] wcscat (in: _Dest=0x54baf80, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.708] wcscat (in: _Dest=0x54baf80, _Source="Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe.xml" [0090.708] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54baf80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xce4 [0090.708] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2e28d9c, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc2e28d9c, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc2e28d9c, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x11c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI4EC0~1.XML")) returned 1 [0090.708] wcscmp (_String1="Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe.xml", _String2=".") returned 1 [0090.708] wcscmp (_String1="Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe.xml", _String2="..") returned 1 [0090.708] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe4) returned 0x396fc58 [0090.708] wcscpy (in: _Dest=0x396fc58, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.708] wcscat (in: _Dest=0x396fc58, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.708] wcscat (in: _Dest=0x396fc58, _Source="Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe.xml" [0090.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x396fc58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd38 [0090.709] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd518d47, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xfd518d47, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xfd518d47, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x3c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MIFAD6~1.XML")) returned 1 [0090.709] wcscmp (_String1="Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0090.709] wcscmp (_String1="Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0090.709] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf4) returned 0x5ba35f8 [0090.709] wcscpy (in: _Dest=0x5ba35f8, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.709] wcscat (in: _Dest=0x5ba35f8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.709] wcscat (in: _Dest=0x5ba35f8, _Source="Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe.xml" [0090.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba35f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd3c [0090.710] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2b2de74, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc2b2de74, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc2b2de74, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x3e47, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI6B66~1.XML")) returned 1 [0090.710] wcscmp (_String1="Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0090.710] wcscmp (_String1="Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0090.710] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xee) returned 0x5450e60 [0090.710] wcscpy (in: _Dest=0x5450e60, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.710] wcscat (in: _Dest=0x5450e60, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.710] wcscat (in: _Dest=0x5450e60, _Source="Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe.xml" [0090.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5450e60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd40 [0090.711] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc900f90c, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc900f90c, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc900f90c, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", cAlternateFileName="MIED02~1.XML")) returned 1 [0090.711] wcscmp (_String1="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0090.711] wcscmp (_String1="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0090.711] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x118) returned 0x74daf48 [0090.711] wcscpy (in: _Dest=0x74daf48, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.711] wcscat (in: _Dest=0x74daf48, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.711] wcscat (in: _Dest=0x74daf48, _Source="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" [0090.711] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74daf48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd44 [0090.711] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc91d956f, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc91d956f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc91d956f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe.xml", cAlternateFileName="MI1DCA~1.XML")) returned 1 [0090.711] wcscmp (_String1="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0090.711] wcscmp (_String1="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0090.712] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x118) returned 0x74d9828 [0090.712] wcscpy (in: _Dest=0x74d9828, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.712] wcscat (in: _Dest=0x74d9828, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.712] wcscat (in: _Dest=0x74d9828, _Source="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" [0090.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74d9828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd48 [0090.712] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a8c1df, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc8a8c1df, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc8a8c1df, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x41c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI91E0~1.XML")) returned 1 [0090.712] wcscmp (_String1="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0090.712] wcscmp (_String1="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0090.712] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x5499c08 [0090.712] wcscpy (in: _Dest=0x5499c08, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.712] wcscat (in: _Dest=0x5499c08, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.712] wcscat (in: _Dest=0x5499c08, _Source="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe.xml" [0090.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5499c08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20f4 [0090.713] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8e1fa68, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc8e1fa68, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc8e1fa68, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x2187, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI5BAC~1.XML")) returned 1 [0090.713] wcscmp (_String1="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe.xml", _String2=".") returned 1 [0090.713] wcscmp (_String1="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe.xml", _String2="..") returned 1 [0090.713] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba30f8 [0090.713] wcscpy (in: _Dest=0x5ba30f8, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0090.713] wcscat (in: _Dest=0x5ba30f8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0090.713] wcscat (in: _Dest=0x5ba30f8, _Source="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe.xml" [0090.713] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba30f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20e4 [0090.714] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x542f8e0 | out: lpFindFileData=0x542f8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2117eac, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x2117eac, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x2117eac, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x347, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", cAlternateFileName="MIF40C~1.XML")) returned 1 [0090.714] wcscmp (_String1="Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", _String2=".") returned 1 [0090.714] wcscmp (_String1="Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", _String2="..") returned 1 [0090.714] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x116) returned 0xe02fee0 [0091.315] wcscpy (in: _Dest=0xe02fee0, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository" [0091.315] wcscat (in: _Dest=0xe02fee0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\" [0091.315] wcscat (in: _Dest=0xe02fee0, _Source="Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_split.scale-100_8wekyb3d8bbwe.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" Thread: id = 997 os_tid = 0x1dd8 [0082.884] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppxProvisioning.xml" (normalized: "c:\\programdata\\microsoft\\windows\\appxprovisioning.xml")) returned 0x20 [0082.885] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppxProvisioning.xml", dwFileAttributes=0x20) returned 1 [0082.885] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppxProvisioning.xml" (normalized: "c:\\programdata\\microsoft\\windows\\appxprovisioning.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f68 [0082.885] GetFileSizeEx (in: hFile=0x1f68, lpFileSize=0x245ff8b4 | out: lpFileSize=0x245ff8b4*=17175) returned 1 [0082.885] SetFilePointerEx (in: hFile=0x1f68, liDistanceToMove=0x4313, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.885] ReadFile (in: hFile=0x1f68, lpBuffer=0x245ff838, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x245ff834, lpOverlapped=0x0 | out: lpBuffer=0x245ff838*, lpNumberOfBytesRead=0x245ff834*=0x4, lpOverlapped=0x0) returned 1 [0082.887] SetFilePointerEx (in: hFile=0x1f68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.887] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe557248 [0085.957] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe556e88 [0085.957] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe556e38 [0085.957] NtQuerySystemTime (in: CurrentTime=0x245ff814 | out: CurrentTime=0x245ff814*=132260136431111494) returned 0x0 [0085.957] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0xfa1a1c5e [0085.957] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0x9eb7a608 [0085.957] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0xcbf9b0ef [0085.957] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0x7f5bc581 [0085.957] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0x826eabcd [0085.957] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0xf4fd8672 [0085.957] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0x3d9a693 [0085.957] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0x4a216ca5 [0085.957] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0x198bad37 [0085.957] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0x9696070d [0085.957] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0xf9d777 [0085.957] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0x77cd0986 [0085.957] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0x998ecc57 [0085.957] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0x525d690d [0085.957] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0x1960b73d [0085.957] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0x1cd4ed0 [0085.957] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0x2c405abe [0085.957] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0xe4c92d11 [0085.958] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0xe5bf5083 [0085.958] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0xcba32034 [0085.958] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0xeaa45cef [0085.958] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0x42731b32 [0085.958] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0x9a8879c3 [0085.958] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0x84ffedaa [0085.958] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0xe8eccc25 [0085.958] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0x2bf53238 [0085.958] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0x884b8311 [0085.958] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0xc787f94 [0085.958] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0x50ef337f [0085.958] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0x227743cd [0085.958] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0xfc652dca [0085.958] RtlRandom (in: Seed=0x245ff820 | out: Seed=0x245ff820) returned 0xb45bbbc6 [0085.968] ReadFile (in: hFile=0x1f68, lpBuffer=0xe557d90, nNumberOfBytesToRead=0x4317, lpNumberOfBytesRead=0x245ff810, lpOverlapped=0x0 | out: lpBuffer=0xe557d90*, lpNumberOfBytesRead=0x245ff810*=0x4317, lpOverlapped=0x0) returned 1 [0085.970] SetFilePointerEx (in: hFile=0x1f68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.970] WriteFile (in: hFile=0x1f68, lpBuffer=0xe564598*, nNumberOfBytesToWrite=0x4317, lpNumberOfBytesWritten=0x245ff80c, lpOverlapped=0x0 | out: lpBuffer=0xe564598*, lpNumberOfBytesWritten=0x245ff80c*=0x4317, lpOverlapped=0x0) returned 1 [0089.301] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7283298 [0089.301] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72831f8 [0089.302] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x72831f8) returned 1 [0089.302] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe564598) returned 1 [0091.534] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe557d90) returned 1 [0091.534] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74aea10) returned 1 [0091.534] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8a38) returned 1 [0091.534] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x35) returned 0x389f640 [0091.534] SetFilePointerEx (in: hFile=0x1f68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.535] WriteFile (hFile=0x1f68, lpBuffer=0x74d84d8, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x245ff874, lpOverlapped=0x0) Thread: id = 998 os_tid = 0x1ddc [0082.887] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x7584040 [0082.887] wcscpy (in: _Dest=0x7584040, _Source="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC") returned="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC" [0082.887] wcscat (in: _Dest=0x7584040, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\") returned="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\" [0082.887] wcscat (in: _Dest=0x7584040, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\*" [0082.887] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542fb48 [0082.887] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\*", lpFindFileData=0x542fb48 | out: lpFindFileData=0x542fb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x7dc6c35, ftLastAccessTime.dwHighDateTime=0x1d5d806, ftLastWriteTime.dwLowDateTime=0x7dc6c35, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445300 [0082.888] wcscmp (_String1=".", _String2=".") returned 0 [0082.888] FindNextFileW (in: hFindFile=0x5445300, lpFindFileData=0x542fb48 | out: lpFindFileData=0x542fb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x7dc6c35, ftLastAccessTime.dwHighDateTime=0x1d5d806, ftLastWriteTime.dwLowDateTime=0x7dc6c35, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.888] wcscmp (_String1="..", _String2=".") returned 1 [0082.888] wcscmp (_String1="..", _String2="..") returned 0 [0082.888] FindNextFileW (in: hFindFile=0x5445300, lpFindFileData=0x542fb48 | out: lpFindFileData=0x542fb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x17cbb4ff, ftLastAccessTime.dwHighDateTime=0x1d2a02b, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Archive", cAlternateFileName="")) returned 1 [0082.888] wcscmp (_String1="Archive", _String2=".") returned 1 [0082.888] wcscmp (_String1="Archive", _String2="..") returned 1 [0082.888] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x5ba7dc8 [0082.888] wcscpy (in: _Dest=0x5ba7dc8, _Source="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC") returned="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC" [0082.888] wcscat (in: _Dest=0x5ba7dc8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\") returned="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\" [0082.888] wcscat (in: _Dest=0x5ba7dc8, _Source="Archive" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive") returned="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive" [0082.888] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x5ba7e38 [0082.889] wcscpy (in: _Dest=0x5ba7e38, _Source="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive") returned="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive" [0082.889] wcscat (in: _Dest=0x5ba7e38, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\") returned="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\" [0082.889] wcscat (in: _Dest=0x5ba7e38, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\*" [0082.889] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542e0d0 [0082.889] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\*", lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x17cbb4ff, ftLastAccessTime.dwHighDateTime=0x1d2a02b, ftLastWriteTime.dwLowDateTime=0x7d7457cd, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e7c0 [0085.956] wcscmp (_String1=".", _String2=".") returned 0 [0085.957] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x17cbb4ff, ftLastAccessTime.dwHighDateTime=0x1d2a02b, ftLastWriteTime.dwLowDateTime=0x7d7457cd, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.957] wcscmp (_String1="..", _String2=".") returned 1 [0085.957] wcscmp (_String1="..", _String2="..") returned 0 [0085.957] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7457cd, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x1302615f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1302615f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apps", cAlternateFileName="")) returned 1 [0085.957] wcscmp (_String1="Apps", _String2=".") returned 1 [0085.957] wcscmp (_String1="Apps", _String2="..") returned 1 [0085.957] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6c) returned 0x74aee48 [0085.957] wcscpy (in: _Dest=0x74aee48, _Source="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive") returned="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive" [0085.957] wcscat (in: _Dest=0x74aee48, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\") returned="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\" [0085.957] wcscat (in: _Dest=0x74aee48, _Source="Apps" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps") returned="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps" [0088.786] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x74aee48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe4 [0088.787] FindNextFileW (in: hFindFile=0x389e7c0, lpFindFileData=0x542e0d0 | out: lpFindFileData=0x542e0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7457cd, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x1302615f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1302615f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apps", cAlternateFileName="")) returned 0 [0088.787] FindClose (in: hFindFile=0x389e7c0 | out: hFindFile=0x389e7c0) returned 1 [0088.787] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542e0d0) returned 1 [0088.787] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba7e38) returned 1 [0088.787] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba7dc8) returned 1 [0088.787] FindNextFileW (in: hFindFile=0x5445300, lpFindFileData=0x542fb48 | out: lpFindFileData=0x542fb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2032263, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GenuineTicket", cAlternateFileName="GENUIN~1")) returned 1 [0088.787] wcscmp (_String1="GenuineTicket", _String2=".") returned 1 [0088.787] wcscmp (_String1="GenuineTicket", _String2="..") returned 1 [0088.787] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6e) returned 0x74b04e0 [0088.788] wcscpy (in: _Dest=0x74b04e0, _Source="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC") returned="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC" [0088.788] wcscat (in: _Dest=0x74b04e0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\") returned="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\" [0088.788] wcscat (in: _Dest=0x74b04e0, _Source="GenuineTicket" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\GenuineTicket") returned="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\GenuineTicket" [0088.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x74b04e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f4 [0088.788] FindNextFileW (in: hFindFile=0x5445300, lpFindFileData=0x542fb48 | out: lpFindFileData=0x542fb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6ecf30bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f6ef001, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Import", cAlternateFileName="")) returned 1 [0088.788] wcscmp (_String1="Import", _String2=".") returned 1 [0088.788] wcscmp (_String1="Import", _String2="..") returned 1 [0088.788] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0xe53a3a0 [0088.788] wcscpy (in: _Dest=0xe53a3a0, _Source="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC") returned="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC" [0088.788] wcscat (in: _Dest=0xe53a3a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\") returned="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\" [0088.788] wcscat (in: _Dest=0xe53a3a0, _Source="Import" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Import") returned="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Import" [0088.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0xe53a3a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f8c [0088.789] FindNextFileW (in: hFindFile=0x5445300, lpFindFileData=0x542fb48 | out: lpFindFileData=0x542fb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6ecf30bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6ecf30bd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Install", cAlternateFileName="")) returned 1 [0088.789] wcscmp (_String1="Install", _String2=".") returned 1 [0088.789] wcscmp (_String1="Install", _String2="..") returned 1 [0088.789] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x396e4c0 [0088.789] wcscpy (in: _Dest=0x396e4c0, _Source="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC") returned="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC" [0088.789] wcscat (in: _Dest=0x396e4c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\") returned="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\" [0088.789] wcscat (in: _Dest=0x396e4c0, _Source="Install" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Install") returned="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Install" [0088.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x396e4c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1874 [0088.790] FindNextFileW (in: hFindFile=0x5445300, lpFindFileData=0x542fb48 | out: lpFindFileData=0x542fb48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1b51a174, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xfbdffacb, ftLastAccessTime.dwHighDateTime=0x1d5d805, ftLastWriteTime.dwLowDateTime=0x7dc6c35, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0xdc870, dwReserved0=0x0, dwReserved1=0x0, cFileName="tokens.dat", cAlternateFileName="")) returned 1 [0088.790] wcscmp (_String1="tokens.dat", _String2=".") returned 1 [0088.790] wcscmp (_String1="tokens.dat", _String2="..") returned 1 [0088.790] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x68) returned 0x5468da0 [0088.790] wcscpy (in: _Dest=0x5468da0, _Source="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC") returned="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC" [0088.790] wcscat (in: _Dest=0x5468da0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\") returned="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\" [0088.790] wcscat (in: _Dest=0x5468da0, _Source="tokens.dat" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\tokens.dat") returned="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\tokens.dat" [0088.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5468da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1870 [0088.791] FindNextFileW (in: hFindFile=0x5445300, lpFindFileData=0x542fb48 | out: lpFindFileData=0x542fb48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1b51a174, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xfbdffacb, ftLastAccessTime.dwHighDateTime=0x1d5d805, ftLastWriteTime.dwLowDateTime=0x7dc6c35, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0xdc870, dwReserved0=0x0, dwReserved1=0x0, cFileName="tokens.dat", cAlternateFileName="")) returned 0 [0088.791] FindClose (in: hFindFile=0x5445300 | out: hFindFile=0x5445300) returned 1 [0088.791] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542fb48) returned 1 [0088.791] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7584040) returned 1 [0088.791] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b5a08) returned 1 Thread: id = 999 os_tid = 0x1de0 [0082.889] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6e) returned 0x74b05d0 [0085.954] wcscpy (in: _Dest=0x74b05d0, _Source="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataCache" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataCache") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataCache" [0085.954] wcscat (in: _Dest=0x74b05d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataCache\\") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataCache\\" [0085.954] wcscat (in: _Dest=0x74b05d0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataCache\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataCache\\*" [0085.954] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a41b0 [0085.954] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataCache\\*", lpFindFileData=0x53a41b0 | out: lpFindFileData=0x53a41b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f00595d, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xccc6a2b9, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xccc6a2b9, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e700 [0085.955] wcscmp (_String1=".", _String2=".") returned 0 [0085.955] FindNextFileW (in: hFindFile=0x389e700, lpFindFileData=0x53a41b0 | out: lpFindFileData=0x53a41b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f00595d, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xccc6a2b9, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xccc6a2b9, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.955] wcscmp (_String1="..", _String2=".") returned 1 [0085.955] wcscmp (_String1="..", _String2="..") returned 0 [0085.955] FindNextFileW (in: hFindFile=0x389e700, lpFindFileData=0x53a41b0 | out: lpFindFileData=0x53a41b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6acf85b2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xccc1dbbe, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xccc1dbbe, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0xafc58, dwReserved0=0x0, dwReserved1=0x0, cFileName="dmrc.idx", cAlternateFileName="")) returned 1 [0085.955] wcscmp (_String1="dmrc.idx", _String2=".") returned 1 [0085.955] wcscmp (_String1="dmrc.idx", _String2="..") returned 1 [0085.955] FindNextFileW (in: hFindFile=0x389e700, lpFindFileData=0x53a41b0 | out: lpFindFileData=0x53a41b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f00595d, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x8f00595d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x8f00595d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dmrccache", cAlternateFileName="DMRCCA~1")) returned 1 [0085.955] wcscmp (_String1="dmrccache", _String2=".") returned 1 [0085.955] wcscmp (_String1="dmrccache", _String2="..") returned 1 [0085.955] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7e) returned 0x3976c48 [0085.955] wcscpy (in: _Dest=0x3976c48, _Source="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataCache" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataCache") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataCache" [0085.955] wcscat (in: _Dest=0x3976c48, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataCache\\") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataCache\\" [0085.955] wcscat (in: _Dest=0x3976c48, _Source="dmrccache" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataCache\\dmrccache") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataCache\\dmrccache" [0088.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3976c48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b0 [0088.795] FindNextFileW (in: hFindFile=0x389e700, lpFindFileData=0x53a41b0 | out: lpFindFileData=0x53a41b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f00595d, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x8f00595d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x8f00595d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dmrccache", cAlternateFileName="DMRCCA~1")) returned 0 [0088.795] FindClose (in: hFindFile=0x389e700 | out: hFindFile=0x389e700) returned 1 [0088.796] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a41b0) returned 1 [0088.796] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b05d0) returned 1 [0088.796] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eedcf0) returned 1 Thread: id = 1000 os_tid = 0x1de4 [0082.890] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6e) returned 0x74ae920 [0085.953] wcscpy (in: _Dest=0x74ae920, _Source="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore" [0085.953] wcscat (in: _Dest=0x74ae920, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\" [0085.953] wcscat (in: _Dest=0x74ae920, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\*" [0085.953] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a24d0 [0085.953] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\*", lpFindFileData=0x53a24d0 | out: lpFindFileData=0x53a24d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2129d74, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e740 [0085.956] wcscmp (_String1=".", _String2=".") returned 0 [0085.956] FindNextFileW (in: hFindFile=0x389e740, lpFindFileData=0x53a24d0 | out: lpFindFileData=0x53a24d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2129d74, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.956] wcscmp (_String1="..", _String2=".") returned 1 [0085.956] wcscmp (_String1="..", _String2="..") returned 0 [0085.956] FindNextFileW (in: hFindFile=0x389e740, lpFindFileData=0x53a24d0 | out: lpFindFileData=0x53a24d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212a24b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8fdd8c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0085.956] wcscmp (_String1="en-US", _String2=".") returned 1 [0085.956] wcscmp (_String1="en-US", _String2="..") returned 1 [0085.956] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x76) returned 0x38d1820 [0085.956] wcscpy (in: _Dest=0x38d1820, _Source="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore" [0085.956] wcscat (in: _Dest=0x38d1820, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\" [0085.956] wcscat (in: _Dest=0x38d1820, _Source="en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US" [0088.792] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38d1820, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f98 [0088.793] FindNextFileW (in: hFindFile=0x389e740, lpFindFileData=0x53a24d0 | out: lpFindFileData=0x53a24d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212a24b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8fdd8c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0088.793] FindClose (in: hFindFile=0x389e740 | out: hFindFile=0x389e740) returned 1 [0088.793] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a24d0) returned 1 [0088.793] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74ae920) returned 1 [0088.793] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eedd68) returned 1 Thread: id = 1001 os_tid = 0x1de8 [0082.890] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x542b938 [0082.890] wcscpy (in: _Dest=0x542b938, _Source="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer") returned="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer" [0082.890] wcscat (in: _Dest=0x542b938, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\") returned="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\" [0082.890] wcscat (in: _Dest=0x542b938, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\*" [0082.890] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542fdb0 [0082.890] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x542fdb0 | out: lpFindFileData=0x542fdb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212a839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54454c0 [0082.890] wcscmp (_String1=".", _String2=".") returned 0 [0082.890] FindNextFileW (in: hFindFile=0x54454c0, lpFindFileData=0x542fdb0 | out: lpFindFileData=0x542fdb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212a839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.890] wcscmp (_String1="..", _String2=".") returned 1 [0082.891] wcscmp (_String1="..", _String2="..") returned 0 [0082.891] FindNextFileW (in: hFindFile=0x54454c0, lpFindFileData=0x542fdb0 | out: lpFindFileData=0x542fdb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212a839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0082.891] FindClose (in: hFindFile=0x54454c0 | out: hFindFile=0x54454c0) returned 1 [0082.891] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542fdb0) returned 1 [0082.891] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542b938) returned 1 [0082.891] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x6e95a30) returned 1 Thread: id = 1002 os_tid = 0x1dec [0082.892] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x75840a0 [0082.892] wcscpy (in: _Dest=0x75840a0, _Source="C:\\ProgramData\\Microsoft\\Windows\\LfSvc" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\LfSvc") returned="C:\\ProgramData\\Microsoft\\Windows\\LfSvc" [0082.892] wcscat (in: _Dest=0x75840a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\") returned="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\" [0082.892] wcscat (in: _Dest=0x75840a0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\*" [0082.892] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542fdb0 [0082.892] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\*", lpFindFileData=0x542fdb0 | out: lpFindFileData=0x542fdb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xf4120249, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf4120249, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54454c0 [0082.892] wcscmp (_String1=".", _String2=".") returned 0 [0082.892] FindNextFileW (in: hFindFile=0x54454c0, lpFindFileData=0x542fdb0 | out: lpFindFileData=0x542fdb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xf4120249, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf4120249, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.892] wcscmp (_String1="..", _String2=".") returned 1 [0082.892] wcscmp (_String1="..", _String2="..") returned 0 [0082.892] FindNextFileW (in: hFindFile=0x54454c0, lpFindFileData=0x542fdb0 | out: lpFindFileData=0x542fdb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4120249, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf4120249, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf4120249, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0082.892] wcscmp (_String1="Cache", _String2=".") returned 1 [0082.892] wcscmp (_String1="Cache", _String2="..") returned 1 [0082.892] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x542b4c0 [0082.892] wcscpy (in: _Dest=0x542b4c0, _Source="C:\\ProgramData\\Microsoft\\Windows\\LfSvc" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\LfSvc") returned="C:\\ProgramData\\Microsoft\\Windows\\LfSvc" [0082.893] wcscat (in: _Dest=0x542b4c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\") returned="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\" [0082.893] wcscat (in: _Dest=0x542b4c0, _Source="Cache" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\Cache") returned="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\Cache" [0082.893] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x542b590 [0082.893] wcscpy (in: _Dest=0x542b590, _Source="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\Cache" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\Cache") returned="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\Cache" [0082.893] wcscat (in: _Dest=0x542b590, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\Cache\\") returned="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\Cache\\" [0082.893] wcscat (in: _Dest=0x542b590, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\Cache\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\Cache\\*" [0082.893] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542e338 [0082.893] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\Cache\\*", lpFindFileData=0x542e338 | out: lpFindFileData=0x542e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4120249, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf4120249, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf4120249, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445600 [0082.893] wcscmp (_String1=".", _String2=".") returned 0 [0082.893] FindNextFileW (in: hFindFile=0x5445600, lpFindFileData=0x542e338 | out: lpFindFileData=0x542e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4120249, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf4120249, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf4120249, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.893] wcscmp (_String1="..", _String2=".") returned 1 [0082.893] wcscmp (_String1="..", _String2="..") returned 0 [0082.893] FindNextFileW (in: hFindFile=0x5445600, lpFindFileData=0x542e338 | out: lpFindFileData=0x542e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4120249, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf4120249, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf4120249, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0082.893] FindClose (in: hFindFile=0x5445600 | out: hFindFile=0x5445600) returned 1 [0082.893] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542e338) returned 1 [0082.893] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542b590) returned 1 [0082.893] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542b4c0) returned 1 [0082.893] FindNextFileW (in: hFindFile=0x54454c0, lpFindFileData=0x542fdb0 | out: lpFindFileData=0x542fdb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15ce201c, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xc212be41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15ce201c, ftLastWriteTime.dwHighDateTime=0x1d1a050, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Geofence", cAlternateFileName="")) returned 1 [0082.893] wcscmp (_String1="Geofence", _String2=".") returned 1 [0082.894] wcscmp (_String1="Geofence", _String2="..") returned 1 [0082.894] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x542b4c0 [0082.894] wcscpy (in: _Dest=0x542b4c0, _Source="C:\\ProgramData\\Microsoft\\Windows\\LfSvc" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\LfSvc") returned="C:\\ProgramData\\Microsoft\\Windows\\LfSvc" [0082.894] wcscat (in: _Dest=0x542b4c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\") returned="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\" [0082.894] wcscat (in: _Dest=0x542b4c0, _Source="Geofence" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\Geofence") returned="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\Geofence" [0082.894] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x5ba7f18 [0082.894] wcscpy (in: _Dest=0x5ba7f18, _Source="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\Geofence" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\Geofence") returned="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\Geofence" [0082.894] wcscat (in: _Dest=0x5ba7f18, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\Geofence\\") returned="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\Geofence\\" [0082.894] wcscat (in: _Dest=0x5ba7f18, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\Geofence\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\Geofence\\*" [0082.894] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542e338 [0082.894] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\Geofence\\*", lpFindFileData=0x542e338 | out: lpFindFileData=0x542e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15ce201c, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xc212be41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15ce201c, ftLastWriteTime.dwHighDateTime=0x1d1a050, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ebc0 [0085.952] wcscmp (_String1=".", _String2=".") returned 0 [0085.952] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x542e338 | out: lpFindFileData=0x542e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15ce201c, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xc212be41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15ce201c, ftLastWriteTime.dwHighDateTime=0x1d1a050, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.952] wcscmp (_String1="..", _String2=".") returned 1 [0085.952] wcscmp (_String1="..", _String2="..") returned 0 [0085.952] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x542e338 | out: lpFindFileData=0x542e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15ce201c, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0x15ce201c, ftLastAccessTime.dwHighDateTime=0x1d1a050, ftLastWriteTime.dwLowDateTime=0x4baaeab, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x0, dwReserved1=0x0, cFileName="GeofenceApplicationID.dat", cAlternateFileName="GEOFEN~1.DAT")) returned 1 [0085.953] wcscmp (_String1="GeofenceApplicationID.dat", _String2=".") returned 1 [0085.953] wcscmp (_String1="GeofenceApplicationID.dat", _String2="..") returned 1 [0085.953] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x94) returned 0x55c5998 [0085.953] wcscpy (in: _Dest=0x55c5998, _Source="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\Geofence" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\Geofence") returned="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\Geofence" [0085.953] wcscat (in: _Dest=0x55c5998, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\Geofence\\") returned="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\Geofence\\" [0085.953] wcscat (in: _Dest=0x55c5998, _Source="GeofenceApplicationID.dat" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\Geofence\\GeofenceApplicationID.dat") returned="C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\Geofence\\GeofenceApplicationID.dat" [0088.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55c5998, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1828 [0088.815] FindNextFileW (in: hFindFile=0x389ebc0, lpFindFileData=0x542e338 | out: lpFindFileData=0x542e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15ce201c, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0x15ce201c, ftLastAccessTime.dwHighDateTime=0x1d1a050, ftLastWriteTime.dwLowDateTime=0x4baaeab, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x0, dwReserved1=0x0, cFileName="GeofenceApplicationID.dat", cAlternateFileName="GEOFEN~1.DAT")) returned 0 [0088.815] FindClose (in: hFindFile=0x389ebc0 | out: hFindFile=0x389ebc0) returned 1 [0088.815] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542e338) returned 1 [0088.815] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba7f18) returned 1 [0088.815] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542b4c0) returned 1 [0088.816] FindNextFileW (in: hFindFile=0x54454c0, lpFindFileData=0x542fdb0 | out: lpFindFileData=0x542fdb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15ce201c, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xc212be41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15ce201c, ftLastWriteTime.dwHighDateTime=0x1d1a050, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Geofence", cAlternateFileName="")) returned 0 [0088.816] FindClose (in: hFindFile=0x54454c0 | out: hFindFile=0x54454c0) returned 1 [0088.816] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542fdb0) returned 1 [0088.816] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75840a0) returned 1 [0088.816] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5428f50) returned 1 Thread: id = 1003 os_tid = 0x1df0 [0082.897] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x74) returned 0x38d1120 [0082.897] wcscpy (in: _Dest=0x38d1120, _Source="C:\\ProgramData\\Microsoft\\Windows\\PackagedEventProviders" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\PackagedEventProviders") returned="C:\\ProgramData\\Microsoft\\Windows\\PackagedEventProviders" [0082.897] wcscat (in: _Dest=0x38d1120, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\PackagedEventProviders\\") returned="C:\\ProgramData\\Microsoft\\Windows\\PackagedEventProviders\\" [0082.897] wcscat (in: _Dest=0x38d1120, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\PackagedEventProviders\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\PackagedEventProviders\\*" [0082.897] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5430750 [0082.897] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\PackagedEventProviders\\*", lpFindFileData=0x5430750 | out: lpFindFileData=0x5430750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212c481, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445500 [0082.897] wcscmp (_String1=".", _String2=".") returned 0 [0082.897] FindNextFileW (in: hFindFile=0x5445500, lpFindFileData=0x5430750 | out: lpFindFileData=0x5430750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212c481, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.897] wcscmp (_String1="..", _String2=".") returned 1 [0082.897] wcscmp (_String1="..", _String2="..") returned 0 [0082.897] FindNextFileW (in: hFindFile=0x5445500, lpFindFileData=0x5430750 | out: lpFindFileData=0x5430750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212c481, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0082.897] FindClose (in: hFindFile=0x5445500 | out: hFindFile=0x5445500) returned 1 [0082.897] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5430750) returned 1 [0082.897] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38d1120) returned 1 [0082.897] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eedde0) returned 1 Thread: id = 1004 os_tid = 0x1df4 [0082.899] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6a) returned 0x5eedde0 [0082.899] wcscpy (in: _Dest=0x5eedde0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Parental Controls" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Parental Controls") returned="C:\\ProgramData\\Microsoft\\Windows\\Parental Controls" [0082.899] wcscat (in: _Dest=0x5eedde0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Parental Controls\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Parental Controls\\" [0082.899] wcscat (in: _Dest=0x5eedde0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Parental Controls\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Parental Controls\\*" [0082.899] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5430750 [0082.899] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Parental Controls\\*", lpFindFileData=0x5430750 | out: lpFindFileData=0x5430750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212c80e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445500 [0082.900] wcscmp (_String1=".", _String2=".") returned 0 [0082.900] FindNextFileW (in: hFindFile=0x5445500, lpFindFileData=0x5430750 | out: lpFindFileData=0x5430750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212c80e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.900] wcscmp (_String1="..", _String2=".") returned 1 [0082.900] wcscmp (_String1="..", _String2="..") returned 0 [0082.900] FindNextFileW (in: hFindFile=0x5445500, lpFindFileData=0x5430750 | out: lpFindFileData=0x5430750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212cd78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings", cAlternateFileName="")) returned 1 [0082.900] wcscmp (_String1="settings", _String2=".") returned 1 [0082.900] wcscmp (_String1="settings", _String2="..") returned 1 [0082.900] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x78) returned 0x38d0aa0 [0082.900] wcscpy (in: _Dest=0x38d0aa0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Parental Controls" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Parental Controls") returned="C:\\ProgramData\\Microsoft\\Windows\\Parental Controls" [0082.900] wcscat (in: _Dest=0x38d0aa0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Parental Controls\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Parental Controls\\" [0082.900] wcscat (in: _Dest=0x38d0aa0, _Source="settings" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Parental Controls\\settings") returned="C:\\ProgramData\\Microsoft\\Windows\\Parental Controls\\settings" [0082.900] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7c) returned 0x3977cc0 [0082.900] wcscpy (in: _Dest=0x3977cc0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Parental Controls\\settings" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Parental Controls\\settings") returned="C:\\ProgramData\\Microsoft\\Windows\\Parental Controls\\settings" [0082.900] wcscat (in: _Dest=0x3977cc0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Parental Controls\\settings\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Parental Controls\\settings\\" [0082.900] wcscat (in: _Dest=0x3977cc0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Parental Controls\\settings\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Parental Controls\\settings\\*" [0082.900] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542ea70 [0082.900] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Parental Controls\\settings\\*", lpFindFileData=0x542ea70 | out: lpFindFileData=0x542ea70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212cd78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445600 [0082.900] wcscmp (_String1=".", _String2=".") returned 0 [0082.900] FindNextFileW (in: hFindFile=0x5445600, lpFindFileData=0x542ea70 | out: lpFindFileData=0x542ea70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212cd78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.900] wcscmp (_String1="..", _String2=".") returned 1 [0082.900] wcscmp (_String1="..", _String2="..") returned 0 [0082.900] FindNextFileW (in: hFindFile=0x5445600, lpFindFileData=0x542ea70 | out: lpFindFileData=0x542ea70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212cd78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0082.900] FindClose (in: hFindFile=0x5445600 | out: hFindFile=0x5445600) returned 1 [0082.901] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542ea70) returned 1 [0082.901] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3977cc0) returned 1 [0082.901] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38d0aa0) returned 1 [0082.901] FindNextFileW (in: hFindFile=0x5445500, lpFindFileData=0x5430750 | out: lpFindFileData=0x5430750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212cd78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings", cAlternateFileName="")) returned 0 [0082.901] FindClose (in: hFindFile=0x5445500 | out: hFindFile=0x5445500) returned 1 [0082.901] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5430750) returned 1 [0082.901] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eedde0) returned 1 [0082.901] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b1fb8) returned 1 Thread: id = 1005 os_tid = 0x1df8 [0082.902] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x80) returned 0x3977cc0 [0082.902] wcscpy (in: _Dest=0x3977cc0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" [0082.902] wcscat (in: _Dest=0x3977cc0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0082.902] wcscat (in: _Dest=0x3977cc0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*" [0082.902] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5430750 [0082.902] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*", lpFindFileData=0x5430750 | out: lpFindFileData=0x5430750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1516f86b, ftLastAccessTime.dwHighDateTime=0x1d336da, ftLastWriteTime.dwLowDateTime=0x15195c01, ftLastWriteTime.dwHighDateTime=0x1d336da, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445500 [0082.904] wcscmp (_String1=".", _String2=".") returned 0 [0082.904] FindNextFileW (in: hFindFile=0x5445500, lpFindFileData=0x5430750 | out: lpFindFileData=0x5430750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1516f86b, ftLastAccessTime.dwHighDateTime=0x1d336da, ftLastWriteTime.dwLowDateTime=0x15195c01, ftLastWriteTime.dwHighDateTime=0x1d336da, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.904] wcscmp (_String1="..", _String2=".") returned 1 [0082.904] wcscmp (_String1="..", _String2="..") returned 0 [0082.904] FindNextFileW (in: hFindFile=0x5445500, lpFindFileData=0x5430750 | out: lpFindFileData=0x5430750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14fcc049, ftCreationTime.dwHighDateTime=0x1d336da, ftLastAccessTime.dwLowDateTime=0x14fcc049, ftLastAccessTime.dwHighDateTime=0x1d336da, ftLastWriteTime.dwLowDateTime=0x14fa5e38, ftLastWriteTime.dwHighDateTime=0x1d336da, nFileSizeHigh=0x0, nFileSizeLow=0x3c8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-report-2017-09-26.xml", cAlternateFileName="ENERGY~2.XML")) returned 1 [0082.904] wcscmp (_String1="energy-report-2017-09-26.xml", _String2=".") returned 1 [0082.904] wcscmp (_String1="energy-report-2017-09-26.xml", _String2="..") returned 1 [0082.904] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb6) returned 0x5b15dd0 [0082.904] wcscpy (in: _Dest=0x5b15dd0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" [0082.904] wcscat (in: _Dest=0x5b15dd0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0082.904] wcscat (in: _Dest=0x5b15dd0, _Source="energy-report-2017-09-26.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-09-26.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-09-26.xml" [0082.904] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-09-26.xml" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-2017-09-26.xml")) returned 0x20 [0082.905] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-09-26.xml", dwFileAttributes=0x20) returned 1 [0082.905] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-09-26.xml" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-2017-09-26.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fa4 [0082.905] GetFileSizeEx (in: hFile=0x1fa4, lpFileSize=0x249ffae4 | out: lpFileSize=0x249ffae4*=15502) returned 1 [0082.905] SetFilePointerEx (in: hFile=0x1fa4, liDistanceToMove=0x3c8a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.906] ReadFile (in: hFile=0x1fa4, lpBuffer=0x249ffa68, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x249ffa64, lpOverlapped=0x0 | out: lpBuffer=0x249ffa68*, lpNumberOfBytesRead=0x249ffa64*=0x4, lpOverlapped=0x0) returned 1 [0082.907] SetFilePointerEx (in: hFile=0x1fa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.907] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe53da28 [0085.939] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe53d960 [0085.939] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe53dbe0 [0085.939] NtQuerySystemTime (in: CurrentTime=0x249ffa44 | out: CurrentTime=0x249ffa44*=132260136430955505) returned 0x0 [0085.939] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0xe871519a [0085.939] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0xdb1ace71 [0085.939] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0xabdc700e [0085.939] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0x66f7d464 [0085.939] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0xe9bccdca [0085.939] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0x72ed6363 [0085.939] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0x19bea870 [0085.939] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0x31f0f044 [0085.939] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0xde1a534c [0085.939] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0x697679fe [0085.939] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0x7d98e3ff [0085.939] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0x5c453835 [0085.940] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0x3294283d [0085.940] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0x822a60cd [0085.940] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0xb84c7dd1 [0085.940] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0x5a269f56 [0085.940] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0x3cb551e7 [0085.940] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0xc5bb88a6 [0085.940] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0x6e953b07 [0085.940] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0x72f017fb [0085.940] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0x75a88264 [0085.940] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0xe7388bf6 [0085.940] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0x91aed813 [0085.940] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0xa735a46d [0085.940] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0xe736842f [0085.940] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0xc7d8381 [0085.940] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0x4635f5c0 [0085.940] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0xf27b5447 [0085.940] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0x1543aad1 [0085.940] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0x47edc1c8 [0085.940] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0x844c7d8b [0085.940] RtlRandom (in: Seed=0x249ffa50 | out: Seed=0x249ffa50) returned 0xaec0f87a [0085.950] ReadFile (in: hFile=0x1fa4, lpBuffer=0xe53dd78, nNumberOfBytesToRead=0x3c8e, lpNumberOfBytesRead=0x249ffa40, lpOverlapped=0x0 | out: lpBuffer=0xe53dd78*, lpNumberOfBytesRead=0x249ffa40*=0x3c8e, lpOverlapped=0x0) returned 1 [0085.952] SetFilePointerEx (in: hFile=0x1fa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.952] WriteFile (in: hFile=0x1fa4, lpBuffer=0xe54a580*, nNumberOfBytesToWrite=0x3c8e, lpNumberOfBytesWritten=0x249ffa3c, lpOverlapped=0x0 | out: lpBuffer=0xe54a580*, lpNumberOfBytesWritten=0x249ffa3c*=0x3c8e, lpOverlapped=0x0) returned 1 [0089.301] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282ed8 [0089.301] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7283248 [0089.301] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7283248) returned 1 [0089.301] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe54a580) returned 1 [0091.597] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe53dd78) returned 1 [0091.600] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe53ae08) returned 1 [0091.600] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba89a8) returned 1 [0091.600] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x45) returned 0x397de58 [0091.600] SetFilePointerEx (in: hFile=0x1fa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.600] WriteFile (hFile=0x1fa4, lpBuffer=0x5ba9e70, nNumberOfBytesToWrite=0x129, lpNumberOfBytesWritten=0x249ffaa4, lpOverlapped=0x0) Thread: id = 1006 os_tid = 0x1dfc [0082.907] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x542b938 [0082.907] wcscpy (in: _Dest=0x542b938, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0082.907] wcscat (in: _Dest=0x542b938, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0082.907] wcscat (in: _Dest=0x542b938, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\*" [0082.907] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54309b8 [0082.907] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\*", lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc21e5ea3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445540 [0082.908] wcscmp (_String1=".", _String2=".") returned 0 [0082.908] FindNextFileW (in: hFindFile=0x5445540, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc21e5ea3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.908] wcscmp (_String1="..", _String2=".") returned 1 [0082.908] wcscmp (_String1="..", _String2="..") returned 0 [0082.908] FindNextFileW (in: hFindFile=0x5445540, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc21e5ea3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0082.908] FindClose (in: hFindFile=0x5445540 | out: hFindFile=0x5445540) returned 1 [0082.908] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54309b8) returned 1 [0082.908] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542b938) returned 1 [0082.908] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b5a68) returned 1 Thread: id = 1007 os_tid = 0x1e00 [0082.909] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x542b938 [0082.909] wcscpy (in: _Dest=0x542b938, _Source="C:\\ProgramData\\Microsoft\\Windows\\SleepStudy" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\SleepStudy") returned="C:\\ProgramData\\Microsoft\\Windows\\SleepStudy" [0082.909] wcscat (in: _Dest=0x542b938, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\SleepStudy\\") returned="C:\\ProgramData\\Microsoft\\Windows\\SleepStudy\\" [0082.909] wcscat (in: _Dest=0x542b938, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\SleepStudy\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\SleepStudy\\*" [0082.909] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54309b8 [0082.909] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\SleepStudy\\*", lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedcf5f61, ftCreationTime.dwHighDateTime=0x1d336d9, ftLastAccessTime.dwLowDateTime=0xeeb42f5b, ftLastAccessTime.dwHighDateTime=0x1d336d9, ftLastWriteTime.dwLowDateTime=0xeeb42f5b, ftLastWriteTime.dwHighDateTime=0x1d336d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445540 [0082.910] wcscmp (_String1=".", _String2=".") returned 0 [0082.910] FindNextFileW (in: hFindFile=0x5445540, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedcf5f61, ftCreationTime.dwHighDateTime=0x1d336d9, ftLastAccessTime.dwLowDateTime=0xeeb42f5b, ftLastAccessTime.dwHighDateTime=0x1d336d9, ftLastWriteTime.dwLowDateTime=0xeeb42f5b, ftLastWriteTime.dwHighDateTime=0x1d336d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.910] wcscmp (_String1="..", _String2=".") returned 1 [0082.910] wcscmp (_String1="..", _String2="..") returned 0 [0082.910] FindNextFileW (in: hFindFile=0x5445540, lpFindFileData=0x54309b8 | out: lpFindFileData=0x54309b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb42f5b, ftCreationTime.dwHighDateTime=0x1d336d9, ftLastAccessTime.dwLowDateTime=0xeeb42f5b, ftLastAccessTime.dwHighDateTime=0x1d336d9, ftLastWriteTime.dwLowDateTime=0xeeb42f5b, ftLastWriteTime.dwHighDateTime=0x1d336d9, nFileSizeHigh=0x0, nFileSizeLow=0x6229, dwReserved0=0x0, dwReserved1=0x0, cFileName="sleepstudy-report-latest.xml", cAlternateFileName="SLEEPS~1.XML")) returned 1 [0082.910] wcscmp (_String1="sleepstudy-report-latest.xml", _String2=".") returned 1 [0082.910] wcscmp (_String1="sleepstudy-report-latest.xml", _String2="..") returned 1 [0082.910] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x92) returned 0x55c5218 [0082.910] wcscpy (in: _Dest=0x55c5218, _Source="C:\\ProgramData\\Microsoft\\Windows\\SleepStudy" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\SleepStudy") returned="C:\\ProgramData\\Microsoft\\Windows\\SleepStudy" [0082.910] wcscat (in: _Dest=0x55c5218, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\SleepStudy\\") returned="C:\\ProgramData\\Microsoft\\Windows\\SleepStudy\\" [0082.910] wcscat (in: _Dest=0x55c5218, _Source="sleepstudy-report-latest.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\SleepStudy\\sleepstudy-report-latest.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\SleepStudy\\sleepstudy-report-latest.xml" [0082.910] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\SleepStudy\\sleepstudy-report-latest.xml" (normalized: "c:\\programdata\\microsoft\\windows\\sleepstudy\\sleepstudy-report-latest.xml")) returned 0x20 [0082.911] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\SleepStudy\\sleepstudy-report-latest.xml", dwFileAttributes=0x20) returned 1 [0082.911] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\SleepStudy\\sleepstudy-report-latest.xml" (normalized: "c:\\programdata\\microsoft\\windows\\sleepstudy\\sleepstudy-report-latest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fac [0082.911] GetFileSizeEx (in: hFile=0x1fac, lpFileSize=0x24aff904 | out: lpFileSize=0x24aff904*=25129) returned 1 [0082.911] SetFilePointerEx (in: hFile=0x1fac, liDistanceToMove=0x6225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.911] ReadFile (in: hFile=0x1fac, lpBuffer=0x24aff888, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24aff884, lpOverlapped=0x0 | out: lpBuffer=0x24aff888*, lpNumberOfBytesRead=0x24aff884*=0x4, lpOverlapped=0x0) returned 1 [0082.913] SetFilePointerEx (in: hFile=0x1fac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.913] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe53be90 [0085.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe53bdf0 [0085.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe53bfa8 [0085.928] NtQuerySystemTime (in: CurrentTime=0x24aff864 | out: CurrentTime=0x24aff864*=132260136430798940) returned 0x0 [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0xc63b91a1 [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0x64096ba8 [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0x457fa748 [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0x2a3141f6 [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0x9db5db9b [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0x41beafd [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0xac0292c0 [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0x9294a85d [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0xf677b0ee [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0x28997cac [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0x7418020e [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0xbb1112b6 [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0xc5718032 [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0xc47a7b0c [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0x8d1eeb59 [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0xe73831f8 [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0x81e9667e [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0x130ae9b [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0x4aacd732 [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0x594080a3 [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0x946a5efe [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0x20bf8db9 [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0xad3f3a0d [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0xbc1a48bb [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0x5a794e87 [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0x8a8788ec [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0xe4624524 [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0xac353a76 [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0xe8f10492 [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0xe5ab2092 [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0x6b057b88 [0085.929] RtlRandom (in: Seed=0x24aff870 | out: Seed=0x24aff870) returned 0x64a42afc [0085.938] ReadFile (in: hFile=0x1fac, lpBuffer=0x7388008, nNumberOfBytesToRead=0x6229, lpNumberOfBytesRead=0x24aff860, lpOverlapped=0x0 | out: lpBuffer=0x7388008*, lpNumberOfBytesRead=0x24aff860*=0x6229, lpOverlapped=0x0) returned 1 [0085.951] SetFilePointerEx (in: hFile=0x1fac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.951] WriteFile (in: hFile=0x1fac, lpBuffer=0x73a2020*, nNumberOfBytesToWrite=0x6229, lpNumberOfBytesWritten=0x24aff85c, lpOverlapped=0x0 | out: lpBuffer=0x73a2020*, lpNumberOfBytesWritten=0x24aff85c*=0x6229, lpOverlapped=0x0) returned 1 [0089.307] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066520 [0089.307] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066368 [0089.307] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe066368) returned 1 [0089.307] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73a2020) returned 1 [0091.534] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7388008) returned 1 [0091.534] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe53ad90) returned 1 [0091.534] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8960) returned 1 [0091.534] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x45) returned 0x397dcc8 [0091.534] SetFilePointerEx (in: hFile=0x1fac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.534] WriteFile (hFile=0x1fac, lpBuffer=0x5ba9c00, nNumberOfBytesToWrite=0x129, lpNumberOfBytesWritten=0x24aff8c4, lpOverlapped=0x0) Thread: id = 1008 os_tid = 0x1e04 [0082.913] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x757e8c0 [0082.913] wcscpy (in: _Dest=0x757e8c0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Sqm" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm" [0082.913] wcscat (in: _Dest=0x757e8c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\" [0082.913] wcscat (in: _Dest=0x757e8c0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\*" [0082.913] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542ea70 [0082.913] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\*", lpFindFileData=0x542ea70 | out: lpFindFileData=0x542ea70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445600 [0082.913] wcscmp (_String1=".", _String2=".") returned 0 [0082.913] FindNextFileW (in: hFindFile=0x5445600, lpFindFileData=0x542ea70 | out: lpFindFileData=0x542ea70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.914] wcscmp (_String1="..", _String2=".") returned 1 [0082.914] wcscmp (_String1="..", _String2="..") returned 0 [0082.914] FindNextFileW (in: hFindFile=0x5445600, lpFindFileData=0x542ea70 | out: lpFindFileData=0x542ea70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Manifest", cAlternateFileName="")) returned 1 [0082.914] wcscmp (_String1="Manifest", _String2=".") returned 1 [0082.914] wcscmp (_String1="Manifest", _String2="..") returned 1 [0082.914] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x542b590 [0082.914] wcscpy (in: _Dest=0x542b590, _Source="C:\\ProgramData\\Microsoft\\Windows\\Sqm" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm" [0082.914] wcscat (in: _Dest=0x542b590, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\" [0082.914] wcscat (in: _Dest=0x542b590, _Source="Manifest" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest" [0082.914] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x542b660 [0082.914] wcscpy (in: _Dest=0x542b660, _Source="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest" [0082.914] wcscat (in: _Dest=0x542b660, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\" [0082.914] wcscat (in: _Dest=0x542b660, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\*" [0082.914] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542ef40 [0082.914] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\*", lpFindFileData=0x542ef40 | out: lpFindFileData=0x542ef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54456c0 [0082.914] wcscmp (_String1=".", _String2=".") returned 0 [0082.914] FindNextFileW (in: hFindFile=0x54456c0, lpFindFileData=0x542ef40 | out: lpFindFileData=0x542ef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.914] wcscmp (_String1="..", _String2=".") returned 1 [0082.914] wcscmp (_String1="..", _String2="..") returned 0 [0082.914] FindNextFileW (in: hFindFile=0x54456c0, lpFindFileData=0x542ef40 | out: lpFindFileData=0x542ef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0082.914] FindClose (in: hFindFile=0x54456c0 | out: hFindFile=0x54456c0) returned 1 [0082.914] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542ef40) returned 1 [0082.915] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542b660) returned 1 [0082.915] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542b590) returned 1 [0082.915] FindNextFileW (in: hFindFile=0x5445600, lpFindFileData=0x542ea70 | out: lpFindFileData=0x542ea70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sessions", cAlternateFileName="")) returned 1 [0082.915] wcscmp (_String1="Sessions", _String2=".") returned 1 [0082.915] wcscmp (_String1="Sessions", _String2="..") returned 1 [0082.915] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x542b590 [0082.915] wcscpy (in: _Dest=0x542b590, _Source="C:\\ProgramData\\Microsoft\\Windows\\Sqm" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm" [0082.915] wcscat (in: _Dest=0x542b590, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\" [0082.915] wcscat (in: _Dest=0x542b590, _Source="Sessions" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions" [0082.915] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x542b660 [0082.915] wcscpy (in: _Dest=0x542b660, _Source="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions" [0082.915] wcscat (in: _Dest=0x542b660, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\" [0082.915] wcscat (in: _Dest=0x542b660, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\*" [0082.915] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542ef40 [0082.915] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\*", lpFindFileData=0x542ef40 | out: lpFindFileData=0x542ef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54456c0 [0082.915] wcscmp (_String1=".", _String2=".") returned 0 [0082.915] FindNextFileW (in: hFindFile=0x54456c0, lpFindFileData=0x542ef40 | out: lpFindFileData=0x542ef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.915] wcscmp (_String1="..", _String2=".") returned 1 [0082.915] wcscmp (_String1="..", _String2="..") returned 0 [0082.915] FindNextFileW (in: hFindFile=0x54456c0, lpFindFileData=0x542ef40 | out: lpFindFileData=0x542ef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0082.915] FindClose (in: hFindFile=0x54456c0 | out: hFindFile=0x54456c0) returned 1 [0082.915] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542ef40) returned 1 [0082.916] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542b660) returned 1 [0082.916] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542b590) returned 1 [0082.916] FindNextFileW (in: hFindFile=0x5445600, lpFindFileData=0x542ea70 | out: lpFindFileData=0x542ea70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Upload", cAlternateFileName="")) returned 1 [0082.916] wcscmp (_String1="Upload", _String2=".") returned 1 [0082.916] wcscmp (_String1="Upload", _String2="..") returned 1 [0082.916] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x7584100 [0082.916] wcscpy (in: _Dest=0x7584100, _Source="C:\\ProgramData\\Microsoft\\Windows\\Sqm" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm" [0082.916] wcscat (in: _Dest=0x7584100, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\" [0082.916] wcscat (in: _Dest=0x7584100, _Source="Upload" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload" [0082.916] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x542b590 [0082.916] wcscpy (in: _Dest=0x542b590, _Source="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload" [0082.916] wcscat (in: _Dest=0x542b590, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\" [0082.916] wcscat (in: _Dest=0x542b590, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\*" [0082.916] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5430018 [0082.916] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\*", lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445640 [0082.916] wcscmp (_String1=".", _String2=".") returned 0 [0082.916] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.916] wcscmp (_String1="..", _String2=".") returned 1 [0082.916] wcscmp (_String1="..", _String2="..") returned 0 [0082.916] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0082.916] FindClose (in: hFindFile=0x5445640 | out: hFindFile=0x5445640) returned 1 [0082.917] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5430018) returned 1 [0082.917] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542b590) returned 1 [0082.917] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7584100) returned 1 [0082.917] FindNextFileW (in: hFindFile=0x5445600, lpFindFileData=0x542ea70 | out: lpFindFileData=0x542ea70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Upload", cAlternateFileName="")) returned 0 [0082.917] FindClose (in: hFindFile=0x5445600 | out: hFindFile=0x5445600) returned 1 [0082.917] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542ea70) returned 1 [0082.917] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757e8c0) returned 1 [0082.917] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757e4a0) returned 1 Thread: id = 1009 os_tid = 0x1e08 [0082.918] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x542ba08 [0082.918] wcscpy (in: _Dest=0x542ba08, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu" [0082.918] wcscat (in: _Dest=0x542ba08, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\" [0082.918] wcscat (in: _Dest=0x542ba08, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\*" [0082.918] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542ea70 [0082.918] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x542ea70 | out: lpFindFileData=0x542ea70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc229ee00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a923ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445600 [0082.918] wcscmp (_String1=".", _String2=".") returned 0 [0082.918] FindNextFileW (in: hFindFile=0x5445600, lpFindFileData=0x542ea70 | out: lpFindFileData=0x542ea70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc229ee00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a923ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.918] wcscmp (_String1="..", _String2=".") returned 1 [0082.918] wcscmp (_String1="..", _String2="..") returned 0 [0082.918] FindNextFileW (in: hFindFile=0x5445600, lpFindFileData=0x542ea70 | out: lpFindFileData=0x542ea70*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a923ff6, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f43b93, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f43b93, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0082.918] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0082.918] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0082.919] FindNextFileW (in: hFindFile=0x5445600, lpFindFileData=0x542ea70 | out: lpFindFileData=0x542ea70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 1 [0082.919] wcscmp (_String1="Programs", _String2=".") returned 1 [0082.919] wcscmp (_String1="Programs", _String2="..") returned 1 [0082.919] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6a) returned 0x5eedde0 [0082.919] wcscpy (in: _Dest=0x5eedde0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu" [0082.919] wcscat (in: _Dest=0x5eedde0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\" [0082.919] wcscat (in: _Dest=0x5eedde0, _Source="Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0082.919] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6e) returned 0xe53b948 [0085.927] wcscpy (in: _Dest=0xe53b948, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0085.927] wcscat (in: _Dest=0xe53b948, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0085.927] wcscat (in: _Dest=0xe53b948, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\*" [0085.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a1d98 [0085.928] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389eac0 [0085.928] wcscmp (_String1=".", _String2=".") returned 0 [0085.928] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.928] wcscmp (_String1="..", _String2=".") returned 1 [0085.928] wcscmp (_String1="..", _String2="..") returned 0 [0085.928] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4ae4bfb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4ae4bfb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4ae4bfb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x974, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access 2016.lnk", cAlternateFileName="ACCESS~1.LNK")) returned 1 [0085.928] wcscmp (_String1="Access 2016.lnk", _String2=".") returned 1 [0085.928] wcscmp (_String1="Access 2016.lnk", _String2="..") returned 1 [0085.928] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc23497a5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a94a259, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1 [0085.928] wcscmp (_String1="Accessibility", _String2=".") returned 1 [0085.928] wcscmp (_String1="Accessibility", _String2="..") returned 1 [0085.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x86) returned 0x549d568 [0085.928] wcscpy (in: _Dest=0x549d568, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0085.928] wcscat (in: _Dest=0x549d568, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0085.928] wcscat (in: _Dest=0x549d568, _Source="Accessibility" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility" [0088.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x549d568, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f9c [0088.817] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc234b032, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x47011dad, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~2")) returned 1 [0088.817] wcscmp (_String1="Accessories", _String2=".") returned 1 [0088.817] wcscmp (_String1="Accessories", _String2="..") returned 1 [0088.817] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x82) returned 0x549da78 [0088.817] wcscpy (in: _Dest=0x549da78, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0088.817] wcscat (in: _Dest=0x549da78, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0088.817] wcscat (in: _Dest=0x549da78, _Source="Accessories" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" [0088.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x549da78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x844 [0088.818] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38b1d2da, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2eb3f5a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2eda1a5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x999, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat Reader DC.lnk", cAlternateFileName="ACROBA~1.LNK")) returned 1 [0088.818] wcscmp (_String1="Acrobat Reader DC.lnk", _String2=".") returned 1 [0088.818] wcscmp (_String1="Acrobat Reader DC.lnk", _String2="..") returned 1 [0088.818] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc23f53a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x76b7cd4d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0088.818] wcscmp (_String1="Administrative Tools", _String2=".") returned 1 [0088.818] wcscmp (_String1="Administrative Tools", _String2="..") returned 1 [0088.818] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x94) returned 0x55c5a38 [0088.818] wcscpy (in: _Dest=0x55c5a38, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0088.818] wcscat (in: _Dest=0x55c5a38, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0088.818] wcscat (in: _Dest=0x55c5a38, _Source="Administrative Tools" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools" [0088.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55c5a38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1824 [0088.819] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a923ff6, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x96fe9bef, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x6e749736, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x31c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0088.819] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0088.819] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0088.819] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4b0ade7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4b0ade7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4b0ade7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x973, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel 2016.lnk", cAlternateFileName="EXCEL2~1.LNK")) returned 1 [0088.819] wcscmp (_String1="Excel 2016.lnk", _String2=".") returned 1 [0088.819] wcscmp (_String1="Excel 2016.lnk", _String2="..") returned 1 [0088.819] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4c6308a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4c6308a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c6308a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x926, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0088.819] wcscmp (_String1="Google Chrome.lnk", _String2=".") returned 1 [0088.819] wcscmp (_String1="Google Chrome.lnk", _String2="..") returned 1 [0088.819] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x25, ftCreationTime.dwLowDateTime=0x97a9db13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97a9db13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97a9db13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x92d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Immersive Control Panel.lnk", cAlternateFileName="")) returned 1 [0088.819] wcscmp (_String1="Immersive Control Panel.lnk", _String2=".") returned 1 [0088.819] wcscmp (_String1="Immersive Control Panel.lnk", _String2="..") returned 1 [0088.819] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabaf4d3e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac589477, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac589477, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0088.819] wcscmp (_String1="Java", _String2=".") returned 1 [0088.819] wcscmp (_String1="Java", _String2="..") returned 1 [0088.819] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x74) returned 0x38d0920 [0088.819] wcscpy (in: _Dest=0x38d0920, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0088.819] wcscat (in: _Dest=0x38d0920, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0088.819] wcscat (in: _Dest=0x38d0920, _Source="Java" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java" [0088.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38d0920, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1820 [0088.820] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc248d7d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9704bf, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0088.820] wcscmp (_String1="Maintenance", _String2=".") returned 1 [0088.820] wcscmp (_String1="Maintenance", _String2="..") returned 1 [0088.820] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x82) returned 0x549db98 [0088.820] wcscpy (in: _Dest=0x549db98, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0088.820] wcscat (in: _Dest=0x549db98, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0088.820] wcscat (in: _Dest=0x549db98, _Source="Maintenance" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance" [0088.820] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x549db98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x181c [0088.821] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4b0ade7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office 2016 Tools", cAlternateFileName="MICROS~1")) returned 1 [0088.821] wcscmp (_String1="Microsoft Office 2016 Tools", _String2=".") returned 1 [0088.821] wcscmp (_String1="Microsoft Office 2016 Tools", _String2="..") returned 1 [0088.821] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa2) returned 0x388f3b0 [0088.821] wcscpy (in: _Dest=0x388f3b0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0088.821] wcscat (in: _Dest=0x388f3b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0088.821] wcscat (in: _Dest=0x388f3b0, _Source="Microsoft Office 2016 Tools" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools" [0088.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x388f3b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1818 [0088.822] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x25, ftCreationTime.dwLowDateTime=0x496f62c5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x496f62c5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x496f62c5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="MiracastView.lnk", cAlternateFileName="")) returned 1 [0088.822] wcscmp (_String1="MiracastView.lnk", _String2=".") returned 1 [0088.822] wcscmp (_String1="MiracastView.lnk", _String2="..") returned 1 [0088.822] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef80377f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef84fc3f, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x3f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0088.822] wcscmp (_String1="Mozilla Firefox.lnk", _String2=".") returned 1 [0088.822] wcscmp (_String1="Mozilla Firefox.lnk", _String2="..") returned 1 [0088.822] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d4712f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d4712f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d4712f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive for Business.lnk", cAlternateFileName="ONEDRI~1.LNK")) returned 1 [0088.822] wcscmp (_String1="OneDrive for Business.lnk", _String2=".") returned 1 [0088.822] wcscmp (_String1="OneDrive for Business.lnk", _String2="..") returned 1 [0088.822] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d6d38e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d6d38e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d6d38e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x95f, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNote 2016.lnk", cAlternateFileName="ONENOT~1.LNK")) returned 1 [0088.822] wcscmp (_String1="OneNote 2016.lnk", _String2=".") returned 1 [0088.822] wcscmp (_String1="OneNote 2016.lnk", _String2="..") returned 1 [0088.822] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d6d38e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d6d38e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d6d38e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x96d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook 2016.lnk", cAlternateFileName="OUTLOO~1.LNK")) returned 1 [0088.822] wcscmp (_String1="Outlook 2016.lnk", _String2=".") returned 1 [0088.822] wcscmp (_String1="Outlook 2016.lnk", _String2="..") returned 1 [0088.822] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d935fc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d935fc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d935fc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x998, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPoint 2016.lnk", cAlternateFileName="POWERP~1.LNK")) returned 1 [0088.822] wcscmp (_String1="PowerPoint 2016.lnk", _String2=".") returned 1 [0088.822] wcscmp (_String1="PowerPoint 2016.lnk", _String2="..") returned 1 [0088.822] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x25, ftCreationTime.dwLowDateTime=0x567be970, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x567be970, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x567be970, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x897, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrintDialog.lnk", cAlternateFileName="")) returned 1 [0088.822] wcscmp (_String1="PrintDialog.lnk", _String2=".") returned 1 [0088.822] wcscmp (_String1="PrintDialog.lnk", _String2="..") returned 1 [0088.822] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd412f52, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x87e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project 2016.lnk", cAlternateFileName="PROJEC~1.LNK")) returned 1 [0088.822] wcscmp (_String1="Project 2016.lnk", _String2=".") returned 1 [0088.822] wcscmp (_String1="Project 2016.lnk", _String2="..") returned 1 [0088.822] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d935fc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d935fc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d935fc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x967, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher 2016.lnk", cAlternateFileName="PUBLIS~1.LNK")) returned 1 [0088.822] wcscmp (_String1="Publisher 2016.lnk", _String2=".") returned 1 [0088.822] wcscmp (_String1="Publisher 2016.lnk", _String2="..") returned 1 [0088.822] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d935fc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d935fc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d935fc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Skype for Business 2016.lnk", cAlternateFileName="SKYPEF~1.LNK")) returned 1 [0088.823] wcscmp (_String1="Skype for Business 2016.lnk", _String2=".") returned 1 [0088.823] wcscmp (_String1="Skype for Business 2016.lnk", _String2="..") returned 1 [0088.823] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc24e5770, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9704bf, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Startup", cAlternateFileName="")) returned 1 [0088.823] wcscmp (_String1="Startup", _String2=".") returned 1 [0088.823] wcscmp (_String1="Startup", _String2="..") returned 1 [0088.823] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7a) returned 0x3976ef0 [0088.823] wcscpy (in: _Dest=0x3976ef0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0088.823] wcscat (in: _Dest=0x3976ef0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0088.823] wcscat (in: _Dest=0x3976ef0, _Source="Startup" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" [0088.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3976ef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1814 [0088.823] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc24e74df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x474d6904, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0088.823] wcscmp (_String1="System Tools", _String2=".") returned 1 [0088.823] wcscmp (_String1="System Tools", _String2="..") returned 1 [0088.823] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x84) returned 0x549dc28 [0088.823] wcscpy (in: _Dest=0x549dc28, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0088.823] wcscat (in: _Dest=0x549dc28, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0088.824] wcscat (in: _Dest=0x549dc28, _Source="System Tools" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools" [0088.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x549dc28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1810 [0088.824] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc24e8184, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0088.824] wcscmp (_String1="Tablet PC", _String2=".") returned 1 [0088.824] wcscmp (_String1="Tablet PC", _String2="..") returned 1 [0088.824] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7e) returned 0x3977088 [0088.824] wcscpy (in: _Dest=0x3977088, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0088.824] wcscat (in: _Dest=0x3977088, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0088.824] wcscat (in: _Dest=0x3977088, _Source="Tablet PC" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC" [0088.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3977088, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x180c [0088.825] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc307c637, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0xc307c637, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xc307c637, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio 2016.lnk", cAlternateFileName="VISIO2~1.LNK")) returned 1 [0088.825] wcscmp (_String1="Visio 2016.lnk", _String2=".") returned 1 [0088.825] wcscmp (_String1="Visio 2016.lnk", _String2="..") returned 1 [0088.825] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea725d67, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea725d67, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea725d67, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows 10 Update Assistant.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0088.825] wcscmp (_String1="Windows 10 Update Assistant.lnk", _String2=".") returned 1 [0088.825] wcscmp (_String1="Windows 10 Update Assistant.lnk", _String2="..") returned 1 [0088.825] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e664927, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6e664927, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6e664927, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x628, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0088.825] wcscmp (_String1="Windows Media Player.lnk", _String2=".") returned 1 [0088.825] wcscmp (_String1="Windows Media Player.lnk", _String2="..") returned 1 [0088.825] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4db984e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4db984e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4db984e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x999, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word 2016.lnk", cAlternateFileName="WORD20~1.LNK")) returned 1 [0088.825] wcscmp (_String1="Word 2016.lnk", _String2=".") returned 1 [0088.825] wcscmp (_String1="Word 2016.lnk", _String2="..") returned 1 [0088.825] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a1d98 | out: lpFindFileData=0x53a1d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4db984e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4db984e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4db984e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x999, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word 2016.lnk", cAlternateFileName="WORD20~1.LNK")) returned 0 [0088.825] FindClose (in: hFindFile=0x389eac0 | out: hFindFile=0x389eac0) returned 1 [0088.825] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a1d98) returned 1 [0088.826] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe53b948) returned 1 [0088.826] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5eedde0) returned 1 [0088.826] FindNextFileW (in: hFindFile=0x5445600, lpFindFileData=0x542ea70 | out: lpFindFileData=0x542ea70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 0 [0088.826] FindClose (in: hFindFile=0x5445600 | out: hFindFile=0x5445600) returned 1 [0088.826] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542ea70) returned 1 [0088.826] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542ba08) returned 1 [0088.826] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b5948) returned 1 Thread: id = 1010 os_tid = 0x1e0c [0082.919] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6a) returned 0xe53a490 [0085.925] wcscpy (in: _Dest=0xe53a490, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places" [0085.925] wcscat (in: _Dest=0xe53a490, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\" [0085.925] wcscat (in: _Dest=0xe53a490, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\*" [0085.925] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a29a0 [0085.925] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\*", lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc252d1d0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389eac0 [0085.925] wcscmp (_String1=".", _String2=".") returned 0 [0085.925] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc252d1d0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.925] wcscmp (_String1="..", _String2=".") returned 1 [0085.925] wcscmp (_String1="..", _String2="..") returned 0 [0085.926] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x0, dwReserved1=0x0, cFileName="01 - File Explorer.lnk", cAlternateFileName="")) returned 1 [0085.926] wcscmp (_String1="01 - File Explorer.lnk", _String2=".") returned 1 [0085.926] wcscmp (_String1="01 - File Explorer.lnk", _String2="..") returned 1 [0085.926] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x151, dwReserved0=0x0, dwReserved1=0x0, cFileName="03 - Documents.lnk", cAlternateFileName="")) returned 1 [0085.926] wcscmp (_String1="03 - Documents.lnk", _String2=".") returned 1 [0085.926] wcscmp (_String1="03 - Documents.lnk", _String2="..") returned 1 [0085.926] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x151, dwReserved0=0x0, dwReserved1=0x0, cFileName="04 - Downloads.lnk", cAlternateFileName="")) returned 1 [0085.926] wcscmp (_String1="04 - Downloads.lnk", _String2=".") returned 1 [0085.926] wcscmp (_String1="04 - Downloads.lnk", _String2="..") returned 1 [0085.926] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x149, dwReserved0=0x0, dwReserved1=0x0, cFileName="05 - Music.lnk", cAlternateFileName="")) returned 1 [0085.926] wcscmp (_String1="05 - Music.lnk", _String2=".") returned 1 [0085.926] wcscmp (_String1="05 - Music.lnk", _String2="..") returned 1 [0085.926] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x151, dwReserved0=0x0, dwReserved1=0x0, cFileName="06 - Pictures.lnk", cAlternateFileName="")) returned 1 [0085.926] wcscmp (_String1="06 - Pictures.lnk", _String2=".") returned 1 [0085.926] wcscmp (_String1="06 - Pictures.lnk", _String2="..") returned 1 [0085.926] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x0, dwReserved1=0x0, cFileName="07 - Videos.lnk", cAlternateFileName="")) returned 1 [0085.926] wcscmp (_String1="07 - Videos.lnk", _String2=".") returned 1 [0085.926] wcscmp (_String1="07 - Videos.lnk", _String2="..") returned 1 [0085.926] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x0, dwReserved1=0x0, cFileName="08 - Homegroup.lnk", cAlternateFileName="")) returned 1 [0085.926] wcscmp (_String1="08 - Homegroup.lnk", _String2=".") returned 1 [0085.926] wcscmp (_String1="08 - Homegroup.lnk", _String2="..") returned 1 [0085.926] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x113, dwReserved0=0x0, dwReserved1=0x0, cFileName="09 - Network.lnk", cAlternateFileName="")) returned 1 [0085.926] wcscmp (_String1="09 - Network.lnk", _String2=".") returned 1 [0085.926] wcscmp (_String1="09 - Network.lnk", _String2="..") returned 1 [0085.926] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x141, dwReserved0=0x0, dwReserved1=0x0, cFileName="10 - UserProfile.lnk", cAlternateFileName="")) returned 1 [0085.926] wcscmp (_String1="10 - UserProfile.lnk", _String2=".") returned 1 [0085.926] wcscmp (_String1="10 - UserProfile.lnk", _String2="..") returned 1 [0085.926] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f770e1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8e8141c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8ea7682, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0085.926] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0085.926] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0085.926] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f770e1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8e8141c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8ea7682, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0085.926] FindClose (in: hFindFile=0x389eac0 | out: hFindFile=0x389eac0) returned 1 [0085.927] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a29a0) returned 1 [0085.927] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe53a490) returned 1 [0085.927] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b23a8) returned 1 Thread: id = 1011 os_tid = 0x1e10 [0082.920] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0x542bad8 [0082.920] wcscpy (in: _Dest=0x542bad8, _Source="C:\\ProgramData\\Microsoft\\Windows\\SystemData" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\SystemData") returned="C:\\ProgramData\\Microsoft\\Windows\\SystemData" [0082.920] wcscat (in: _Dest=0x542bad8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\SystemData\\") returned="C:\\ProgramData\\Microsoft\\Windows\\SystemData\\" [0082.920] wcscat (in: _Dest=0x542bad8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\SystemData\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\SystemData\\*" [0082.920] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542ef40 [0082.920] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\SystemData\\*", lpFindFileData=0x542ef40 | out: lpFindFileData=0x542ef40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0082.920] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542ef40) returned 1 [0082.920] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542bad8) returned 1 [0082.920] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b5e28) returned 1 Thread: id = 1012 os_tid = 0x1e14 [0082.921] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x542bad8 [0082.921] wcscpy (in: _Dest=0x542bad8, _Source="C:\\ProgramData\\Microsoft\\Windows\\Templates" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Templates") returned="C:\\ProgramData\\Microsoft\\Windows\\Templates" [0082.921] wcscat (in: _Dest=0x542bad8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Templates\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Templates\\" [0082.921] wcscat (in: _Dest=0x542bad8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Templates\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Templates\\*" [0082.921] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542ef40 [0082.921] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x542ef40 | out: lpFindFileData=0x542ef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc25d1ac7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445640 [0082.922] wcscmp (_String1=".", _String2=".") returned 0 [0082.922] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x542ef40 | out: lpFindFileData=0x542ef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc25d1ac7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.922] wcscmp (_String1="..", _String2=".") returned 1 [0082.922] wcscmp (_String1="..", _String2="..") returned 0 [0082.922] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x542ef40 | out: lpFindFileData=0x542ef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc25d1ac7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0082.922] FindClose (in: hFindFile=0x5445640 | out: hFindFile=0x5445640) returned 1 [0082.922] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542ef40) returned 1 [0082.922] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542bad8) returned 1 [0082.922] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b5ee8) returned 1 Thread: id = 1013 os_tid = 0x1e18 [0082.924] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x757e8c0 [0082.924] wcscpy (in: _Dest=0x757e8c0, _Source="C:\\ProgramData\\Microsoft\\Windows\\WER" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER") returned="C:\\ProgramData\\Microsoft\\Windows\\WER" [0082.924] wcscat (in: _Dest=0x757e8c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\" [0082.924] wcscat (in: _Dest=0x757e8c0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\*" [0082.925] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542ef40 [0082.925] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\*", lpFindFileData=0x542ef40 | out: lpFindFileData=0x542ef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d22c5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445640 [0082.925] wcscmp (_String1=".", _String2=".") returned 0 [0082.925] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x542ef40 | out: lpFindFileData=0x542ef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d22c5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.925] wcscmp (_String1="..", _String2=".") returned 1 [0082.925] wcscmp (_String1="..", _String2="..") returned 0 [0082.925] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x542ef40 | out: lpFindFileData=0x542ef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d2e0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1 [0082.925] wcscmp (_String1="ReportArchive", _String2=".") returned 1 [0082.925] wcscmp (_String1="ReportArchive", _String2="..") returned 1 [0082.925] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x5468160 [0082.925] wcscpy (in: _Dest=0x5468160, _Source="C:\\ProgramData\\Microsoft\\Windows\\WER" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER") returned="C:\\ProgramData\\Microsoft\\Windows\\WER" [0082.925] wcscat (in: _Dest=0x5468160, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\" [0082.926] wcscat (in: _Dest=0x5468160, _Source="ReportArchive" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive" [0082.926] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6a) returned 0xe53b420 [0085.923] wcscpy (in: _Dest=0xe53b420, _Source="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive" [0085.923] wcscat (in: _Dest=0xe53b420, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\" [0085.923] wcscat (in: _Dest=0xe53b420, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\*" [0085.923] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a2c08 [0085.923] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\*", lpFindFileData=0x53a2c08 | out: lpFindFileData=0x53a2c08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d2e0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389eac0 [0085.924] wcscmp (_String1=".", _String2=".") returned 0 [0085.924] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a2c08 | out: lpFindFileData=0x53a2c08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d2e0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.924] wcscmp (_String1="..", _String2=".") returned 1 [0085.924] wcscmp (_String1="..", _String2="..") returned 0 [0085.924] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a2c08 | out: lpFindFileData=0x53a2c08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d2e0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0085.924] FindClose (in: hFindFile=0x389eac0 | out: hFindFile=0x389eac0) returned 1 [0085.925] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a2c08) returned 1 [0085.925] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe53b420) returned 1 [0085.925] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5468160) returned 1 [0085.925] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x542ef40 | out: lpFindFileData=0x542ef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d33b0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportQueue", cAlternateFileName="REPORT~2")) returned 1 [0085.925] wcscmp (_String1="ReportQueue", _String2=".") returned 1 [0085.925] wcscmp (_String1="ReportQueue", _String2="..") returned 1 [0085.925] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x5468b00 [0085.925] wcscpy (in: _Dest=0x5468b00, _Source="C:\\ProgramData\\Microsoft\\Windows\\WER" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER") returned="C:\\ProgramData\\Microsoft\\Windows\\WER" [0085.925] wcscat (in: _Dest=0x5468b00, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\" [0085.925] wcscat (in: _Dest=0x5468b00, _Source="ReportQueue" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue" [0088.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5468b00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fb0 [0088.828] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x542ef40 | out: lpFindFileData=0x542ef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x56c668bc, ftLastAccessTime.dwHighDateTime=0x1d5d806, ftLastWriteTime.dwLowDateTime=0x56c668bc, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0088.828] wcscmp (_String1="Temp", _String2=".") returned 1 [0088.828] wcscmp (_String1="Temp", _String2="..") returned 1 [0088.828] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x7583ec0 [0088.828] wcscpy (in: _Dest=0x7583ec0, _Source="C:\\ProgramData\\Microsoft\\Windows\\WER" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER") returned="C:\\ProgramData\\Microsoft\\Windows\\WER" [0088.828] wcscat (in: _Dest=0x7583ec0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\" [0088.828] wcscat (in: _Dest=0x7583ec0, _Source="Temp" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" [0088.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7583ec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a8 [0088.829] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x542ef40 | out: lpFindFileData=0x542ef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x56c668bc, ftLastAccessTime.dwHighDateTime=0x1d5d806, ftLastWriteTime.dwLowDateTime=0x56c668bc, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0088.829] FindClose (in: hFindFile=0x5445640 | out: hFindFile=0x5445640) returned 1 [0088.829] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542ef40) returned 1 [0088.829] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757e8c0) returned 1 [0088.829] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757e448) returned 1 Thread: id = 1014 os_tid = 0x1e1c [0082.926] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x757e918 [0082.926] wcscpy (in: _Dest=0x757e918, _Source="C:\\ProgramData\\Microsoft\\Windows\\wfp" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\wfp") returned="C:\\ProgramData\\Microsoft\\Windows\\wfp" [0082.926] wcscat (in: _Dest=0x757e918, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\wfp\\") returned="C:\\ProgramData\\Microsoft\\Windows\\wfp\\" [0082.926] wcscat (in: _Dest=0x757e918, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\wfp\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\wfp\\*" [0082.926] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x542f678 [0082.926] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\wfp\\*", lpFindFileData=0x542f678 | out: lpFindFileData=0x542f678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8846c94f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8846c94f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445680 [0082.926] wcscmp (_String1=".", _String2=".") returned 0 [0082.927] FindNextFileW (in: hFindFile=0x5445680, lpFindFileData=0x542f678 | out: lpFindFileData=0x542f678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8846c94f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8846c94f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.927] wcscmp (_String1="..", _String2=".") returned 1 [0082.927] wcscmp (_String1="..", _String2="..") returned 0 [0082.927] FindNextFileW (in: hFindFile=0x5445680, lpFindFileData=0x542f678 | out: lpFindFileData=0x542f678*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0x8846c94f, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8846c94f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b56981, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wfpdiag.etl", cAlternateFileName="")) returned 1 [0082.927] wcscmp (_String1="wfpdiag.etl", _String2=".") returned 1 [0082.927] wcscmp (_String1="wfpdiag.etl", _String2="..") returned 1 [0082.927] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x54681d0 [0082.927] wcscpy (in: _Dest=0x54681d0, _Source="C:\\ProgramData\\Microsoft\\Windows\\wfp" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\wfp") returned="C:\\ProgramData\\Microsoft\\Windows\\wfp" [0082.927] wcscat (in: _Dest=0x54681d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\wfp\\") returned="C:\\ProgramData\\Microsoft\\Windows\\wfp\\" [0082.927] wcscat (in: _Dest=0x54681d0, _Source="wfpdiag.etl" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\wfp\\wfpdiag.etl") returned="C:\\ProgramData\\Microsoft\\Windows\\wfp\\wfpdiag.etl" [0082.927] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\wfp\\wfpdiag.etl" (normalized: "c:\\programdata\\microsoft\\windows\\wfp\\wfpdiag.etl")) returned 0x2000 [0085.916] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\wfp\\wfpdiag.etl", dwFileAttributes=0x20) returned 1 [0089.297] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\wfp\\wfpdiag.etl" (normalized: "c:\\programdata\\microsoft\\windows\\wfp\\wfpdiag.etl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.297] GetLastError () returned 0x20 [0089.297] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8) returned 0x38a3d90 [0089.297] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0089.297] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a3d90) returned 1 [0089.297] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38a3df0, Size=0x10) returned 0x550d850 [0089.297] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x5468a90 [0089.297] wcscpy (in: _Dest=0x5468a90, _Source="C:\\ProgramData\\Microsoft\\Windows\\wfp\\wfpdiag.etl" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\wfp\\wfpdiag.etl") returned="C:\\ProgramData\\Microsoft\\Windows\\wfp\\wfpdiag.etl" [0089.297] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\wfp\\wfpdiag.etl", dwFileAttributes=0x2000) returned 1 [0089.298] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54681d0) returned 1 [0089.298] FindNextFileW (in: hFindFile=0x5445680, lpFindFileData=0x542f678 | out: lpFindFileData=0x542f678*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0x8846c94f, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8846c94f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b56981, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wfpdiag.etl", cAlternateFileName="")) returned 0 [0089.298] FindClose (in: hFindFile=0x5445680 | out: hFindFile=0x5445680) returned 1 [0089.298] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542f678) returned 1 [0089.298] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757e918) returned 1 [0089.298] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757e9c8) returned 1 Thread: id = 1015 os_tid = 0x1e20 [0082.927] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_150x150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\officehublogo_150x150.png")) returned 0x20 [0085.917] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_150x150.png", dwFileAttributes=0x20) returned 0 [0085.918] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_150x150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\officehublogo_150x150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0085.920] GetLastError () returned 0x5 [0085.920] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_150x150.png", dwFileAttributes=0x20) returned 0 [0085.922] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54997e8) returned 1 Thread: id = 1016 os_tid = 0x1e24 [0082.928] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_310x150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\officehublogo_310x150.png")) returned 0x20 [0085.909] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_310x150.png", dwFileAttributes=0x20) returned 0 [0085.911] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_310x150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\officehublogo_310x150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0085.912] GetLastError () returned 0x5 [0085.912] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_310x150.png", dwFileAttributes=0x20) returned 0 [0085.913] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5499d10) returned 1 Thread: id = 1017 os_tid = 0x1e28 [0082.928] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_310x310.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\officehublogo_310x310.png")) returned 0x20 [0085.900] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_310x310.png", dwFileAttributes=0x20) returned 0 [0085.901] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_310x310.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\officehublogo_310x310.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0085.903] GetLastError () returned 0x5 [0085.903] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_310x310.png", dwFileAttributes=0x20) returned 0 [0085.904] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5499f20) returned 1 Thread: id = 1018 os_tid = 0x1e2c [0082.929] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_44x44.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\officehublogo_44x44.png")) returned 0x20 [0082.931] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_44x44.png", dwFileAttributes=0x20) returned 0 [0082.932] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_44x44.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\officehublogo_44x44.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.934] GetLastError () returned 0x5 [0082.934] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_44x44.png", dwFileAttributes=0x20) returned 0 [0082.935] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba27f8) returned 1 Thread: id = 1019 os_tid = 0x1e30 [0082.936] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_71x71.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\officehublogo_71x71.png")) returned 0x20 [0082.938] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_71x71.png", dwFileAttributes=0x20) returned 0 [0082.939] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_71x71.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\officehublogo_71x71.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.942] GetLastError () returned 0x5 [0082.942] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_71x71.png", dwFileAttributes=0x20) returned 0 [0082.943] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba34f8) returned 1 Thread: id = 1020 os_tid = 0x1e34 [0082.945] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_Splash.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\officehublogo_splash.png")) returned 0x20 [0082.947] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_Splash.png", dwFileAttributes=0x20) returned 0 [0082.949] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_Splash.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\officehublogo_splash.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.950] GetLastError () returned 0x5 [0082.950] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeHubLogo_Splash.png", dwFileAttributes=0x20) returned 0 [0082.951] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba36f8) returned 1 Thread: id = 1021 os_tid = 0x1e38 [0082.955] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeIcon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\officeicon.png")) returned 0x20 [0082.956] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeIcon.png", dwFileAttributes=0x20) returned 0 [0082.958] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeIcon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\officeicon.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0082.959] GetLastError () returned 0x5 [0082.959] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\OfficeIcon.png", dwFileAttributes=0x20) returned 0 [0082.961] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b8bf8) returned 1 Thread: id = 1022 os_tid = 0x1e3c [0082.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 0x20 [0082.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties", dwFileAttributes=0x20) returned 1 [0082.965] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fbc [0082.966] GetFileSizeEx (in: hFile=0x1fbc, lpFileSize=0x2527f794 | out: lpFileSize=0x2527f794*=149) returned 1 [0082.966] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe51e6d0 [0085.881] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe51e6f8 [0085.881] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe51e270 [0085.881] NtQuerySystemTime (in: CurrentTime=0x2527f6f4 | out: CurrentTime=0x2527f6f4*=132260136430340147) returned 0x0 [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0xe6cfe806 [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0xf98519f1 [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0x8b326aa9 [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0x5a66906c [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0x90c6b13a [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0x40018160 [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0x44b31d05 [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0x15281426 [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0xb7e9d367 [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0xf884bf75 [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0xfefa2380 [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0x157634d8 [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0xf948b482 [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0xe0941b3d [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0x88f731e4 [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0xb4cd022c [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0x7d87143e [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0xcd180551 [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0xadbe14a8 [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0x346105d5 [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0x6fc308c1 [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0xe840c216 [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0xbeecfa70 [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0x9d5db006 [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0x94196397 [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0x78de663 [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0x48491bc6 [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0xbc5639a8 [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0x4669170d [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0xcd6747f5 [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0xbfbb2840 [0085.881] RtlRandom (in: Seed=0x2527f700 | out: Seed=0x2527f700) returned 0x61821d81 [0085.891] ReadFile (in: hFile=0x1fbc, lpBuffer=0xe51ed40, nNumberOfBytesToRead=0x95, lpNumberOfBytesRead=0x2527f6f0, lpOverlapped=0x0 | out: lpBuffer=0xe51ed40*, lpNumberOfBytesRead=0x2527f6f0*=0x95, lpOverlapped=0x0) returned 1 [0085.892] SetFilePointerEx (in: hFile=0x1fbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.893] WriteFile (in: hFile=0x1fbc, lpBuffer=0xe52b548*, nNumberOfBytesToWrite=0x95, lpNumberOfBytesWritten=0x2527f6ec, lpOverlapped=0x0 | out: lpBuffer=0xe52b548*, lpNumberOfBytesWritten=0x2527f6ec*=0x95, lpOverlapped=0x0) returned 1 [0089.294] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282eb0 [0089.294] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282ed8 [0089.294] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282ed8) returned 1 [0089.294] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe52b548) returned 1 [0091.623] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe51ed40) returned 1 [0091.623] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe51d378) returned 1 [0091.623] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8d50) returned 1 [0091.623] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3d) returned 0x5ba8960 [0091.623] SetFilePointerEx (in: hFile=0x1fbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.623] WriteFile (hFile=0x1fbc, lpBuffer=0x5baaaa0, nNumberOfBytesToWrite=0x121, lpNumberOfBytesWritten=0x2527f754, lpOverlapped=0x0) Thread: id = 1023 os_tid = 0x1e40 [0082.968] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x542bad8 [0082.968] wcscpy (in: _Dest=0x542bad8, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64" [0082.968] wcscat (in: _Dest=0x542bad8, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\" [0082.968] wcscat (in: _Dest=0x542bad8, _Source="*" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\*") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\*" [0082.968] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5430018 [0082.968] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\*", lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe451d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54456c0 [0082.968] wcscmp (_String1=".", _String2=".") returned 0 [0082.968] FindNextFileW (in: hFindFile=0x54456c0, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe451d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.968] wcscmp (_String1="..", _String2=".") returned 1 [0082.968] wcscmp (_String1="..", _String2="..") returned 0 [0082.968] FindNextFileW (in: hFindFile=0x54456c0, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x27a, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvm.cfg", cAlternateFileName="")) returned 1 [0082.968] wcscmp (_String1="jvm.cfg", _String2=".") returned 1 [0082.968] wcscmp (_String1="jvm.cfg", _String2="..") returned 1 [0082.968] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6a) returned 0xe51db70 [0085.880] wcscpy (in: _Dest=0xe51db70, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64" [0085.880] wcscat (in: _Dest=0xe51db70, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\" [0085.880] wcscat (in: _Dest=0xe51db70, _Source="jvm.cfg" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" [0088.831] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0xe51db70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1574 [0088.831] FindNextFileW (in: hFindFile=0x54456c0, lpFindFileData=0x5430018 | out: lpFindFileData=0x5430018*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x27a, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvm.cfg", cAlternateFileName="")) returned 0 [0088.831] FindClose (in: hFindFile=0x54456c0 | out: hFindFile=0x54456c0) returned 1 [0088.831] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5430018) returned 1 [0088.831] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542bad8) returned 1 [0088.832] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x6e963f0) returned 1 Thread: id = 1024 os_tid = 0x1e44 [0082.969] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x542bc10 [0082.969] wcscpy (in: _Dest=0x542bc10, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\applet" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\applet") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\applet" [0082.969] wcscat (in: _Dest=0x542bc10, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\applet\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\applet\\" [0082.969] wcscat (in: _Dest=0x542bc10, _Source="*" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\applet\\*") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\applet\\*" [0082.969] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393d3b0 [0082.969] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\applet\\*", lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f40 [0082.970] wcscmp (_String1=".", _String2=".") returned 0 [0082.970] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.970] wcscmp (_String1="..", _String2=".") returned 1 [0082.970] wcscmp (_String1="..", _String2="..") returned 0 [0082.970] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0082.970] FindClose (in: hFindFile=0x5444f40 | out: hFindFile=0x5444f40) returned 1 [0082.970] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393d3b0) returned 1 [0082.970] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542bc10) returned 1 [0082.970] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x6e96458) returned 1 Thread: id = 1025 os_tid = 0x1e48 [0082.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 0x20 [0082.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties", dwFileAttributes=0x20) returned 1 [0082.971] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fc4 [0082.972] GetFileSizeEx (in: hFile=0x1fc4, lpFileSize=0x253ff840 | out: lpFileSize=0x253ff840*=1378) returned 1 [0082.972] SetFilePointerEx (in: hFile=0x1fc4, liDistanceToMove=0x55e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.972] ReadFile (in: hFile=0x1fc4, lpBuffer=0x253ff7c4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x253ff7c0, lpOverlapped=0x0 | out: lpBuffer=0x253ff7c4*, lpNumberOfBytesRead=0x253ff7c0*=0x4, lpOverlapped=0x0) returned 1 [0082.974] SetFilePointerEx (in: hFile=0x1fc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.974] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe503980 [0085.869] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe503b38 [0085.869] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe503a48 [0085.869] NtQuerySystemTime (in: CurrentTime=0x253ff7a0 | out: CurrentTime=0x253ff7a0*=132260136430340147) returned 0x0 [0085.869] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0xf29957 [0085.869] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0x41189ade [0085.869] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0x991fc9c0 [0085.869] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0xec2bfb86 [0085.869] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0x3457edff [0085.869] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0xbbf15c9a [0085.870] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0x45249f42 [0085.870] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0x7bacf859 [0085.870] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0x45b7a661 [0085.870] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0x2151cb3 [0085.870] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0x5b53aed2 [0085.870] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0x1c8dbad1 [0085.870] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0x5e38d325 [0085.870] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0x483ec9d2 [0085.870] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0x92afa83e [0085.870] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0x60c5ed7e [0085.870] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0x156e92ac [0085.870] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0xaf1e9b7b [0085.870] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0x25bbb02e [0085.870] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0xa792776d [0085.870] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0x6cac1a2f [0085.870] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0x3d2a2346 [0085.870] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0x2c27d77b [0085.870] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0x2e1b7b89 [0085.870] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0x82cedbe4 [0085.870] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0x3a3da2c6 [0085.870] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0xcff1c47d [0085.870] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0x3b608362 [0085.870] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0xb61e1322 [0085.870] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0x57ed04d7 [0085.870] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0x8ef56a4d [0085.870] RtlRandom (in: Seed=0x253ff7ac | out: Seed=0x253ff7ac) returned 0x62a8f92d [0085.880] ReadFile (in: hFile=0x1fc4, lpBuffer=0xe503d20, nNumberOfBytesToRead=0x562, lpNumberOfBytesRead=0x253ff79c, lpOverlapped=0x0 | out: lpBuffer=0xe503d20*, lpNumberOfBytesRead=0x253ff79c*=0x562, lpOverlapped=0x0) returned 1 [0085.880] SetFilePointerEx (in: hFile=0x1fc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.880] WriteFile (in: hFile=0x1fc4, lpBuffer=0xe510528*, nNumberOfBytesToWrite=0x562, lpNumberOfBytesWritten=0x253ff798, lpOverlapped=0x0 | out: lpBuffer=0xe510528*, lpNumberOfBytesWritten=0x253ff798*=0x562, lpOverlapped=0x0) returned 1 [0089.292] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282e88 [0089.293] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282eb0 [0089.293] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282eb0) returned 1 [0089.293] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe510528) returned 1 [0091.626] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe503d20) returned 1 [0091.626] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4d0338) returned 1 [0091.626] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8d08) returned 1 [0091.626] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x35) returned 0x389ef00 [0091.626] SetFilePointerEx (in: hFile=0x1fc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.626] WriteFile (hFile=0x1fc4, lpBuffer=0x74d8600, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x253ff800, lpOverlapped=0x0) Thread: id = 1026 os_tid = 0x1e4c [0082.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar")) returned 0x20 [0085.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar", dwFileAttributes=0x20) returned 1 [0085.829] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x828 [0085.830] GetFileSizeEx (in: hFile=0x828, lpFileSize=0x2547fbec | out: lpFileSize=0x2547fbec*=3036922) returned 1 [0085.830] SetFilePointerEx (in: hFile=0x828, liDistanceToMove=0x2e56f6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.830] ReadFile (in: hFile=0x828, lpBuffer=0x2547fb70, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2547fb6c, lpOverlapped=0x0 | out: lpBuffer=0x2547fb70*, lpNumberOfBytesRead=0x2547fb6c*=0x4, lpOverlapped=0x0) returned 1 [0085.843] SetFilePointerEx (in: hFile=0x828, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.843] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe4b63a0 [0085.843] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe4b6620 [0085.843] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe4b6670 [0085.843] NtQuerySystemTime (in: CurrentTime=0x2547fb4c | out: CurrentTime=0x2547fb4c*=132260136430034802) returned 0x0 [0085.843] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0x28ea7f5c [0085.844] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0xa3b8c879 [0085.844] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0x136409bc [0085.844] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0x66550327 [0085.844] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0x3c5208c6 [0085.844] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0xc0adf0a6 [0085.844] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0x8b12c5e8 [0085.844] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0x7d9a6392 [0085.844] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0xf75ce208 [0085.844] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0x8d8f166 [0085.844] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0x30c3a684 [0085.844] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0x612ba120 [0085.844] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0x9da1d972 [0085.844] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0xa45b9ba8 [0085.844] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0x520aeaab [0085.844] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0x639a8e31 [0085.844] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0x8d4fc559 [0085.844] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0x38305fb [0085.844] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0xeab95f0 [0085.844] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0xf7824aa3 [0085.844] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0xbb8828f5 [0085.844] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0x4dc1eb67 [0085.844] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0x8eeb12e9 [0085.844] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0x94693679 [0085.844] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0x22effade [0085.844] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0xc38a3866 [0085.844] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0x25a59b42 [0085.844] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0xf68247d2 [0085.844] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0xdbf21846 [0085.844] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0x555493f6 [0085.844] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0x409f3ea1 [0085.844] RtlRandom (in: Seed=0x2547fb58 | out: Seed=0x2547fb58) returned 0x86bbed3b [0085.854] SetFilePointerEx (in: hFile=0x828, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.854] ReadFile (in: hFile=0x828, lpBuffer=0xe4dd500, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2547fb04, lpOverlapped=0x0 | out: lpBuffer=0xe4dd500*, lpNumberOfBytesRead=0x2547fb04*=0xc800, lpOverlapped=0x0) returned 1 [0085.863] SetFilePointerEx (in: hFile=0x828, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.863] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8d08 [0085.863] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0xe4d0338 [0085.863] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe4b63a0 [0085.863] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4b63a0) returned 1 [0085.864] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe4f6510 [0085.869] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe4b6468 [0085.869] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe4b6490 [0085.869] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4b6490) returned 1 [0085.869] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4d0338) returned 1 [0085.869] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8d08) returned 1 [0085.869] WriteFile (in: hFile=0x828, lpBuffer=0xe4f6510*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2547fb04, lpOverlapped=0x0 | out: lpBuffer=0xe4f6510*, lpNumberOfBytesWritten=0x2547fb04*=0xc800, lpOverlapped=0x0) returned 1 [0089.293] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4f6510) returned 1 [0091.623] SetFilePointerEx (in: hFile=0x828, liDistanceToMove=0x177000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.623] ReadFile (in: hFile=0x828, lpBuffer=0xe4dd500, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2547fb04, lpOverlapped=0x0 | out: lpBuffer=0xe4dd500*, lpNumberOfBytesRead=0x2547fb04*=0xc800, lpOverlapped=0x0) returned 1 [0091.627] SetFilePointerEx (in: hFile=0x828, liDistanceToMove=0x177000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.627] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba89a8 [0091.627] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x74af208 [0091.627] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09abe0 [0091.627] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09abe0) returned 1 [0091.628] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe4f6510 [0091.629] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09ae38 [0091.629] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09ad98 [0091.629] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09ad98) returned 1 [0091.629] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74af208) returned 1 [0091.629] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba89a8) returned 1 [0091.629] WriteFile (in: hFile=0x828, lpBuffer=0xe4f6510*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2547fb04, lpOverlapped=0x0 | out: lpBuffer=0xe4f6510*, lpNumberOfBytesWritten=0x2547fb04*=0xc800, lpOverlapped=0x0) returned 1 [0091.634] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4f6510) returned 1 [0091.634] SetFilePointerEx (in: hFile=0x828, liDistanceToMove=0x2d8efa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.634] ReadFile (in: hFile=0x828, lpBuffer=0xe4dd500, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2547fb04, lpOverlapped=0x0 | out: lpBuffer=0xe4dd500*, lpNumberOfBytesRead=0x2547fb04*=0xc800, lpOverlapped=0x0) returned 1 [0091.635] SetFilePointerEx (in: hFile=0x828, liDistanceToMove=0x2d8efa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.635] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8ac8 [0091.635] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x74ae998 [0091.635] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09b108 [0091.635] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09b108) returned 1 [0091.636] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe4d0cf8 [0091.636] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09b108 [0091.636] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09b0b8 [0091.636] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09b0b8) returned 1 [0091.636] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74ae998) returned 1 [0091.636] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8ac8) returned 1 [0091.637] WriteFile (in: hFile=0x828, lpBuffer=0xe4d0cf8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2547fb04, lpOverlapped=0x0 | out: lpBuffer=0xe4d0cf8*, lpNumberOfBytesWritten=0x2547fb04*=0xc800, lpOverlapped=0x0) returned 1 [0092.135] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4d0cf8) Thread: id = 1027 os_tid = 0x1e50 [0082.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 0x20 [0085.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist", dwFileAttributes=0x20) returned 1 [0085.828] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x8c8 [0085.828] GetFileSizeEx (in: hFile=0x8c8, lpFileSize=0x254ff78c | out: lpFileSize=0x254ff78c*=84355) returned 1 [0085.828] SetFilePointerEx (in: hFile=0x8c8, liDistanceToMove=0x1497f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.828] ReadFile (in: hFile=0x8c8, lpBuffer=0x254ff710, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x254ff70c, lpOverlapped=0x0 | out: lpBuffer=0x254ff710*, lpNumberOfBytesRead=0x254ff70c*=0x4, lpOverlapped=0x0) returned 1 [0085.831] SetFilePointerEx (in: hFile=0x8c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.831] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe4b63a0 [0085.831] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe4b65f8 [0085.831] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe4b6670 [0085.831] NtQuerySystemTime (in: CurrentTime=0x254ff6ec | out: CurrentTime=0x254ff6ec*=132260136429861542) returned 0x0 [0085.831] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0x8e5d8072 [0085.831] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0xdefaf6fd [0085.831] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0x55e0e4ef [0085.831] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0x460885b8 [0085.831] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0x3f4cab85 [0085.831] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0x4c88e6b9 [0085.831] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0x2a1840e0 [0085.831] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0x6f4539a6 [0085.831] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0x3fa60282 [0085.831] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0xac038c8c [0085.831] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0x410e6991 [0085.831] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0xf84de5cc [0085.831] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0xf3d23d51 [0085.831] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0x64387f3a [0085.831] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0xff1e63ea [0085.831] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0x1137b894 [0085.831] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0x556986d5 [0085.831] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0x6db6d51a [0085.831] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0x54711675 [0085.831] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0x1674c005 [0085.831] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0xdab0b7c5 [0085.831] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0xf78de094 [0085.831] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0x923fc3ea [0085.832] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0xdd95e154 [0085.832] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0x514ba0ca [0085.832] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0x527bff02 [0085.832] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0xa90d8be1 [0085.832] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0x278f6dd4 [0085.832] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0xf226ebbd [0085.832] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0x433b3c22 [0085.832] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0x211ea001 [0085.832] RtlRandom (in: Seed=0x254ff6f8 | out: Seed=0x254ff6f8) returned 0x65f4591 [0085.843] SetFilePointerEx (in: hFile=0x8c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.843] ReadFile (in: hFile=0x8c8, lpBuffer=0xe4d0cf8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x254ff6cc, lpOverlapped=0x0 | out: lpBuffer=0xe4d0cf8*, lpNumberOfBytesRead=0x254ff6cc*=0xc800, lpOverlapped=0x0) returned 1 [0085.856] SetFilePointerEx (in: hFile=0x8c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.856] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8d08 [0085.856] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0xe4d0338 [0085.856] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe4b63a0 [0085.856] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4b63a0) returned 1 [0085.857] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe4e9d08 [0085.862] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe4b6440 [0085.862] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe4b6468 [0085.862] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4b6468) returned 1 [0085.862] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4d0338) returned 1 [0085.862] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8d08) returned 1 [0085.862] WriteFile (in: hFile=0x8c8, lpBuffer=0xe4e9d08*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x254ff6cc, lpOverlapped=0x0 | out: lpBuffer=0xe4e9d08*, lpNumberOfBytesWritten=0x254ff6cc*=0xc800, lpOverlapped=0x0) returned 1 [0089.290] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4e9d08) returned 1 [0091.634] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4d0cf8) returned 1 [0091.634] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1f) returned 0xe09abe0 [0091.634] SetFilePointerEx (in: hFile=0x8c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.635] WriteFile (hFile=0x8c8, lpBuffer=0x74e2dc8, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x254ff74c, lpOverlapped=0x0) Thread: id = 1028 os_tid = 0x1e54 [0082.975] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x542bc10 [0082.975] wcscpy (in: _Dest=0x542bc10, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm" [0082.975] wcscat (in: _Dest=0x542bc10, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\" [0082.975] wcscat (in: _Dest=0x542bc10, _Source="*" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\*") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\*" [0082.975] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393d3b0 [0082.975] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\*", lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105e2a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f40 [0082.976] wcscmp (_String1=".", _String2=".") returned 0 [0082.976] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105e2a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.976] wcscmp (_String1="..", _String2=".") returned 1 [0082.976] wcscmp (_String1="..", _String2="..") returned 0 [0082.976] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc824, dwReserved0=0x0, dwReserved1=0x0, cFileName="CIEXYZ.pf", cAlternateFileName="")) returned 1 [0082.976] wcscmp (_String1="CIEXYZ.pf", _String2=".") returned 1 [0082.976] wcscmp (_String1="CIEXYZ.pf", _String2="..") returned 1 [0082.976] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6a) returned 0xe4d0b30 [0085.826] wcscpy (in: _Dest=0xe4d0b30, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm" [0085.826] wcscat (in: _Dest=0xe4d0b30, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\" [0085.826] wcscat (in: _Dest=0xe4d0b30, _Source="CIEXYZ.pf" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" [0088.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0xe4d0b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fc0 [0088.833] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAY.pf", cAlternateFileName="")) returned 1 [0088.833] wcscmp (_String1="GRAY.pf", _String2=".") returned 1 [0088.833] wcscmp (_String1="GRAY.pf", _String2="..") returned 1 [0088.833] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x5468160 [0088.833] wcscpy (in: _Dest=0x5468160, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm" [0088.833] wcscat (in: _Dest=0x5468160, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\" [0088.833] wcscat (in: _Dest=0x5468160, _Source="GRAY.pf" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" [0088.833] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5468160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1564 [0088.834] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="LINEAR_RGB.pf", cAlternateFileName="LINEAR~1.PF")) returned 1 [0088.834] wcscmp (_String1="LINEAR_RGB.pf", _String2=".") returned 1 [0088.834] wcscmp (_String1="LINEAR_RGB.pf", _String2="..") returned 1 [0088.834] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x72) returned 0x38d1ea0 [0088.834] wcscpy (in: _Dest=0x38d1ea0, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm" [0088.834] wcscat (in: _Dest=0x38d1ea0, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\" [0088.834] wcscat (in: _Dest=0x38d1ea0, _Source="LINEAR_RGB.pf" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" [0088.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d1ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1548 [0088.834] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4302a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PYCC.pf", cAlternateFileName="")) returned 1 [0088.834] wcscmp (_String1="PYCC.pf", _String2=".") returned 1 [0088.835] wcscmp (_String1="PYCC.pf", _String2="..") returned 1 [0088.835] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x5468e10 [0088.835] wcscpy (in: _Dest=0x5468e10, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm" [0088.835] wcscat (in: _Dest=0x5468e10, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\" [0088.835] wcscat (in: _Dest=0x5468e10, _Source="PYCC.pf" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" [0088.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5468e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fb4 [0088.835] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x0, cFileName="sRGB.pf", cAlternateFileName="")) returned 1 [0088.835] wcscmp (_String1="sRGB.pf", _String2=".") returned 1 [0088.835] wcscmp (_String1="sRGB.pf", _String2="..") returned 1 [0088.835] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x5468ef0 [0088.835] wcscpy (in: _Dest=0x5468ef0, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm" [0088.835] wcscat (in: _Dest=0x5468ef0, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\" [0088.835] wcscat (in: _Dest=0x5468ef0, _Source="sRGB.pf" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" [0088.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5468ef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1808 [0088.836] FindNextFileW (in: hFindFile=0x5444f40, lpFindFileData=0x393d3b0 | out: lpFindFileData=0x393d3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x0, cFileName="sRGB.pf", cAlternateFileName="")) returned 0 [0088.836] FindClose (in: hFindFile=0x5444f40 | out: hFindFile=0x5444f40) returned 1 [0088.836] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393d3b0) returned 1 [0088.836] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542bc10) returned 1 [0088.836] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b6068) returned 1 Thread: id = 1029 os_tid = 0x1e58 [0082.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 0x20 [0082.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties", dwFileAttributes=0x20) returned 1 [0082.978] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fcc [0082.978] GetFileSizeEx (in: hFile=0x1fcc, lpFileSize=0x255ffa98 | out: lpFileSize=0x255ffa98*=5548) returned 1 [0082.978] SetFilePointerEx (in: hFile=0x1fcc, liDistanceToMove=0x15a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.978] ReadFile (in: hFile=0x1fcc, lpBuffer=0x255ffa1c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x255ffa18, lpOverlapped=0x0 | out: lpBuffer=0x255ffa1c*, lpNumberOfBytesRead=0x255ffa18*=0x4, lpOverlapped=0x0) returned 1 [0082.980] SetFilePointerEx (in: hFile=0x1fcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.980] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe4b64b8 [0085.815] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe4b6648 [0085.815] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe4b66c0 [0085.815] NtQuerySystemTime (in: CurrentTime=0x255ff9f8 | out: CurrentTime=0x255ff9f8*=132260136429705524) returned 0x0 [0085.815] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0x64a1fee4 [0085.815] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0xe99a060 [0085.815] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0x278fcecb [0085.815] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0x694389b7 [0085.815] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0x7cbefcef [0085.815] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0x4f20f164 [0085.815] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0x7140c8cc [0085.815] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0xfc76d1a2 [0085.815] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0xa73dea43 [0085.815] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0x7ec46c3f [0085.815] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0xec697add [0085.815] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0x2a5d7cd6 [0085.815] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0x8b0bab96 [0085.815] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0x53b15d82 [0085.815] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0x875482eb [0085.815] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0x5494a1c7 [0085.815] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0xec5bbe0c [0085.815] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0x2265658f [0085.815] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0x57d74151 [0085.815] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0x31831ec4 [0085.815] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0xdc980527 [0085.815] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0x38dc3b70 [0085.815] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0x6de2c6a3 [0085.815] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0xc4234010 [0085.815] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0x13396f15 [0085.815] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0xae357f31 [0085.815] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0x2183a524 [0085.815] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0x43820bd4 [0085.815] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0x106f7534 [0085.815] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0xa3759f74 [0085.816] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0xbabec321 [0085.816] RtlRandom (in: Seed=0x255ffa04 | out: Seed=0x255ffa04) returned 0xbd855d69 [0085.826] ReadFile (in: hFile=0x1fcc, lpBuffer=0xe4b6ce0, nNumberOfBytesToRead=0x15ac, lpNumberOfBytesRead=0x255ff9f4, lpOverlapped=0x0 | out: lpBuffer=0xe4b6ce0*, lpNumberOfBytesRead=0x255ff9f4*=0x15ac, lpOverlapped=0x0) returned 1 [0085.827] SetFilePointerEx (in: hFile=0x1fcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.827] WriteFile (in: hFile=0x1fcc, lpBuffer=0xe4c34e8*, nNumberOfBytesToWrite=0x15ac, lpNumberOfBytesWritten=0x255ff9f0, lpOverlapped=0x0 | out: lpBuffer=0xe4c34e8*, lpNumberOfBytesWritten=0x255ff9f0*=0x15ac, lpOverlapped=0x0) returned 1 [0089.289] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282e38 [0089.290] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282e60 [0089.290] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282e60) returned 1 [0089.290] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4c34e8) returned 1 [0091.638] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4b6ce0) returned 1 [0091.638] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe37e278) returned 1 [0091.638] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8cc0) returned 1 [0091.638] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3d) returned 0x5ba89a8 [0091.638] SetFilePointerEx (in: hFile=0x1fcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.638] WriteFile (hFile=0x1fcc, lpBuffer=0x5baad10, nNumberOfBytesToWrite=0x121, lpNumberOfBytesWritten=0x255ffa58, lpOverlapped=0x0) Thread: id = 1030 os_tid = 0x1e5c [0082.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 0x20 [0082.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data", dwFileAttributes=0x20) returned 1 [0082.980] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fd0 [0082.980] GetFileSizeEx (in: hFile=0x1fd0, lpFileSize=0x2567fa6c | out: lpFileSize=0x2567fa6c*=4122) returned 1 [0082.980] SetFilePointerEx (in: hFile=0x1fd0, liDistanceToMove=0x1016, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.980] ReadFile (in: hFile=0x1fd0, lpBuffer=0x2567f9f0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2567f9ec, lpOverlapped=0x0 | out: lpBuffer=0x2567f9f0*, lpNumberOfBytesRead=0x2567f9ec*=0x4, lpOverlapped=0x0) returned 1 [0082.982] SetFilePointerEx (in: hFile=0x1fd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.982] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe45d5c0 [0085.803] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe45d6d8 [0085.803] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe45d700 [0085.803] NtQuerySystemTime (in: CurrentTime=0x2567f9cc | out: CurrentTime=0x2567f9cc*=132260136429548926) returned 0x0 [0085.803] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0xa9094e9c [0085.803] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0x4c684a0b [0085.803] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0xcc8ced0b [0085.803] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0x980028e1 [0085.803] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0x4e2a47ab [0085.803] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0x737b4f35 [0085.803] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0x4f1531d0 [0085.803] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0x6b703123 [0085.803] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0x2500c5c3 [0085.803] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0xd1f9332b [0085.803] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0x5ff14f15 [0085.803] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0x6acd48c [0085.803] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0x7f244366 [0085.803] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0xc524e16a [0085.803] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0x7a76b26e [0085.803] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0xc22959ee [0085.803] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0xee3d02d7 [0085.803] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0x7cea976 [0085.803] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0x47830d85 [0085.803] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0xcb29c44a [0085.803] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0xe87b1687 [0085.803] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0x8da6a976 [0085.803] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0x7d81acd5 [0085.803] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0xfb0f16fd [0085.803] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0x88014233 [0085.804] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0xcba75365 [0085.804] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0x15fb6ba6 [0085.804] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0xb336daf9 [0085.804] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0xbf2195ab [0085.804] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0x34f3f407 [0085.804] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0xa1a60981 [0085.804] RtlRandom (in: Seed=0x2567f9d8 | out: Seed=0x2567f9d8) returned 0x2e4175e7 [0085.814] ReadFile (in: hFile=0x1fd0, lpBuffer=0xe49ccc8, nNumberOfBytesToRead=0x101a, lpNumberOfBytesRead=0x2567f9c8, lpOverlapped=0x0 | out: lpBuffer=0xe49ccc8*, lpNumberOfBytesRead=0x2567f9c8*=0x101a, lpOverlapped=0x0) returned 1 [0085.814] SetFilePointerEx (in: hFile=0x1fd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.815] WriteFile (in: hFile=0x1fd0, lpBuffer=0xe4a94d0*, nNumberOfBytesToWrite=0x101a, lpNumberOfBytesWritten=0x2567f9c4, lpOverlapped=0x0 | out: lpBuffer=0xe4a94d0*, lpNumberOfBytesWritten=0x2567f9c4*=0x101a, lpOverlapped=0x0) returned 1 [0089.290] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282e60 [0089.291] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282e88 [0089.291] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282e88) returned 1 [0089.291] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4a94d0) returned 1 [0091.629] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe49ccc8) returned 1 [0091.633] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe37e200) returned 1 [0091.633] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8c78) returned 1 [0091.633] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x27) returned 0x38a6b80 [0091.633] SetFilePointerEx (in: hFile=0x1fd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.633] WriteFile (hFile=0x1fd0, lpBuffer=0x74e2968, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x2567fa2c, lpOverlapped=0x0) Thread: id = 1031 os_tid = 0x1e60 [0082.982] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x542b590 [0082.982] wcscpy (in: _Dest=0x542b590, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy" [0082.982] wcscat (in: _Dest=0x542b590, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\" [0082.982] wcscat (in: _Dest=0x542b590, _Source="*" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\*") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\*" [0082.982] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393a390 [0082.982] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\*", lpFindFileData=0x393a390 | out: lpFindFileData=0x393a390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa10e432c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f80 [0082.984] wcscmp (_String1=".", _String2=".") returned 0 [0082.984] FindNextFileW (in: hFindFile=0x5444f80, lpFindFileData=0x393a390 | out: lpFindFileData=0x393a390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa10e432c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.984] wcscmp (_String1="..", _String2=".") returned 1 [0082.984] wcscmp (_String1="..", _String2="..") returned 0 [0082.984] FindNextFileW (in: hFindFile=0x5444f80, lpFindFileData=0x393a390 | out: lpFindFileData=0x393a390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x374c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ffjcext.zip", cAlternateFileName="")) returned 1 [0082.984] wcscmp (_String1="ffjcext.zip", _String2=".") returned 1 [0082.984] wcscmp (_String1="ffjcext.zip", _String2="..") returned 1 [0082.984] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x74) returned 0x38d0aa0 [0082.984] wcscpy (in: _Dest=0x38d0aa0, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy" [0082.984] wcscat (in: _Dest=0x38d0aa0, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\" [0082.984] wcscat (in: _Dest=0x38d0aa0, _Source="ffjcext.zip" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" [0082.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip")) returned 0x20 [0082.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip", dwFileAttributes=0x20) returned 1 [0082.985] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fd8 [0082.985] GetFileSizeEx (in: hFile=0x1fd8, lpFileSize=0x256ff754 | out: lpFileSize=0x256ff754*=14156) returned 1 [0082.985] SetFilePointerEx (in: hFile=0x1fd8, liDistanceToMove=0x3748, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.985] ReadFile (in: hFile=0x1fd8, lpBuffer=0x256ff6d8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x256ff6d4, lpOverlapped=0x0 | out: lpBuffer=0x256ff6d8*, lpNumberOfBytesRead=0x256ff6d4*=0x4, lpOverlapped=0x0) returned 1 [0082.987] SetFilePointerEx (in: hFile=0x1fd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.987] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe38cb38 [0085.771] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe38cb10 [0085.771] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe38ca98 [0085.771] NtQuerySystemTime (in: CurrentTime=0x256ff6b4 | out: CurrentTime=0x256ff6b4*=132260136429237131) returned 0x0 [0085.771] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0xfb7a29e3 [0085.771] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0xd1d2d6ae [0085.771] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0xd6551096 [0085.771] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0x15044fc3 [0085.771] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0x9a941e56 [0085.771] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0x93ee659f [0085.772] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0x3043637a [0085.772] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0x8c94cd1c [0085.772] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0xa674eb2f [0085.772] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0x37d7b2bd [0085.772] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0x8a14817d [0085.772] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0x22b483c8 [0085.772] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0xfa24d950 [0085.772] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0x8daa3e34 [0085.772] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0xf47019b7 [0085.772] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0xc635642d [0085.772] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0x89329363 [0085.772] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0x863a1be5 [0085.772] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0xc90ba4b6 [0085.772] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0x57fa7d58 [0085.772] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0xdd7c0a87 [0085.772] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0xea35a8bb [0085.772] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0x4c4d2130 [0085.772] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0x31b89b0e [0085.772] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0xefb6b175 [0085.772] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0x900b487b [0085.772] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0x9eea824d [0085.772] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0x2ec24395 [0085.772] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0x39aaa6df [0085.772] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0xace1f284 [0085.772] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0x2cbca19d [0085.772] RtlRandom (in: Seed=0x256ff6c0 | out: Seed=0x256ff6c0) returned 0x9b3ad2be [0085.783] ReadFile (in: hFile=0x1fd8, lpBuffer=0xe46aca8, nNumberOfBytesToRead=0x374c, lpNumberOfBytesRead=0x256ff6b0, lpOverlapped=0x0 | out: lpBuffer=0xe46aca8*, lpNumberOfBytesRead=0x256ff6b0*=0x374c, lpOverlapped=0x0) returned 1 [0085.796] SetFilePointerEx (in: hFile=0x1fd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.796] WriteFile (in: hFile=0x1fd8, lpBuffer=0xe4774b0*, nNumberOfBytesToWrite=0x374c, lpNumberOfBytesWritten=0x256ff6ac, lpOverlapped=0x0 | out: lpBuffer=0xe4774b0*, lpNumberOfBytesWritten=0x256ff6ac*=0x374c, lpOverlapped=0x0) returned 1 [0089.512] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080b28 [0089.512] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080678 [0089.513] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe080678) returned 1 [0089.513] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4774b0) returned 1 [0091.475] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe46aca8) returned 1 [0091.475] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe37dc60) returned 1 [0091.475] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8ac8) returned 1 [0091.475] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x23) returned 0x38a6880 [0091.475] SetFilePointerEx (in: hFile=0x1fd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.475] WriteFile (hFile=0x1fd8, lpBuffer=0x74e1c48, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x256ff714, lpOverlapped=0x0) Thread: id = 1032 os_tid = 0x1e64 [0082.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar")) returned 0x20 [0085.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar", dwFileAttributes=0x20) returned 1 [0085.770] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x8cc [0085.770] GetFileSizeEx (in: hFile=0x8cc, lpFileSize=0x2577fb10 | out: lpFileSize=0x2577fb10*=5040094) returned 1 [0085.770] SetFilePointerEx (in: hFile=0x8cc, liDistanceToMove=0x4ce7da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.770] ReadFile (in: hFile=0x8cc, lpBuffer=0x2577fa94, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2577fa90, lpOverlapped=0x0 | out: lpBuffer=0x2577fa94*, lpNumberOfBytesRead=0x2577fa90*=0x4, lpOverlapped=0x0) returned 1 [0085.783] SetFilePointerEx (in: hFile=0x8cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.783] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe38cb88 [0085.783] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe38c9d0 [0085.783] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe38c958 [0085.784] NtQuerySystemTime (in: CurrentTime=0x2577fa70 | out: CurrentTime=0x2577fa70*=132260136429392669) returned 0x0 [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0xb55eebfd [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0xea950539 [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0xa90e5b23 [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0xbe76c247 [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0xad57170f [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0xee6c7cec [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0xbba51509 [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0xb4317936 [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0x1eaf23fe [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0x51245e83 [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0xd88fdc72 [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0xe3a1bef1 [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0xe305734a [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0xbb686c0c [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0xcf799e8a [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0xf4f1ea55 [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0xbc813cb7 [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0x3e3acea4 [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0xaa134fda [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0x25c30735 [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0xf6362cb8 [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0x3c8bb40e [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0xeece4198 [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0xcd1d7f6a [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0x5f5a1ae1 [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0xbc0cad88 [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0x30d55a82 [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0xe56906b0 [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0x45082145 [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0xf1baed55 [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0xf5aac40c [0085.784] RtlRandom (in: Seed=0x2577fa7c | out: Seed=0x2577fa7c) returned 0x72395b6d [0085.794] SetFilePointerEx (in: hFile=0x8cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.794] ReadFile (in: hFile=0x8cc, lpBuffer=0xe483cb8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2577fa28, lpOverlapped=0x0 | out: lpBuffer=0xe483cb8*, lpNumberOfBytesRead=0x2577fa28*=0xc800, lpOverlapped=0x0) returned 1 [0085.796] SetFilePointerEx (in: hFile=0x8cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.796] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8c78 [0085.796] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0xe37e200 [0085.796] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe38ca98 [0085.796] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe38ca98) returned 1 [0085.797] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe4904c0 [0085.802] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe38cb38 [0085.803] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe38cb88 [0085.803] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe38cb88) returned 1 [0085.803] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe37e200) returned 1 [0085.803] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8c78) returned 1 [0085.803] WriteFile (in: hFile=0x8cc, lpBuffer=0xe4904c0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2577fa28, lpOverlapped=0x0 | out: lpBuffer=0xe4904c0*, lpNumberOfBytesWritten=0x2577fa28*=0xc800, lpOverlapped=0x0) returned 1 [0089.513] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4904c0) returned 1 [0091.475] SetFilePointerEx (in: hFile=0x8cc, liDistanceToMove=0x271000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.476] ReadFile (in: hFile=0x8cc, lpBuffer=0xe483cb8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2577fa28, lpOverlapped=0x0 | out: lpBuffer=0xe483cb8*, lpNumberOfBytesRead=0x2577fa28*=0xc800, lpOverlapped=0x0) returned 1 [0091.477] SetFilePointerEx (in: hFile=0x8cc, liDistanceToMove=0x271000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.478] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8ac8 [0091.478] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0xe4d0608 [0091.478] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09aeb0 [0091.478] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09aeb0) returned 1 [0091.478] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe4904c0 [0091.479] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09adc0 [0091.479] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09ad20 [0091.479] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09ad20) returned 1 [0091.479] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4d0608) returned 1 [0091.479] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8ac8) returned 1 [0091.479] WriteFile (in: hFile=0x8cc, lpBuffer=0xe4904c0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2577fa28, lpOverlapped=0x0 | out: lpBuffer=0xe4904c0*, lpNumberOfBytesWritten=0x2577fa28*=0xc800, lpOverlapped=0x0) returned 1 [0091.481] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4904c0) returned 1 [0091.481] SetFilePointerEx (in: hFile=0x8cc, liDistanceToMove=0x4c1fde, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.481] ReadFile (in: hFile=0x8cc, lpBuffer=0xe483cb8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2577fa28, lpOverlapped=0x0 | out: lpBuffer=0xe483cb8*, lpNumberOfBytesRead=0x2577fa28*=0xc800, lpOverlapped=0x0) returned 1 [0091.482] SetFilePointerEx (in: hFile=0x8cc, liDistanceToMove=0x4c1fde, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.482] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8ac8 [0091.482] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0xe4cfd98 [0091.482] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09ae88 [0091.482] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09ae88) returned 1 [0091.484] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe3a63e8 [0091.484] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09aeb0 [0091.484] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09ac80 [0091.484] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09ac80) returned 1 [0091.484] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4cfd98) returned 1 [0091.484] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8ac8) returned 1 [0091.484] WriteFile (in: hFile=0x8cc, lpBuffer=0xe3a63e8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2577fa28, lpOverlapped=0x0 | out: lpBuffer=0xe3a63e8*, lpNumberOfBytesWritten=0x2577fa28*=0xc800, lpOverlapped=0x0) returned 1 [0091.487] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe3a63e8) returned 1 [0091.487] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0xe53a338 [0091.487] SetFilePointerEx (in: hFile=0x8cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.487] WriteFile (hFile=0x8cc, lpBuffer=0xe538430, nNumberOfBytesToWrite=0x145, lpNumberOfBytesWritten=0x2577fad0, lpOverlapped=0x0) Thread: id = 1033 os_tid = 0x1e68 [0082.988] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x542b660 [0082.988] wcscpy (in: _Dest=0x542b660, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext" [0082.988] wcscat (in: _Dest=0x542b660, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\" [0082.988] wcscat (in: _Dest=0x542b660, _Source="*" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\*") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\*" [0082.988] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393a5f8 [0082.988] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\*", lpFindFileData=0x393a5f8 | out: lpFindFileData=0x393a5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa11bdb26, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa8ed01b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444fc0 [0082.990] wcscmp (_String1=".", _String2=".") returned 0 [0082.990] FindNextFileW (in: hFindFile=0x5444fc0, lpFindFileData=0x393a5f8 | out: lpFindFileData=0x393a5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa11bdb26, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa8ed01b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.990] wcscmp (_String1="..", _String2=".") returned 1 [0082.990] wcscmp (_String1="..", _String2="..") returned 0 [0082.990] FindNextFileW (in: hFindFile=0x5444fc0, lpFindFileData=0x393a5f8 | out: lpFindFileData=0x393a5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2de78, dwReserved0=0x0, dwReserved1=0x0, cFileName="access-bridge-64.jar", cAlternateFileName="ACCESS~1.JAR")) returned 1 [0082.990] wcscmp (_String1="access-bridge-64.jar", _String2=".") returned 1 [0082.990] wcscmp (_String1="access-bridge-64.jar", _String2="..") returned 1 [0082.990] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x80) returned 0x3977dd0 [0082.990] wcscpy (in: _Dest=0x3977dd0, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext" [0082.990] wcscat (in: _Dest=0x3977dd0, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\" [0082.990] wcscat (in: _Dest=0x3977dd0, _Source="access-bridge-64.jar" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" [0082.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 0x20 [0082.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar", dwFileAttributes=0x20) returned 1 [0082.991] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fe0 [0082.991] GetFileSizeEx (in: hFile=0x1fe0, lpFileSize=0x257ffea4 | out: lpFileSize=0x257ffea4*=188024) returned 1 [0082.991] SetFilePointerEx (in: hFile=0x1fe0, liDistanceToMove=0x2de74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.991] ReadFile (in: hFile=0x1fe0, lpBuffer=0x257ffe28, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x257ffe24, lpOverlapped=0x0 | out: lpBuffer=0x257ffe28*, lpNumberOfBytesRead=0x257ffe24*=0x4, lpOverlapped=0x0) returned 1 [0082.993] SetFilePointerEx (in: hFile=0x1fe0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.993] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe450878 [0085.674] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe450a58 [0085.674] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe4508a0 [0085.674] NtQuerySystemTime (in: CurrentTime=0x257ffe04 | out: CurrentTime=0x257ffe04*=132260136428299732) returned 0x0 [0085.674] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0xdf2458b5 [0085.674] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0x3bb978a5 [0085.675] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0x15d415e9 [0085.675] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0xfb523582 [0085.675] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0xd75772fd [0085.675] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0xa4021c4e [0085.675] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0x36ffdbc4 [0085.675] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0xcf7c68fe [0085.675] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0x1b345626 [0085.675] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0xba741553 [0085.675] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0xf8f1e939 [0085.675] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0x6eb4eb87 [0085.675] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0x57da1bec [0085.675] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0xdc09c46a [0085.675] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0x3bf97151 [0085.675] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0x3cf9f3f0 [0085.675] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0xf1b7b91e [0085.675] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0x9f82ba5c [0085.675] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0x42df5b1c [0085.675] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0x765cbf4d [0085.675] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0xa4207707 [0085.675] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0x2631ca00 [0085.675] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0xc5638ae1 [0085.675] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0x5f19f807 [0085.675] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0x77b98d74 [0085.675] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0x5be18c67 [0085.675] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0x65bf4089 [0085.675] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0x5ca8e6b6 [0085.675] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0x7e2b7f78 [0085.675] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0xcb90178d [0085.675] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0x109a38f3 [0085.675] RtlRandom (in: Seed=0x257ffe10 | out: Seed=0x257ffe10) returned 0x6a8192b0 [0085.761] SetFilePointerEx (in: hFile=0x1fe0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.761] ReadFile (in: hFile=0x1fe0, lpBuffer=0xe450c90, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x257ffde4, lpOverlapped=0x0 | out: lpBuffer=0xe450c90*, lpNumberOfBytesRead=0x257ffde4*=0xc800, lpOverlapped=0x0) returned 1 [0085.763] SetFilePointerEx (in: hFile=0x1fe0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.763] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8cc0 [0085.763] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0xe45d4c8 [0085.763] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe450a08 [0085.763] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe450a08) returned 1 [0085.764] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe45e4a0 [0085.769] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe450ad0 [0085.769] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe450b48 [0085.769] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe450b48) returned 1 [0085.769] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe45d4c8) returned 1 [0085.769] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8cc0) returned 1 [0085.769] WriteFile (in: hFile=0x1fe0, lpBuffer=0xe45e4a0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x257ffde4, lpOverlapped=0x0 | out: lpBuffer=0xe45e4a0*, lpNumberOfBytesWritten=0x257ffde4*=0xc800, lpOverlapped=0x0) returned 1 [0089.286] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe45e4a0) returned 1 [0091.638] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe450c90) returned 1 [0091.638] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x35) returned 0x389ef80 [0091.638] SetFilePointerEx (in: hFile=0x1fe0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.638] WriteFile (hFile=0x1fe0, lpBuffer=0x74d7948, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x257ffe64, lpOverlapped=0x0) Thread: id = 1034 os_tid = 0x1e6c [0082.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 0x20 [0082.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties", dwFileAttributes=0x20) returned 1 [0082.994] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fe4 [0082.994] GetFileSizeEx (in: hFile=0x1fe4, lpFileSize=0x2587f868 | out: lpFileSize=0x2587f868*=3928) returned 1 [0082.994] SetFilePointerEx (in: hFile=0x1fe4, liDistanceToMove=0xf54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.994] ReadFile (in: hFile=0x1fe4, lpBuffer=0x2587f7ec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2587f7e8, lpOverlapped=0x0 | out: lpBuffer=0x2587f7ec*, lpNumberOfBytesRead=0x2587f7e8*=0x4, lpOverlapped=0x0) returned 1 [0082.996] SetFilePointerEx (in: hFile=0x1fe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.996] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe436158 [0085.663] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe436180 [0085.663] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe435f50 [0085.663] NtQuerySystemTime (in: CurrentTime=0x2587f7c8 | out: CurrentTime=0x2587f7c8*=132260136428142690) returned 0x0 [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0x7a3f366a [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0xb90b8335 [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0xcb4536cd [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0xeec90449 [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0x4882fe3b [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0x434527f9 [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0x88548da [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0x4ece0808 [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0x7d112c70 [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0x9b94e1f2 [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0xdee57869 [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0x92a1bf4 [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0xd211a87 [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0x11f61d3c [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0x246a1c7e [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0x7b22e24 [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0x57683ec8 [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0xc8158055 [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0xd4cb8f3b [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0x47466990 [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0x5da30e46 [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0xb8073d4 [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0xff8a6598 [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0x3da4d052 [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0xb4757fb2 [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0xb3019215 [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0xe042d287 [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0x8eb7cd95 [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0xaa1a5556 [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0xd798700b [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0x2a9b0ae0 [0085.663] RtlRandom (in: Seed=0x2587f7d4 | out: Seed=0x2587f7d4) returned 0xdda924f [0085.674] ReadFile (in: hFile=0x1fe4, lpBuffer=0xe436c78, nNumberOfBytesToRead=0xf58, lpNumberOfBytesRead=0x2587f7c4, lpOverlapped=0x0 | out: lpBuffer=0xe436c78*, lpNumberOfBytesRead=0x2587f7c4*=0xf58, lpOverlapped=0x0) returned 1 [0085.674] SetFilePointerEx (in: hFile=0x1fe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.674] WriteFile (in: hFile=0x1fe4, lpBuffer=0xe443480*, nNumberOfBytesToWrite=0xf58, lpNumberOfBytesWritten=0x2587f7c0, lpOverlapped=0x0 | out: lpBuffer=0xe443480*, lpNumberOfBytesWritten=0x2587f7c0*=0xf58, lpOverlapped=0x0) returned 1 [0089.283] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282e10 [0089.283] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282e38 [0089.283] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282e38) returned 1 [0089.283] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe443480) returned 1 [0091.638] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe436c78) returned 1 [0091.638] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe3cd688) returned 1 [0091.638] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8c30) returned 1 [0091.638] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x35) returned 0x389ef40 [0091.639] SetFilePointerEx (in: hFile=0x1fe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.639] WriteFile (hFile=0x1fe4, lpBuffer=0x74d8728, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x2587f828, lpOverlapped=0x0) Thread: id = 1035 os_tid = 0x1e70 [0082.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 0x20 [0082.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc", dwFileAttributes=0x20) returned 1 [0082.997] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fe8 [0082.997] GetFileSizeEx (in: hFile=0x1fe8, lpFileSize=0x258ffe44 | out: lpFileSize=0x258ffe44*=3770) returned 1 [0082.997] SetFilePointerEx (in: hFile=0x1fe8, liDistanceToMove=0xeb6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.997] ReadFile (in: hFile=0x1fe8, lpBuffer=0x258ffdc8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x258ffdc4, lpOverlapped=0x0 | out: lpBuffer=0x258ffdc8*, lpNumberOfBytesRead=0x258ffdc4*=0x4, lpOverlapped=0x0) returned 1 [0082.999] SetFilePointerEx (in: hFile=0x1fe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.999] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe41bf10 [0085.651] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe41bf88 [0085.651] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe41bec0 [0085.651] NtQuerySystemTime (in: CurrentTime=0x258ffda4 | out: CurrentTime=0x258ffda4*=132260136428142690) returned 0x0 [0085.651] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0xc82a2d6d [0085.651] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0x8da61a32 [0085.651] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0x98779ea1 [0085.651] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0xc2f0b970 [0085.651] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0x14fd87e7 [0085.651] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0xa6c074f [0085.651] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0x73ebfc3c [0085.651] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0xbc45033b [0085.651] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0x6496acb [0085.651] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0x463c129a [0085.651] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0x31bf038e [0085.651] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0x253d256d [0085.651] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0xd48e96a4 [0085.651] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0x509e91f2 [0085.651] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0x8284e655 [0085.651] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0x62f0754 [0085.651] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0xe954034e [0085.651] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0x5e31230c [0085.651] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0xb72ca192 [0085.651] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0x6ca8c11e [0085.651] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0xa21ef1a1 [0085.651] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0xed03b12d [0085.652] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0x2cfc0053 [0085.652] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0xf1be14e7 [0085.652] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0x730df59c [0085.652] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0x7fbbc94 [0085.652] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0x6cecb140 [0085.652] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0xeb77b50d [0085.652] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0x2dac44c4 [0085.652] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0xab18694f [0085.652] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0xb4acad9e [0085.652] RtlRandom (in: Seed=0x258ffdb0 | out: Seed=0x258ffdb0) returned 0x4e54a37f [0085.661] ReadFile (in: hFile=0x1fe8, lpBuffer=0xe41cc60, nNumberOfBytesToRead=0xeba, lpNumberOfBytesRead=0x258ffda0, lpOverlapped=0x0 | out: lpBuffer=0xe41cc60*, lpNumberOfBytesRead=0x258ffda0*=0xeba, lpOverlapped=0x0) returned 1 [0085.662] SetFilePointerEx (in: hFile=0x1fe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.662] WriteFile (in: hFile=0x1fe8, lpBuffer=0xe429468*, nNumberOfBytesToWrite=0xeba, lpNumberOfBytesWritten=0x258ffd9c, lpOverlapped=0x0 | out: lpBuffer=0xe429468*, lpNumberOfBytesWritten=0x258ffd9c*=0xeba, lpOverlapped=0x0) returned 1 [0089.278] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282de8 [0089.278] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282e10 [0089.278] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282e10) returned 1 [0089.278] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe429468) returned 1 [0091.639] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe41cc60) returned 1 [0091.639] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe3cd610) returned 1 [0091.639] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8be8) returned 1 [0091.639] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x29) returned 0x390acc8 [0091.639] SetFilePointerEx (in: hFile=0x1fe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.639] WriteFile (hFile=0x1fe8, lpBuffer=0x74e2ee0, nNumberOfBytesToWrite=0x10d, lpNumberOfBytesWritten=0x258ffe04, lpOverlapped=0x0) Thread: id = 1036 os_tid = 0x1e74 [0082.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 0x20 [0082.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src", dwFileAttributes=0x20) returned 1 [0082.999] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fec [0082.999] GetFileSizeEx (in: hFile=0x1fec, lpFileSize=0x2597f998 | out: lpFileSize=0x2597f998*=10568) returned 1 [0083.000] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0x2944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.000] ReadFile (in: hFile=0x1fec, lpBuffer=0x2597f91c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2597f918, lpOverlapped=0x0 | out: lpBuffer=0x2597f91c*, lpNumberOfBytesRead=0x2597f918*=0x4, lpOverlapped=0x0) returned 1 [0083.001] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.001] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe4021a0 [0085.639] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe4025d8 [0085.639] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe402330 [0085.639] NtQuerySystemTime (in: CurrentTime=0x2597f8f8 | out: CurrentTime=0x2597f8f8*=132260136427986430) returned 0x0 [0085.639] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0x1d7c3f1 [0085.639] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0xf5055db3 [0085.639] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0xd272f295 [0085.639] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0xca4a07d1 [0085.639] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0xee5d8733 [0085.639] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0x9c4167 [0085.639] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0xeee8db33 [0085.639] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0x81ee1581 [0085.639] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0x9943a0a5 [0085.639] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0x9ec8e08d [0085.640] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0x9cdc22db [0085.640] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0xb4930872 [0085.640] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0xb451261d [0085.640] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0x2219b9a [0085.640] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0xd3e53f09 [0085.640] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0xe8f104cb [0085.640] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0x43b2fa8d [0085.640] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0x4181652f [0085.640] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0xa6248a01 [0085.640] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0x9687787d [0085.640] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0x177af1b5 [0085.640] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0x189979b7 [0085.640] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0x9250a3ef [0085.640] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0xaa78ed9b [0085.640] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0x7f79cb8c [0085.640] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0xf68ddcd1 [0085.640] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0x2d15f5ab [0085.640] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0xc753c07 [0085.640] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0x520269a7 [0085.640] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0xfe2ef3 [0085.640] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0x6bf0fbb5 [0085.640] RtlRandom (in: Seed=0x2597f904 | out: Seed=0x2597f904) returned 0xda2c28b0 [0085.650] ReadFile (in: hFile=0x1fec, lpBuffer=0xe402c48, nNumberOfBytesToRead=0x2948, lpNumberOfBytesRead=0x2597f8f4, lpOverlapped=0x0 | out: lpBuffer=0xe402c48*, lpNumberOfBytesRead=0x2597f8f4*=0x2948, lpOverlapped=0x0) returned 1 [0085.662] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.662] WriteFile (in: hFile=0x1fec, lpBuffer=0xe40f450*, nNumberOfBytesToWrite=0x2948, lpNumberOfBytesWritten=0x2597f8f0, lpOverlapped=0x0 | out: lpBuffer=0xe40f450*, lpNumberOfBytesWritten=0x2597f8f0*=0x2948, lpOverlapped=0x0) returned 1 [0089.278] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282d98 [0089.278] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282de8 [0089.278] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282de8) returned 1 [0089.278] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe40f450) returned 1 [0091.640] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe402c48) returned 1 [0091.640] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe3cd598) returned 1 [0091.640] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8ba0) returned 1 [0091.640] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3f) returned 0x5ba8a38 [0091.640] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.640] WriteFile (hFile=0x1fec, lpBuffer=0x5baae48, nNumberOfBytesToWrite=0x123, lpNumberOfBytesWritten=0x2597f958, lpOverlapped=0x0) Thread: id = 1037 os_tid = 0x1e78 [0083.002] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x542b730 [0083.002] wcscpy (in: _Dest=0x542b730, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts" [0083.002] wcscat (in: _Dest=0x542b730, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\" [0083.002] wcscat (in: _Dest=0x542b730, _Source="*" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\*") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\*" [0083.002] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393a860 [0083.002] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\*", lpFindFileData=0x393a860 | out: lpFindFileData=0x393a860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa122f229, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445000 [0083.004] wcscmp (_String1=".", _String2=".") returned 0 [0083.004] FindNextFileW (in: hFindFile=0x5445000, lpFindFileData=0x393a860 | out: lpFindFileData=0x393a860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa122f229, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.004] wcscmp (_String1="..", _String2=".") returned 1 [0083.004] wcscmp (_String1="..", _String2="..") returned 0 [0083.004] FindNextFileW (in: hFindFile=0x5445000, lpFindFileData=0x393a860 | out: lpFindFileData=0x393a860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x12588, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaBrightDemiBold.ttf", cAlternateFileName="LUCIDA~1.TTF")) returned 1 [0083.004] wcscmp (_String1="LucidaBrightDemiBold.ttf", _String2=".") returned 1 [0083.004] wcscmp (_String1="LucidaBrightDemiBold.ttf", _String2="..") returned 1 [0083.004] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8c) returned 0x549ec80 [0083.004] wcscpy (in: _Dest=0x549ec80, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts" [0083.004] wcscat (in: _Dest=0x549ec80, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\" [0083.004] wcscat (in: _Dest=0x549ec80, _Source="LucidaBrightDemiBold.ttf" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" [0083.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 0x20 [0083.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf", dwFileAttributes=0x20) returned 1 [0083.005] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ff4 [0083.005] GetFileSizeEx (in: hFile=0x1ff4, lpFileSize=0x259ffd24 | out: lpFileSize=0x259ffd24*=75144) returned 1 [0083.005] SetFilePointerEx (in: hFile=0x1ff4, liDistanceToMove=0x12584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.005] ReadFile (in: hFile=0x1ff4, lpBuffer=0x259ffca8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x259ffca4, lpOverlapped=0x0 | out: lpBuffer=0x259ffca8*, lpNumberOfBytesRead=0x259ffca4*=0x4, lpOverlapped=0x0) returned 1 [0083.010] SetFilePointerEx (in: hFile=0x1ff4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.010] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe3e7e18 [0085.620] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe3e7f80 [0085.620] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe3e7eb8 [0085.620] NtQuerySystemTime (in: CurrentTime=0x259ffc84 | out: CurrentTime=0x259ffc84*=132260136427830365) returned 0x0 [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0x18aac172 [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0x45688de6 [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0x2e0245ef [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0x9b9c3387 [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0xa568efb3 [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0x8a396c37 [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0x2d66ffe [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0xaed8d4c5 [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0x653c5753 [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0xb316b85a [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0xf07eff33 [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0x7e9b110d [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0xadf555c4 [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0xeb20509a [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0x937fd710 [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0xd6d4dc1 [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0x81b1f69f [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0x707873c7 [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0x87754d72 [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0xdef120 [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0xc51416b0 [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0x87a3085f [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0x7e677f1a [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0x4075b057 [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0x745cb2e2 [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0xd22fa574 [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0x75e627cd [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0x10ecd3e3 [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0x8626a14a [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0xc703fd5f [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0xb639ebb0 [0085.621] RtlRandom (in: Seed=0x259ffc90 | out: Seed=0x259ffc90) returned 0x14e8e5d7 [0085.630] SetFilePointerEx (in: hFile=0x1ff4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.630] ReadFile (in: hFile=0x1ff4, lpBuffer=0xe3e8c30, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x259ffc64, lpOverlapped=0x0 | out: lpBuffer=0xe3e8c30*, lpNumberOfBytesRead=0x259ffc64*=0xc800, lpOverlapped=0x0) returned 1 [0085.632] SetFilePointerEx (in: hFile=0x1ff4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.632] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8eb8 [0085.632] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0xe3cccb0 [0085.632] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe3e7fa8 [0085.632] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe3e7fa8) returned 1 [0085.633] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe3f5438 [0085.639] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe3e8070 [0085.639] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe3e80e8 [0085.639] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe3e80e8) returned 1 [0085.639] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe3cccb0) returned 1 [0085.639] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8eb8) returned 1 [0085.639] WriteFile (in: hFile=0x1ff4, lpBuffer=0xe3f5438*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x259ffc64, lpOverlapped=0x0 | out: lpBuffer=0xe3f5438*, lpNumberOfBytesWritten=0x259ffc64*=0xc800, lpOverlapped=0x0) returned 1 [0089.511] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe3f5438) returned 1 [0091.480] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe3e8c30) returned 1 [0091.481] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3d) returned 0x5ba8918 [0091.481] SetFilePointerEx (in: hFile=0x1ff4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.481] WriteFile (hFile=0x1ff4, lpBuffer=0x5ba9ac8, nNumberOfBytesToWrite=0x121, lpNumberOfBytesWritten=0x259ffce4, lpOverlapped=0x0) Thread: id = 1038 os_tid = 0x1e7c [0083.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 0x20 [0083.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties", dwFileAttributes=0x20) returned 1 [0083.008] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ff8 [0083.009] GetFileSizeEx (in: hFile=0x1ff8, lpFileSize=0x25a7fa1c | out: lpFileSize=0x25a7fa1c*=13962) returned 1 [0083.009] SetFilePointerEx (in: hFile=0x1ff8, liDistanceToMove=0x3686, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.009] ReadFile (in: hFile=0x1ff8, lpBuffer=0x25a7f9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25a7f99c, lpOverlapped=0x0 | out: lpBuffer=0x25a7f9a0*, lpNumberOfBytesRead=0x25a7f99c*=0x4, lpOverlapped=0x0) returned 1 [0083.010] SetFilePointerEx (in: hFile=0x1ff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.010] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe3ceaf8 [0085.609] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe3ceb20 [0085.609] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe3ce918 [0085.609] NtQuerySystemTime (in: CurrentTime=0x25a7f97c | out: CurrentTime=0x25a7f97c*=132260136427680565) returned 0x0 [0085.609] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0x16c5ebd2 [0085.609] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0xd4515ce5 [0085.609] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0x2ec61af [0085.609] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0x8cbd8d37 [0085.609] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0x93905f01 [0085.610] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0x96b6d2a5 [0085.610] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0xa3e4beaa [0085.610] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0x72e2f569 [0085.610] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0xfd652842 [0085.610] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0x864e1240 [0085.610] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0xf8f1fb44 [0085.610] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0x7d573ac3 [0085.610] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0xb2dc6ae3 [0085.610] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0xb79e1bce [0085.610] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0x2bf07906 [0085.610] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0x670c8b8f [0085.610] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0xc4e8e2c5 [0085.610] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0xaedc9362 [0085.610] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0xf9c99250 [0085.610] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0xe0c82fdb [0085.610] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0x2302f97e [0085.610] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0x46797a65 [0085.610] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0x429d0b37 [0085.610] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0xd69beec7 [0085.610] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0xbe3c9260 [0085.610] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0xfd283ff5 [0085.610] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0xebf16686 [0085.610] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0xbb57236f [0085.610] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0x752984ca [0085.610] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0xfef2f88d [0085.610] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0xbc9d259f [0085.610] RtlRandom (in: Seed=0x25a7f988 | out: Seed=0x25a7f988) returned 0xb722263d [0085.620] ReadFile (in: hFile=0x1ff8, lpBuffer=0xe3cec18, nNumberOfBytesToRead=0x368a, lpNumberOfBytesRead=0x25a7f978, lpOverlapped=0x0 | out: lpBuffer=0xe3cec18*, lpNumberOfBytesRead=0x25a7f978*=0x368a, lpOverlapped=0x0) returned 1 [0085.631] SetFilePointerEx (in: hFile=0x1ff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.631] WriteFile (in: hFile=0x1ff8, lpBuffer=0xe3db420*, nNumberOfBytesToWrite=0x368a, lpNumberOfBytesWritten=0x25a7f974, lpOverlapped=0x0 | out: lpBuffer=0xe3db420*, lpNumberOfBytesWritten=0x25a7f974*=0x368a, lpOverlapped=0x0) returned 1 [0089.511] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080b00 [0089.511] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0806f0 [0089.511] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0806f0) returned 1 [0089.511] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe3db420) returned 1 [0091.480] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe3cec18) returned 1 [0091.480] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe3ccc38) returned 1 [0091.480] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8918) returned 1 [0091.480] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4f) returned 0x757f0a8 [0091.480] SetFilePointerEx (in: hFile=0x1ff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.480] WriteFile (hFile=0x1ff8, lpBuffer=0x758abf8, nNumberOfBytesToWrite=0x133, lpNumberOfBytesWritten=0x25a7f9dc, lpOverlapped=0x0) Thread: id = 1039 os_tid = 0x1e80 [0083.010] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x542b798 [0083.010] wcscpy (in: _Dest=0x542b798, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images" [0083.011] wcscat (in: _Dest=0x542b798, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\" [0083.011] wcscat (in: _Dest=0x542b798, _Source="*" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\*") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\*" [0083.011] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393aac8 [0083.011] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\*", lpFindFileData=0x393aac8 | out: lpFindFileData=0x393aac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa12313ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445040 [0083.011] wcscmp (_String1=".", _String2=".") returned 0 [0083.011] FindNextFileW (in: hFindFile=0x5445040, lpFindFileData=0x393aac8 | out: lpFindFileData=0x393aac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa12313ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.011] wcscmp (_String1="..", _String2=".") returned 1 [0083.011] wcscmp (_String1="..", _String2="..") returned 0 [0083.011] FindNextFileW (in: hFindFile=0x5445040, lpFindFileData=0x393aac8 | out: lpFindFileData=0x393aac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cursors", cAlternateFileName="")) returned 1 [0083.011] wcscmp (_String1="cursors", _String2=".") returned 1 [0083.011] wcscmp (_String1="cursors", _String2="..") returned 1 [0083.011] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6c) returned 0xe3ccff8 [0085.609] wcscpy (in: _Dest=0xe3ccff8, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images" [0085.609] wcscat (in: _Dest=0xe3ccff8, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\" [0085.609] wcscat (in: _Dest=0xe3ccff8, _Source="cursors" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors" [0088.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0xe3ccff8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fc8 [0088.838] FindNextFileW (in: hFindFile=0x5445040, lpFindFileData=0x393aac8 | out: lpFindFileData=0x393aac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cursors", cAlternateFileName="")) returned 0 [0088.838] FindClose (in: hFindFile=0x5445040 | out: hFindFile=0x5445040) returned 1 [0088.838] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393aac8) returned 1 [0088.838] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542b798) returned 1 [0088.838] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x6e96528) returned 1 Thread: id = 1040 os_tid = 0x1e84 [0083.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 0x20 [0083.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties", dwFileAttributes=0x20) returned 1 [0083.012] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2004 [0083.013] GetFileSizeEx (in: hFile=0x2004, lpFileSize=0x25b7f748 | out: lpFileSize=0x25b7f748*=56) returned 1 [0083.013] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe3b3b78 [0085.596] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe3b3b28 [0085.596] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe3b3b50 [0085.597] NtQuerySystemTime (in: CurrentTime=0x25b7f6a8 | out: CurrentTime=0x25b7f6a8*=132260136427518409) returned 0x0 [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0xf64c84c8 [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0x75f50385 [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0xa03549f0 [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0x9063725b [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0x17afea7c [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0x51abfcc [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0x3072adb9 [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0x156c0201 [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0xefa7d2ed [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0x17501970 [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0x64859990 [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0x4df547c [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0x485abe1c [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0xe04b8cea [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0x609ffef0 [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0xc68f581e [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0xa6d517a5 [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0x4636d186 [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0xa0dba20e [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0xa4706670 [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0xd7652e7 [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0xae0a92f9 [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0xf416049f [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0x5eee3e41 [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0x8d64fc4e [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0x1ba858cc [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0x60f31c28 [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0x302e4603 [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0x8d099c22 [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0x38ad0095 [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0x7f52f968 [0085.597] RtlRandom (in: Seed=0x25b7f6b4 | out: Seed=0x25b7f6b4) returned 0x75c9438e [0085.607] ReadFile (in: hFile=0x2004, lpBuffer=0xe3b3bf8, nNumberOfBytesToRead=0x38, lpNumberOfBytesRead=0x25b7f6a4, lpOverlapped=0x0 | out: lpBuffer=0xe3b3bf8*, lpNumberOfBytesRead=0x25b7f6a4*=0x38, lpOverlapped=0x0) returned 1 [0085.609] SetFilePointerEx (in: hFile=0x2004, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.609] WriteFile (in: hFile=0x2004, lpBuffer=0xe3c0400*, nNumberOfBytesToWrite=0x38, lpNumberOfBytesWritten=0x25b7f6a0, lpOverlapped=0x0 | out: lpBuffer=0xe3c0400*, lpNumberOfBytesWritten=0x25b7f6a0*=0x38, lpOverlapped=0x0) returned 1 [0089.271] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282d70 [0089.271] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282d98 [0089.271] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282d98) returned 1 [0089.271] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe3c0400) returned 1 [0091.689] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe3b3bf8) returned 1 [0091.692] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe37dbe8) returned 1 [0091.692] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba88d0) returned 1 [0091.692] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2f) returned 0x390a830 [0091.692] SetFilePointerEx (in: hFile=0x2004, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.692] WriteFile (hFile=0x2004, lpBuffer=0x74d8850, nNumberOfBytesToWrite=0x113, lpNumberOfBytesWritten=0x25b7f708, lpOverlapped=0x0) Thread: id = 1041 os_tid = 0x1e88 [0083.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 0x20 [0085.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar", dwFileAttributes=0x20) returned 1 [0085.570] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x8e8 [0085.570] GetFileSizeEx (in: hFile=0x8e8, lpFileSize=0x25bff998 | out: lpFileSize=0x25bff998*=944167) returned 1 [0085.570] SetFilePointerEx (in: hFile=0x8e8, liDistanceToMove=0xe6823, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.570] ReadFile (in: hFile=0x8e8, lpBuffer=0x25bff91c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25bff918, lpOverlapped=0x0 | out: lpBuffer=0x25bff91c*, lpNumberOfBytesRead=0x25bff918*=0x4, lpOverlapped=0x0) returned 1 [0085.578] SetFilePointerEx (in: hFile=0x8e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.578] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe37f030 [0085.578] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe37f008 [0085.578] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe37ef90 [0085.578] NtQuerySystemTime (in: CurrentTime=0x25bff8f8 | out: CurrentTime=0x25bff8f8*=132260136427361322) returned 0x0 [0085.578] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0x6640d709 [0085.578] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0xb261ab7d [0085.578] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0x52651ec1 [0085.578] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0x258ae409 [0085.578] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0x73b10ddc [0085.578] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0x8052ff44 [0085.578] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0xd3b3eccc [0085.578] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0xb06a2066 [0085.578] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0x6d521650 [0085.578] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0x33444778 [0085.578] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0x1217c57b [0085.578] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0x3e58e1ea [0085.578] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0xe9d46b8 [0085.578] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0xe080caa3 [0085.578] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0x3b5d4840 [0085.578] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0x39b1ef1f [0085.578] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0x8f7c5921 [0085.578] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0x844c55e0 [0085.578] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0x9831a8a7 [0085.578] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0xbfbb6541 [0085.579] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0xb0bfed90 [0085.579] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0x21209974 [0085.579] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0x97919515 [0085.579] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0xbc3e6617 [0085.579] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0xca51718f [0085.579] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0xb2828ba1 [0085.579] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0xfcda5538 [0085.579] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0x6dfe72f1 [0085.579] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0x9cbaa4da [0085.579] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0x1d021e7c [0085.579] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0xc806a430 [0085.579] RtlRandom (in: Seed=0x25bff904 | out: Seed=0x25bff904) returned 0x251e7824 [0085.588] SetFilePointerEx (in: hFile=0x8e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.588] ReadFile (in: hFile=0x8e8, lpBuffer=0xe399be0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x25bff8b0, lpOverlapped=0x0 | out: lpBuffer=0xe399be0*, lpNumberOfBytesRead=0x25bff8b0*=0xc800, lpOverlapped=0x0) returned 1 [0085.590] SetFilePointerEx (in: hFile=0x8e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.590] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba88d0 [0085.590] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0xe37dbe8 [0085.590] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe37ecc0 [0085.590] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe37ecc0) returned 1 [0085.591] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe3a63e8 [0085.596] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe37ebf8 [0085.596] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe37ef90 [0085.596] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe37ef90) returned 1 [0085.596] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe37dbe8) returned 1 [0085.596] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba88d0) returned 1 [0085.596] WriteFile (in: hFile=0x8e8, lpBuffer=0xe3a63e8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x25bff8b0, lpOverlapped=0x0 | out: lpBuffer=0xe3a63e8*, lpNumberOfBytesWritten=0x25bff8b0*=0xc800, lpOverlapped=0x0) returned 1 [0089.509] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe3a63e8) returned 1 [0091.482] SetFilePointerEx (in: hFile=0x8e8, liDistanceToMove=0x7d000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.482] ReadFile (in: hFile=0x8e8, lpBuffer=0xe399be0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x25bff8b0, lpOverlapped=0x0 | out: lpBuffer=0xe399be0*, lpNumberOfBytesRead=0x25bff8b0*=0xc800, lpOverlapped=0x0) returned 1 [0091.488] SetFilePointerEx (in: hFile=0x8e8, liDistanceToMove=0x7d000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.488] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8ac8 [0091.488] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0xe4d0608 [0091.488] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09aeb0 [0091.488] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09aeb0) returned 1 [0091.489] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe3a63e8 [0091.490] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09adc0 [0091.490] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09ad48 [0091.490] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09ad48) returned 1 [0091.490] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4d0608) returned 1 [0091.490] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8ac8) returned 1 [0091.490] WriteFile (in: hFile=0x8e8, lpBuffer=0xe3a63e8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x25bff8b0, lpOverlapped=0x0 | out: lpBuffer=0xe3a63e8*, lpNumberOfBytesWritten=0x25bff8b0*=0xc800, lpOverlapped=0x0) returned 1 [0091.492] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe3a63e8) returned 1 [0091.492] SetFilePointerEx (in: hFile=0x8e8, liDistanceToMove=0xda027, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.492] ReadFile (in: hFile=0x8e8, lpBuffer=0xe399be0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x25bff8b0, lpOverlapped=0x0 | out: lpBuffer=0xe399be0*, lpNumberOfBytesRead=0x25bff8b0*=0xc800, lpOverlapped=0x0) returned 1 [0091.496] SetFilePointerEx (in: hFile=0x8e8, liDistanceToMove=0xda027, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.496] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8ac8 [0091.496] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0xe4cfd98 [0091.496] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09ae88 [0091.496] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09ae88) returned 1 [0091.497] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe2be320 [0091.497] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09aeb0 [0091.497] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09ac80 [0091.497] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09ac80) returned 1 [0091.497] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4cfd98) returned 1 [0091.497] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8ac8) returned 1 [0091.498] WriteFile (in: hFile=0x8e8, lpBuffer=0xe2be320*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x25bff8b0, lpOverlapped=0x0 | out: lpBuffer=0xe2be320*, lpNumberOfBytesWritten=0x25bff8b0*=0xc800, lpOverlapped=0x0) returned 1 [0091.503] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe2be320) returned 1 [0091.503] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0xe53a3a0 [0091.503] SetFilePointerEx (in: hFile=0x8e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.503] WriteFile (hFile=0x8e8, lpBuffer=0xe538588, nNumberOfBytesToWrite=0x145, lpNumberOfBytesWritten=0x25bff958, lpOverlapped=0x0) Thread: id = 1042 os_tid = 0x1e8c [0083.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 0x20 [0083.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar", dwFileAttributes=0x20) returned 1 [0083.014] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2008 [0083.014] GetFileSizeEx (in: hFile=0x2008, lpFileSize=0x25c7f904 | out: lpFileSize=0x25c7f904*=116446) returned 1 [0083.014] SetFilePointerEx (in: hFile=0x2008, liDistanceToMove=0x1c6da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.014] ReadFile (in: hFile=0x2008, lpBuffer=0x25c7f888, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25c7f884, lpOverlapped=0x0 | out: lpBuffer=0x25c7f888*, lpNumberOfBytesRead=0x25c7f884*=0x4, lpOverlapped=0x0) returned 1 [0083.016] SetFilePointerEx (in: hFile=0x2008, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.016] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe37ed60 [0085.558] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe37f058 [0085.558] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe37ee28 [0085.558] NtQuerySystemTime (in: CurrentTime=0x25c7f864 | out: CurrentTime=0x25c7f864*=132260136427216564) returned 0x0 [0085.558] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x3024f2e6 [0085.558] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0xcac85df0 [0085.558] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x9407c004 [0085.558] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x19087f39 [0085.558] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0xe2764fff [0085.559] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0xac68a711 [0085.559] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0xf5e2b58d [0085.559] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x1a233aa5 [0085.559] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0xb15dc755 [0085.559] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x918a4ac7 [0085.559] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x6d5ea504 [0085.559] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0xbcbdb28d [0085.559] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x773d5803 [0085.559] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0xbe43dc04 [0085.559] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x65b012fe [0085.559] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0xfc067465 [0085.559] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0xbf86ddca [0085.559] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x1d83dd3d [0085.559] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x8ac129bb [0085.559] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x4a899e32 [0085.559] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x59162665 [0085.559] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x50de2e77 [0085.559] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x351bef55 [0085.559] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x500789b3 [0085.559] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x27916079 [0085.559] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0xa3fc9702 [0085.559] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x97261f0c [0085.559] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x3e2617b8 [0085.559] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x61e9ccd7 [0085.559] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x4f711001 [0085.559] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0xb03b6010 [0085.559] RtlRandom (in: Seed=0x25c7f870 | out: Seed=0x25c7f870) returned 0x9670a663 [0085.568] SetFilePointerEx (in: hFile=0x2008, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.568] ReadFile (in: hFile=0x2008, lpBuffer=0xe37fbc8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x25c7f844, lpOverlapped=0x0 | out: lpBuffer=0xe37fbc8*, lpNumberOfBytesRead=0x25c7f844*=0xc800, lpOverlapped=0x0) returned 1 [0085.571] SetFilePointerEx (in: hFile=0x2008, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.571] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba88d0 [0085.571] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0xe37dbe8 [0085.571] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe37ecc0 [0085.571] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe37ecc0) returned 1 [0085.572] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe38d3d8 [0085.578] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe37f0d0 [0085.578] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe37ef90 [0085.578] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe37ef90) returned 1 [0085.578] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe37dbe8) returned 1 [0085.578] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba88d0) returned 1 [0085.578] WriteFile (in: hFile=0x2008, lpBuffer=0xe38d3d8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x25c7f844, lpOverlapped=0x0 | out: lpBuffer=0xe38d3d8*, lpNumberOfBytesWritten=0x25c7f844*=0xc800, lpOverlapped=0x0) returned 1 [0089.508] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe38d3d8) returned 1 [0091.486] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe37fbc8) returned 1 [0091.486] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1b) returned 0xe09b018 [0091.486] SetFilePointerEx (in: hFile=0x2008, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.487] WriteFile (hFile=0x2008, lpBuffer=0x549aa78, nNumberOfBytesToWrite=0xff, lpNumberOfBytesWritten=0x25c7f8c4, lpOverlapped=0x0) Thread: id = 1043 os_tid = 0x1e90 [0083.016] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x542b868 [0083.016] wcscpy (in: _Dest=0x542b868, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr" [0083.016] wcscat (in: _Dest=0x542b868, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\" [0083.016] wcscat (in: _Dest=0x542b868, _Source="*" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\*") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\*" [0083.016] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393ad30 [0083.016] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\*", lpFindFileData=0x393ad30 | out: lpFindFileData=0x393ad30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1295634, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445080 [0083.017] wcscmp (_String1=".", _String2=".") returned 0 [0083.017] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x393ad30 | out: lpFindFileData=0x393ad30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1295634, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.017] wcscmp (_String1="..", _String2=".") returned 1 [0083.017] wcscmp (_String1="..", _String2="..") returned 0 [0083.017] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x393ad30 | out: lpFindFileData=0x393ad30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="default.jfc", cAlternateFileName="")) returned 1 [0083.017] wcscmp (_String1="default.jfc", _String2=".") returned 1 [0083.017] wcscmp (_String1="default.jfc", _String2="..") returned 1 [0083.017] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6e) returned 0xe37dcd8 [0085.558] wcscpy (in: _Dest=0xe37dcd8, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr" [0085.558] wcscat (in: _Dest=0xe37dcd8, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\" [0085.558] wcscat (in: _Dest=0xe37dcd8, _Source="default.jfc" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" [0088.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0xe37dcd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ffc [0088.839] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x393ad30 | out: lpFindFileData=0x393ad30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e61, dwReserved0=0x0, dwReserved1=0x0, cFileName="profile.jfc", cAlternateFileName="")) returned 1 [0088.839] wcscmp (_String1="profile.jfc", _String2=".") returned 1 [0088.839] wcscmp (_String1="profile.jfc", _String2="..") returned 1 [0088.839] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6e) returned 0x74affb8 [0088.839] wcscpy (in: _Dest=0x74affb8, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr" [0088.839] wcscat (in: _Dest=0x74affb8, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\" [0088.839] wcscat (in: _Dest=0x74affb8, _Source="profile.jfc" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" [0088.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74affb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1804 [0088.840] FindNextFileW (in: hFindFile=0x5445080, lpFindFileData=0x393ad30 | out: lpFindFileData=0x393ad30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e61, dwReserved0=0x0, dwReserved1=0x0, cFileName="profile.jfc", cAlternateFileName="")) returned 0 [0088.840] FindClose (in: hFindFile=0x5445080 | out: hFindFile=0x5445080) returned 1 [0088.840] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393ad30) returned 1 [0088.840] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542b868) returned 1 [0088.840] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x543d338) returned 1 Thread: id = 1044 os_tid = 0x1e94 [0083.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 0x20 [0083.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar", dwFileAttributes=0x20) returned 1 [0083.018] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2010 [0083.018] GetFileSizeEx (in: hFile=0x2010, lpFileSize=0x25d7f920 | out: lpFileSize=0x25d7f920*=560581) returned 1 [0083.018] SetFilePointerEx (in: hFile=0x2010, liDistanceToMove=0x88dc1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.018] ReadFile (in: hFile=0x2010, lpBuffer=0x25d7f8a4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25d7f8a0, lpOverlapped=0x0 | out: lpBuffer=0x25d7f8a4*, lpNumberOfBytesRead=0x25d7f8a0*=0x4, lpOverlapped=0x0) returned 1 [0083.020] SetFilePointerEx (in: hFile=0x2010, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.020] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe2fd3a0 [0085.527] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe2fd300 [0085.527] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe2fd440 [0085.527] NtQuerySystemTime (in: CurrentTime=0x25d7f880 | out: CurrentTime=0x25d7f880*=132260136426904234) returned 0x0 [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0xd93cfbb4 [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0x7f5550d1 [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0x167fedd8 [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0xab4b70d5 [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0x4b5db94e [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0x27212b1d [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0x66196882 [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0xb9223a3b [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0xc8237e0f [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0xd8c1da4a [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0x5127d1a9 [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0x678b388 [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0x2f216804 [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0xb79bcb99 [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0xbaaa939d [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0x86b08489 [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0xcf4b89c4 [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0xed7844b [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0xfd5b783a [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0xfba38ece [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0x4e5d2261 [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0x5c13d848 [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0x4d587df [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0x8c6427e [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0x708ce009 [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0xd36f990d [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0xc4a9ea5d [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0xb99afb8c [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0x6a96f651 [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0x3a918ffd [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0x25259cf5 [0085.528] RtlRandom (in: Seed=0x25d7f88c | out: Seed=0x25d7f88c) returned 0xf465df44 [0085.538] SetFilePointerEx (in: hFile=0x2010, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.538] ReadFile (in: hFile=0x2010, lpBuffer=0xe34bb98, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x25d7f838, lpOverlapped=0x0 | out: lpBuffer=0xe34bb98*, lpNumberOfBytesRead=0x25d7f838*=0xc800, lpOverlapped=0x0) returned 1 [0085.550] SetFilePointerEx (in: hFile=0x2010, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.550] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba88d0 [0085.550] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x7574d58 [0085.550] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe2fd148 [0085.550] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe2fd148) returned 1 [0085.551] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe3713b0 [0085.556] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe2fd558 [0085.556] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe2fd418 [0085.556] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe2fd418) returned 1 [0085.557] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7574d58) returned 1 [0085.557] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba88d0) returned 1 [0085.557] WriteFile (in: hFile=0x2010, lpBuffer=0xe3713b0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x25d7f838, lpOverlapped=0x0 | out: lpBuffer=0xe3713b0*, lpNumberOfBytesWritten=0x25d7f838*=0xc800, lpOverlapped=0x0) returned 1 [0089.267] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe3713b0) returned 1 [0091.693] SetFilePointerEx (in: hFile=0x2010, liDistanceToMove=0x4b000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.693] ReadFile (in: hFile=0x2010, lpBuffer=0xe34bb98, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x25d7f838, lpOverlapped=0x0 | out: lpBuffer=0xe34bb98*, lpNumberOfBytesRead=0x25d7f838*=0xc800, lpOverlapped=0x0) returned 1 [0091.695] SetFilePointerEx (in: hFile=0x2010, liDistanceToMove=0x4b000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.695] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8f48 [0091.695] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x74af208 [0091.695] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09a2a8 [0091.695] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09a2a8) returned 1 [0091.696] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe450c90 [0091.702] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09a5c8 [0091.702] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09a370 [0091.702] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09a370) returned 1 [0091.702] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74af208) returned 1 [0091.702] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8f48) returned 1 [0091.702] WriteFile (in: hFile=0x2010, lpBuffer=0xe450c90*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x25d7f838, lpOverlapped=0x0 | out: lpBuffer=0xe450c90*, lpNumberOfBytesWritten=0x25d7f838*=0xc800, lpOverlapped=0x0) returned 1 [0091.704] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe450c90) returned 1 [0091.704] SetFilePointerEx (in: hFile=0x2010, liDistanceToMove=0x7c5c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.704] ReadFile (in: hFile=0x2010, lpBuffer=0xe34bb98, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x25d7f838, lpOverlapped=0x0 | out: lpBuffer=0xe34bb98*, lpNumberOfBytesRead=0x25d7f838*=0xc800, lpOverlapped=0x0) returned 1 [0091.705] SetFilePointerEx (in: hFile=0x2010, liDistanceToMove=0x7c5c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.705] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8ac8 [0091.706] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x74af6b8 [0091.706] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09a4d8 [0091.706] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09a4d8) returned 1 [0091.706] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe450c90 [0091.707] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09a190 [0091.707] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09a4d8 [0091.707] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09a4d8) returned 1 [0091.707] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74af6b8) returned 1 [0091.707] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8ac8) returned 1 [0091.707] WriteFile (hFile=0x2010, lpBuffer=0xe450c90, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x25d7f838, lpOverlapped=0x0) Thread: id = 1045 os_tid = 0x1e98 [0083.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 0x20 [0085.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar", dwFileAttributes=0x20) returned 1 [0085.526] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x7c8 [0085.526] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0x25dffda4 | out: lpFileSize=0x25dffda4*=33932) returned 1 [0085.526] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x8488, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.526] ReadFile (in: hFile=0x7c8, lpBuffer=0x25dffd28, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25dffd24, lpOverlapped=0x0 | out: lpBuffer=0x25dffd28*, lpNumberOfBytesRead=0x25dffd24*=0x4, lpOverlapped=0x0) returned 1 [0085.539] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.539] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe2fd3a0 [0085.539] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe2fd328 [0085.539] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe2fd440 [0085.539] NtQuerySystemTime (in: CurrentTime=0x25dffd04 | out: CurrentTime=0x25dffd04*=132260136427049803) returned 0x0 [0085.539] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0xf53db32c [0085.539] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0x362649b5 [0085.539] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0x8f442894 [0085.539] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0x5363c30d [0085.539] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0x3f36767d [0085.539] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0xefeb3694 [0085.539] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0xf327a346 [0085.539] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0x66940df1 [0085.539] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0x1f0602d2 [0085.539] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0x239fb922 [0085.539] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0x839dfe89 [0085.539] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0x3a82f5da [0085.539] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0xdd1b7f8a [0085.539] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0xd218627 [0085.539] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0x428fc84b [0085.539] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0xaab5c92e [0085.539] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0xfffa7d6c [0085.539] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0xb1a1db6c [0085.539] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0x7ec5be3d [0085.539] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0xfa1ef0be [0085.539] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0x3425cdf1 [0085.539] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0x642db6be [0085.540] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0xf3a89bc8 [0085.540] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0x32c6bc4d [0085.540] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0x25bda8a0 [0085.540] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0x2c508d3d [0085.540] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0x257f97de [0085.540] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0x2cd58ef2 [0085.540] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0x3a0ccb36 [0085.540] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0x16756173 [0085.540] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0x61dc16ba [0085.540] RtlRandom (in: Seed=0x25dffd10 | out: Seed=0x25dffd10) returned 0xae77d0fd [0085.549] ReadFile (in: hFile=0x7c8, lpBuffer=0xe3583a0, nNumberOfBytesToRead=0x848c, lpNumberOfBytesRead=0x25dffd00, lpOverlapped=0x0 | out: lpBuffer=0xe3583a0*, lpNumberOfBytesRead=0x25dffd00*=0x848c, lpOverlapped=0x0) returned 1 [0085.558] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.558] WriteFile (in: hFile=0x7c8, lpBuffer=0xe364ba8*, nNumberOfBytesToWrite=0x848c, lpNumberOfBytesWritten=0x25dffcfc, lpOverlapped=0x0 | out: lpBuffer=0xe364ba8*, lpNumberOfBytesWritten=0x25dffcfc*=0x848c, lpOverlapped=0x0) returned 1 [0089.268] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282d48 [0089.268] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282d98 [0089.268] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282d98) returned 1 [0089.268] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe364ba8) returned 1 [0091.692] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe3583a0) returned 1 [0091.692] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7574ce0) returned 1 [0091.692] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8f48) returned 1 [0091.692] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x21) returned 0x3891bb0 [0091.692] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.692] WriteFile (hFile=0x7c8, lpBuffer=0x74e2ff8, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x25dffd64, lpOverlapped=0x0) Thread: id = 1046 os_tid = 0x1e9c [0083.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 0x20 [0083.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar", dwFileAttributes=0x20) returned 1 [0083.022] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2014 [0083.022] GetFileSizeEx (in: hFile=0x2014, lpFileSize=0x25e7fb6c | out: lpFileSize=0x25e7fb6c*=584576) returned 1 [0083.022] SetFilePointerEx (in: hFile=0x2014, liDistanceToMove=0x8eb7c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.022] ReadFile (in: hFile=0x2014, lpBuffer=0x25e7faf0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25e7faec, lpOverlapped=0x0 | out: lpBuffer=0x25e7faf0*, lpNumberOfBytesRead=0x25e7faec*=0x4, lpOverlapped=0x0) returned 1 [0083.023] SetFilePointerEx (in: hFile=0x2014, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.024] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe3325b8 [0085.507] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe332a68 [0085.507] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe332838 [0085.507] NtQuerySystemTime (in: CurrentTime=0x25e7facc | out: CurrentTime=0x25e7facc*=132260136426580241) returned 0x0 [0085.507] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0xe42b7810 [0085.507] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0x485d879f [0085.507] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0x835976f6 [0085.507] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0x30b43a81 [0085.507] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0xeea7ce94 [0085.507] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0xef3a23c4 [0085.507] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0xa5ed6b63 [0085.507] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0xc2d72624 [0085.507] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0xba4c2769 [0085.507] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0x5856325d [0085.507] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0x8f2ffcc [0085.507] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0xf86dfec6 [0085.507] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0xcea46c76 [0085.507] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0x6d2c6ce1 [0085.507] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0xdaa75f54 [0085.507] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0x8a0f9ca7 [0085.507] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0x4389b77 [0085.507] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0x126be35 [0085.507] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0x1e42a206 [0085.507] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0x5aadc700 [0085.508] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0xdb400ede [0085.508] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0xf481e6c1 [0085.508] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0x28b16535 [0085.508] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0xc748ac18 [0085.508] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0xb877f862 [0085.508] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0x6dcf9ae4 [0085.508] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0x52b035c2 [0085.508] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0xc5178e60 [0085.508] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0x83de65c6 [0085.508] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0xee083d13 [0085.508] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0x9dad10bc [0085.508] RtlRandom (in: Seed=0x25e7fad8 | out: Seed=0x25e7fad8) returned 0xf5a2d7f [0085.517] SetFilePointerEx (in: hFile=0x2014, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.517] ReadFile (in: hFile=0x2014, lpBuffer=0xe332b88, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x25e7fa84, lpOverlapped=0x0 | out: lpBuffer=0xe332b88*, lpNumberOfBytesRead=0x25e7fa84*=0xc800, lpOverlapped=0x0) returned 1 [0085.519] SetFilePointerEx (in: hFile=0x2014, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.519] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8f48 [0085.519] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x7566450 [0085.519] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe332680 [0085.519] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe332680) returned 1 [0085.520] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe33f390 [0085.525] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe332a90 [0085.525] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe332950 [0085.525] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe332950) returned 1 [0085.525] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7566450) returned 1 [0085.525] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8f48) returned 1 [0085.525] WriteFile (in: hFile=0x2014, lpBuffer=0xe33f390*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x25e7fa84, lpOverlapped=0x0 | out: lpBuffer=0xe33f390*, lpNumberOfBytesWritten=0x25e7fa84*=0xc800, lpOverlapped=0x0) returned 1 [0089.042] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe33f390) returned 1 [0089.048] SetFilePointerEx (in: hFile=0x2014, liDistanceToMove=0x4b000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.048] ReadFile (in: hFile=0x2014, lpBuffer=0xe332b88, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x25e7fa84, lpOverlapped=0x0 | out: lpBuffer=0xe332b88*, lpNumberOfBytesRead=0x25e7fa84*=0xc800, lpOverlapped=0x0) returned 1 [0089.094] SetFilePointerEx (in: hFile=0x2014, liDistanceToMove=0x4b000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.094] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x537bab8 [0089.094] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x74b0558 [0089.094] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282a00 [0089.094] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282a00) returned 1 [0089.095] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe223298 [0089.101] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282898 [0089.101] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282c30 [0089.101] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282c30) returned 1 [0089.101] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b0558) returned 1 [0089.101] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537bab8) returned 1 [0089.101] WriteFile (in: hFile=0x2014, lpBuffer=0xe223298*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x25e7fa84, lpOverlapped=0x0 | out: lpBuffer=0xe223298*, lpNumberOfBytesWritten=0x25e7fa84*=0xc800, lpOverlapped=0x0) returned 1 [0089.103] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe223298) returned 1 [0089.103] SetFilePointerEx (in: hFile=0x2014, liDistanceToMove=0x82380, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.103] ReadFile (in: hFile=0x2014, lpBuffer=0xe332b88, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x25e7fa84, lpOverlapped=0x0 | out: lpBuffer=0xe332b88*, lpNumberOfBytesRead=0x25e7fa84*=0xc800, lpOverlapped=0x0) returned 1 [0089.106] SetFilePointerEx (in: hFile=0x2014, liDistanceToMove=0x82380, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.106] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x537bef0 [0089.106] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x74b0738 [0089.106] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282d70 [0089.106] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282d70) returned 1 [0089.107] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x74a00d8 [0089.108] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282f00 [0089.108] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282d70 [0089.108] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282d70) returned 1 [0089.108] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b0738) returned 1 [0089.108] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537bef0) returned 1 [0089.108] WriteFile (in: hFile=0x2014, lpBuffer=0x74a00d8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x25e7fa84, lpOverlapped=0x0 | out: lpBuffer=0x74a00d8*, lpNumberOfBytesWritten=0x25e7fa84*=0xc800, lpOverlapped=0x0) returned 1 [0089.505] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74a00d8) returned 1 [0091.507] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0xe53a610 [0091.507] SetFilePointerEx (in: hFile=0x2014, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.507] WriteFile (hFile=0x2014, lpBuffer=0xe538838, nNumberOfBytesToWrite=0x141, lpNumberOfBytesWritten=0x25e7fb2c, lpOverlapped=0x0) Thread: id = 1047 os_tid = 0x1ea0 [0083.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 0x20 [0083.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt", dwFileAttributes=0x20) returned 1 [0083.025] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2018 [0083.025] GetFileSizeEx (in: hFile=0x2018, lpFileSize=0x25effce4 | out: lpFileSize=0x25effce4*=4226) returned 1 [0083.025] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0x107e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.025] ReadFile (in: hFile=0x2018, lpBuffer=0x25effc68, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25effc64, lpOverlapped=0x0 | out: lpBuffer=0x25effc68*, lpNumberOfBytesRead=0x25effc64*=0x4, lpOverlapped=0x0) returned 1 [0083.026] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.026] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe3183c0 [0085.496] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe318320 [0085.496] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe3180f0 [0085.496] NtQuerySystemTime (in: CurrentTime=0x25effc44 | out: CurrentTime=0x25effc44*=132260136426580241) returned 0x0 [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0x82ccaf2b [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0xfe2c4317 [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0xd1f525ca [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0x8131607a [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0xbf98bc58 [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0x93c1e825 [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0x69284e18 [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0x77d852d7 [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0x661f8eae [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0xe4473629 [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0x2ae704a3 [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0x91ead68a [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0x8ec168cf [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0x4c3279e2 [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0x8e3783d6 [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0xf399a0aa [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0x308443a5 [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0x5e7b70c0 [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0x8ec5404e [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0xcb533611 [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0xd1558a4d [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0x1a855299 [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0x2be3a105 [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0xff9c0a67 [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0x4f3be185 [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0x81680d0c [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0x4b53c4b6 [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0x243c3638 [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0x23a7c398 [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0x6f690b18 [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0x48dd86e5 [0085.496] RtlRandom (in: Seed=0x25effc50 | out: Seed=0x25effc50) returned 0xcec6267d [0085.506] ReadFile (in: hFile=0x2018, lpBuffer=0xe318b70, nNumberOfBytesToRead=0x1082, lpNumberOfBytesRead=0x25effc40, lpOverlapped=0x0 | out: lpBuffer=0xe318b70*, lpNumberOfBytesRead=0x25effc40*=0x1082, lpOverlapped=0x0) returned 1 [0085.518] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.518] WriteFile (in: hFile=0x2018, lpBuffer=0xe325378*, nNumberOfBytesToWrite=0x1082, lpNumberOfBytesWritten=0x25effc3c, lpOverlapped=0x0 | out: lpBuffer=0xe325378*, lpNumberOfBytesWritten=0x25effc3c*=0x1082, lpOverlapped=0x0) returned 1 [0089.042] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282cd0 [0089.042] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282898 [0089.042] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282898) returned 1 [0089.042] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe325378) returned 1 [0089.048] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe318b70) returned 1 [0089.048] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75663d8) returned 1 [0089.048] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba87f8) returned 1 [0089.048] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x27) returned 0x38a6730 [0089.048] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.048] WriteFile (in: hFile=0x2018, lpBuffer=0x757a150*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x25effca4, lpOverlapped=0x0 | out: lpBuffer=0x757a150*, lpNumberOfBytesWritten=0x25effca4*=0x10b, lpOverlapped=0x0) returned 1 [0092.154] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757a150) returned 1 [0092.154] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6640) returned 1 [0092.154] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282af0) returned 1 [0092.154] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6730) returned 1 [0092.154] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282cd0) returned 1 [0092.154] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe318320) returned 1 [0092.154] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe318460) returned 1 [0092.154] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe318208) Thread: id = 1048 os_tid = 0x1ea4 [0083.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 0x20 [0083.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties", dwFileAttributes=0x20) returned 1 [0083.027] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x201c [0083.027] GetFileSizeEx (in: hFile=0x201c, lpFileSize=0x25f7fab8 | out: lpFileSize=0x25f7fab8*=2455) returned 1 [0083.027] SetFilePointerEx (in: hFile=0x201c, liDistanceToMove=0x993, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.027] ReadFile (in: hFile=0x201c, lpBuffer=0x25f7fa3c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25f7fa38, lpOverlapped=0x0 | out: lpBuffer=0x25f7fa3c*, lpNumberOfBytesRead=0x25f7fa38*=0x4, lpOverlapped=0x0) returned 1 [0083.029] SetFilePointerEx (in: hFile=0x201c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.029] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe2fe830 [0085.484] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe2fe740 [0085.484] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe2fe808 [0085.484] NtQuerySystemTime (in: CurrentTime=0x25f7fa18 | out: CurrentTime=0x25f7fa18*=132260136426424089) returned 0x0 [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0x53bf411b [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0x79c7d1be [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0xad5e2567 [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0x193b0afd [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0x8be053cc [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0xa8e08731 [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0xbf529137 [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0x464ee3d4 [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0x9ed55118 [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0x16196f2a [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0x5a596b43 [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0x114e3800 [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0x95504ef [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0xb63d9dae [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0xff755245 [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0x51941902 [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0x51de677a [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0x46c6b1ab [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0x4942a7a4 [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0x653a2026 [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0x6682fdb8 [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0xcedd9334 [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0x29f99f3c [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0xb689a313 [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0x6df0341 [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0x846d0169 [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0x937bc4e0 [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0x225ce45b [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0x529e22e8 [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0xad1689a5 [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0xdd6a7d57 [0085.484] RtlRandom (in: Seed=0x25f7fa24 | out: Seed=0x25f7fa24) returned 0x52396935 [0085.495] ReadFile (in: hFile=0x201c, lpBuffer=0xe2feb58, nNumberOfBytesToRead=0x997, lpNumberOfBytesRead=0x25f7fa14, lpOverlapped=0x0 | out: lpBuffer=0xe2feb58*, lpNumberOfBytesRead=0x25f7fa14*=0x997, lpOverlapped=0x0) returned 1 [0085.495] SetFilePointerEx (in: hFile=0x201c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.495] WriteFile (in: hFile=0x201c, lpBuffer=0xe30b360*, nNumberOfBytesToWrite=0x997, lpNumberOfBytesWritten=0x25f7fa10, lpOverlapped=0x0 | out: lpBuffer=0xe30b360*, lpNumberOfBytesWritten=0x25f7fa10*=0x997, lpOverlapped=0x0) returned 1 [0089.046] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282820 [0089.046] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282898 [0089.046] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282898) returned 1 [0089.046] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe30b360) returned 1 [0089.046] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe2feb58) returned 1 [0089.046] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7566360) returned 1 [0089.046] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba87b0) returned 1 [0089.046] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x31) returned 0x7567f88 [0089.046] SetFilePointerEx (in: hFile=0x201c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.046] WriteFile (in: hFile=0x201c, lpBuffer=0x74d9a78*, nNumberOfBytesToWrite=0x115, lpNumberOfBytesWritten=0x25f7fa78, lpOverlapped=0x0 | out: lpBuffer=0x74d9a78*, lpNumberOfBytesWritten=0x25f7fa78*=0x115, lpOverlapped=0x0) returned 1 [0092.146] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74d9a78) returned 1 [0092.146] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445240) returned 1 [0092.146] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282a50) returned 1 [0092.146] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7567f88) returned 1 [0092.146] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282820) returned 1 [0092.146] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe2fe740) returned 1 [0092.146] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe2fe880) returned 1 [0092.146] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe2fe6f0) returned 1 [0092.146] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb4) returned 0x5b160d0 [0092.146] wcscpy (in: _Dest=0x5b160d0, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" [0092.146] wcscat (in: _Dest=0x5b160d0, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.mailto[knoocknoo@cock.li].a0a70" [0092.146] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x25f7fa30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.146] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xca) returned 0x757fd60 Thread: id = 1049 os_tid = 0x1ea8 [0083.029] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x68) returned 0x5468780 [0083.029] wcscpy (in: _Dest=0x5468780, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management" [0083.029] wcscat (in: _Dest=0x5468780, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\" [0083.029] wcscat (in: _Dest=0x5468780, _Source="*" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\*") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\*" [0083.029] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x39375d8 [0083.029] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\*", lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1389711, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389eb80 [0085.483] wcscmp (_String1=".", _String2=".") returned 0 [0085.483] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1389711, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.483] wcscmp (_String1="..", _String2=".") returned 1 [0085.483] wcscmp (_String1="..", _String2="..") returned 0 [0085.483] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="jmxremote.access", cAlternateFileName="JMXREM~1.ACC")) returned 1 [0085.483] wcscmp (_String1="jmxremote.access", _String2=".") returned 1 [0085.483] wcscmp (_String1="jmxremote.access", _String2="..") returned 1 [0085.483] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x86) returned 0x549d4d8 [0085.483] wcscpy (in: _Dest=0x549d4d8, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management" [0085.483] wcscat (in: _Dest=0x549d4d8, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\" [0085.483] wcscat (in: _Dest=0x549d4d8, _Source="jmxremote.access" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" [0088.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549d4d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x200c [0088.842] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb28, dwReserved0=0x0, dwReserved1=0x0, cFileName="jmxremote.password.template", cAlternateFileName="JMXREM~1.TEM")) returned 1 [0088.842] wcscmp (_String1="jmxremote.password.template", _String2=".") returned 1 [0088.842] wcscmp (_String1="jmxremote.password.template", _String2="..") returned 1 [0088.842] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9c) returned 0x54a2598 [0088.842] wcscpy (in: _Dest=0x54a2598, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management" [0088.842] wcscat (in: _Dest=0x54a2598, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\" [0088.842] wcscat (in: _Dest=0x54a2598, _Source="jmxremote.password.template" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" [0088.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54a2598, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17fc [0088.843] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3926, dwReserved0=0x0, dwReserved1=0x0, cFileName="management.properties", cAlternateFileName="MANAGE~1.PRO")) returned 1 [0088.843] wcscmp (_String1="management.properties", _String2=".") returned 1 [0088.843] wcscmp (_String1="management.properties", _String2="..") returned 1 [0088.843] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x90) returned 0x549fb58 [0088.843] wcscpy (in: _Dest=0x549fb58, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management" [0088.843] wcscat (in: _Dest=0x549fb58, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\" [0088.843] wcscat (in: _Dest=0x549fb58, _Source="management.properties" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" [0088.843] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549fb58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17f8 [0088.843] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xd30, dwReserved0=0x0, dwReserved1=0x0, cFileName="snmp.acl.template", cAlternateFileName="SNMPAC~1.TEM")) returned 1 [0088.843] wcscmp (_String1="snmp.acl.template", _String2=".") returned 1 [0088.843] wcscmp (_String1="snmp.acl.template", _String2="..") returned 1 [0088.843] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x88) returned 0x549ce18 [0088.844] wcscpy (in: _Dest=0x549ce18, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management" [0088.844] wcscat (in: _Dest=0x549ce18, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\" [0088.844] wcscat (in: _Dest=0x549ce18, _Source="snmp.acl.template" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" [0088.844] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549ce18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17f4 [0088.844] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xd30, dwReserved0=0x0, dwReserved1=0x0, cFileName="snmp.acl.template", cAlternateFileName="SNMPAC~1.TEM")) returned 0 [0088.844] FindClose (in: hFindFile=0x389eb80 | out: hFindFile=0x389eb80) returned 1 [0088.845] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39375d8) returned 1 [0088.845] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5468780) returned 1 [0088.845] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396dab0) returned 1 Thread: id = 1050 os_tid = 0x1eac [0083.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 0x20 [0083.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar", dwFileAttributes=0x20) returned 1 [0083.031] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2020 [0083.031] GetFileSizeEx (in: hFile=0x2020, lpFileSize=0x2607fb80 | out: lpFileSize=0x2607fb80*=381) returned 1 [0083.031] SetFilePointerEx (in: hFile=0x2020, liDistanceToMove=0x179, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.031] ReadFile (in: hFile=0x2020, lpBuffer=0x2607fb04, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2607fb00, lpOverlapped=0x0 | out: lpBuffer=0x2607fb04*, lpNumberOfBytesRead=0x2607fb00*=0x4, lpOverlapped=0x0) returned 1 [0083.032] SetFilePointerEx (in: hFile=0x2020, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.032] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe2976c0 [0085.458] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe2977b0 [0085.458] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe2978f0 [0085.458] NtQuerySystemTime (in: CurrentTime=0x2607fae0 | out: CurrentTime=0x2607fae0*=132260136426111375) returned 0x0 [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0xb7ffaede [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0x4f6af46c [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0xaab307fc [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0xe1874851 [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0x1e32cd2e [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0x1a33a9a0 [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0x2aee864 [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0x6091a8e [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0x795a8c7a [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0x74b2442a [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0x937c0c9a [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0x7ad75941 [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0x6f981d95 [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0x62dc72d [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0x37b24349 [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0xc0e9fd1a [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0xe348a7d0 [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0x2de467ad [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0xc36621f0 [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0x1a6473c4 [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0xa019f272 [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0x194b783c [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0x6366b9b8 [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0xc2b0d208 [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0x4e90bf2a [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0xe099b838 [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0xfde22a12 [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0xa4d036ac [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0xa7bd7a96 [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0xb01823b0 [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0x2deb4252 [0085.459] RtlRandom (in: Seed=0x2607faec | out: Seed=0x2607faec) returned 0x9c31be93 [0085.469] ReadFile (in: hFile=0x2020, lpBuffer=0xe2cab28, nNumberOfBytesToRead=0x17d, lpNumberOfBytesRead=0x2607fadc, lpOverlapped=0x0 | out: lpBuffer=0xe2cab28*, lpNumberOfBytesRead=0x2607fadc*=0x17d, lpOverlapped=0x0) returned 1 [0085.469] SetFilePointerEx (in: hFile=0x2020, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.470] WriteFile (in: hFile=0x2020, lpBuffer=0xe2d7330*, nNumberOfBytesToWrite=0x17d, lpNumberOfBytesWritten=0x2607fad8, lpOverlapped=0x0 | out: lpBuffer=0xe2d7330*, lpNumberOfBytesWritten=0x2607fad8*=0x17d, lpOverlapped=0x0) returned 1 [0089.010] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7280ec8 [0089.010] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281058 [0089.010] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7281058) returned 1 [0089.010] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe2d7330) returned 1 [0089.049] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe2cab28) returned 1 [0089.049] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7574bf0) returned 1 [0089.049] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba86d8) returned 1 [0089.049] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x35) returned 0x5444c40 [0089.049] SetFilePointerEx (in: hFile=0x2020, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.050] WriteFile (in: hFile=0x2020, lpBuffer=0x74d9cc8*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x2607fb40, lpOverlapped=0x0 | out: lpBuffer=0x74d9cc8*, lpNumberOfBytesWritten=0x2607fb40*=0x119, lpOverlapped=0x0) returned 1 [0092.158] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74d9cc8) returned 1 [0092.158] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444ac0) returned 1 [0092.158] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282b18) returned 1 [0092.158] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444c40) returned 1 [0092.158] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7280ec8) returned 1 [0092.158] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe2977b0) returned 1 [0092.158] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe297558) returned 1 [0092.158] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe297698) Thread: id = 1051 os_tid = 0x1eb0 [0083.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 0x20 [0085.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index", dwFileAttributes=0x20) returned 1 [0085.457] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x924 [0085.457] GetFileSizeEx (in: hFile=0x924, lpFileSize=0x260ffa70 | out: lpFileSize=0x260ffa70*=2126) returned 1 [0085.457] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x84a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.457] ReadFile (in: hFile=0x924, lpBuffer=0x260ff9f4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x260ff9f0, lpOverlapped=0x0 | out: lpBuffer=0x260ff9f4*, lpNumberOfBytesRead=0x260ff9f0*=0x4, lpOverlapped=0x0) returned 1 [0085.470] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.470] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe2976c0 [0085.470] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe2977d8 [0085.470] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe2978f0 [0085.470] NtQuerySystemTime (in: CurrentTime=0x260ff9d0 | out: CurrentTime=0x260ff9d0*=132260136426267815) returned 0x0 [0085.470] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0x418a72bd [0085.470] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0x4ce8fc82 [0085.470] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0x9c90bd49 [0085.470] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0xa039934b [0085.470] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0xd5f762fd [0085.470] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0x40d61337 [0085.470] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0x4534b9f [0085.470] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0x7a94a194 [0085.470] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0xf0310fe7 [0085.470] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0x5efd886a [0085.470] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0x30f2f3fc [0085.470] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0xc533be9e [0085.470] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0xa9e6147d [0085.470] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0xb11e048d [0085.470] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0x577c6c1c [0085.470] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0xc28267b6 [0085.470] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0x9a858613 [0085.470] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0xf9c77898 [0085.470] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0xbadb6371 [0085.470] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0xd4ea8fe4 [0085.470] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0xd3211c97 [0085.470] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0xc067cd6c [0085.470] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0x994e5fac [0085.470] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0x1e61b137 [0085.470] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0x51d47231 [0085.470] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0xf743d588 [0085.470] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0xcd164324 [0085.470] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0x5f9562bc [0085.471] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0xb80756ef [0085.471] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0x1d3f6cad [0085.471] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0x3cfd5b15 [0085.471] RtlRandom (in: Seed=0x260ff9dc | out: Seed=0x260ff9dc) returned 0x52a5877b [0085.481] ReadFile (in: hFile=0x924, lpBuffer=0xe2e3b38, nNumberOfBytesToRead=0x84e, lpNumberOfBytesRead=0x260ff9cc, lpOverlapped=0x0 | out: lpBuffer=0xe2e3b38*, lpNumberOfBytesRead=0x260ff9cc*=0x84e, lpOverlapped=0x0) returned 1 [0085.481] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.481] WriteFile (in: hFile=0x924, lpBuffer=0xe2f0340*, nNumberOfBytesToWrite=0x84e, lpNumberOfBytesWritten=0x260ff9c8, lpOverlapped=0x0 | out: lpBuffer=0xe2f0340*, lpNumberOfBytesWritten=0x260ff9c8*=0x84e, lpOverlapped=0x0) returned 1 [0089.042] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72827f8 [0089.042] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282898 [0089.042] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282898) returned 1 [0089.042] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe2f0340) returned 1 [0089.048] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe2e3b38) returned 1 [0089.048] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7574c68) returned 1 [0089.048] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8720) returned 1 [0089.048] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x21) returned 0x38a6700 [0089.048] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.048] WriteFile (in: hFile=0x924, lpBuffer=0x757a038*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x260ffa30, lpOverlapped=0x0 | out: lpBuffer=0x757a038*, lpNumberOfBytesWritten=0x260ffa30*=0x105, lpOverlapped=0x0) returned 1 [0092.152] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757a038) returned 1 [0092.152] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6be0) returned 1 [0092.152] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282ac8) returned 1 [0092.152] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6700) returned 1 [0092.152] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x72827f8) returned 1 [0092.152] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe2977d8) returned 1 [0092.152] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe297580) returned 1 [0092.152] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe2976e8) returned 1 [0092.152] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa4) returned 0x388e1d0 [0092.152] wcscpy (in: _Dest=0x388e1d0, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" [0092.152] wcscat (in: _Dest=0x388e1d0, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.mailto[knoocknoo@cock.li].a0a70" [0092.152] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x260ff9e8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.152] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x53e85a8 Thread: id = 1052 os_tid = 0x1eb4 [0083.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 0x20 [0083.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties", dwFileAttributes=0x20) returned 1 [0083.034] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2024 [0083.034] GetFileSizeEx (in: hFile=0x2024, lpFileSize=0x2617f9f0 | out: lpFileSize=0x2617f9f0*=4464) returned 1 [0083.034] SetFilePointerEx (in: hFile=0x2024, liDistanceToMove=0x116c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.034] ReadFile (in: hFile=0x2024, lpBuffer=0x2617f974, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2617f970, lpOverlapped=0x0 | out: lpBuffer=0x2617f974*, lpNumberOfBytesRead=0x2617f970*=0x4, lpOverlapped=0x0) returned 1 [0083.037] SetFilePointerEx (in: hFile=0x2024, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.037] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe297b60 [0085.418] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe297cf0 [0085.418] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe298010 [0085.418] NtQuerySystemTime (in: CurrentTime=0x2617f950 | out: CurrentTime=0x2617f950*=132260136425799579) returned 0x0 [0085.418] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0x333f8fc5 [0085.418] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0x7513794c [0085.418] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0xf0308e23 [0085.418] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0x373d4f92 [0085.418] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0x56fc4c04 [0085.418] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0x6a9b24ca [0085.418] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0x7fca1199 [0085.418] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0x321dbb73 [0085.418] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0x1043e2d3 [0085.418] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0x808c5edb [0085.418] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0x1b0d3c5a [0085.418] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0xa608fe73 [0085.418] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0xedaf2b63 [0085.418] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0x89e40c00 [0085.418] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0xdd3ad24d [0085.418] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0xc0205c31 [0085.419] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0x380760f4 [0085.419] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0x2dc1ee2f [0085.419] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0xe345715d [0085.419] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0x7d2bfb44 [0085.419] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0x609e3ead [0085.419] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0xb2e0dfe5 [0085.419] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0xd62d441c [0085.419] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0x67892fc0 [0085.419] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0xa36700a5 [0085.419] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0xd9c26676 [0085.419] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0x8765b3a9 [0085.419] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0x4fd2f406 [0085.419] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0xcb222e9e [0085.419] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0x251fa3b7 [0085.419] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0x5faa71ff [0085.419] RtlRandom (in: Seed=0x2617f95c | out: Seed=0x2617f95c) returned 0xfb492f69 [0085.429] ReadFile (in: hFile=0x2024, lpBuffer=0xe298b08, nNumberOfBytesToRead=0x1170, lpNumberOfBytesRead=0x2617f94c, lpOverlapped=0x0 | out: lpBuffer=0xe298b08*, lpNumberOfBytesRead=0x2617f94c*=0x1170, lpOverlapped=0x0) returned 1 [0085.450] SetFilePointerEx (in: hFile=0x2024, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.450] WriteFile (in: hFile=0x2024, lpBuffer=0xe2a5310*, nNumberOfBytesToWrite=0x1170, lpNumberOfBytesWritten=0x2617f948, lpOverlapped=0x0 | out: lpBuffer=0xe2a5310*, lpNumberOfBytesWritten=0x2617f948*=0x1170, lpOverlapped=0x0) returned 1 [0089.047] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282848 [0089.047] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282898 [0089.047] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282898) returned 1 [0089.047] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe2a5310) returned 1 [0089.047] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe298b08) returned 1 [0089.047] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7574b78) returned 1 [0089.047] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8690) returned 1 [0089.047] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x29) returned 0x54b85f8 [0089.047] SetFilePointerEx (in: hFile=0x2024, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.047] WriteFile (in: hFile=0x2024, lpBuffer=0x7579f20*, nNumberOfBytesToWrite=0x10d, lpNumberOfBytesWritten=0x2617f9b0, lpOverlapped=0x0 | out: lpBuffer=0x7579f20*, lpNumberOfBytesWritten=0x2617f9b0*=0x10d, lpOverlapped=0x0) returned 1 [0092.159] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7579f20) returned 1 [0092.159] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b8780) returned 1 [0092.159] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282a78) returned 1 [0092.159] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b85f8) returned 1 [0092.159] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282848) returned 1 [0092.159] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe297cf0) returned 1 [0092.160] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe297c78) returned 1 [0092.160] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe297ca0) returned 1 [0092.160] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xac) returned 0x5445e60 [0092.160] wcscpy (in: _Dest=0x5445e60, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" [0092.160] wcscat (in: _Dest=0x5445e60, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.mailto[knoocknoo@cock.li].a0a70" [0092.160] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x2617f968, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.160] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x53f7bc0 Thread: id = 1053 os_tid = 0x1eb8 [0083.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar")) returned 0x20 [0085.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar", dwFileAttributes=0x20) returned 1 [0085.416] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x950 [0085.417] GetFileSizeEx (in: hFile=0x950, lpFileSize=0x261ff848 | out: lpFileSize=0x261ff848*=1923211) returned 1 [0085.417] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x1d5887, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.417] ReadFile (in: hFile=0x950, lpBuffer=0x261ff7cc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x261ff7c8, lpOverlapped=0x0 | out: lpBuffer=0x261ff7cc*, lpNumberOfBytesRead=0x261ff7c8*=0x4, lpOverlapped=0x0) returned 1 [0085.437] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.437] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe297b60 [0085.438] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe297d18 [0085.438] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe298010 [0085.438] NtQuerySystemTime (in: CurrentTime=0x261ff7a8 | out: CurrentTime=0x261ff7a8*=132260136426032113) returned 0x0 [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0x1b6d5f17 [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0xe2ba1e4f [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0xb5b60d02 [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0x11238230 [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0x15b41668 [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0x3739c266 [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0x2c4c3704 [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0x28ead13d [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0x85851719 [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0x3268fc02 [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0x24282aca [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0xccd4ab5 [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0x21022b51 [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0x9a7afc26 [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0x279f3c8b [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0xea4816b1 [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0x9dc44bf6 [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0x7d19af31 [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0xd39b1658 [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0x9c67192e [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0xb22ef7cd [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0xc694ac3 [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0xd34e7631 [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0x409f1c5a [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0x7ebfd1cb [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0x5e28c073 [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0xeba6a0e [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0xcdb64103 [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0x929348ab [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0x936c6d65 [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0x4d34f58a [0085.438] RtlRandom (in: Seed=0x261ff7b4 | out: Seed=0x261ff7b4) returned 0xb67a421b [0085.448] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.448] ReadFile (in: hFile=0x950, lpBuffer=0xe2b1b18, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x261ff760, lpOverlapped=0x0 | out: lpBuffer=0xe2b1b18*, lpNumberOfBytesRead=0x261ff760*=0xc800, lpOverlapped=0x0) returned 1 [0085.450] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.450] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba86d8 [0085.450] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x7574bf0 [0085.450] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe297c00 [0085.450] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe297c00) returned 1 [0085.451] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe2be320 [0085.456] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe298010 [0085.456] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe297ed0 [0085.456] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe297ed0) returned 1 [0085.456] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7574bf0) returned 1 [0085.456] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba86d8) returned 1 [0085.456] WriteFile (in: hFile=0x950, lpBuffer=0xe2be320*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x261ff760, lpOverlapped=0x0 | out: lpBuffer=0xe2be320*, lpNumberOfBytesWritten=0x261ff760*=0xc800, lpOverlapped=0x0) returned 1 [0089.506] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe2be320) returned 1 [0091.491] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0xed800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.491] ReadFile (in: hFile=0x950, lpBuffer=0xe2b1b18, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x261ff760, lpOverlapped=0x0 | out: lpBuffer=0xe2b1b18*, lpNumberOfBytesRead=0x261ff760*=0xc800, lpOverlapped=0x0) returned 1 [0091.493] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0xed800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.493] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8ac8 [0091.493] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0xe4d0608 [0091.493] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09aeb0 [0091.493] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09aeb0) returned 1 [0091.494] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe3a63e8 [0091.495] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09ade8 [0091.495] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09ad48 [0091.495] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09ad48) returned 1 [0091.495] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4d0608) returned 1 [0091.495] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8ac8) returned 1 [0091.495] WriteFile (in: hFile=0x950, lpBuffer=0xe3a63e8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x261ff760, lpOverlapped=0x0 | out: lpBuffer=0xe3a63e8*, lpNumberOfBytesWritten=0x261ff760*=0xc800, lpOverlapped=0x0) returned 1 [0091.498] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe3a63e8) returned 1 [0091.498] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x1c908b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.498] ReadFile (in: hFile=0x950, lpBuffer=0xe2b1b18, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x261ff760, lpOverlapped=0x0 | out: lpBuffer=0xe2b1b18*, lpNumberOfBytesRead=0x261ff760*=0xc800, lpOverlapped=0x0) returned 1 [0091.500] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x1c908b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.500] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8ac8 [0091.500] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0xe4cfd98 [0091.500] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09ae88 [0091.500] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09ae88) returned 1 [0091.501] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe2702d8 [0091.502] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09aed8 [0091.502] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09ac80 [0091.502] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09ac80) returned 1 [0091.502] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4cfd98) returned 1 [0091.502] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8ac8) returned 1 [0091.502] WriteFile (in: hFile=0x950, lpBuffer=0xe2702d8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x261ff760, lpOverlapped=0x0 | out: lpBuffer=0xe2702d8*, lpNumberOfBytesWritten=0x261ff760*=0xc800, lpOverlapped=0x0) returned 1 [0091.506] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe2702d8) returned 1 [0091.506] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0xe53a408 [0091.506] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.506] WriteFile (hFile=0x950, lpBuffer=0xe5386e0, nNumberOfBytesToWrite=0x145, lpNumberOfBytesWritten=0x261ff808, lpOverlapped=0x0) Thread: id = 1054 os_tid = 0x1ebc [0083.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 0x20 [0083.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja", dwFileAttributes=0x20) returned 1 [0083.040] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2028 [0083.040] GetFileSizeEx (in: hFile=0x2028, lpFileSize=0x2627fa48 | out: lpFileSize=0x2627fa48*=2796) returned 1 [0083.040] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0xae8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.040] ReadFile (in: hFile=0x2028, lpBuffer=0x2627f9cc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2627f9c8, lpOverlapped=0x0 | out: lpBuffer=0x2627f9cc*, lpNumberOfBytesRead=0x2627f9c8*=0x4, lpOverlapped=0x0) returned 1 [0083.041] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.041] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe27d860 [0085.404] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe27d9a0 [0085.404] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe27d748 [0085.404] NtQuerySystemTime (in: CurrentTime=0x2627f9a8 | out: CurrentTime=0x2627f9a8*=132260136425642679) returned 0x0 [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0x47cbc442 [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0x7643ec30 [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0x870c27d4 [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0x2b254c7b [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0x49ab3955 [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0x72245323 [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0x607f270 [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0x283e5855 [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0x924baba [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0xed8f638f [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0xedddea4f [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0xb0c6bbc2 [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0x3d2a8173 [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0xc08257a0 [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0x5f5dd7d4 [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0x3c5a2e09 [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0xddb8315a [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0x1fdb36b6 [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0x77ee053e [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0x8b574f3 [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0x6bedcf1 [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0x81c20066 [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0xf353db84 [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0x5c980b88 [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0x3d86197f [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0xa5fa413 [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0xacd9d76b [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0x7f72053a [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0x6b628a78 [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0xd47a97dc [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0x2432d8da [0085.405] RtlRandom (in: Seed=0x2627f9b4 | out: Seed=0x2627f9b4) returned 0x67ee1476 [0085.415] ReadFile (in: hFile=0x2028, lpBuffer=0xe27dae8, nNumberOfBytesToRead=0xaec, lpNumberOfBytesRead=0x2627f9a4, lpOverlapped=0x0 | out: lpBuffer=0xe27dae8*, lpNumberOfBytesRead=0x2627f9a4*=0xaec, lpOverlapped=0x0) returned 1 [0085.416] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.416] WriteFile (in: hFile=0x2028, lpBuffer=0xe28a2f0*, nNumberOfBytesToWrite=0xaec, lpNumberOfBytesWritten=0x2627f9a0, lpOverlapped=0x0 | out: lpBuffer=0xe28a2f0*, lpNumberOfBytesWritten=0x2627f9a0*=0xaec, lpOverlapped=0x0) returned 1 [0089.047] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282870 [0089.047] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282898 [0089.047] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282898) returned 1 [0089.047] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe28a2f0) returned 1 [0089.047] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe27dae8) returned 1 [0089.047] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75662e8) returned 1 [0089.047] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8648) returned 1 [0089.047] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x35) returned 0x5444c00 [0089.047] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.047] WriteFile (in: hFile=0x2028, lpBuffer=0x74d9ba0*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x2627fa08, lpOverlapped=0x0 | out: lpBuffer=0x74d9ba0*, lpNumberOfBytesWritten=0x2627fa08*=0x119, lpOverlapped=0x0) returned 1 [0092.149] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74d9ba0) returned 1 [0092.149] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445280) returned 1 [0092.149] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282aa0) returned 1 [0092.149] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444c00) returned 1 [0092.149] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282870) returned 1 [0092.149] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe27d9a0) returned 1 [0092.150] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe27d590) returned 1 [0092.150] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe27d680) returned 1 [0092.150] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb8) returned 0x5b16790 [0092.150] wcscpy (in: _Dest=0x5b16790, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" [0092.150] wcscat (in: _Dest=0x5b16790, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.mailto[knoocknoo@cock.li].a0a70" [0092.150] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x2627f9c0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.150] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x757ffe8 Thread: id = 1055 os_tid = 0x1ec0 [0083.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 0x20 [0083.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties", dwFileAttributes=0x20) returned 1 [0083.042] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x202c [0083.042] GetFileSizeEx (in: hFile=0x202c, lpFileSize=0x262ff9f8 | out: lpFileSize=0x262ff9f8*=10393) returned 1 [0083.042] SetFilePointerEx (in: hFile=0x202c, liDistanceToMove=0x2895, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.042] ReadFile (in: hFile=0x202c, lpBuffer=0x262ff97c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x262ff978, lpOverlapped=0x0 | out: lpBuffer=0x262ff97c*, lpNumberOfBytesRead=0x262ff978*=0x4, lpOverlapped=0x0) returned 1 [0083.044] SetFilePointerEx (in: hFile=0x202c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.044] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74ac918 [0085.386] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74acbe8 [0085.386] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74ac940 [0085.386] NtQuerySystemTime (in: CurrentTime=0x262ff958 | out: CurrentTime=0x262ff958*=132260136425486829) returned 0x0 [0085.386] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0xef58d0a5 [0085.386] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0x7495efec [0085.386] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0x80e6af56 [0085.386] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0x86e69c26 [0085.386] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0x16ad7b0b [0085.386] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0xe35b1d86 [0085.386] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0x46e66ec5 [0085.386] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0x4d3c4601 [0085.386] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0x6c977115 [0085.386] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0x1a06bffc [0085.386] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0x30824bb7 [0085.386] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0x49d42eb9 [0085.386] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0x5bf12467 [0085.386] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0x825dd5e9 [0085.386] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0xe9e99db3 [0085.386] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0x2c9a5fa1 [0085.386] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0x13d693fd [0085.386] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0x6446933c [0085.386] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0xd0595615 [0085.386] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0x4a55257d [0085.386] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0x7228d05d [0085.386] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0x752a8a07 [0085.386] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0x3301fc36 [0085.386] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0x8d1acdfe [0085.386] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0xf639812f [0085.386] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0x26840c85 [0085.387] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0xd4973ee3 [0085.387] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0x974e3a99 [0085.387] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0x3c2ed28 [0085.387] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0xf769c289 [0085.387] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0xce75e914 [0085.387] RtlRandom (in: Seed=0x262ff964 | out: Seed=0x262ff964) returned 0xb9408210 [0085.397] ReadFile (in: hFile=0x202c, lpBuffer=0xe2572c8, nNumberOfBytesToRead=0x2899, lpNumberOfBytesRead=0x262ff954, lpOverlapped=0x0 | out: lpBuffer=0xe2572c8*, lpNumberOfBytesRead=0x262ff954*=0x2899, lpOverlapped=0x0) returned 1 [0085.404] SetFilePointerEx (in: hFile=0x202c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.404] WriteFile (in: hFile=0x202c, lpBuffer=0xe263ad0*, nNumberOfBytesToWrite=0x2899, lpNumberOfBytesWritten=0x262ff950, lpOverlapped=0x0 | out: lpBuffer=0xe263ad0*, lpNumberOfBytesWritten=0x262ff950*=0x2899, lpOverlapped=0x0) returned 1 [0089.002] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7280ea0 [0089.002] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281058 [0089.002] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7281058) returned 1 [0089.002] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe263ad0) returned 1 [0089.050] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe2572c8) returned 1 [0089.050] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7566270) returned 1 [0089.050] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8600) returned 1 [0089.050] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x35) returned 0x5444c80 [0089.050] SetFilePointerEx (in: hFile=0x202c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.050] WriteFile (in: hFile=0x202c, lpBuffer=0x74d9df0*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x262ff9b8, lpOverlapped=0x0 | out: lpBuffer=0x74d9df0*, lpNumberOfBytesWritten=0x262ff9b8*=0x119, lpOverlapped=0x0) returned 1 [0092.157] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74d9df0) returned 1 [0092.157] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444b00) returned 1 [0092.157] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282b40) returned 1 [0092.157] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444c80) returned 1 [0092.157] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7280ea0) returned 1 [0092.157] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74acbe8) returned 1 [0092.157] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74ac990) returned 1 [0092.157] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74aca80) returned 1 [0092.157] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb8) returned 0x5b17150 [0092.157] wcscpy (in: _Dest=0x5b17150, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" [0092.157] wcscat (in: _Dest=0x5b17150, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.mailto[knoocknoo@cock.li].a0a70" [0092.157] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x262ff970, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.157] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x75800c0 Thread: id = 1056 os_tid = 0x1ec4 [0083.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar")) returned 0x20 [0083.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar", dwFileAttributes=0x20) returned 1 [0083.044] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2030 [0083.045] GetFileSizeEx (in: hFile=0x2030, lpFileSize=0x2637fc60 | out: lpFileSize=0x2637fc60*=3492573) returned 1 [0083.045] SetFilePointerEx (in: hFile=0x2030, liDistanceToMove=0x354ad9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.045] ReadFile (in: hFile=0x2030, lpBuffer=0x2637fbe4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2637fbe0, lpOverlapped=0x0 | out: lpBuffer=0x2637fbe4*, lpNumberOfBytesRead=0x2637fbe0*=0x4, lpOverlapped=0x0) returned 1 [0083.046] SetFilePointerEx (in: hFile=0x2030, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.046] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe22fe48 [0085.373] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe22fe98 [0085.373] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe22fd58 [0085.373] NtQuerySystemTime (in: CurrentTime=0x2637fbc0 | out: CurrentTime=0x2637fbc0*=132260136425330252) returned 0x0 [0085.373] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0xb0b35cf6 [0085.373] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0x8412d907 [0085.373] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0xf2e6c4a2 [0085.373] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0x39acbc4f [0085.373] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0xd8612fc5 [0085.373] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0xe07cc9e [0085.373] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0xe49ae460 [0085.374] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0x747278de [0085.374] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0xba8b967b [0085.374] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0x2896bbba [0085.374] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0x6af22d42 [0085.374] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0xeb45d7a4 [0085.374] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0x8000cc91 [0085.374] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0x55252bbf [0085.374] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0x3b2e9d9a [0085.374] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0xbc91144a [0085.374] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0xedd69393 [0085.374] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0x8d4a410a [0085.374] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0xd99af7c3 [0085.374] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0x76d42d0a [0085.374] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0xc8a4e766 [0085.374] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0x16671b13 [0085.374] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0x52d5ec7b [0085.374] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0xe64a5ee0 [0085.374] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0xa0253d61 [0085.374] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0xf7133208 [0085.374] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0x15bf8268 [0085.374] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0x62ff9a2c [0085.374] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0x9bea98fc [0085.374] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0x9b3737d1 [0085.374] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0xbcc1b30d [0085.374] RtlRandom (in: Seed=0x2637fbcc | out: Seed=0x2637fbcc) returned 0x70193995 [0085.385] SetFilePointerEx (in: hFile=0x2030, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.385] ReadFile (in: hFile=0x2030, lpBuffer=0xe24aac0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2637fb78, lpOverlapped=0x0 | out: lpBuffer=0xe24aac0*, lpNumberOfBytesRead=0x2637fb78*=0xc800, lpOverlapped=0x0) returned 1 [0085.397] SetFilePointerEx (in: hFile=0x2030, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.397] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8648 [0085.397] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x75662e8 [0085.397] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74ac9e0 [0085.397] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74ac9e0) returned 1 [0085.398] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe2702d8 [0085.403] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74acdf0 [0085.403] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74accb0 [0085.404] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74accb0) returned 1 [0085.404] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75662e8) returned 1 [0085.404] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8648) returned 1 [0085.404] WriteFile (in: hFile=0x2030, lpBuffer=0xe2702d8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2637fb78, lpOverlapped=0x0 | out: lpBuffer=0xe2702d8*, lpNumberOfBytesWritten=0x2637fb78*=0xc800, lpOverlapped=0x0) returned 1 [0089.505] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe2702d8) returned 1 [0091.499] SetFilePointerEx (in: hFile=0x2030, liDistanceToMove=0x1b5800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.499] ReadFile (in: hFile=0x2030, lpBuffer=0xe24aac0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2637fb78, lpOverlapped=0x0 | out: lpBuffer=0xe24aac0*, lpNumberOfBytesRead=0x2637fb78*=0xc800, lpOverlapped=0x0) returned 1 [0091.504] SetFilePointerEx (in: hFile=0x2030, liDistanceToMove=0x1b5800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.504] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8ac8 [0091.504] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0xe4d0608 [0091.504] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09aeb0 [0091.504] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09aeb0) returned 1 [0091.505] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe2be320 [0091.506] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09adc0 [0091.506] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09ad48 [0091.506] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09ad48) returned 1 [0091.506] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4d0608) returned 1 [0091.506] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8ac8) returned 1 [0091.506] WriteFile (in: hFile=0x2030, lpBuffer=0xe2be320*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2637fb78, lpOverlapped=0x0 | out: lpBuffer=0xe2be320*, lpNumberOfBytesWritten=0x2637fb78*=0xc800, lpOverlapped=0x0) returned 1 [0091.507] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe2be320) returned 1 [0091.507] SetFilePointerEx (in: hFile=0x2030, liDistanceToMove=0x3482dd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.507] ReadFile (in: hFile=0x2030, lpBuffer=0xe24aac0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2637fb78, lpOverlapped=0x0 | out: lpBuffer=0xe24aac0*, lpNumberOfBytesRead=0x2637fb78*=0xc800, lpOverlapped=0x0) returned 1 [0091.509] SetFilePointerEx (in: hFile=0x2030, liDistanceToMove=0x3482dd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.509] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8ac8 [0091.509] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0xe4cfd98 [0091.509] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09af00 [0091.509] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09af00) returned 1 [0091.510] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe23e2b8 [0091.511] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09af00 [0091.511] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09ac80 [0091.511] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09ac80) returned 1 [0091.511] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4cfd98) returned 1 [0091.511] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8ac8) returned 1 [0091.511] WriteFile (hFile=0x2030, lpBuffer=0xe23e2b8, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2637fb78, lpOverlapped=0x0) Thread: id = 1057 os_tid = 0x1ec8 [0083.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar")) returned 0x20 [0083.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar", dwFileAttributes=0x20) returned 1 [0083.048] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2034 [0083.048] GetFileSizeEx (in: hFile=0x2034, lpFileSize=0x263ffdec | out: lpFileSize=0x263ffdec*=54560347) returned 1 [0083.048] SetFilePointerEx (in: hFile=0x2034, liDistanceToMove=0x3408657, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.048] ReadFile (in: hFile=0x2034, lpBuffer=0x263ffd70, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x263ffd6c, lpOverlapped=0x0 | out: lpBuffer=0x263ffd70*, lpNumberOfBytesRead=0x263ffd6c*=0x4, lpOverlapped=0x0) returned 1 [0083.051] SetFilePointerEx (in: hFile=0x2034, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.051] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74ae7a8 [0085.354] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74ae730 [0085.354] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74ae618 [0085.354] NtQuerySystemTime (in: CurrentTime=0x263ffd4c | out: CurrentTime=0x263ffd4c*=132260136425189460) returned 0x0 [0085.354] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0xf7515899 [0085.355] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0xf8d67cd6 [0085.355] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0x9d2dcfa6 [0085.355] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0xfe332e11 [0085.355] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0xc8742769 [0085.355] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0x6ad35deb [0085.355] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0x686c3fbf [0085.355] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0x1d60daa3 [0085.355] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0x37e9a51b [0085.355] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0xdc1a478 [0085.355] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0x720daf5c [0085.355] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0x974826c2 [0085.355] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0xefe4b67a [0085.355] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0xf80986e4 [0085.355] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0xbd122a50 [0085.355] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0x35beb53 [0085.355] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0x5a8cda85 [0085.355] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0x97cf1315 [0085.355] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0x651ebe99 [0085.355] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0xd61cb7f6 [0085.355] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0x63f82016 [0085.355] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0x3b2102ee [0085.355] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0xe380214d [0085.355] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0x1c1e03d5 [0085.355] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0xe36a00fc [0085.355] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0x59f53a50 [0085.355] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0x48e3e1f5 [0085.355] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0x932740ad [0085.355] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0x20011662 [0085.355] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0xe87e5b6 [0085.355] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0x717f4b9d [0085.355] RtlRandom (in: Seed=0x263ffd58 | out: Seed=0x263ffd58) returned 0x3b4ce2ad [0085.365] SetFilePointerEx (in: hFile=0x2034, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.365] ReadFile (in: hFile=0x2034, lpBuffer=0xe231ab0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x263ffd04, lpOverlapped=0x0 | out: lpBuffer=0xe231ab0*, lpNumberOfBytesRead=0x263ffd04*=0xc800, lpOverlapped=0x0) returned 1 [0085.366] SetFilePointerEx (in: hFile=0x2034, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.367] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8600 [0085.367] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x7566270 [0085.367] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74ae3e8 [0085.367] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74ae3e8) returned 1 [0085.367] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe23e2b8 [0085.373] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74ae7f8 [0085.373] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74ae6b8 [0085.373] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74ae6b8) returned 1 [0085.373] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7566270) returned 1 [0085.373] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8600) returned 1 [0085.373] WriteFile (in: hFile=0x2034, lpBuffer=0xe23e2b8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x263ffd04, lpOverlapped=0x0 | out: lpBuffer=0xe23e2b8*, lpNumberOfBytesWritten=0x263ffd04*=0xc800, lpOverlapped=0x0) returned 1 [0089.502] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe23e2b8) returned 1 [0091.508] SetFilePointerEx (in: hFile=0x2034, liDistanceToMove=0x1a06800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.508] ReadFile (in: hFile=0x2034, lpBuffer=0xe231ab0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x263ffd04, lpOverlapped=0x0 | out: lpBuffer=0xe231ab0*, lpNumberOfBytesRead=0x263ffd04*=0xc800, lpOverlapped=0x0) returned 1 [0091.513] SetFilePointerEx (in: hFile=0x2034, liDistanceToMove=0x1a06800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.513] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8ac8 [0091.513] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0xe4d0608 [0091.513] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09af28 [0091.513] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09af28) returned 1 [0091.514] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe332b88 [0091.515] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09ae10 [0091.515] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09ad48 [0091.515] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09ad48) returned 1 [0091.515] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4d0608) returned 1 [0091.515] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8ac8) returned 1 [0091.515] WriteFile (in: hFile=0x2034, lpBuffer=0xe332b88*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x263ffd04, lpOverlapped=0x0 | out: lpBuffer=0xe332b88*, lpNumberOfBytesWritten=0x263ffd04*=0xc800, lpOverlapped=0x0) returned 1 [0091.611] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe332b88) returned 1 [0091.611] SetFilePointerEx (in: hFile=0x2034, liDistanceToMove=0x33fbe5b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.611] ReadFile (in: hFile=0x2034, lpBuffer=0xe231ab0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x263ffd04, lpOverlapped=0x0 | out: lpBuffer=0xe231ab0*, lpNumberOfBytesRead=0x263ffd04*=0xc800, lpOverlapped=0x0) returned 1 [0091.615] SetFilePointerEx (in: hFile=0x2034, liDistanceToMove=0x33fbe5b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.615] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8a38 [0091.615] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x74ae998 [0091.615] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09af28 [0091.615] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09af28) returned 1 [0091.616] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x7388008 [0091.617] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09af28 [0091.617] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09ad48 [0091.617] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09ad48) returned 1 [0091.617] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74ae998) returned 1 [0091.617] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8a38) returned 1 [0091.617] WriteFile (in: hFile=0x2034, lpBuffer=0x7388008*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x263ffd04, lpOverlapped=0x0 | out: lpBuffer=0x7388008*, lpNumberOfBytesWritten=0x263ffd04*=0xc800, lpOverlapped=0x0) returned 1 [0091.621] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7388008) returned 1 [0091.621] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0xe53a678 [0091.621] SetFilePointerEx (in: hFile=0x2034, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.621] WriteFile (hFile=0x2034, lpBuffer=0x758a968, nNumberOfBytesToWrite=0x13d, lpNumberOfBytesWritten=0x263ffdac, lpOverlapped=0x0) Thread: id = 1058 os_tid = 0x1ecc [0083.051] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x5468a90 [0083.051] wcscpy (in: _Dest=0x5468a90, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security" [0083.051] wcscat (in: _Dest=0x5468a90, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\" [0083.051] wcscat (in: _Dest=0x5468a90, _Source="*" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\*") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\*" [0083.051] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3937840 [0083.051] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\*", lpFindFileData=0x3937840 | out: lpFindFileData=0x3937840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1418338, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ee40 [0085.366] wcscmp (_String1=".", _String2=".") returned 0 [0085.366] FindNextFileW (in: hFindFile=0x389ee40, lpFindFileData=0x3937840 | out: lpFindFileData=0x3937840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1418338, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.366] wcscmp (_String1="..", _String2=".") returned 1 [0085.366] wcscmp (_String1="..", _String2="..") returned 0 [0085.366] FindNextFileW (in: hFindFile=0x389ee40, lpFindFileData=0x3937840 | out: lpFindFileData=0x3937840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xfd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="blacklist", cAlternateFileName="BLACKL~1")) returned 1 [0085.366] wcscmp (_String1="blacklist", _String2=".") returned 1 [0085.366] wcscmp (_String1="blacklist", _String2="..") returned 1 [0085.366] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x74) returned 0x38d22a0 [0085.366] wcscpy (in: _Dest=0x38d22a0, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security" [0085.366] wcscat (in: _Dest=0x38d22a0, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\" [0085.366] wcscat (in: _Dest=0x38d22a0, _Source="blacklist" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" [0088.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d22a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588 [0088.847] FindNextFileW (in: hFindFile=0x389ee40, lpFindFileData=0x3937840 | out: lpFindFileData=0x3937840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="blacklisted.certs", cAlternateFileName="BLACKL~1.CER")) returned 1 [0088.847] wcscmp (_String1="blacklisted.certs", _String2=".") returned 1 [0088.847] wcscmp (_String1="blacklisted.certs", _String2="..") returned 1 [0088.847] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x84) returned 0x549d7a8 [0088.847] wcscpy (in: _Dest=0x549d7a8, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security" [0088.847] wcscat (in: _Dest=0x549d7a8, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\" [0088.847] wcscat (in: _Dest=0x549d7a8, _Source="blacklisted.certs" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" [0088.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549d7a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x69c [0088.848] FindNextFileW (in: hFindFile=0x389ee40, lpFindFileData=0x3937840 | out: lpFindFileData=0x3937840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1c0eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="cacerts", cAlternateFileName="")) returned 1 [0088.848] wcscmp (_String1="cacerts", _String2=".") returned 1 [0088.848] wcscmp (_String1="cacerts", _String2="..") returned 1 [0088.848] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x74b0030 [0088.848] wcscpy (in: _Dest=0x74b0030, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security" [0088.848] wcscat (in: _Dest=0x74b0030, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\" [0088.848] wcscat (in: _Dest=0x74b0030, _Source="cacerts" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" [0088.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b0030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c4 [0088.849] FindNextFileW (in: hFindFile=0x389ee40, lpFindFileData=0x3937840 | out: lpFindFileData=0x3937840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x9a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.policy", cAlternateFileName="JAVA~1.POL")) returned 1 [0088.849] wcscmp (_String1="java.policy", _String2=".") returned 1 [0088.849] wcscmp (_String1="java.policy", _String2="..") returned 1 [0088.849] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x78) returned 0x38d1ba0 [0088.849] wcscpy (in: _Dest=0x38d1ba0, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security" [0088.849] wcscat (in: _Dest=0x38d1ba0, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\" [0088.849] wcscat (in: _Dest=0x38d1ba0, _Source="java.policy" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" [0088.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d1ba0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7fc [0088.850] FindNextFileW (in: hFindFile=0x389ee40, lpFindFileData=0x3937840 | out: lpFindFileData=0x3937840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8eac, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.security", cAlternateFileName="JAVA~1.SEC")) returned 1 [0088.850] wcscmp (_String1="java.security", _String2=".") returned 1 [0088.850] wcscmp (_String1="java.security", _String2="..") returned 1 [0088.850] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7c) returned 0x3976f78 [0088.850] wcscpy (in: _Dest=0x3976f78, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security" [0088.850] wcscat (in: _Dest=0x3976f78, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\" [0088.850] wcscat (in: _Dest=0x3976f78, _Source="java.security" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" [0088.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3976f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14d0 [0088.850] FindNextFileW (in: hFindFile=0x389ee40, lpFindFileData=0x3937840 | out: lpFindFileData=0x3937840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x62, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.policy", cAlternateFileName="JAVAWS~1.POL")) returned 1 [0088.850] wcscmp (_String1="javaws.policy", _String2=".") returned 1 [0088.850] wcscmp (_String1="javaws.policy", _String2="..") returned 1 [0088.850] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7c) returned 0x3977000 [0088.850] wcscpy (in: _Dest=0x3977000, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security" [0088.850] wcscat (in: _Dest=0x3977000, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\" [0088.850] wcscat (in: _Dest=0x3977000, _Source="javaws.policy" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" [0088.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3977000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f0 [0088.851] FindNextFileW (in: hFindFile=0x389ee40, lpFindFileData=0x3937840 | out: lpFindFileData=0x3937840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xdc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="local_policy.jar", cAlternateFileName="LOCAL_~1.JAR")) returned 1 [0088.851] wcscmp (_String1="local_policy.jar", _String2=".") returned 1 [0088.851] wcscmp (_String1="local_policy.jar", _String2="..") returned 1 [0088.851] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x82) returned 0x549d8c8 [0088.851] wcscpy (in: _Dest=0x549d8c8, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security" [0088.851] wcscat (in: _Dest=0x549d8c8, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\" [0088.851] wcscat (in: _Dest=0x549d8c8, _Source="local_policy.jar" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" [0088.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549d8c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17f0 [0088.852] FindNextFileW (in: hFindFile=0x389ee40, lpFindFileData=0x3937840 | out: lpFindFileData=0x3937840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="trusted.libraries", cAlternateFileName="TRUSTE~1.LIB")) returned 1 [0088.852] wcscmp (_String1="trusted.libraries", _String2=".") returned 1 [0088.852] wcscmp (_String1="trusted.libraries", _String2="..") returned 1 [0088.852] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x84) returned 0x549dcb8 [0088.852] wcscpy (in: _Dest=0x549dcb8, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security" [0088.852] wcscat (in: _Dest=0x549dcb8, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\" [0088.852] wcscat (in: _Dest=0x549dcb8, _Source="trusted.libraries" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries" [0088.852] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549dcb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17ec [0088.853] FindNextFileW (in: hFindFile=0x389ee40, lpFindFileData=0x3937840 | out: lpFindFileData=0x3937840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="US_export_policy.jar", cAlternateFileName="US_EXP~1.JAR")) returned 1 [0088.853] wcscmp (_String1="US_export_policy.jar", _String2=".") returned 1 [0088.853] wcscmp (_String1="US_export_policy.jar", _String2="..") returned 1 [0088.853] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8a) returned 0x549eb50 [0088.853] wcscpy (in: _Dest=0x549eb50, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security" [0088.853] wcscat (in: _Dest=0x549eb50, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\" [0088.853] wcscat (in: _Dest=0x549eb50, _Source="US_export_policy.jar" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" [0088.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549eb50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17e8 [0088.853] FindNextFileW (in: hFindFile=0x389ee40, lpFindFileData=0x3937840 | out: lpFindFileData=0x3937840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="US_export_policy.jar", cAlternateFileName="US_EXP~1.JAR")) returned 0 [0088.854] FindClose (in: hFindFile=0x389ee40 | out: hFindFile=0x389ee40) returned 1 [0088.854] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3937840) returned 1 [0088.854] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5468a90) returned 1 [0088.854] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x6e95890) returned 1 Thread: id = 1059 os_tid = 0x1ed0 [0083.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties")) returned 0x20 [0083.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties", dwFileAttributes=0x20) returned 1 [0083.053] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2038 [0083.053] GetFileSizeEx (in: hFile=0x2038, lpFileSize=0x266ff7e8 | out: lpFileSize=0x266ff7e8*=1210) returned 1 [0083.053] SetFilePointerEx (in: hFile=0x2038, liDistanceToMove=0x4b6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.053] ReadFile (in: hFile=0x2038, lpBuffer=0x266ff76c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x266ff768, lpOverlapped=0x0 | out: lpBuffer=0x266ff76c*, lpNumberOfBytesRead=0x266ff768*=0x4, lpOverlapped=0x0) returned 1 [0083.054] SetFilePointerEx (in: hFile=0x2038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.054] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe231198 [0085.342] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe231440 [0085.342] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe2314b8 [0085.342] NtQuerySystemTime (in: CurrentTime=0x266ff748 | out: CurrentTime=0x266ff748*=132260136425018310) returned 0x0 [0085.342] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0x980b0e95 [0085.342] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0x1f035e8b [0085.342] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0x829c5ba1 [0085.342] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0x21ca9e76 [0085.342] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0x2a263122 [0085.342] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0xc2419367 [0085.342] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0xd4017053 [0085.342] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0x3fe0e132 [0085.342] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0xd5bb3107 [0085.342] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0xeb063a6f [0085.342] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0x9de97611 [0085.342] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0x186a6654 [0085.342] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0x645bf662 [0085.342] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0x709f0236 [0085.342] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0x94688cb6 [0085.342] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0xdb5b00a4 [0085.342] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0x4c4e2bb5 [0085.342] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0xd5db83a0 [0085.342] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0x86df4859 [0085.342] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0xa54ce16a [0085.342] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0x4c25d53e [0085.342] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0xb7917e1e [0085.342] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0x3e89ef82 [0085.343] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0xf00c63d0 [0085.343] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0xa1863e43 [0085.343] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0x777813dc [0085.343] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0x33635902 [0085.343] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0x2be1eb33 [0085.343] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0xf5a08855 [0085.343] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0xde80bba3 [0085.343] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0x77390d9c [0085.343] RtlRandom (in: Seed=0x266ff754 | out: Seed=0x266ff754) returned 0xf9f7b501 [0085.352] ReadFile (in: hFile=0x2038, lpBuffer=0x73d4040, nNumberOfBytesToRead=0x4ba, lpNumberOfBytesRead=0x266ff744, lpOverlapped=0x0 | out: lpBuffer=0x73d4040*, lpNumberOfBytesRead=0x266ff744*=0x4ba, lpOverlapped=0x0) returned 1 [0085.352] SetFilePointerEx (in: hFile=0x2038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.352] WriteFile (in: hFile=0x2038, lpBuffer=0x73e0848*, nNumberOfBytesToWrite=0x4ba, lpNumberOfBytesWritten=0x266ff740, lpOverlapped=0x0 | out: lpBuffer=0x73e0848*, lpNumberOfBytesWritten=0x266ff740*=0x4ba, lpOverlapped=0x0) returned 1 [0088.998] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7280e78 [0088.998] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281058 [0088.998] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7281058) returned 1 [0088.998] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73e0848) returned 1 [0089.050] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73d4040) returned 1 [0089.050] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75661f8) returned 1 [0089.050] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba85b8) returned 1 [0089.050] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2d) returned 0x54b84a8 [0089.050] SetFilePointerEx (in: hFile=0x2038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.050] WriteFile (in: hFile=0x2038, lpBuffer=0x74d95d8*, nNumberOfBytesToWrite=0x111, lpNumberOfBytesWritten=0x266ff7a8, lpOverlapped=0x0 | out: lpBuffer=0x74d95d8*, lpNumberOfBytesWritten=0x266ff7a8*=0x111, lpOverlapped=0x0) returned 1 [0092.161] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74d95d8) returned 1 [0092.161] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b6de8) returned 1 [0092.161] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282b68) returned 1 [0092.161] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b84a8) returned 1 [0092.161] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7280e78) returned 1 [0092.161] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe231440) returned 1 [0092.161] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe2312b0) returned 1 [0092.161] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe231148) Thread: id = 1060 os_tid = 0x1ed4 [0083.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat")) returned 0x20 [0083.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat", dwFileAttributes=0x20) returned 1 [0083.055] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x203c [0083.055] GetFileSizeEx (in: hFile=0x203c, lpFileSize=0x2677f938 | out: lpFileSize=0x2677f938*=105500) returned 1 [0083.055] SetFilePointerEx (in: hFile=0x203c, liDistanceToMove=0x19c18, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.055] ReadFile (in: hFile=0x203c, lpBuffer=0x2677f8bc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2677f8b8, lpOverlapped=0x0 | out: lpBuffer=0x2677f8bc*, lpNumberOfBytesRead=0x2677f8b8*=0x4, lpOverlapped=0x0) returned 1 [0083.057] SetFilePointerEx (in: hFile=0x203c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.057] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe1932d8 [0085.329] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe193288 [0085.329] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe192f40 [0085.329] NtQuerySystemTime (in: CurrentTime=0x2677f898 | out: CurrentTime=0x2677f898*=132260136424861942) returned 0x0 [0085.329] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0xccb2bd8c [0085.329] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0x8e4e6216 [0085.329] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0x2c2bb9a4 [0085.329] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0x6114f955 [0085.329] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0xf7a92cac [0085.329] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0x3af7d1ec [0085.329] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0x874405d3 [0085.329] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0x3b22be1d [0085.329] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0x9bb5ac4 [0085.329] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0x21c875d6 [0085.329] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0xbf3ee33b [0085.329] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0xeeb4bf5e [0085.329] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0x44a43b55 [0085.329] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0xf5fc1cf1 [0085.329] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0xb0883c8 [0085.329] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0x95d31ccc [0085.329] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0x911be53b [0085.329] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0xfa437f3 [0085.329] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0xac5ba13f [0085.329] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0x7bcf6447 [0085.329] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0x1e535e77 [0085.329] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0x1fc41d50 [0085.329] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0x9181b331 [0085.329] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0x4b09f163 [0085.329] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0x25f3e54e [0085.330] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0x6ea2056 [0085.330] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0xfd076419 [0085.330] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0xca9a840b [0085.330] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0x7a020e5d [0085.330] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0x30238478 [0085.330] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0xc2bbfc70 [0085.330] RtlRandom (in: Seed=0x2677f8a4 | out: Seed=0x2677f8a4) returned 0xa04a054 [0085.339] SetFilePointerEx (in: hFile=0x203c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.339] ReadFile (in: hFile=0x203c, lpBuffer=0x73bb030, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2677f878, lpOverlapped=0x0 | out: lpBuffer=0x73bb030*, lpNumberOfBytesRead=0x2677f878*=0xc800, lpOverlapped=0x0) returned 1 [0085.340] SetFilePointerEx (in: hFile=0x203c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.340] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba85b8 [0085.340] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x75661f8 [0085.340] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe193008 [0085.340] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe193008) returned 1 [0085.341] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x73c7838 [0085.342] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe193418 [0085.342] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe1932d8 [0085.342] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1932d8) returned 1 [0085.342] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75661f8) returned 1 [0085.342] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba85b8) returned 1 [0085.342] WriteFile (in: hFile=0x203c, lpBuffer=0x73c7838*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2677f878, lpOverlapped=0x0 | out: lpBuffer=0x73c7838*, lpNumberOfBytesWritten=0x2677f878*=0xc800, lpOverlapped=0x0) returned 1 [0088.997] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73c7838) returned 1 [0089.051] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73bb030) returned 1 [0089.051] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d) returned 0x72828c0 [0089.051] SetFilePointerEx (in: hFile=0x203c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.051] WriteFile (hFile=0x203c, lpBuffer=0x757a380, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0x2677f8f8, lpOverlapped=0x0) Thread: id = 1061 os_tid = 0x1ed8 [0083.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 0x20 [0085.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings", dwFileAttributes=0x20) returned 1 [0085.316] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x958 [0085.316] GetFileSizeEx (in: hFile=0x958, lpFileSize=0x267ffd10 | out: lpFileSize=0x267ffd10*=8400) returned 1 [0085.316] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0x20cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.316] ReadFile (in: hFile=0x958, lpBuffer=0x267ffc94, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x267ffc90, lpOverlapped=0x0 | out: lpBuffer=0x267ffc94*, lpNumberOfBytesRead=0x267ffc90*=0x4, lpOverlapped=0x0) returned 1 [0085.319] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.319] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe215cc8 [0085.319] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe215ed0 [0085.319] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe215d68 [0085.319] NtQuerySystemTime (in: CurrentTime=0x267ffc70 | out: CurrentTime=0x267ffc70*=132260136424705985) returned 0x0 [0085.319] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0x84692e6c [0085.319] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0xf32d401d [0085.319] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0x4ad826c [0085.319] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0x560eaccb [0085.319] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0x5181d6b2 [0085.319] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0x91443537 [0085.319] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0x59053597 [0085.319] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0x79d44a38 [0085.319] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0x3fdf3708 [0085.319] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0x67493630 [0085.319] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0x1598d995 [0085.319] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0x319a615c [0085.319] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0x39469f56 [0085.319] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0xd6984989 [0085.319] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0x7f86f0d0 [0085.319] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0x9c2c40a4 [0085.319] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0xd7bda585 [0085.319] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0xe6ab8db0 [0085.319] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0x83440797 [0085.319] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0x848232b8 [0085.319] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0x537f7c29 [0085.319] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0x214fc176 [0085.319] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0xb1a07b3f [0085.319] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0x612ba3e1 [0085.319] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0x8eb7466b [0085.319] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0x92934280 [0085.320] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0xae5a11b0 [0085.320] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0x61469bbc [0085.320] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0x6b75a73 [0085.320] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0x15d5a545 [0085.320] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0xbfe970bc [0085.320] RtlRandom (in: Seed=0x267ffc7c | out: Seed=0x267ffc7c) returned 0xdc8aeab5 [0085.328] ReadFile (in: hFile=0x958, lpBuffer=0x7394810, nNumberOfBytesToRead=0x20d0, lpNumberOfBytesRead=0x267ffc6c, lpOverlapped=0x0 | out: lpBuffer=0x7394810*, lpNumberOfBytesRead=0x267ffc6c*=0x20d0, lpOverlapped=0x0) returned 1 [0085.339] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.340] WriteFile (in: hFile=0x958, lpBuffer=0x73ae828*, nNumberOfBytesToWrite=0x20d0, lpNumberOfBytesWritten=0x267ffc68, lpOverlapped=0x0 | out: lpBuffer=0x73ae828*, lpNumberOfBytesWritten=0x267ffc68*=0x20d0, lpOverlapped=0x0) returned 1 [0088.997] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7280e50 [0088.997] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281058 [0088.997] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7281058) returned 1 [0088.997] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x73ae828) returned 1 [0089.050] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7394810) returned 1 [0089.050] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7566180) returned 1 [0089.051] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8570) returned 1 [0089.051] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x21) returned 0x38a67c0 [0089.051] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.051] WriteFile (in: hFile=0x958, lpBuffer=0x757a268*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x267ffcd0, lpOverlapped=0x0 | out: lpBuffer=0x757a268*, lpNumberOfBytesWritten=0x267ffcd0*=0x105, lpOverlapped=0x0) returned 1 [0092.164] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757a268) returned 1 [0092.164] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a66a0) returned 1 [0092.164] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282b90) returned 1 [0092.164] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a67c0) returned 1 [0092.164] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7280e50) returned 1 [0092.164] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe215ed0) returned 1 [0092.164] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe215c00) returned 1 [0092.164] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe215c50) returned 1 [0092.164] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa4) returned 0x74e0968 [0092.164] wcscpy (in: _Dest=0x74e0968, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" [0092.164] wcscat (in: _Dest=0x74e0968, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.mailto[knoocknoo@cock.li].a0a70" [0092.165] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x267ffc88, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.165] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x53e8670 Thread: id = 1062 os_tid = 0x1edc [0083.058] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x5468b00 [0083.058] wcscpy (in: _Dest=0x5468b00, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin") returned="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin" [0083.058] wcscat (in: _Dest=0x5468b00, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\" [0083.058] wcscat (in: _Dest=0x5468b00, _Source="*" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\*") returned="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\*" [0083.058] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3937d10 [0083.058] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\*", lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389eac0 [0085.317] wcscmp (_String1=".", _String2=".") returned 0 [0085.317] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.318] wcscmp (_String1="..", _String2=".") returned 1 [0085.318] wcscmp (_String1="..", _String2="..") returned 0 [0085.318] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xfa840, dwReserved0=0x0, dwReserved1=0x0, cFileName="deployJava1.dll", cAlternateFileName="DEPLOY~1.DLL")) returned 1 [0085.318] wcscmp (_String1="deployJava1.dll", _String2=".") returned 1 [0085.318] wcscmp (_String1="deployJava1.dll", _String2="..") returned 1 [0085.318] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11a640, dwReserved0=0x0, dwReserved1=0x0, cFileName="npdeployJava1.dll", cAlternateFileName="NPDEPL~1.DLL")) returned 1 [0085.318] wcscmp (_String1="npdeployJava1.dll", _String2=".") returned 1 [0085.318] wcscmp (_String1="npdeployJava1.dll", _String2="..") returned 1 [0085.318] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11a640, dwReserved0=0x0, dwReserved1=0x0, cFileName="npdeployJava1.dll", cAlternateFileName="NPDEPL~1.DLL")) returned 0 [0085.318] FindClose (in: hFindFile=0x389eac0 | out: hFindFile=0x389eac0) returned 1 [0085.318] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3937d10) returned 1 [0085.318] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5468b00) returned 1 [0085.318] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x6e95c38) returned 1 Thread: id = 1063 os_tid = 0x1ee0 [0083.062] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x5468b70 [0083.062] wcscpy (in: _Dest=0x5468b70, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2") returned="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2" [0083.062] wcscat (in: _Dest=0x5468b70, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\" [0083.062] wcscat (in: _Dest=0x5468b70, _Source="*" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\*") returned="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\*" [0083.062] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x39381e0 [0083.062] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\*", lpFindFileData=0x39381e0 | out: lpFindFileData=0x39381e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2a2bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ecc0 [0085.313] wcscmp (_String1=".", _String2=".") returned 0 [0085.313] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x39381e0 | out: lpFindFileData=0x39381e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2a2bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.313] wcscmp (_String1="..", _String2=".") returned 1 [0085.313] wcscmp (_String1="..", _String2="..") returned 0 [0085.313] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x39381e0 | out: lpFindFileData=0x39381e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xca750, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr100.dll", cAlternateFileName="")) returned 1 [0085.313] wcscmp (_String1="msvcr100.dll", _String2=".") returned 1 [0085.313] wcscmp (_String1="msvcr100.dll", _String2="..") returned 1 [0085.313] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x39381e0 | out: lpFindFileData=0x39381e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39440, dwReserved0=0x0, dwReserved1=0x0, cFileName="npjp2.dll", cAlternateFileName="")) returned 1 [0085.313] wcscmp (_String1="npjp2.dll", _String2=".") returned 1 [0085.314] wcscmp (_String1="npjp2.dll", _String2="..") returned 1 [0085.314] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x39381e0 | out: lpFindFileData=0x39381e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39440, dwReserved0=0x0, dwReserved1=0x0, cFileName="npjp2.dll", cAlternateFileName="")) returned 0 [0085.314] FindClose (in: hFindFile=0x389ecc0 | out: hFindFile=0x389ecc0) returned 1 [0085.314] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39381e0) returned 1 [0085.314] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5468b70) returned 1 [0085.314] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x6e95960) returned 1 Thread: id = 1064 os_tid = 0x1ee4 [0083.062] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x542b8d0 [0083.062] wcscpy (in: _Dest=0x542b8d0, _Source="C:\\Users\\Default.migrated\\Documents\\My Music" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Music") returned="C:\\Users\\Default.migrated\\Documents\\My Music" [0083.063] wcscat (in: _Dest=0x542b8d0, _Source="\\" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Music\\") returned="C:\\Users\\Default.migrated\\Documents\\My Music\\" [0083.063] wcscat (in: _Dest=0x542b8d0, _Source="*" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Music\\*") returned="C:\\Users\\Default.migrated\\Documents\\My Music\\*" [0083.063] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3938448 [0083.063] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\My Music\\*", lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0083.064] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3938448) returned 1 [0083.064] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542b8d0) returned 1 [0083.064] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x6e95bd0) returned 1 Thread: id = 1065 os_tid = 0x1ee8 [0083.066] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x5468be0 [0083.066] wcscpy (in: _Dest=0x5468be0, _Source="C:\\Users\\Default.migrated\\Documents\\My Pictures" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Pictures") returned="C:\\Users\\Default.migrated\\Documents\\My Pictures" [0083.066] wcscat (in: _Dest=0x5468be0, _Source="\\" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Pictures\\") returned="C:\\Users\\Default.migrated\\Documents\\My Pictures\\" [0083.066] wcscat (in: _Dest=0x5468be0, _Source="*" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Pictures\\*") returned="C:\\Users\\Default.migrated\\Documents\\My Pictures\\*" [0083.066] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3938448 [0083.066] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\My Pictures\\*", lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0085.311] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3938448) returned 1 [0085.311] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5468be0) returned 1 [0085.311] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x6e959c8) returned 1 Thread: id = 1066 os_tid = 0x1eec [0083.066] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x542b8d0 [0083.066] wcscpy (in: _Dest=0x542b8d0, _Source="C:\\Users\\Default.migrated\\Documents\\My Videos" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Videos") returned="C:\\Users\\Default.migrated\\Documents\\My Videos" [0083.066] wcscat (in: _Dest=0x542b8d0, _Source="\\" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Videos\\") returned="C:\\Users\\Default.migrated\\Documents\\My Videos\\" [0083.066] wcscat (in: _Dest=0x542b8d0, _Source="*" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Videos\\*") returned="C:\\Users\\Default.migrated\\Documents\\My Videos\\*" [0083.066] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x39386b0 [0083.066] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\My Videos\\*", lpFindFileData=0x39386b0 | out: lpFindFileData=0x39386b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0083.068] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39386b0) returned 1 [0083.068] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542b8d0) returned 1 [0083.068] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x6e95a98) returned 1 Thread: id = 1067 os_tid = 0x1ef0 [0083.069] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x542b8d0 [0083.069] wcscpy (in: _Dest=0x542b8d0, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server") returned="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server" [0083.069] wcscat (in: _Dest=0x542b8d0, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\" [0083.069] wcscat (in: _Dest=0x542b8d0, _Source="*" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\*") returned="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\*" [0083.069] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x39386b0 [0083.069] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\*", lpFindFileData=0x39386b0 | out: lpFindFileData=0x39386b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8af971e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2b6c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xab35b530, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54450c0 [0083.069] wcscmp (_String1=".", _String2=".") returned 0 [0083.069] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x39386b0 | out: lpFindFileData=0x39386b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8af971e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2b6c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xab35b530, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.069] wcscmp (_String1="..", _String2=".") returned 1 [0083.069] wcscmp (_String1="..", _String2="..") returned 0 [0083.070] FindNextFileW (in: hFindFile=0x54450c0, lpFindFileData=0x39386b0 | out: lpFindFileData=0x39386b0*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xab35b530, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xab35b530, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xabaa88bc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11d0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="classes.jsa", cAlternateFileName="")) returned 1 [0083.070] wcscmp (_String1="classes.jsa", _String2=".") returned 1 [0083.070] wcscmp (_String1="classes.jsa", _String2="..") returned 1 [0083.070] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x74) returned 0x38d1120 [0083.070] wcscpy (in: _Dest=0x38d1120, _Source="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server") returned="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server" [0083.070] wcscat (in: _Dest=0x38d1120, _Source="\\" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\") returned="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\" [0083.070] wcscat (in: _Dest=0x38d1120, _Source="classes.jsa" | out: _Dest="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" [0083.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa")) returned 0x21 [0083.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa", dwFileAttributes=0x20) returned 1 [0089.935] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1824 [0092.888] GetFileSizeEx (in: hFile=0x1824, lpFileSize=0x26aff768 | out: lpFileSize=0x26aff768*=18677760) returned 1 [0092.888] SetFilePointerEx (in: hFile=0x1824, liDistanceToMove=0x11cfffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.888] ReadFile (in: hFile=0x1824, lpBuffer=0x26aff6ec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26aff6e8, lpOverlapped=0x0 | out: lpBuffer=0x26aff6ec*, lpNumberOfBytesRead=0x26aff6e8*=0x4, lpOverlapped=0x0) returned 1 [0092.890] SetFilePointerEx (in: hFile=0x1824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.890] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0661d8 [0092.890] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0669f8 [0092.890] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066908 [0092.890] NtQuerySystemTime (in: CurrentTime=0x26aff6c8 | out: CurrentTime=0x26aff6c8*=132260136500495067) returned 0x0 [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0xe3179900 [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0x7a232648 [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0x8c6fb0cc [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0x84608b8c [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0x5a6af70c [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0x6b53b33b [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0xb5992bfb [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0x4c70a11c [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0xf398027c [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0xd226188b [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0xd67f458 [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0x95d8a2bd [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0x2d3f6ac1 [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0x9f65e56b [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0xe58ed2c7 [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0xed434fdd [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0x955f77d7 [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0x797af9fc [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0x920120bb [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0xa0e8fc42 [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0xaa0cfb44 [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0x5a1efbc3 [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0x2ab8f027 [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0x35a6a4a5 [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0x2e88b58 [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0x55f23a8b [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0x22284859 [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0x63acf239 [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0xebcc7a6 [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0x87259c2d [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0x6ddd47dd [0092.890] RtlRandom (in: Seed=0x26aff6d4 | out: Seed=0x26aff6d4) returned 0x2d5ed221 Thread: id = 1068 os_tid = 0x1ef4 [0083.075] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url")) returned 0x20 [0083.076] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url", dwFileAttributes=0x20) returned 1 [0083.076] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2048 [0083.076] GetFileSizeEx (in: hFile=0x2048, lpFileSize=0x26b7ff00 | out: lpFileSize=0x26b7ff00*=208) returned 1 [0083.076] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe215d68 [0085.297] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe215e30 [0085.297] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe215b60 [0085.297] NtQuerySystemTime (in: CurrentTime=0x26b7fe60 | out: CurrentTime=0x26b7fe60*=132260136424549751) returned 0x0 [0085.297] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0x735ac15e [0085.297] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0xa1d430b1 [0085.297] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0xe372c840 [0085.297] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0xb90ba9fa [0085.297] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0xcc1f977b [0085.297] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0xb24b776b [0085.297] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0xe15980eb [0085.297] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0xd44b0b91 [0085.297] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0x7519f4d2 [0085.297] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0xd38b4b10 [0085.297] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0x6885e386 [0085.297] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0xf9734b23 [0085.297] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0xaca2391d [0085.297] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0xfcf2f28f [0085.297] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0x90d584b6 [0085.297] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0xca7b4f75 [0085.297] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0x17e902ff [0085.297] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0x1cde6dad [0085.297] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0x30c7cf5c [0085.297] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0x99fae7d3 [0085.297] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0xf05d2269 [0085.297] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0x9154cee [0085.297] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0xd033f636 [0085.297] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0x4b152f7c [0085.297] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0xe7c6042d [0085.297] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0x7379680d [0085.297] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0xf172ea25 [0085.297] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0x9dfe4477 [0085.297] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0x14e1f268 [0085.298] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0x436fcf53 [0085.298] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0x273abd1c [0085.298] RtlRandom (in: Seed=0x26b7fe6c | out: Seed=0x26b7fe6c) returned 0x7c2b5aaa [0085.308] ReadFile (in: hFile=0x2048, lpBuffer=0xe216a90, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x26b7fe5c, lpOverlapped=0x0 | out: lpBuffer=0xe216a90*, lpNumberOfBytesRead=0x26b7fe5c*=0xd0, lpOverlapped=0x0) returned 1 [0085.309] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.309] WriteFile (in: hFile=0x2048, lpBuffer=0xe223298*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x26b7fe58, lpOverlapped=0x0 | out: lpBuffer=0xe223298*, lpNumberOfBytesWritten=0x26b7fe58*=0xd0, lpOverlapped=0x0) returned 1 [0088.987] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7280e28 [0088.988] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281058 [0088.988] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7281058) returned 1 [0088.988] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe223298) returned 1 [0089.102] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe216a90) returned 1 [0089.102] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7574b00) returned 1 [0089.102] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8528) returned 1 [0089.102] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d) returned 0x72828e8 [0089.102] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.102] WriteFile (in: hFile=0x2048, lpBuffer=0x757a5b0*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0x26b7fec0, lpOverlapped=0x0 | out: lpBuffer=0x757a5b0*, lpNumberOfBytesWritten=0x26b7fec0*=0x101, lpOverlapped=0x0) returned 1 [0092.168] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757a5b0) returned 1 [0092.168] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282c30) returned 1 [0092.168] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282c58) returned 1 [0092.168] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x72828e8) returned 1 [0092.168] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7280e28) returned 1 [0092.168] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe215e30) returned 1 [0092.168] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe215ae8) returned 1 [0092.168] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe215c28) Thread: id = 1069 os_tid = 0x1ef8 [0083.077] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x44) returned 0x397bb08 [0083.077] wcscpy (in: _Dest=0x397bb08, _Source="C:\\Users\\FD1HVy\\Favorites\\Links" | out: _Dest="C:\\Users\\FD1HVy\\Favorites\\Links") returned="C:\\Users\\FD1HVy\\Favorites\\Links" [0083.077] wcscat (in: _Dest=0x397bb08, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Favorites\\Links\\") returned="C:\\Users\\FD1HVy\\Favorites\\Links\\" [0083.077] wcscat (in: _Dest=0x397bb08, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Favorites\\Links\\*") returned="C:\\Users\\FD1HVy\\Favorites\\Links\\*" [0083.077] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3938918 [0083.077] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\*", lpFindFileData=0x3938918 | out: lpFindFileData=0x3938918*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445100 [0083.077] wcscmp (_String1=".", _String2=".") returned 0 [0083.077] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x3938918 | out: lpFindFileData=0x3938918*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.077] wcscmp (_String1="..", _String2=".") returned 1 [0083.077] wcscmp (_String1="..", _String2="..") returned 0 [0083.077] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x3938918 | out: lpFindFileData=0x3938918*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0083.077] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0083.077] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0083.077] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x3938918 | out: lpFindFileData=0x3938918*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0083.077] FindClose (in: hFindFile=0x5445100 | out: hFindFile=0x5445100) returned 1 [0083.077] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3938918) returned 1 [0083.078] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397bb08) returned 1 [0083.078] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8018) returned 1 Thread: id = 1070 os_tid = 0x1efc [0083.079] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\574tRWuFE4nB3ib5-Tp.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\llmkz1w\\574trwufe4nb3ib5-tp.gif")) returned 0x20 [0083.079] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\574tRWuFE4nB3ib5-Tp.gif", dwFileAttributes=0x20) returned 1 [0083.079] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\574tRWuFE4nB3ib5-Tp.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\llmkz1w\\574trwufe4nb3ib5-tp.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x204c [0083.079] GetFileSizeEx (in: hFile=0x204c, lpFileSize=0x26c7f9c4 | out: lpFileSize=0x26c7f9c4*=71035) returned 1 [0083.079] SetFilePointerEx (in: hFile=0x204c, liDistanceToMove=0x11577, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.079] ReadFile (in: hFile=0x204c, lpBuffer=0x26c7f948, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26c7f944, lpOverlapped=0x0 | out: lpBuffer=0x26c7f948*, lpNumberOfBytesRead=0x26c7f944*=0x4, lpOverlapped=0x0) returned 1 [0083.079] SetFilePointerEx (in: hFile=0x204c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.079] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe1fc160 [0085.279] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe1fc480 [0085.279] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe1fbfa8 [0085.279] NtQuerySystemTime (in: CurrentTime=0x26c7f924 | out: CurrentTime=0x26c7f924*=132260136424436034) returned 0x0 [0085.279] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0x66caf6d7 [0085.279] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0xd35e2059 [0085.279] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0x8acb2019 [0085.279] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0xbc36b698 [0085.279] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0xd0690c29 [0085.279] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0xc8bfe696 [0085.279] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0xa3e64883 [0085.279] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0x1c7466da [0085.279] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0x71b1735e [0085.279] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0xd3ce2478 [0085.279] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0xdbc38e1e [0085.279] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0x7bfd0812 [0085.279] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0x13eca759 [0085.279] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0xdef45ab8 [0085.280] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0xd96951aa [0085.280] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0x2d08cbdd [0085.280] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0x9e942994 [0085.280] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0x944c30ea [0085.280] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0xce757d84 [0085.280] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0xcd5c6d08 [0085.280] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0x557294c6 [0085.280] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0x954898a5 [0085.280] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0x9cb7c307 [0085.280] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0x783c537 [0085.280] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0x12c4e5de [0085.280] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0x8e8100e5 [0085.280] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0xa1b0f08a [0085.280] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0x4a96cfc3 [0085.280] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0xe3d98e11 [0085.280] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0x3c0078ce [0085.280] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0x7f111dda [0085.280] RtlRandom (in: Seed=0x26c7f930 | out: Seed=0x26c7f930) returned 0xc9657542 [0085.290] SetFilePointerEx (in: hFile=0x204c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.290] ReadFile (in: hFile=0x204c, lpBuffer=0xe1fca78, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x26c7f904, lpOverlapped=0x0 | out: lpBuffer=0xe1fca78*, lpNumberOfBytesRead=0x26c7f904*=0xc800, lpOverlapped=0x0) returned 1 [0085.290] SetFilePointerEx (in: hFile=0x204c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.290] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8528 [0085.290] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x7574b00 [0085.290] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe1fc070 [0085.290] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1fc070) returned 1 [0085.291] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe209280 [0085.296] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe1fbfa8 [0085.296] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe1fc340 [0085.296] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1fc340) returned 1 [0085.296] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7574b00) returned 1 [0085.296] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8528) returned 1 [0085.296] WriteFile (in: hFile=0x204c, lpBuffer=0xe209280*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x26c7f904, lpOverlapped=0x0 | out: lpBuffer=0xe209280*, lpNumberOfBytesWritten=0x26c7f904*=0xc800, lpOverlapped=0x0) returned 1 [0088.989] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe209280) returned 1 [0089.053] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1fca78) returned 1 [0089.053] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3b) returned 0x537b0e0 [0089.053] SetFilePointerEx (in: hFile=0x204c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.053] WriteFile (in: hFile=0x204c, lpBuffer=0x74d9700*, nNumberOfBytesToWrite=0x11f, lpNumberOfBytesWritten=0x26c7f984, lpOverlapped=0x0 | out: lpBuffer=0x74d9700*, lpNumberOfBytesWritten=0x26c7f984*=0x11f, lpOverlapped=0x0) returned 1 [0092.169] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74d9700) returned 1 [0092.169] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537bf38) returned 1 [0092.169] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282c08) returned 1 [0092.169] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x537b0e0) returned 1 [0092.169] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1fbfa8) returned 1 [0092.169] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1fc480) returned 1 [0092.169] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1fc1d8) returned 1 [0092.169] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1fc110) Thread: id = 1071 os_tid = 0x1f00 [0083.080] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\5LyR-.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\llmkz1w\\5lyr-.m4a")) returned 0x20 [0083.080] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\5LyR-.m4a", dwFileAttributes=0x20) returned 1 [0083.080] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\5LyR-.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\llmkz1w\\5lyr-.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2050 [0083.080] GetFileSizeEx (in: hFile=0x2050, lpFileSize=0x26cff7d8 | out: lpFileSize=0x26cff7d8*=62590) returned 1 [0083.080] SetFilePointerEx (in: hFile=0x2050, liDistanceToMove=0xf47a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.080] ReadFile (in: hFile=0x2050, lpBuffer=0x26cff75c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26cff758, lpOverlapped=0x0 | out: lpBuffer=0x26cff75c*, lpNumberOfBytesRead=0x26cff758*=0x4, lpOverlapped=0x0) returned 1 [0083.080] SetFilePointerEx (in: hFile=0x2050, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.080] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe1e20a8 [0085.260] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe1e23a0 [0085.260] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe1e2350 [0085.260] NtQuerySystemTime (in: CurrentTime=0x26cff738 | out: CurrentTime=0x26cff738*=132260136424236565) returned 0x0 [0085.260] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0xc396ea0e [0085.260] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0xd9ddb82f [0085.260] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0xa5013806 [0085.260] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0x5d7bb79f [0085.260] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0x6fbd2601 [0085.260] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0x9d9b1d20 [0085.260] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0x699a7d31 [0085.260] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0x1a2718d1 [0085.260] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0x5d5227a1 [0085.260] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0xd1e6f19e [0085.260] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0xf65bf10 [0085.260] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0x56bd9b3f [0085.260] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0x1810ffb3 [0085.260] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0x9d248d85 [0085.260] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0x4875c068 [0085.260] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0xface62db [0085.260] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0xccf14437 [0085.260] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0x3584bec8 [0085.260] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0xa51af6d9 [0085.260] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0x5c8e82b7 [0085.261] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0x7d5c435e [0085.261] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0x5df79f92 [0085.261] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0x3c4093d4 [0085.261] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0x54acf8a9 [0085.261] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0xf148b045 [0085.261] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0x29fd9a58 [0085.261] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0xd335bda0 [0085.261] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0xb4d9590c [0085.261] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0x2e427fc2 [0085.261] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0x2a994505 [0085.261] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0x8bc385ef [0085.261] RtlRandom (in: Seed=0x26cff744 | out: Seed=0x26cff744) returned 0x600d255 [0085.270] SetFilePointerEx (in: hFile=0x2050, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.270] ReadFile (in: hFile=0x2050, lpBuffer=0xe1e2a60, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x26cff718, lpOverlapped=0x0 | out: lpBuffer=0xe1e2a60*, lpNumberOfBytesRead=0x26cff718*=0xc800, lpOverlapped=0x0) returned 1 [0085.271] SetFilePointerEx (in: hFile=0x2050, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.271] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8528 [0085.271] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x7574b00 [0085.271] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe1e2058 [0085.271] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1e2058) returned 1 [0085.272] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe1ef268 [0085.278] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe1e2468 [0085.278] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe1e2328 [0085.278] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1e2328) returned 1 [0085.278] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7574b00) returned 1 [0085.278] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8528) returned 1 [0085.278] WriteFile (in: hFile=0x2050, lpBuffer=0xe1ef268*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x26cff718, lpOverlapped=0x0 | out: lpBuffer=0xe1ef268*, lpNumberOfBytesWritten=0x26cff718*=0xc800, lpOverlapped=0x0) returned 1 [0088.986] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1ef268) returned 1 [0089.102] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1e2a60) returned 1 [0089.102] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1f) returned 0x7282910 [0089.103] SetFilePointerEx (in: hFile=0x2050, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.103] WriteFile (in: hFile=0x2050, lpBuffer=0x757a6c8*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x26cff798, lpOverlapped=0x0 | out: lpBuffer=0x757a6c8*, lpNumberOfBytesWritten=0x26cff798*=0x103, lpOverlapped=0x0) returned 1 [0092.229] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757a6c8) returned 1 [0092.229] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282c80) returned 1 [0092.229] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282938) returned 1 [0092.229] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282910) returned 1 [0092.229] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1e2468) returned 1 [0092.229] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1e23a0) returned 1 [0092.229] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1e2440) returned 1 [0092.229] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1e20f8) Thread: id = 1072 os_tid = 0x1f04 [0083.081] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\coo4EbVBHlZSJOyb7.pps" (normalized: "c:\\users\\fd1hvy\\desktop\\llmkz1w\\coo4ebvbhlzsjoyb7.pps")) returned 0x20 [0083.081] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\coo4EbVBHlZSJOyb7.pps", dwFileAttributes=0x20) returned 1 [0083.081] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\coo4EbVBHlZSJOyb7.pps" (normalized: "c:\\users\\fd1hvy\\desktop\\llmkz1w\\coo4ebvbhlzsjoyb7.pps"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2054 [0083.082] GetFileSizeEx (in: hFile=0x2054, lpFileSize=0x26d7fd30 | out: lpFileSize=0x26d7fd30*=11706) returned 1 [0083.082] SetFilePointerEx (in: hFile=0x2054, liDistanceToMove=0x2db6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.082] ReadFile (in: hFile=0x2054, lpBuffer=0x26d7fcb4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26d7fcb0, lpOverlapped=0x0 | out: lpBuffer=0x26d7fcb4*, lpNumberOfBytesRead=0x26d7fcb0*=0x4, lpOverlapped=0x0) returned 1 [0083.082] SetFilePointerEx (in: hFile=0x2054, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.082] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe1c7aa0 [0085.248] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe1c7bb8 [0085.248] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe1c7be0 [0085.248] NtQuerySystemTime (in: CurrentTime=0x26d7fc90 | out: CurrentTime=0x26d7fc90*=132260136424080189) returned 0x0 [0085.248] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0x8c277ec2 [0085.248] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0x40470aaa [0085.248] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0x92385071 [0085.248] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0xe4a95053 [0085.248] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0x65134a0b [0085.248] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0xc8927407 [0085.248] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0x8cf589cc [0085.248] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0x14150a5d [0085.249] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0x1227b5b6 [0085.249] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0xe3d6cb7e [0085.249] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0xa14c1048 [0085.249] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0xec2a503b [0085.249] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0xfb92a0f0 [0085.249] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0xfbc2f5f2 [0085.249] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0xaaaf8443 [0085.249] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0x34a14985 [0085.249] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0xfcdd43db [0085.249] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0xf32b183f [0085.249] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0xc8e2ba84 [0085.249] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0x32b39194 [0085.249] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0xa75fb4ee [0085.249] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0x5062b861 [0085.249] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0x922f127b [0085.249] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0xa5f2deba [0085.249] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0x4ad70a2e [0085.249] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0x9bdd6d43 [0085.249] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0xb55a7c64 [0085.249] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0x723fce5e [0085.249] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0x15981df6 [0085.249] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0x539bc17f [0085.249] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0xa24855b9 [0085.249] RtlRandom (in: Seed=0x26d7fc9c | out: Seed=0x26d7fc9c) returned 0x572ddff9 [0085.259] ReadFile (in: hFile=0x2054, lpBuffer=0xe1c8a48, nNumberOfBytesToRead=0x2dba, lpNumberOfBytesRead=0x26d7fc8c, lpOverlapped=0x0 | out: lpBuffer=0xe1c8a48*, lpNumberOfBytesRead=0x26d7fc8c*=0x2dba, lpOverlapped=0x0) returned 1 [0085.260] SetFilePointerEx (in: hFile=0x2054, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.260] WriteFile (in: hFile=0x2054, lpBuffer=0xe1d5250*, nNumberOfBytesToWrite=0x2dba, lpNumberOfBytesWritten=0x26d7fc88, lpOverlapped=0x0 | out: lpBuffer=0xe1d5250*, lpNumberOfBytesWritten=0x26d7fc88*=0x2dba, lpOverlapped=0x0) returned 1 [0088.984] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7280e00 [0088.984] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281058 [0088.984] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7281058) returned 1 [0088.984] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1d5250) returned 1 [0089.103] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1c8a48) returned 1 [0089.103] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7574a88) returned 1 [0089.103] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba84e0) returned 1 [0089.103] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x37) returned 0x5444cc0 [0089.104] SetFilePointerEx (in: hFile=0x2054, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.104] WriteFile (in: hFile=0x2054, lpBuffer=0x75843f0*, nNumberOfBytesToWrite=0x11b, lpNumberOfBytesWritten=0x26d7fcf0, lpOverlapped=0x0 | out: lpBuffer=0x75843f0*, lpNumberOfBytesWritten=0x26d7fcf0*=0x11b, lpOverlapped=0x0) returned 1 [0092.208] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75843f0) returned 1 [0092.208] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444b80) returned 1 [0092.208] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282960) returned 1 [0092.208] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444cc0) returned 1 [0092.208] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7280e00) returned 1 [0092.208] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1c7bb8) returned 1 [0092.208] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1c7ac8) returned 1 [0092.208] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1c7c08) Thread: id = 1073 os_tid = 0x1f08 [0083.082] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\kdektZvR.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\llmkz1w\\kdektzvr.wav")) returned 0x20 [0083.082] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\kdektZvR.wav", dwFileAttributes=0x20) returned 1 [0083.083] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\kdektZvR.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\llmkz1w\\kdektzvr.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2058 [0083.083] GetFileSizeEx (in: hFile=0x2058, lpFileSize=0x26dffce8 | out: lpFileSize=0x26dffce8*=69562) returned 1 [0083.083] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0x10fb6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.083] ReadFile (in: hFile=0x2058, lpBuffer=0x26dffc6c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26dffc68, lpOverlapped=0x0 | out: lpBuffer=0x26dffc6c*, lpNumberOfBytesRead=0x26dffc68*=0x4, lpOverlapped=0x0) returned 1 [0083.083] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.083] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe1ae3e8 [0085.231] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe1ae438 [0085.231] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe1ae0c8 [0085.231] NtQuerySystemTime (in: CurrentTime=0x26dffc48 | out: CurrentTime=0x26dffc48*=132260136423924655) returned 0x0 [0085.231] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0x9434ef0e [0085.231] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0x421f23ff [0085.231] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0x76d183a9 [0085.231] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0x8d164b16 [0085.231] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0xefd466e8 [0085.231] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0xc5e8fe6e [0085.231] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0x22c2242e [0085.231] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0x531bcffc [0085.231] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0xa414d257 [0085.231] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0x4b76fe13 [0085.231] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0x509af4af [0085.231] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0x447ec874 [0085.231] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0x8e72f555 [0085.231] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0x7a3111e4 [0085.231] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0x664dd821 [0085.232] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0xabd6d3a5 [0085.232] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0xeac77d2c [0085.232] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0x468a4d32 [0085.232] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0xcb798d26 [0085.232] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0x3a6f8cc1 [0085.232] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0x5515dfa7 [0085.232] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0x343035b [0085.232] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0x70ab9d6f [0085.232] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0x1a6b9d07 [0085.232] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0xb7c83312 [0085.232] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0xf76b4afd [0085.232] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0xc5c64230 [0085.232] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0x3bab1e49 [0085.232] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0xc7ed6c0a [0085.232] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0x3f29f8d6 [0085.232] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0x195bc5f4 [0085.232] RtlRandom (in: Seed=0x26dffc54 | out: Seed=0x26dffc54) returned 0xf6ee8e23 [0085.241] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.241] ReadFile (in: hFile=0x2058, lpBuffer=0xe1aea30, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x26dffc28, lpOverlapped=0x0 | out: lpBuffer=0xe1aea30*, lpNumberOfBytesRead=0x26dffc28*=0xc800, lpOverlapped=0x0) returned 1 [0085.242] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.242] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba84e0 [0085.242] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x7574a88 [0085.242] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe1ae028 [0085.242] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1ae028) returned 1 [0085.243] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe1bb238 [0085.248] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe1adf60 [0085.248] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe1ae2f8 [0085.248] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1ae2f8) returned 1 [0085.248] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7574a88) returned 1 [0085.248] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba84e0) returned 1 [0085.248] WriteFile (in: hFile=0x2058, lpBuffer=0xe1bb238*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x26dffc28, lpOverlapped=0x0 | out: lpBuffer=0xe1bb238*, lpNumberOfBytesWritten=0x26dffc28*=0xc800, lpOverlapped=0x0) returned 1 [0088.978] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1bb238) returned 1 [0089.104] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1aea30) returned 1 [0089.104] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x25) returned 0x38a67f0 [0089.104] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.104] WriteFile (in: hFile=0x2058, lpBuffer=0x757a7e0*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x26dffca8, lpOverlapped=0x0 | out: lpBuffer=0x757a7e0*, lpNumberOfBytesWritten=0x26dffca8*=0x109, lpOverlapped=0x0) returned 1 [0092.210] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757a7e0) returned 1 [0092.210] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a66d0) returned 1 [0092.210] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282988) returned 1 [0092.210] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a67f0) returned 1 [0092.210] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1adf60) returned 1 [0092.210] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1ae438) returned 1 [0092.210] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1adfb0) returned 1 [0092.210] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1ae0f0) Thread: id = 1074 os_tid = 0x1f0c [0083.083] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x7584100 [0083.083] wcscpy (in: _Dest=0x7584100, _Source="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\NgMGpHjS" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\NgMGpHjS") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\NgMGpHjS" [0083.083] wcscat (in: _Dest=0x7584100, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\NgMGpHjS\\") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\NgMGpHjS\\" [0083.083] wcscat (in: _Dest=0x7584100, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\NgMGpHjS\\*") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\NgMGpHjS\\*" [0083.084] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3938918 [0083.084] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\NgMGpHjS\\*", lpFindFileData=0x3938918 | out: lpFindFileData=0x3938918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf404620, ftCreationTime.dwHighDateTime=0x1d5cf37, ftLastAccessTime.dwLowDateTime=0xb34c7240, ftLastAccessTime.dwHighDateTime=0x1d5d596, ftLastWriteTime.dwLowDateTime=0xb34c7240, ftLastWriteTime.dwHighDateTime=0x1d5d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445100 [0083.084] wcscmp (_String1=".", _String2=".") returned 0 [0083.084] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x3938918 | out: lpFindFileData=0x3938918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf404620, ftCreationTime.dwHighDateTime=0x1d5cf37, ftLastAccessTime.dwLowDateTime=0xb34c7240, ftLastAccessTime.dwHighDateTime=0x1d5d596, ftLastWriteTime.dwLowDateTime=0xb34c7240, ftLastWriteTime.dwHighDateTime=0x1d5d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.084] wcscmp (_String1="..", _String2=".") returned 1 [0083.084] wcscmp (_String1="..", _String2="..") returned 0 [0083.084] FindNextFileW (in: hFindFile=0x5445100, lpFindFileData=0x3938918 | out: lpFindFileData=0x3938918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf62981b0, ftCreationTime.dwHighDateTime=0x1d5d60a, ftLastAccessTime.dwLowDateTime=0xf6ac5ca0, ftLastAccessTime.dwHighDateTime=0x1d5cb9e, ftLastWriteTime.dwLowDateTime=0xf6ac5ca0, ftLastWriteTime.dwHighDateTime=0x1d5cb9e, nFileSizeHigh=0x0, nFileSizeLow=0x630b, dwReserved0=0x0, dwReserved1=0x0, cFileName="aW_TT7wnqnrFVd.csv", cAlternateFileName="AW_TT7~1.CSV")) returned 1 [0083.084] wcscmp (_String1="aW_TT7wnqnrFVd.csv", _String2=".") returned 1 [0083.084] wcscmp (_String1="aW_TT7wnqnrFVd.csv", _String2="..") returned 1 [0083.084] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x78) returned 0x38d11a0 [0083.084] wcscpy (in: _Dest=0x38d11a0, _Source="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\NgMGpHjS" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\NgMGpHjS") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\NgMGpHjS" [0083.084] wcscat (in: _Dest=0x38d11a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\NgMGpHjS\\") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\NgMGpHjS\\" [0083.084] wcscat (in: _Dest=0x38d11a0, _Source="aW_TT7wnqnrFVd.csv" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\NgMGpHjS\\aW_TT7wnqnrFVd.csv") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\NgMGpHjS\\aW_TT7wnqnrFVd.csv" [0083.084] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\NgMGpHjS\\aW_TT7wnqnrFVd.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\llmkz1w\\ngmgphjs\\aw_tt7wnqnrfvd.csv")) returned 0x20 [0083.084] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\NgMGpHjS\\aW_TT7wnqnrFVd.csv", dwFileAttributes=0x20) returned 1 [0083.084] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\NgMGpHjS\\aW_TT7wnqnrFVd.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\llmkz1w\\ngmgphjs\\aw_tt7wnqnrfvd.csv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2060 [0083.085] GetFileSizeEx (in: hFile=0x2060, lpFileSize=0x26e7fd84 | out: lpFileSize=0x26e7fd84*=25355) returned 1 [0083.085] SetFilePointerEx (in: hFile=0x2060, liDistanceToMove=0x6307, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.085] ReadFile (in: hFile=0x2060, lpBuffer=0x26e7fd08, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26e7fd04, lpOverlapped=0x0 | out: lpBuffer=0x26e7fd08*, lpNumberOfBytesRead=0x26e7fd04*=0x4, lpOverlapped=0x0) returned 1 [0083.085] SetFilePointerEx (in: hFile=0x2060, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.085] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe194420 [0085.219] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe193f48 [0085.219] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe194010 [0085.219] NtQuerySystemTime (in: CurrentTime=0x26e7fce4 | out: CurrentTime=0x26e7fce4*=132260136423768483) returned 0x0 [0085.219] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0x7644d8f1 [0085.219] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0x9f140fc2 [0085.219] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0x4ac5f2c7 [0085.219] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0xf0947a4b [0085.219] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0x4c40f499 [0085.219] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0x4fbca826 [0085.219] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0x28aae978 [0085.219] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0x7abf6911 [0085.219] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0x7a8459fc [0085.219] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0x73b8a53c [0085.219] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0x4bc0e14b [0085.219] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0xef19f7d6 [0085.219] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0x8f5b7249 [0085.219] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0x4878780 [0085.219] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0x503204d9 [0085.219] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0xc35bba4e [0085.219] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0x5a42bee5 [0085.219] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0xb50f145 [0085.219] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0x16998925 [0085.219] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0xfddf470d [0085.219] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0xc385da66 [0085.219] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0x6038e1f7 [0085.219] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0x172e961c [0085.219] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0x5daff9e7 [0085.219] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0xb1d59822 [0085.219] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0x82cc170d [0085.219] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0x12edb953 [0085.219] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0xdbce49d3 [0085.220] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0xafb5cc25 [0085.220] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0x97207b95 [0085.220] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0x26589531 [0085.220] RtlRandom (in: Seed=0x26e7fcf0 | out: Seed=0x26e7fcf0) returned 0x70ad716f [0085.230] ReadFile (in: hFile=0x2060, lpBuffer=0xe194a18, nNumberOfBytesToRead=0x630b, lpNumberOfBytesRead=0x26e7fce0, lpOverlapped=0x0 | out: lpBuffer=0xe194a18*, lpNumberOfBytesRead=0x26e7fce0*=0x630b, lpOverlapped=0x0) returned 1 [0085.231] SetFilePointerEx (in: hFile=0x2060, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.231] WriteFile (in: hFile=0x2060, lpBuffer=0xe1a1220*, nNumberOfBytesToWrite=0x630b, lpNumberOfBytesWritten=0x26e7fcdc, lpOverlapped=0x0 | out: lpBuffer=0xe1a1220*, lpNumberOfBytesWritten=0x26e7fcdc*=0x630b, lpOverlapped=0x0) returned 1 [0088.975] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281120 [0088.975] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7280f40 [0088.975] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7280f40) returned 1 [0088.975] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1a1220) returned 1 [0089.104] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe194a18) returned 1 [0089.104] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7574a10) returned 1 [0089.105] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8498) returned 1 [0089.105] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x31) returned 0x5444d40 [0089.105] SetFilePointerEx (in: hFile=0x2060, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.105] WriteFile (in: hFile=0x2060, lpBuffer=0x75849b8*, nNumberOfBytesToWrite=0x115, lpNumberOfBytesWritten=0x26e7fd44, lpOverlapped=0x0 | out: lpBuffer=0x75849b8*, lpNumberOfBytesWritten=0x26e7fd44*=0x115, lpOverlapped=0x0) returned 1 [0092.213] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75849b8) returned 1 [0092.213] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444e40) returned 1 [0092.213] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x72829d8) returned 1 [0092.214] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444d40) returned 1 [0092.214] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7281120) returned 1 [0092.214] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe193f48) returned 1 [0092.214] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe193f70) returned 1 [0092.214] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1940d8) Thread: id = 1075 os_tid = 0x1f10 [0083.085] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x68) returned 0x5468cc0 [0083.085] wcscpy (in: _Dest=0x5468cc0, _Source="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB" [0083.085] wcscat (in: _Dest=0x5468cc0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\" [0083.085] wcscat (in: _Dest=0x5468cc0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\*") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\*" [0083.085] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3938b80 [0083.085] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\*", lpFindFileData=0x3938b80 | out: lpFindFileData=0x3938b80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2feac8d0, ftCreationTime.dwHighDateTime=0x1d5d0bd, ftLastAccessTime.dwLowDateTime=0x2e6ea280, ftLastAccessTime.dwHighDateTime=0x1d5d412, ftLastWriteTime.dwLowDateTime=0x2e6ea280, ftLastWriteTime.dwHighDateTime=0x1d5d412, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ee00 [0085.218] wcscmp (_String1=".", _String2=".") returned 0 [0085.218] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x3938b80 | out: lpFindFileData=0x3938b80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2feac8d0, ftCreationTime.dwHighDateTime=0x1d5d0bd, ftLastAccessTime.dwLowDateTime=0x2e6ea280, ftLastAccessTime.dwHighDateTime=0x1d5d412, ftLastWriteTime.dwLowDateTime=0x2e6ea280, ftLastWriteTime.dwHighDateTime=0x1d5d412, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.218] wcscmp (_String1="..", _String2=".") returned 1 [0085.218] wcscmp (_String1="..", _String2="..") returned 0 [0085.218] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x3938b80 | out: lpFindFileData=0x3938b80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e820dc0, ftCreationTime.dwHighDateTime=0x1d5d0ba, ftLastAccessTime.dwLowDateTime=0x84ef3fc0, ftLastAccessTime.dwHighDateTime=0x1d5d192, ftLastWriteTime.dwLowDateTime=0x84ef3fc0, ftLastWriteTime.dwHighDateTime=0x1d5d192, nFileSizeHigh=0x0, nFileSizeLow=0x181c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="3M3v_A7CybEX1zV.png", cAlternateFileName="3M3V_A~1.PNG")) returned 1 [0085.218] wcscmp (_String1="3M3v_A7CybEX1zV.png", _String2=".") returned 1 [0085.218] wcscmp (_String1="3M3v_A7CybEX1zV.png", _String2="..") returned 1 [0085.218] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8c) returned 0x549f7c8 [0085.219] wcscpy (in: _Dest=0x549f7c8, _Source="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB" [0085.219] wcscat (in: _Dest=0x549f7c8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\" [0085.219] wcscat (in: _Dest=0x549f7c8, _Source="3M3v_A7CybEX1zV.png" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\3M3v_A7CybEX1zV.png") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\3M3v_A7CybEX1zV.png" [0088.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549f7c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x954 [0088.856] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x3938b80 | out: lpFindFileData=0x3938b80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fb3eed0, ftCreationTime.dwHighDateTime=0x1d5d3fa, ftLastAccessTime.dwLowDateTime=0x2e771520, ftLastAccessTime.dwHighDateTime=0x1d5cc4a, ftLastWriteTime.dwLowDateTime=0x2e771520, ftLastWriteTime.dwHighDateTime=0x1d5cc4a, nFileSizeHigh=0x0, nFileSizeLow=0xc42e, dwReserved0=0x0, dwReserved1=0x0, cFileName="8fSuXkg9Nz0uGh.mp3", cAlternateFileName="8FSUXK~1.MP3")) returned 1 [0088.856] wcscmp (_String1="8fSuXkg9Nz0uGh.mp3", _String2=".") returned 1 [0088.856] wcscmp (_String1="8fSuXkg9Nz0uGh.mp3", _String2="..") returned 1 [0088.856] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8a) returned 0x549ed18 [0088.856] wcscpy (in: _Dest=0x549ed18, _Source="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB" [0088.856] wcscat (in: _Dest=0x549ed18, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\" [0088.856] wcscat (in: _Dest=0x549ed18, _Source="8fSuXkg9Nz0uGh.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\8fSuXkg9Nz0uGh.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\8fSuXkg9Nz0uGh.mp3" [0088.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549ed18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17e4 [0088.856] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x3938b80 | out: lpFindFileData=0x3938b80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe411f20, ftCreationTime.dwHighDateTime=0x1d5d7bc, ftLastAccessTime.dwLowDateTime=0x5b3de160, ftLastAccessTime.dwHighDateTime=0x1d5cc36, ftLastWriteTime.dwLowDateTime=0x5b3de160, ftLastWriteTime.dwHighDateTime=0x1d5cc36, nFileSizeHigh=0x0, nFileSizeLow=0xd537, dwReserved0=0x0, dwReserved1=0x0, cFileName="FsSAE.docx", cAlternateFileName="FSSAE~1.DOC")) returned 1 [0088.857] wcscmp (_String1="FsSAE.docx", _String2=".") returned 1 [0088.857] wcscmp (_String1="FsSAE.docx", _String2="..") returned 1 [0088.857] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7a) returned 0x3977110 [0088.857] wcscpy (in: _Dest=0x3977110, _Source="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB" [0088.857] wcscat (in: _Dest=0x3977110, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\" [0088.857] wcscat (in: _Dest=0x3977110, _Source="FsSAE.docx" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\FsSAE.docx") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\FsSAE.docx" [0088.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3977110, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17e0 [0088.857] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x3938b80 | out: lpFindFileData=0x3938b80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86765d0, ftCreationTime.dwHighDateTime=0x1d5d076, ftLastAccessTime.dwLowDateTime=0x1020cdc0, ftLastAccessTime.dwHighDateTime=0x1d5d2b0, ftLastWriteTime.dwLowDateTime=0x1020cdc0, ftLastWriteTime.dwHighDateTime=0x1d5d2b0, nFileSizeHigh=0x0, nFileSizeLow=0xc1db, dwReserved0=0x0, dwReserved1=0x0, cFileName="GHuzJTYw.avi", cAlternateFileName="")) returned 1 [0088.857] wcscmp (_String1="GHuzJTYw.avi", _String2=".") returned 1 [0088.857] wcscmp (_String1="GHuzJTYw.avi", _String2="..") returned 1 [0088.857] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7e) returned 0x3977440 [0088.857] wcscpy (in: _Dest=0x3977440, _Source="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB" [0088.857] wcscat (in: _Dest=0x3977440, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\" [0088.857] wcscat (in: _Dest=0x3977440, _Source="GHuzJTYw.avi" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\GHuzJTYw.avi") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\GHuzJTYw.avi" [0088.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3977440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17dc [0088.858] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x3938b80 | out: lpFindFileData=0x3938b80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x400a1dd0, ftCreationTime.dwHighDateTime=0x1d5d55c, ftLastAccessTime.dwLowDateTime=0x1720040, ftLastAccessTime.dwHighDateTime=0x1d5d586, ftLastWriteTime.dwLowDateTime=0x1720040, ftLastWriteTime.dwHighDateTime=0x1d5d586, nFileSizeHigh=0x0, nFileSizeLow=0x15350, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jik_KOLk7P.mp3", cAlternateFileName="JIK_KO~1.MP3")) returned 1 [0088.858] wcscmp (_String1="Jik_KOLk7P.mp3", _String2=".") returned 1 [0088.858] wcscmp (_String1="Jik_KOLk7P.mp3", _String2="..") returned 1 [0088.858] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x82) returned 0x549cea8 [0088.858] wcscpy (in: _Dest=0x549cea8, _Source="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB" [0088.858] wcscat (in: _Dest=0x549cea8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\" [0088.858] wcscat (in: _Dest=0x549cea8, _Source="Jik_KOLk7P.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\Jik_KOLk7P.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\Jik_KOLk7P.mp3" [0088.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549cea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17d8 [0088.859] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x3938b80 | out: lpFindFileData=0x3938b80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24d045c0, ftCreationTime.dwHighDateTime=0x1d5c847, ftLastAccessTime.dwLowDateTime=0x3e78d2d0, ftLastAccessTime.dwHighDateTime=0x1d5d585, ftLastWriteTime.dwLowDateTime=0x3e78d2d0, ftLastWriteTime.dwHighDateTime=0x1d5d585, nFileSizeHigh=0x0, nFileSizeLow=0x3b67, dwReserved0=0x0, dwReserved1=0x0, cFileName="JKdqbhUfHdihs.docx", cAlternateFileName="JKDQBH~1.DOC")) returned 1 [0088.859] wcscmp (_String1="JKdqbhUfHdihs.docx", _String2=".") returned 1 [0088.859] wcscmp (_String1="JKdqbhUfHdihs.docx", _String2="..") returned 1 [0088.859] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8a) returned 0x549edb0 [0088.859] wcscpy (in: _Dest=0x549edb0, _Source="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB" [0088.859] wcscat (in: _Dest=0x549edb0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\" [0088.859] wcscat (in: _Dest=0x549edb0, _Source="JKdqbhUfHdihs.docx" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\JKdqbhUfHdihs.docx") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\JKdqbhUfHdihs.docx" [0088.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549edb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17d4 [0088.860] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x3938b80 | out: lpFindFileData=0x3938b80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7778db80, ftCreationTime.dwHighDateTime=0x1d5d4c6, ftLastAccessTime.dwLowDateTime=0x519bc260, ftLastAccessTime.dwHighDateTime=0x1d5cf85, ftLastWriteTime.dwLowDateTime=0x519bc260, ftLastWriteTime.dwHighDateTime=0x1d5cf85, nFileSizeHigh=0x0, nFileSizeLow=0x11734, dwReserved0=0x0, dwReserved1=0x0, cFileName="JQF6Y2EQ.swf", cAlternateFileName="")) returned 1 [0088.860] wcscmp (_String1="JQF6Y2EQ.swf", _String2=".") returned 1 [0088.860] wcscmp (_String1="JQF6Y2EQ.swf", _String2="..") returned 1 [0088.860] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7e) returned 0x3977550 [0088.860] wcscpy (in: _Dest=0x3977550, _Source="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB" [0088.860] wcscat (in: _Dest=0x3977550, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\" [0088.860] wcscat (in: _Dest=0x3977550, _Source="JQF6Y2EQ.swf" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\JQF6Y2EQ.swf") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\JQF6Y2EQ.swf" [0088.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3977550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17d0 [0088.860] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x3938b80 | out: lpFindFileData=0x3938b80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42ec6850, ftCreationTime.dwHighDateTime=0x1d5d7f0, ftLastAccessTime.dwLowDateTime=0x3733c180, ftLastAccessTime.dwHighDateTime=0x1d5d290, ftLastWriteTime.dwLowDateTime=0x3733c180, ftLastWriteTime.dwHighDateTime=0x1d5d290, nFileSizeHigh=0x0, nFileSizeLow=0xd7c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="N UnSNd.swf", cAlternateFileName="NUNSND~1.SWF")) returned 1 [0088.860] wcscmp (_String1="N UnSNd.swf", _String2=".") returned 1 [0088.861] wcscmp (_String1="N UnSNd.swf", _String2="..") returned 1 [0088.861] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7c) returned 0x3977660 [0088.861] wcscpy (in: _Dest=0x3977660, _Source="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB" [0088.861] wcscat (in: _Dest=0x3977660, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\" [0088.861] wcscat (in: _Dest=0x3977660, _Source="N UnSNd.swf" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\N UnSNd.swf") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\N UnSNd.swf" [0088.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3977660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17cc [0088.861] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x3938b80 | out: lpFindFileData=0x3938b80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2989da0, ftCreationTime.dwHighDateTime=0x1d5ca96, ftLastAccessTime.dwLowDateTime=0x9b31b310, ftLastAccessTime.dwHighDateTime=0x1d5cb77, ftLastWriteTime.dwLowDateTime=0x9b31b310, ftLastWriteTime.dwHighDateTime=0x1d5cb77, nFileSizeHigh=0x0, nFileSizeLow=0x27dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z0m0eECvz66.swf", cAlternateFileName="Z0M0EE~1.SWF")) returned 1 [0088.861] wcscmp (_String1="Z0m0eECvz66.swf", _String2=".") returned 1 [0088.861] wcscmp (_String1="Z0m0eECvz66.swf", _String2="..") returned 1 [0088.861] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x84) returned 0x549cb48 [0088.861] wcscpy (in: _Dest=0x549cb48, _Source="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB" [0088.861] wcscat (in: _Dest=0x549cb48, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\" [0088.861] wcscat (in: _Dest=0x549cb48, _Source="Z0m0eECvz66.swf" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\Z0m0eECvz66.swf") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\Z0m0eECvz66.swf" [0088.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549cb48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17c8 [0088.862] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x3938b80 | out: lpFindFileData=0x3938b80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2989da0, ftCreationTime.dwHighDateTime=0x1d5ca96, ftLastAccessTime.dwLowDateTime=0x9b31b310, ftLastAccessTime.dwHighDateTime=0x1d5cb77, ftLastWriteTime.dwLowDateTime=0x9b31b310, ftLastWriteTime.dwHighDateTime=0x1d5cb77, nFileSizeHigh=0x0, nFileSizeLow=0x27dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z0m0eECvz66.swf", cAlternateFileName="Z0M0EE~1.SWF")) returned 0 [0088.862] FindClose (in: hFindFile=0x389ee00 | out: hFindFile=0x389ee00) returned 1 [0088.862] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3938b80) returned 1 [0088.862] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5468cc0) returned 1 [0088.862] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba7968) returned 1 Thread: id = 1076 os_tid = 0x1f14 [0083.086] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\Xs_PfQV6pA.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\llmkz1w\\xs_pfqv6pa.mp3")) returned 0x20 [0083.086] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\Xs_PfQV6pA.mp3", dwFileAttributes=0x20) returned 1 [0083.086] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\Xs_PfQV6pA.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\llmkz1w\\xs_pfqv6pa.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2064 [0083.086] GetFileSizeEx (in: hFile=0x2064, lpFileSize=0x26f7f90c | out: lpFileSize=0x26f7f90c*=55972) returned 1 [0083.086] SetFilePointerEx (in: hFile=0x2064, liDistanceToMove=0xdaa0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.086] ReadFile (in: hFile=0x2064, lpBuffer=0x26f7f890, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26f7f88c, lpOverlapped=0x0 | out: lpBuffer=0x26f7f890*, lpNumberOfBytesRead=0x26f7f88c*=0x4, lpOverlapped=0x0) returned 1 [0083.086] SetFilePointerEx (in: hFile=0x2064, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.086] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e4858 [0085.201] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e4790 [0085.201] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e4948 [0085.201] NtQuerySystemTime (in: CurrentTime=0x26f7f86c | out: CurrentTime=0x26f7f86c*=132260136423611624) returned 0x0 [0085.201] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0x733bac5f [0085.201] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0x23f3a5b5 [0085.201] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0xa93fefa3 [0085.201] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0x4c5c4cb0 [0085.201] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0x85403a5a [0085.201] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0x6340c364 [0085.201] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0x160b591 [0085.201] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0x55d27e3e [0085.201] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0xcd2e60b [0085.201] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0xc0c6012c [0085.201] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0x3c4cd2da [0085.201] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0xcc2a6b2a [0085.201] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0x39f65e2c [0085.201] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0xc6490d94 [0085.201] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0x5baaa43f [0085.201] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0x9f4cac12 [0085.201] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0x8dde5b6f [0085.201] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0xa93c0274 [0085.201] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0xb9971f0a [0085.201] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0x9257fe81 [0085.201] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0x30c1a4f6 [0085.201] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0x73495d5f [0085.201] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0x64f288c9 [0085.201] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0xe89e94d1 [0085.201] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0x7d6b908b [0085.201] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0x73759267 [0085.201] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0xffbafe81 [0085.201] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0xe28f2531 [0085.202] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0x34c4493e [0085.202] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0x514af959 [0085.202] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0x414bf81e [0085.202] RtlRandom (in: Seed=0x26f7f878 | out: Seed=0x26f7f878) returned 0xa22fb03b [0085.211] SetFilePointerEx (in: hFile=0x2064, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.211] ReadFile (in: hFile=0x2064, lpBuffer=0xe1799f8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x26f7f84c, lpOverlapped=0x0 | out: lpBuffer=0xe1799f8*, lpNumberOfBytesRead=0x26f7f84c*=0xc800, lpOverlapped=0x0) returned 1 [0085.211] SetFilePointerEx (in: hFile=0x2064, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.212] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8498 [0085.212] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x7575460 [0085.212] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e4718 [0085.212] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e4718) returned 1 [0085.212] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe186200 [0085.217] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e46c8 [0085.217] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e4a88 [0085.217] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e4a88) returned 1 [0085.217] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7575460) returned 1 [0085.218] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8498) returned 1 [0085.218] WriteFile (in: hFile=0x2064, lpBuffer=0xe186200*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x26f7f84c, lpOverlapped=0x0 | out: lpBuffer=0xe186200*, lpNumberOfBytesWritten=0x26f7f84c*=0xc800, lpOverlapped=0x0) returned 1 [0088.976] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe186200) returned 1 [0089.104] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1799f8) returned 1 [0089.104] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x29) returned 0x54b6cd0 [0089.104] SetFilePointerEx (in: hFile=0x2064, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.104] WriteFile (in: hFile=0x2064, lpBuffer=0x757a8f8*, nNumberOfBytesToWrite=0x10d, lpNumberOfBytesWritten=0x26f7f8cc, lpOverlapped=0x0 | out: lpBuffer=0x757a8f8*, lpNumberOfBytesWritten=0x26f7f8cc*=0x10d, lpOverlapped=0x0) returned 1 [0092.212] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757a8f8) returned 1 [0092.212] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b6e20) returned 1 [0092.212] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x72829b0) returned 1 [0092.212] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b6cd0) returned 1 [0092.212] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e46c8) returned 1 [0092.212] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e4790) returned 1 [0092.212] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e46a0) returned 1 [0092.212] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e47e0) Thread: id = 1077 os_tid = 0x1f18 [0083.087] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\ZoSDUSz3c59BTS.png" (normalized: "c:\\users\\fd1hvy\\desktop\\llmkz1w\\zosdusz3c59bts.png")) returned 0x20 [0085.183] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\ZoSDUSz3c59BTS.png", dwFileAttributes=0x20) returned 1 [0085.183] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\ZoSDUSz3c59BTS.png" (normalized: "c:\\users\\fd1hvy\\desktop\\llmkz1w\\zosdusz3c59bts.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x97c [0085.184] GetFileSizeEx (in: hFile=0x97c, lpFileSize=0x26fffb10 | out: lpFileSize=0x26fffb10*=65671) returned 1 [0085.184] SetFilePointerEx (in: hFile=0x97c, liDistanceToMove=0x10083, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.184] ReadFile (in: hFile=0x97c, lpBuffer=0x26fffa94, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26fffa90, lpOverlapped=0x0 | out: lpBuffer=0x26fffa94*, lpNumberOfBytesRead=0x26fffa90*=0x4, lpOverlapped=0x0) returned 1 [0085.184] SetFilePointerEx (in: hFile=0x97c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.184] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe146ad0 [0085.184] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe146b98 [0085.184] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe146c10 [0085.184] NtQuerySystemTime (in: CurrentTime=0x26fffa70 | out: CurrentTime=0x26fffa70*=132260136423476103) returned 0x0 [0085.184] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0x3816b545 [0085.184] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0xa33b4cf6 [0085.184] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0x91ebe0a4 [0085.184] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0x2f59209b [0085.184] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0xc6fb4331 [0085.184] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0xf6047151 [0085.184] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0x41bb2716 [0085.184] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0xc47fd4ef [0085.184] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0x45312f36 [0085.184] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0x9a4e8e54 [0085.184] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0x59fe5590 [0085.184] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0x85f91fe6 [0085.184] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0x460e404c [0085.184] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0xc3e9592d [0085.184] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0x4f705eb2 [0085.184] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0x70baed81 [0085.184] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0x40413bf6 [0085.184] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0x4afe6e21 [0085.184] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0xddad26ff [0085.184] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0xc868e4a9 [0085.184] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0x43c5f7c6 [0085.184] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0x27247170 [0085.184] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0x69ab501d [0085.184] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0x17ad7235 [0085.184] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0x7143fe3b [0085.185] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0x4f5284ac [0085.185] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0xf6edea4d [0085.185] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0x59c042 [0085.185] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0xfe0edacd [0085.185] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0x7a048d18 [0085.185] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0x538544de [0085.185] RtlRandom (in: Seed=0x26fffa7c | out: Seed=0x26fffa7c) returned 0x20cfe5bf [0085.194] SetFilePointerEx (in: hFile=0x97c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.194] ReadFile (in: hFile=0x97c, lpBuffer=0xe1609e8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x26fffa50, lpOverlapped=0x0 | out: lpBuffer=0xe1609e8*, lpNumberOfBytesRead=0x26fffa50*=0xc800, lpOverlapped=0x0) returned 1 [0085.194] SetFilePointerEx (in: hFile=0x97c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.194] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8498 [0085.194] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x7575460 [0085.194] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe146ad0 [0085.194] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe146ad0) returned 1 [0085.195] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe16d1f0 [0085.200] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe146a58 [0085.200] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe146e40 [0085.200] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe146e40) returned 1 [0085.200] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7575460) returned 1 [0085.200] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8498) returned 1 [0085.200] WriteFile (in: hFile=0x97c, lpBuffer=0xe16d1f0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x26fffa50, lpOverlapped=0x0 | out: lpBuffer=0xe16d1f0*, lpNumberOfBytesWritten=0x26fffa50*=0xc800, lpOverlapped=0x0) returned 1 [0088.974] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe16d1f0) returned 1 [0089.105] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1609e8) returned 1 [0089.105] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x31) returned 0x5444dc0 [0089.105] SetFilePointerEx (in: hFile=0x97c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.105] WriteFile (in: hFile=0x97c, lpBuffer=0x7584518*, nNumberOfBytesToWrite=0x115, lpNumberOfBytesWritten=0x26fffad0, lpOverlapped=0x0 | out: lpBuffer=0x7584518*, lpNumberOfBytesWritten=0x26fffad0*=0x115, lpOverlapped=0x0) returned 1 [0092.215] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7584518) returned 1 [0092.215] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444e00) returned 1 [0092.215] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282a00) returned 1 [0092.215] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444dc0) returned 1 [0092.215] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe146a58) returned 1 [0092.215] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe146b98) returned 1 [0092.215] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe146e68) returned 1 [0092.215] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe146b70) returned 1 [0092.215] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa6) returned 0x74e08b8 [0092.215] wcscpy (in: _Dest=0x74e08b8, _Source="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\ZoSDUSz3c59BTS.png" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\ZoSDUSz3c59BTS.png") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\ZoSDUSz3c59BTS.png" [0092.215] wcscat (in: _Dest=0x74e08b8, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\ZoSDUSz3c59BTS.png.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\ZoSDUSz3c59BTS.png.mailto[knoocknoo@cock.li].a0a70" [0092.215] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\ZoSDUSz3c59BTS.png.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x26fffa88, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\ZoSDUSz3c59BTS.png.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.216] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x53e8350 Thread: id = 1078 os_tid = 0x1f1c [0083.087] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x76) returned 0x38d1220 [0083.088] wcscpy (in: _Dest=0x38d1220, _Source="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm") returned="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm" [0083.088] wcscat (in: _Dest=0x38d1220, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm\\") returned="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm\\" [0083.088] wcscat (in: _Dest=0x38d1220, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm\\*") returned="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm\\*" [0083.088] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3938de8 [0083.088] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm\\*", lpFindFileData=0x3938de8 | out: lpFindFileData=0x3938de8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf96bbf80, ftCreationTime.dwHighDateTime=0x1d5cf27, ftLastAccessTime.dwLowDateTime=0xb90718b0, ftLastAccessTime.dwHighDateTime=0x1d5d73b, ftLastWriteTime.dwLowDateTime=0xb90718b0, ftLastWriteTime.dwHighDateTime=0x1d5d73b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445140 [0083.088] wcscmp (_String1=".", _String2=".") returned 0 [0083.088] FindNextFileW (in: hFindFile=0x5445140, lpFindFileData=0x3938de8 | out: lpFindFileData=0x3938de8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf96bbf80, ftCreationTime.dwHighDateTime=0x1d5cf27, ftLastAccessTime.dwLowDateTime=0xb90718b0, ftLastAccessTime.dwHighDateTime=0x1d5d73b, ftLastWriteTime.dwLowDateTime=0xb90718b0, ftLastWriteTime.dwHighDateTime=0x1d5d73b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.088] wcscmp (_String1="..", _String2=".") returned 1 [0083.088] wcscmp (_String1="..", _String2="..") returned 0 [0083.088] FindNextFileW (in: hFindFile=0x5445140, lpFindFileData=0x3938de8 | out: lpFindFileData=0x3938de8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f58850, ftCreationTime.dwHighDateTime=0x1d5d801, ftLastAccessTime.dwLowDateTime=0x558e8270, ftLastAccessTime.dwHighDateTime=0x1d5cc3a, ftLastWriteTime.dwLowDateTime=0x558e8270, ftLastWriteTime.dwHighDateTime=0x1d5cc3a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0Aug", cAlternateFileName="")) returned 1 [0083.088] wcscmp (_String1="0Aug", _String2=".") returned 1 [0083.088] wcscmp (_String1="0Aug", _String2="..") returned 1 [0083.088] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7c) returned 0x3976ab0 [0083.088] wcscpy (in: _Dest=0x3976ab0, _Source="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm") returned="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm" [0083.088] wcscat (in: _Dest=0x3976ab0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm\\") returned="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm\\" [0083.088] wcscat (in: _Dest=0x3976ab0, _Source="0Aug" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm\\0Aug") returned="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm\\0Aug" [0083.088] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x80) returned 0x3977908 [0083.088] wcscpy (in: _Dest=0x3977908, _Source="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm\\0Aug" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm\\0Aug") returned="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm\\0Aug" [0083.088] wcscat (in: _Dest=0x3977908, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm\\0Aug\\") returned="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm\\0Aug\\" [0083.088] wcscat (in: _Dest=0x3977908, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm\\0Aug\\*") returned="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm\\0Aug\\*" [0083.088] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3939c58 [0083.088] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm\\0Aug\\*", lpFindFileData=0x3939c58 | out: lpFindFileData=0x3939c58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f58850, ftCreationTime.dwHighDateTime=0x1d5d801, ftLastAccessTime.dwLowDateTime=0x558e8270, ftLastAccessTime.dwHighDateTime=0x1d5cc3a, ftLastWriteTime.dwLowDateTime=0x558e8270, ftLastWriteTime.dwHighDateTime=0x1d5cc3a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444b40 [0083.089] wcscmp (_String1=".", _String2=".") returned 0 [0083.089] FindNextFileW (in: hFindFile=0x5444b40, lpFindFileData=0x3939c58 | out: lpFindFileData=0x3939c58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f58850, ftCreationTime.dwHighDateTime=0x1d5d801, ftLastAccessTime.dwLowDateTime=0x558e8270, ftLastAccessTime.dwHighDateTime=0x1d5cc3a, ftLastWriteTime.dwLowDateTime=0x558e8270, ftLastWriteTime.dwHighDateTime=0x1d5cc3a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.089] wcscmp (_String1="..", _String2=".") returned 1 [0083.089] wcscmp (_String1="..", _String2="..") returned 0 [0083.089] FindNextFileW (in: hFindFile=0x5444b40, lpFindFileData=0x3939c58 | out: lpFindFileData=0x3939c58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe521960, ftCreationTime.dwHighDateTime=0x1d5c809, ftLastAccessTime.dwLowDateTime=0xf76d2b20, ftLastAccessTime.dwHighDateTime=0x1d5d26e, ftLastWriteTime.dwLowDateTime=0xf76d2b20, ftLastWriteTime.dwHighDateTime=0x1d5d26e, nFileSizeHigh=0x0, nFileSizeLow=0xcad7, dwReserved0=0x0, dwReserved1=0x0, cFileName="InreizrY1C1XHVh.xls", cAlternateFileName="INREIZ~1.XLS")) returned 1 [0083.089] wcscmp (_String1="InreizrY1C1XHVh.xls", _String2=".") returned 1 [0083.089] wcscmp (_String1="InreizrY1C1XHVh.xls", _String2="..") returned 1 [0083.089] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa4) returned 0x54dfc60 [0083.089] wcscpy (in: _Dest=0x54dfc60, _Source="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm\\0Aug" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm\\0Aug") returned="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm\\0Aug" [0083.089] wcscat (in: _Dest=0x54dfc60, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm\\0Aug\\") returned="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm\\0Aug\\" [0083.089] wcscat (in: _Dest=0x54dfc60, _Source="InreizrY1C1XHVh.xls" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm\\0Aug\\InreizrY1C1XHVh.xls") returned="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm\\0Aug\\InreizrY1C1XHVh.xls" [0083.089] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm\\0Aug\\InreizrY1C1XHVh.xls" (normalized: "c:\\users\\fd1hvy\\documents\\uojqqpc-tplhhkjzqd\\1fznt1aj4sm\\0aug\\inreizry1c1xhvh.xls")) returned 0x20 [0083.089] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm\\0Aug\\InreizrY1C1XHVh.xls", dwFileAttributes=0x20) returned 1 [0083.089] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\1FznT1aJ4sm\\0Aug\\InreizrY1C1XHVh.xls" (normalized: "c:\\users\\fd1hvy\\documents\\uojqqpc-tplhhkjzqd\\1fznt1aj4sm\\0aug\\inreizry1c1xhvh.xls"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2070 [0083.089] GetFileSizeEx (in: hFile=0x2070, lpFileSize=0x2707fb18 | out: lpFileSize=0x2707fb18*=51927) returned 1 [0083.089] SetFilePointerEx (in: hFile=0x2070, liDistanceToMove=0xcad3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.089] ReadFile (in: hFile=0x2070, lpBuffer=0x2707fa9c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2707fa98, lpOverlapped=0x0 | out: lpBuffer=0x2707fa9c*, lpNumberOfBytesRead=0x2707fa98*=0x4, lpOverlapped=0x0) returned 1 [0083.090] SetFilePointerEx (in: hFile=0x2070, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.090] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe146ee0 [0085.166] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe146a08 [0085.166] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe146d50 [0085.166] NtQuerySystemTime (in: CurrentTime=0x2707fa78 | out: CurrentTime=0x2707fa78*=132260136423302027) returned 0x0 [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0xa200b177 [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0x18cbad7c [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0x21366d11 [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0x36ebf3ad [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0x15960c76 [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0xc920b891 [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0xe50f112b [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0xd9a39de8 [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0x95c42452 [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0x7de7f95e [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0x5c8f93c2 [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0x57058e2 [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0x724aa16a [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0xfbad00de [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0x99cd3d73 [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0x4283ab34 [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0xd73c850a [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0xa88ead14 [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0x149bed7a [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0x6abe75f9 [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0x43fce9d3 [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0x8873f77d [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0x44d89902 [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0x4d2e6908 [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0x885a7bae [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0xf68ab249 [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0x87caafc5 [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0x332e5b8a [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0x5f7a805d [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0xe8b97e17 [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0xcd80d1a4 [0085.166] RtlRandom (in: Seed=0x2707fa84 | out: Seed=0x2707fa84) returned 0x11ea149e [0085.175] SetFilePointerEx (in: hFile=0x2070, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.176] ReadFile (in: hFile=0x2070, lpBuffer=0xe1479d8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2707fa58, lpOverlapped=0x0 | out: lpBuffer=0xe1479d8*, lpNumberOfBytesRead=0x2707fa58*=0xc800, lpOverlapped=0x0) returned 1 [0085.176] SetFilePointerEx (in: hFile=0x2070, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.176] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba84e0 [0085.176] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x7566180 [0085.176] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe146d78 [0085.176] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe146d78) returned 1 [0085.177] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe1541e0 [0085.183] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe146c38 [0085.183] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe146e40 [0085.183] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe146e40) returned 1 [0085.183] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7566180) returned 1 [0085.183] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba84e0) returned 1 [0085.183] WriteFile (in: hFile=0x2070, lpBuffer=0xe1541e0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2707fa58, lpOverlapped=0x0 | out: lpBuffer=0xe1541e0*, lpNumberOfBytesWritten=0x2707fa58*=0xc800, lpOverlapped=0x0) returned 1 [0088.972] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1541e0) returned 1 [0089.105] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1479d8) returned 1 [0089.105] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x33) returned 0x5444f00 [0089.105] SetFilePointerEx (in: hFile=0x2070, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.105] WriteFile (in: hFile=0x2070, lpBuffer=0x7584768*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0x2707fad8, lpOverlapped=0x0 | out: lpBuffer=0x7584768*, lpNumberOfBytesWritten=0x2707fad8*=0x117, lpOverlapped=0x0) returned 1 [0092.218] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7584768) returned 1 [0092.218] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445040) returned 1 [0092.218] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282fc8) returned 1 [0092.218] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444f00) returned 1 [0092.218] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe146c38) returned 1 [0092.218] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe146a08) returned 1 [0092.218] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe146e18) returned 1 [0092.218] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe146aa8) Thread: id = 1079 os_tid = 0x1f20 [0083.090] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\BtPCfe9bjPyifgc5.doc" (normalized: "c:\\users\\fd1hvy\\documents\\uojqqpc-tplhhkjzqd\\btpcfe9bjpyifgc5.doc")) returned 0x20 [0083.090] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\BtPCfe9bjPyifgc5.doc", dwFileAttributes=0x20) returned 1 [0083.090] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\BtPCfe9bjPyifgc5.doc" (normalized: "c:\\users\\fd1hvy\\documents\\uojqqpc-tplhhkjzqd\\btpcfe9bjpyifgc5.doc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2074 [0083.090] GetFileSizeEx (in: hFile=0x2074, lpFileSize=0x270ff77c | out: lpFileSize=0x270ff77c*=75333) returned 1 [0083.091] SetFilePointerEx (in: hFile=0x2074, liDistanceToMove=0x12641, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.091] ReadFile (in: hFile=0x2074, lpBuffer=0x270ff700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x270ff6fc, lpOverlapped=0x0 | out: lpBuffer=0x270ff700*, lpNumberOfBytesRead=0x270ff6fc*=0x4, lpOverlapped=0x0) returned 1 [0083.091] SetFilePointerEx (in: hFile=0x2074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.091] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x749f658 [0085.146] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x749f7c0 [0085.146] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x749fa90 [0085.147] NtQuerySystemTime (in: CurrentTime=0x270ff6dc | out: CurrentTime=0x270ff6dc*=132260136422986593) returned 0x0 [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0xe9cb8b6d [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0x2fcf6886 [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0xe6eb4cf2 [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0x9738572d [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0xac5e53c0 [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0xa69951e0 [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0x691109d7 [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0x35396c7 [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0x64bcf4b2 [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0xfb4e0528 [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0x1b0b9ddb [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0xe317d370 [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0x3df05eda [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0xa8ad2b43 [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0xdbc95e0e [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0xc050b3ab [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0x4dd64dca [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0xcacc4c0a [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0x7231cf70 [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0x442971f0 [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0x319760e8 [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0x241ff47e [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0xb0eb488a [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0x2616ad10 [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0xef914998 [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0x4c03011 [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0xa72aa3e0 [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0x8ed9e066 [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0x44daaee9 [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0x9eb293d9 [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0x65fffc0d [0085.147] RtlRandom (in: Seed=0x270ff6e8 | out: Seed=0x270ff6e8) returned 0x48e91638 [0085.156] SetFilePointerEx (in: hFile=0x2074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.156] ReadFile (in: hFile=0x2074, lpBuffer=0x74a00d8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x270ff6bc, lpOverlapped=0x0 | out: lpBuffer=0x74a00d8*, lpNumberOfBytesRead=0x270ff6bc*=0xc800, lpOverlapped=0x0) returned 1 [0085.157] SetFilePointerEx (in: hFile=0x2074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.157] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8498 [0085.157] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x75665b8 [0085.157] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x749f6d0 [0085.157] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x749f6d0) returned 1 [0085.158] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe13a1c8 [0085.165] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x749f860 [0085.165] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x749f770 [0085.165] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x749f770) returned 1 [0085.165] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75665b8) returned 1 [0085.165] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8498) returned 1 [0085.165] WriteFile (in: hFile=0x2074, lpBuffer=0xe13a1c8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x270ff6bc, lpOverlapped=0x0 | out: lpBuffer=0xe13a1c8*, lpNumberOfBytesWritten=0x270ff6bc*=0xc800, lpOverlapped=0x0) returned 1 [0088.971] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe13a1c8) returned 1 [0089.105] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74a00d8) returned 1 [0089.106] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x35) returned 0x5444e80 [0089.106] SetFilePointerEx (in: hFile=0x2074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.106] WriteFile (in: hFile=0x2074, lpBuffer=0x7584890*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x270ff73c, lpOverlapped=0x0 | out: lpBuffer=0x7584890*, lpNumberOfBytesWritten=0x270ff73c*=0x119, lpOverlapped=0x0) returned 1 [0092.219] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7584890) returned 1 [0092.219] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444ec0) returned 1 [0092.219] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282f28) returned 1 [0092.219] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444e80) returned 1 [0092.220] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x749f860) returned 1 [0092.220] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x749f7c0) returned 1 [0092.220] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x749fab8) returned 1 [0092.220] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x749f7e8) Thread: id = 1080 os_tid = 0x1f24 [0083.091] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\l_SMVRBXvSWgYHn5.ots" (normalized: "c:\\users\\fd1hvy\\documents\\uojqqpc-tplhhkjzqd\\l_smvrbxvswgyhn5.ots")) returned 0x20 [0083.091] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\l_SMVRBXvSWgYHn5.ots", dwFileAttributes=0x20) returned 1 [0083.091] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\l_SMVRBXvSWgYHn5.ots" (normalized: "c:\\users\\fd1hvy\\documents\\uojqqpc-tplhhkjzqd\\l_smvrbxvswgyhn5.ots"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2078 [0083.092] GetFileSizeEx (in: hFile=0x2078, lpFileSize=0x2717faec | out: lpFileSize=0x2717faec*=58495) returned 1 [0083.092] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0xe47b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.092] ReadFile (in: hFile=0x2078, lpBuffer=0x2717fa70, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2717fa6c, lpOverlapped=0x0 | out: lpBuffer=0x2717fa70*, lpNumberOfBytesRead=0x2717fa6c*=0x4, lpOverlapped=0x0) returned 1 [0083.092] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.092] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e6d18 [0085.135] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e7010 [0085.135] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e6ea8 [0085.135] NtQuerySystemTime (in: CurrentTime=0x2717fa4c | out: CurrentTime=0x2717fa4c*=132260136422986593) returned 0x0 [0085.135] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0x1ec31506 [0085.135] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0x30db0f46 [0085.135] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0x6707ce01 [0085.135] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0x1a74ad12 [0085.135] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0x9357c5ce [0085.135] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0x7b169f05 [0085.135] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0xe81f0303 [0085.135] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0x3221e85e [0085.135] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0x7b3c66eb [0085.135] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0xb3311842 [0085.135] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0xabde2179 [0085.135] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0xc0824784 [0085.135] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0x66a1cb75 [0085.135] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0x14772e08 [0085.135] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0xe9f17c5 [0085.135] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0x78065c1c [0085.135] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0xd5da539e [0085.135] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0xc7fe5618 [0085.135] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0xb53a8616 [0085.135] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0x8d021e1d [0085.135] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0x579f35a7 [0085.135] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0x41173ca2 [0085.135] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0xf2c6915d [0085.135] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0xeb915dd8 [0085.135] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0x7fabb736 [0085.135] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0xfda3ab7b [0085.135] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0x8bed01fd [0085.135] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0x31f8cb3d [0085.135] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0xec80f5db [0085.135] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0x5c463ef6 [0085.136] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0x57f9e9a5 [0085.136] RtlRandom (in: Seed=0x2717fa58 | out: Seed=0x2717fa58) returned 0x8bc7d1c9 [0085.144] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.144] ReadFile (in: hFile=0x2078, lpBuffer=0x74860c0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2717fa2c, lpOverlapped=0x0 | out: lpBuffer=0x74860c0*, lpNumberOfBytesRead=0x2717fa2c*=0xc800, lpOverlapped=0x0) returned 1 [0085.145] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.145] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8498 [0085.145] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x75665b8 [0085.145] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e6c50 [0085.145] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e6c50) returned 1 [0085.145] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x74928c8 [0085.146] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e6de0 [0085.146] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e6cf0 [0085.146] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e6cf0) returned 1 [0085.146] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75665b8) returned 1 [0085.146] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8498) returned 1 [0085.146] WriteFile (in: hFile=0x2078, lpBuffer=0x74928c8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2717fa2c, lpOverlapped=0x0 | out: lpBuffer=0x74928c8*, lpNumberOfBytesWritten=0x2717fa2c*=0xc800, lpOverlapped=0x0) returned 1 [0088.969] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74928c8) returned 1 [0089.109] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74860c0) returned 1 [0089.109] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x35) returned 0x5444f40 [0089.109] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.109] WriteFile (in: hFile=0x2078, lpBuffer=0x75851d0*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x2717faac, lpOverlapped=0x0 | out: lpBuffer=0x75851d0*, lpNumberOfBytesWritten=0x2717faac*=0x119, lpOverlapped=0x0) returned 1 [0092.221] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75851d0) returned 1 [0092.221] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445080) returned 1 [0092.221] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282f50) returned 1 [0092.221] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5444f40) returned 1 [0092.221] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e6de0) returned 1 [0092.221] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e7010) returned 1 [0092.221] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e6e30) returned 1 [0092.221] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e6d40) Thread: id = 1081 os_tid = 0x1f28 [0083.092] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\pPnX_7btvRw3eLL.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\uojqqpc-tplhhkjzqd\\ppnx_7btvrw3ell.rtf")) returned 0x20 [0083.092] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\pPnX_7btvRw3eLL.rtf", dwFileAttributes=0x20) returned 1 [0083.093] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\UoJQqpc-TPlhHkjZqD\\pPnX_7btvRw3eLL.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\uojqqpc-tplhhkjzqd\\ppnx_7btvrw3ell.rtf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x207c [0083.093] GetFileSizeEx (in: hFile=0x207c, lpFileSize=0x271ffb88 | out: lpFileSize=0x271ffb88*=31090) returned 1 [0083.093] SetFilePointerEx (in: hFile=0x207c, liDistanceToMove=0x796e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.093] ReadFile (in: hFile=0x207c, lpBuffer=0x271ffb0c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x271ffb08, lpOverlapped=0x0 | out: lpBuffer=0x271ffb0c*, lpNumberOfBytesRead=0x271ffb08*=0x4, lpOverlapped=0x0) returned 1 [0083.093] SetFilePointerEx (in: hFile=0x207c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.093] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e5f40 [0085.122] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e5e28 [0085.122] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e5d10 [0085.122] NtQuerySystemTime (in: CurrentTime=0x271ffae8 | out: CurrentTime=0x271ffae8*=132260136422830654) returned 0x0 [0085.122] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0x91becce7 [0085.122] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0x94c4dca6 [0085.122] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0x1cf2f540 [0085.122] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0xb03d897d [0085.122] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0x9051c4c0 [0085.122] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0xf289a186 [0085.122] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0xf6f85f54 [0085.122] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0xc45c5bdd [0085.122] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0xcd9846cd [0085.122] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0x93873a02 [0085.122] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0xbc224ea2 [0085.122] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0xe224ebb6 [0085.122] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0xbe6b7aa6 [0085.122] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0x55d1d390 [0085.122] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0xe0b4b1ad [0085.122] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0x78ec7385 [0085.122] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0xe00cf3ae [0085.122] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0xb67aee47 [0085.122] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0xb722aee9 [0085.123] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0x9ef0b42 [0085.123] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0x69c58616 [0085.123] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0xa0a9b264 [0085.123] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0xad69ee96 [0085.123] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0x575ec77c [0085.123] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0x5db8d8f9 [0085.123] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0x6874095b [0085.123] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0x1b1e5b46 [0085.123] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0x5c97b876 [0085.123] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0x33ff2d71 [0085.123] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0xfe27d316 [0085.123] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0xf0266251 [0085.123] RtlRandom (in: Seed=0x271ffaf4 | out: Seed=0x271ffaf4) returned 0xfb123e4c [0085.131] ReadFile (in: hFile=0x207c, lpBuffer=0x7413870, nNumberOfBytesToRead=0x7972, lpNumberOfBytesRead=0x271ffae4, lpOverlapped=0x0 | out: lpBuffer=0x7413870*, lpNumberOfBytesRead=0x271ffae4*=0x7972, lpOverlapped=0x0) returned 1 [0085.133] SetFilePointerEx (in: hFile=0x207c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.133] WriteFile (in: hFile=0x207c, lpBuffer=0x7420078*, nNumberOfBytesToWrite=0x7972, lpNumberOfBytesWritten=0x271ffae0, lpOverlapped=0x0 | out: lpBuffer=0x7420078*, lpNumberOfBytesWritten=0x271ffae0*=0x7972, lpOverlapped=0x0) returned 1 [0088.966] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7280dd8 [0088.966] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281058 [0088.966] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7281058) returned 1 [0088.966] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7420078) returned 1 [0089.110] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7413870) returned 1 [0089.110] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7566540) returned 1 [0089.110] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8408) returned 1 [0089.110] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x33) returned 0x5445440 [0089.110] SetFilePointerEx (in: hFile=0x207c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.110] WriteFile (in: hFile=0x207c, lpBuffer=0x75852f8*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0x271ffb48, lpOverlapped=0x0 | out: lpBuffer=0x75852f8*, lpNumberOfBytesWritten=0x271ffb48*=0x117, lpOverlapped=0x0) returned 1 [0092.225] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75852f8) returned 1 [0092.225] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445940) returned 1 [0092.225] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282f78) returned 1 [0092.225] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445440) returned 1 [0092.225] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7280dd8) returned 1 [0092.225] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e5e28) returned 1 [0092.225] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e5e00) returned 1 [0092.225] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e5d38) Thread: id = 1082 os_tid = 0x1f2c [0083.096] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x757e970 [0083.096] wcscpy (in: _Dest=0x757e970, _Source="C:\\Windows10Upgrade\\resources\\amd64" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64") returned="C:\\Windows10Upgrade\\resources\\amd64" [0083.096] wcscat (in: _Dest=0x757e970, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\") returned="C:\\Windows10Upgrade\\resources\\amd64\\" [0083.096] wcscat (in: _Dest=0x757e970, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\*") returned="C:\\Windows10Upgrade\\resources\\amd64\\*" [0083.096] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x39392b8 [0083.096] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\*", lpFindFileData=0x39392b8 | out: lpFindFileData=0x39392b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a5195, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3a652e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445180 [0083.098] wcscmp (_String1=".", _String2=".") returned 0 [0083.098] FindNextFileW (in: hFindFile=0x5445180, lpFindFileData=0x39392b8 | out: lpFindFileData=0x39392b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a5195, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3a652e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.098] wcscmp (_String1="..", _String2=".") returned 1 [0083.098] wcscmp (_String1="..", _String2="..") returned 0 [0083.098] FindNextFileW (in: hFindFile=0x5445180, lpFindFileData=0x39392b8 | out: lpFindFileData=0x39392b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39b5b0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39b5b0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x16ebc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BiosBlocks.xml", cAlternateFileName="BIOSBL~1.XML")) returned 1 [0083.098] wcscmp (_String1="BiosBlocks.xml", _String2=".") returned 1 [0083.098] wcscmp (_String1="BiosBlocks.xml", _String2="..") returned 1 [0083.098] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x5468240 [0083.098] wcscpy (in: _Dest=0x5468240, _Source="C:\\Windows10Upgrade\\resources\\amd64" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64") returned="C:\\Windows10Upgrade\\resources\\amd64" [0083.098] wcscat (in: _Dest=0x5468240, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\") returned="C:\\Windows10Upgrade\\resources\\amd64\\" [0083.098] wcscat (in: _Dest=0x5468240, _Source="BiosBlocks.xml" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml") returned="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" [0083.099] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml")) returned 0x20 [0085.109] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml", dwFileAttributes=0x20) returned 1 [0085.110] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x980 [0085.110] GetFileSizeEx (in: hFile=0x980, lpFileSize=0x2727f918 | out: lpFileSize=0x2727f918*=93884) returned 1 [0085.110] SetFilePointerEx (in: hFile=0x980, liDistanceToMove=0x16eb8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.110] ReadFile (in: hFile=0x980, lpBuffer=0x2727f89c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2727f898, lpOverlapped=0x0 | out: lpBuffer=0x2727f89c*, lpNumberOfBytesRead=0x2727f898*=0x4, lpOverlapped=0x0) returned 1 [0085.112] SetFilePointerEx (in: hFile=0x980, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.112] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e3d78 [0085.112] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e3da0 [0085.112] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e3c38 [0085.112] NtQuerySystemTime (in: CurrentTime=0x2727f878 | out: CurrentTime=0x2727f878*=132260136422673986) returned 0x0 [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0x27559eb5 [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0x2034d0c2 [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0x6f4a1d7a [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0x611baf7a [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0x43df2032 [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0x5812e0a [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0x9297e89c [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0xa7caeafc [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0x16fc5017 [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0xd5e034ee [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0xabcbb3 [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0xbd648746 [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0x210ba77 [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0x53a50691 [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0x446884e0 [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0x46ad9d30 [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0x5e7058a0 [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0xad78a0be [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0x4e8a9f28 [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0xb0448144 [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0xae1c3fa8 [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0x877d0308 [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0x81ed2f88 [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0xcd2e3300 [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0x2983cae7 [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0xb49940c7 [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0x693cf7c2 [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0xbe76a495 [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0xb8b11cab [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0x63ffe4fb [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0xca43a329 [0085.112] RtlRandom (in: Seed=0x2727f884 | out: Seed=0x2727f884) returned 0x5a3e313b [0085.121] SetFilePointerEx (in: hFile=0x980, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.121] ReadFile (in: hFile=0x980, lpBuffer=0x7406060, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2727f858, lpOverlapped=0x0 | out: lpBuffer=0x7406060*, lpNumberOfBytesRead=0x2727f858*=0xc800, lpOverlapped=0x0) returned 1 [0085.133] SetFilePointerEx (in: hFile=0x980, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.133] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba87b0 [0085.133] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x7566180 [0085.133] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e5ec8 [0085.133] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e5ec8) returned 1 [0085.134] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x742c880 [0085.134] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e5f90 [0085.134] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e6008 [0085.134] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e6008) returned 1 [0085.135] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7566180) returned 1 [0085.135] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba87b0) returned 1 [0085.135] WriteFile (in: hFile=0x980, lpBuffer=0x742c880*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2727f858, lpOverlapped=0x0 | out: lpBuffer=0x742c880*, lpNumberOfBytesWritten=0x2727f858*=0xc800, lpOverlapped=0x0) returned 1 [0088.969] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x742c880) returned 1 [0089.109] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7406060) returned 1 [0089.109] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x29) returned 0x54b6f00 [0089.110] SetFilePointerEx (in: hFile=0x980, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.110] WriteFile (in: hFile=0x980, lpBuffer=0x757aa10*, nNumberOfBytesToWrite=0x10d, lpNumberOfBytesWritten=0x2727f8d8, lpOverlapped=0x0 | out: lpBuffer=0x757aa10*, lpNumberOfBytesWritten=0x2727f8d8*=0x10d, lpOverlapped=0x0) returned 1 [0092.223] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757aa10) returned 1 [0092.223] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b6d08) returned 1 [0092.223] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7283108) returned 1 [0092.223] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b6f00) returned 1 [0092.223] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e5f90) returned 1 [0092.223] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e3da0) returned 1 [0092.223] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e3e90) returned 1 [0092.223] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e3eb8) returned 1 [0092.223] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa6) returned 0x74e0d88 [0092.223] wcscpy (in: _Dest=0x74e0d88, _Source="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml") returned="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" [0092.223] wcscat (in: _Dest=0x74e0d88, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml.mailto[knoocknoo@cock.li].a0a70" [0092.223] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x2727f890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.223] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x53e80f8 Thread: id = 1083 os_tid = 0x1f30 [0083.099] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt")) returned 0x20 [0085.079] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt", dwFileAttributes=0x20) returned 1 [0085.080] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x988 [0085.080] GetFileSizeEx (in: hFile=0x988, lpFileSize=0x272ff95c | out: lpFileSize=0x272ff95c*=825371) returned 1 [0085.080] SetFilePointerEx (in: hFile=0x988, liDistanceToMove=0xc9817, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.080] ReadFile (in: hFile=0x988, lpBuffer=0x272ff8e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x272ff8dc, lpOverlapped=0x0 | out: lpBuffer=0x272ff8e0*, lpNumberOfBytesRead=0x272ff8dc*=0x4, lpOverlapped=0x0) returned 1 [0085.083] SetFilePointerEx (in: hFile=0x988, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.083] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e3e90 [0085.083] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e3e68 [0085.083] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e3c60 [0085.083] NtQuerySystemTime (in: CurrentTime=0x272ff8bc | out: CurrentTime=0x272ff8bc*=132260136422361928) returned 0x0 [0085.083] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0x6cf15a82 [0085.083] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0x7572a690 [0085.083] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0x93c7bb20 [0085.083] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0xbc29801d [0085.083] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0x99522189 [0085.083] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0xaa52772c [0085.083] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0xa1dfe534 [0085.083] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0xa2d7cda1 [0085.083] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0x17ddf31d [0085.083] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0xad6fd24c [0085.083] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0xf0786a5a [0085.083] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0xb9e9505b [0085.083] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0x576979b2 [0085.083] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0x302fe59d [0085.083] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0xafd40f0b [0085.083] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0x13d815ef [0085.083] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0xe59c9665 [0085.083] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0x1998bdb5 [0085.083] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0x3cb6c4a [0085.083] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0x4ac33f9f [0085.083] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0xb12ec007 [0085.083] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0xe861b489 [0085.083] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0x3e418eca [0085.083] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0x3d039979 [0085.083] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0x51a9608b [0085.083] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0x63b957e0 [0085.083] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0x92a5c48f [0085.083] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0x90769a9e [0085.083] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0x6359dde1 [0085.084] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0x8af5f668 [0085.084] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0x6d5ccdcb [0085.084] RtlRandom (in: Seed=0x272ff8c8 | out: Seed=0x272ff8c8) returned 0x16803ed [0085.093] SetFilePointerEx (in: hFile=0x988, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.093] ReadFile (in: hFile=0x988, lpBuffer=0x74540a0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x272ff874, lpOverlapped=0x0 | out: lpBuffer=0x74540a0*, lpNumberOfBytesRead=0x272ff874*=0xc800, lpOverlapped=0x0) returned 1 [0085.105] SetFilePointerEx (in: hFile=0x988, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.105] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8408 [0085.105] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x7566540 [0085.105] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e3c38 [0085.105] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e3c38) returned 1 [0085.105] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x746d0b0 [0085.106] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e3e18 [0085.106] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e3d78 [0085.106] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e3d78) returned 1 [0085.106] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7566540) returned 1 [0085.106] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8408) returned 1 [0085.106] WriteFile (in: hFile=0x988, lpBuffer=0x746d0b0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x272ff874, lpOverlapped=0x0 | out: lpBuffer=0x746d0b0*, lpNumberOfBytesWritten=0x272ff874*=0xc800, lpOverlapped=0x0) returned 1 [0089.501] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x746d0b0) returned 1 [0091.515] SetFilePointerEx (in: hFile=0x988, liDistanceToMove=0x70800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.515] ReadFile (in: hFile=0x988, lpBuffer=0x74540a0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x272ff874, lpOverlapped=0x0 | out: lpBuffer=0x74540a0*, lpNumberOfBytesRead=0x272ff874*=0xc800, lpOverlapped=0x0) returned 1 [0091.601] SetFilePointerEx (in: hFile=0x988, liDistanceToMove=0x70800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.601] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8960 [0091.601] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x74af208 [0091.601] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09af28 [0091.601] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09af28) returned 1 [0091.602] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x7388008 [0091.610] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09ae38 [0091.610] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09ad48 [0091.610] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09ad48) returned 1 [0091.610] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74af208) returned 1 [0091.610] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8960) returned 1 [0091.610] WriteFile (in: hFile=0x988, lpBuffer=0x7388008*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x272ff874, lpOverlapped=0x0 | out: lpBuffer=0x7388008*, lpNumberOfBytesWritten=0x272ff874*=0xc800, lpOverlapped=0x0) returned 1 [0091.613] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7388008) returned 1 [0091.613] SetFilePointerEx (in: hFile=0x988, liDistanceToMove=0xbd01b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.613] ReadFile (in: hFile=0x988, lpBuffer=0x74540a0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x272ff874, lpOverlapped=0x0 | out: lpBuffer=0x74540a0*, lpNumberOfBytesRead=0x272ff874*=0xc800, lpOverlapped=0x0) returned 1 [0091.618] SetFilePointerEx (in: hFile=0x988, liDistanceToMove=0xbd01b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.618] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8a38 [0091.618] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x74ae998 [0091.618] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09af50 [0091.618] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09af50) returned 1 [0091.619] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe332b88 [0091.620] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09af50 [0091.620] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09ad48 [0091.620] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09ad48) returned 1 [0091.620] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74ae998) returned 1 [0091.620] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8a38) returned 1 [0091.620] WriteFile (in: hFile=0x988, lpBuffer=0xe332b88*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x272ff874, lpOverlapped=0x0 | out: lpBuffer=0xe332b88*, lpNumberOfBytesWritten=0x272ff874*=0xc800, lpOverlapped=0x0) returned 1 [0091.622] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe332b88) returned 1 [0091.622] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0xe53a6e0 [0091.623] SetFilePointerEx (in: hFile=0x988, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.623] WriteFile (hFile=0x988, lpBuffer=0x38b67a8, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x272ff91c, lpOverlapped=0x0) Thread: id = 1084 os_tid = 0x1f34 [0083.099] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a) returned 0x757e4a0 [0083.099] wcscpy (in: _Dest=0x757e4a0, _Source="C:\\Windows10Upgrade\\resources\\i386" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386") returned="C:\\Windows10Upgrade\\resources\\i386" [0083.099] wcscat (in: _Dest=0x757e4a0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\") returned="C:\\Windows10Upgrade\\resources\\i386\\" [0083.099] wcscat (in: _Dest=0x757e4a0, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\*") returned="C:\\Windows10Upgrade\\resources\\i386\\*" [0083.099] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3939520 [0083.099] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\i386\\*", lpFindFileData=0x3939520 | out: lpFindFileData=0x3939520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3a9fd3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b1515, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b2895, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54451c0 [0083.102] wcscmp (_String1=".", _String2=".") returned 0 [0083.102] FindNextFileW (in: hFindFile=0x54451c0, lpFindFileData=0x3939520 | out: lpFindFileData=0x3939520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3a9fd3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b1515, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b2895, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.102] wcscmp (_String1="..", _String2=".") returned 1 [0083.102] wcscmp (_String1="..", _String2="..") returned 0 [0083.102] FindNextFileW (in: hFindFile=0x54451c0, lpFindFileData=0x3939520 | out: lpFindFileData=0x3939520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ab347, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ab347, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x16600, dwReserved0=0x0, dwReserved1=0x0, cFileName="BiosBlocks.xml", cAlternateFileName="BIOSBL~1.XML")) returned 1 [0083.102] wcscmp (_String1="BiosBlocks.xml", _String2=".") returned 1 [0083.102] wcscmp (_String1="BiosBlocks.xml", _String2="..") returned 1 [0083.102] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x54684e0 [0083.102] wcscpy (in: _Dest=0x54684e0, _Source="C:\\Windows10Upgrade\\resources\\i386" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386") returned="C:\\Windows10Upgrade\\resources\\i386" [0083.102] wcscat (in: _Dest=0x54684e0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\") returned="C:\\Windows10Upgrade\\resources\\i386\\" [0083.102] wcscat (in: _Dest=0x54684e0, _Source="BiosBlocks.xml" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml") returned="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" [0083.102] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml")) returned 0x20 [0085.081] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml", dwFileAttributes=0x20) returned 1 [0085.081] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x984 [0085.081] GetFileSizeEx (in: hFile=0x984, lpFileSize=0x2737fc64 | out: lpFileSize=0x2737fc64*=91648) returned 1 [0085.082] SetFilePointerEx (in: hFile=0x984, liDistanceToMove=0x165fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.082] ReadFile (in: hFile=0x984, lpBuffer=0x2737fbe8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2737fbe4, lpOverlapped=0x0 | out: lpBuffer=0x2737fbe8*, lpNumberOfBytesRead=0x2737fbe4*=0x4, lpOverlapped=0x0) returned 1 [0085.094] SetFilePointerEx (in: hFile=0x984, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.094] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e3d78 [0085.094] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e3cd8 [0085.094] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e3c38 [0085.094] NtQuerySystemTime (in: CurrentTime=0x2737fbc4 | out: CurrentTime=0x2737fbc4*=132260136422518332) returned 0x0 [0085.094] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0xc806e180 [0085.094] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0x746b9f51 [0085.094] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0xba2a2c3f [0085.094] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0x22016486 [0085.094] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0x721b2b62 [0085.094] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0xcdd981de [0085.094] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0xbaa415ad [0085.094] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0xf6e2867a [0085.094] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0xcda368da [0085.094] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0xeaacb96 [0085.094] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0x35ec5b42 [0085.094] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0x18a8e80b [0085.094] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0xb0e0e100 [0085.094] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0x7551e379 [0085.094] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0x41c51c55 [0085.094] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0x9a6147cd [0085.094] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0x1b762d41 [0085.094] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0x4d56af16 [0085.094] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0x6e6d9692 [0085.094] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0x839cb741 [0085.094] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0x2fc0ea2e [0085.094] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0xe756ec4f [0085.095] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0x6dd54169 [0085.095] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0x509d67fd [0085.095] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0x795a27d1 [0085.095] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0xee1645c8 [0085.095] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0xe02b895d [0085.095] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0x2cceed2 [0085.095] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0xdffbd065 [0085.095] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0x120bdc5b [0085.095] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0x9f77b0fb [0085.095] RtlRandom (in: Seed=0x2737fbd0 | out: Seed=0x2737fbd0) returned 0x524d7d07 [0085.104] SetFilePointerEx (in: hFile=0x984, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.104] ReadFile (in: hFile=0x984, lpBuffer=0x74608a8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2737fba4, lpOverlapped=0x0 | out: lpBuffer=0x74608a8*, lpNumberOfBytesRead=0x2737fba4*=0xc800, lpOverlapped=0x0) returned 1 [0085.107] SetFilePointerEx (in: hFile=0x984, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.107] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba87b0 [0085.107] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x7566180 [0085.107] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e3eb8 [0085.107] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e3eb8) returned 1 [0085.108] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x74798b8 [0085.108] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e3f80 [0085.108] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e3ff8 [0085.108] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e3ff8) returned 1 [0085.108] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7566180) returned 1 [0085.108] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba87b0) returned 1 [0085.108] WriteFile (in: hFile=0x984, lpBuffer=0x74798b8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2737fba4, lpOverlapped=0x0 | out: lpBuffer=0x74798b8*, lpNumberOfBytesWritten=0x2737fba4*=0xc800, lpOverlapped=0x0) returned 1 [0088.953] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74798b8) returned 1 [0089.111] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74608a8) returned 1 [0089.148] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x29) returned 0x54b6838 [0089.148] SetFilePointerEx (in: hFile=0x984, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.148] WriteFile (in: hFile=0x984, lpBuffer=0x757ab28*, nNumberOfBytesToWrite=0x10d, lpNumberOfBytesWritten=0x2737fc24, lpOverlapped=0x0 | out: lpBuffer=0x757ab28*, lpNumberOfBytesWritten=0x2737fc24*=0x10d, lpOverlapped=0x0) returned 1 [0092.226] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757ab28) returned 1 [0092.226] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b6d40) returned 1 [0092.226] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7283130) returned 1 [0092.226] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b6838) returned 1 [0092.226] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e3f80) returned 1 [0092.226] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e3cd8) returned 1 [0092.226] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e3df0) returned 1 [0092.226] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e3d00) returned 1 [0092.226] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa4) returned 0x74e0e38 [0092.226] wcscpy (in: _Dest=0x74e0e38, _Source="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml") returned="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" [0092.226] wcscat (in: _Dest=0x74e0e38, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml.mailto[knoocknoo@cock.li].a0a70" [0092.226] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x2737fbdc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.226] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x53e81c0 Thread: id = 1085 os_tid = 0x1f38 [0083.102] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x46) returned 0x397b5b8 [0083.102] wcscpy (in: _Dest=0x397b5b8, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0083.102] wcscat (in: _Dest=0x397b5b8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0083.102] wcscat (in: _Dest=0x397b5b8, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\*") returned="C:\\Windows10Upgrade\\resources\\ux\\*" [0083.102] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3939788 [0083.102] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\*", lpFindFileData=0x3939788 | out: lpFindFileData=0x3939788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea63c947, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445200 [0083.105] wcscmp (_String1=".", _String2=".") returned 0 [0083.105] FindNextFileW (in: hFindFile=0x5445200, lpFindFileData=0x3939788 | out: lpFindFileData=0x3939788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea63c947, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.105] wcscmp (_String1="..", _String2=".") returned 1 [0083.105] wcscmp (_String1="..", _String2="..") returned 0 [0083.105] FindNextFileW (in: hFindFile=0x5445200, lpFindFileData=0x3939788 | out: lpFindFileData=0x3939788*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b4fa7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b4fa7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x397, dwReserved0=0x0, dwReserved1=0x0, cFileName="block.png", cAlternateFileName="")) returned 1 [0083.105] wcscmp (_String1="block.png", _String2=".") returned 1 [0083.105] wcscmp (_String1="block.png", _String2="..") returned 1 [0083.105] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56) returned 0x7583e60 [0083.105] wcscpy (in: _Dest=0x7583e60, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0083.105] wcscat (in: _Dest=0x7583e60, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0083.105] wcscat (in: _Dest=0x7583e60, _Source="block.png" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\block.png") returned="C:\\Windows10Upgrade\\resources\\ux\\block.png" [0083.105] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png")) returned 0x20 [0083.105] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png", dwFileAttributes=0x20) returned 1 [0083.105] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x208c [0083.105] GetFileSizeEx (in: hFile=0x208c, lpFileSize=0x273ffae4 | out: lpFileSize=0x273ffae4*=919) returned 1 [0083.106] SetFilePointerEx (in: hFile=0x208c, liDistanceToMove=0x393, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.106] ReadFile (in: hFile=0x208c, lpBuffer=0x273ffa68, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x273ffa64, lpOverlapped=0x0 | out: lpBuffer=0x273ffa68*, lpNumberOfBytesRead=0x273ffa64*=0x4, lpOverlapped=0x0) returned 1 [0083.107] SetFilePointerEx (in: hFile=0x208c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.107] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e3d78 [0085.069] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e3cb0 [0085.069] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x74e3c38 [0085.069] NtQuerySystemTime (in: CurrentTime=0x273ffa44 | out: CurrentTime=0x273ffa44*=132260136422205685) returned 0x0 [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0x4212a1ba [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0x222fcac2 [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0xa884c355 [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0xddd93a68 [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0x7dee0a4f [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0x53af37ff [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0x3b8273cd [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0x1c0f5edf [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0x553a92a3 [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0xc276dbd8 [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0x8d52912a [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0x4de3cdd0 [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0x54ab28fa [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0xcab13339 [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0xc8ead88d [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0xa2f47bf6 [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0x8d8983c8 [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0x326f5495 [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0xd4706dc1 [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0x12cee553 [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0x1c1a6010 [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0x25a37a00 [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0xb8d9cdf6 [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0xbe580ddb [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0x8c59a68a [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0x3fb4035c [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0xcbb0adb4 [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0x82f9e717 [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0x60e53afc [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0xe383c6d8 [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0x8d27f885 [0085.069] RtlRandom (in: Seed=0x273ffa50 | out: Seed=0x273ffa50) returned 0x161b0217 [0085.078] ReadFile (in: hFile=0x208c, lpBuffer=0x743b090, nNumberOfBytesToRead=0x397, lpNumberOfBytesRead=0x273ffa40, lpOverlapped=0x0 | out: lpBuffer=0x743b090*, lpNumberOfBytesRead=0x273ffa40*=0x397, lpOverlapped=0x0) returned 1 [0085.078] SetFilePointerEx (in: hFile=0x208c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.078] WriteFile (in: hFile=0x208c, lpBuffer=0x7447898*, nNumberOfBytesToWrite=0x397, lpNumberOfBytesWritten=0x273ffa3c, lpOverlapped=0x0 | out: lpBuffer=0x7447898*, lpNumberOfBytesWritten=0x273ffa3c*=0x397, lpOverlapped=0x0) returned 1 [0088.950] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72810d0 [0088.950] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7280f40 [0088.950] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7280f40) returned 1 [0088.950] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7447898) returned 1 [0089.148] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x743b090) returned 1 [0089.148] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7574998) returned 1 [0089.148] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8768) returned 1 [0089.148] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1f) returned 0x72831a8 [0089.148] SetFilePointerEx (in: hFile=0x208c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.149] WriteFile (in: hFile=0x208c, lpBuffer=0x757ac40*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x273ffaa4, lpOverlapped=0x0 | out: lpBuffer=0x757ac40*, lpNumberOfBytesWritten=0x273ffaa4*=0x103, lpOverlapped=0x0) returned 1 [0092.231] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757ac40) returned 1 [0092.231] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282fa0) returned 1 [0092.231] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7283158) returned 1 [0092.231] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x72831a8) returned 1 [0092.231] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x72810d0) returned 1 [0092.231] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e3cb0) returned 1 [0092.231] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e3dc8) returned 1 [0092.231] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e3c88) returned 1 [0092.231] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x96) returned 0x55c5fd8 [0092.231] wcscpy (in: _Dest=0x55c5fd8, _Source="C:\\Windows10Upgrade\\resources\\ux\\block.png" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\block.png") returned="C:\\Windows10Upgrade\\resources\\ux\\block.png" [0092.231] wcscat (in: _Dest=0x55c5fd8, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\block.png.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Windows10Upgrade\\resources\\ux\\block.png.mailto[knoocknoo@cock.li].a0a70" [0092.231] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Windows10Upgrade\\resources\\ux\\block.png.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x273ffa5c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Windows10Upgrade\\resources\\ux\\block.png.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.231] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xac) returned 0x5446140 Thread: id = 1086 os_tid = 0x1f3c [0083.106] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0083.109] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.110] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.112] GetLastError () returned 0x5 [0083.112] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.114] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39704c8) returned 1 Thread: id = 1087 os_tid = 0x1f40 [0083.114] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xde) returned 0x54f17d0 [0083.114] wcscpy (in: _Dest=0x54f17d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0083.115] wcscat (in: _Dest=0x54f17d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\" [0083.115] wcscat (in: _Dest=0x54f17d0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*" [0083.115] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x39399f0 [0083.115] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac08827b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabb9e6bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac08827b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445240 [0083.115] wcscmp (_String1=".", _String2=".") returned 0 [0083.116] FindNextFileW (in: hFindFile=0x5445240, lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac08827b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabb9e6bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac08827b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.116] wcscmp (_String1="..", _String2=".") returned 1 [0083.116] wcscmp (_String1="..", _String2="..") returned 0 [0083.116] FindNextFileW (in: hFindFile=0x5445240, lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac08827b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac08827b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac08827b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1dde, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 1 [0083.116] wcscmp (_String1="AppxBundleManifest.xml", _String2=".") returned 1 [0083.116] wcscmp (_String1="AppxBundleManifest.xml", _String2="..") returned 1 [0083.116] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x108) returned 0x7439cb8 [0085.067] wcscpy (in: _Dest=0x7439cb8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0085.067] wcscat (in: _Dest=0x7439cb8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\" [0085.067] wcscat (in: _Dest=0x7439cb8, _Source="AppxBundleManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" [0088.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7439cb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc78 [0088.864] FindNextFileW (in: hFindFile=0x5445240, lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac08827b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac08827b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac08827b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1dde, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 0 [0088.864] FindClose (in: hFindFile=0x5445240 | out: hFindFile=0x5445240) returned 1 [0088.865] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39399f0) returned 1 [0088.865] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f17d0) returned 1 [0088.865] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54ba928) returned 1 Thread: id = 1088 os_tid = 0x1f44 [0083.116] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0083.117] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.117] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.117] GetLastError () returned 0x5 [0083.117] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.117] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b9558) returned 1 Thread: id = 1089 os_tid = 0x1f48 [0083.118] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x108) returned 0x74e5c58 [0085.066] wcscpy (in: _Dest=0x74e5c58, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" [0085.066] wcscat (in: _Dest=0x74e5c58, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0085.066] wcscat (in: _Dest=0x74e5c58, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0085.066] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a3a78 [0085.066] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbed30aaa, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbed30aaa, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbed30aaa, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389eac0 [0085.067] wcscmp (_String1=".", _String2=".") returned 0 [0085.067] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbed30aaa, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbed30aaa, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbed30aaa, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.067] wcscmp (_String1="..", _String2=".") returned 1 [0085.067] wcscmp (_String1="..", _String2="..") returned 0 [0085.068] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbed30aaa, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbed30aaa, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbed30aaa, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0085.068] FindClose (in: hFindFile=0x389eac0 | out: hFindFile=0x389eac0) returned 1 [0085.068] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a3a78) returned 1 [0085.068] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e5c58) returned 1 [0085.068] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7412890) returned 1 Thread: id = 1090 os_tid = 0x1f4c [0083.119] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml")) returned 0x20 [0083.120] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml", dwFileAttributes=0x20) returned 0 [0083.120] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.120] GetLastError () returned 0x5 [0083.120] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml", dwFileAttributes=0x20) returned 0 [0083.120] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba39f8) returned 1 Thread: id = 1091 os_tid = 0x1f50 [0083.124] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0083.126] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.127] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.129] GetLastError () returned 0x5 [0083.129] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.130] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396f3e8) returned 1 Thread: id = 1092 os_tid = 0x1f54 [0083.131] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54f18b8 [0083.131] wcscpy (in: _Dest=0x54f18b8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0083.131] wcscat (in: _Dest=0x54f18b8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\" [0083.131] wcscat (in: _Dest=0x54f18b8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*" [0083.131] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3939ec0 [0083.131] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x3939ec0 | out: lpFindFileData=0x3939ec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628da999, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabdaf1a7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628da999, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445280 [0083.132] wcscmp (_String1=".", _String2=".") returned 0 [0083.133] FindNextFileW (in: hFindFile=0x5445280, lpFindFileData=0x3939ec0 | out: lpFindFileData=0x3939ec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628da999, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabdaf1a7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628da999, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.133] wcscmp (_String1="..", _String2=".") returned 1 [0083.133] wcscmp (_String1="..", _String2="..") returned 0 [0083.133] FindNextFileW (in: hFindFile=0x5445280, lpFindFileData=0x3939ec0 | out: lpFindFileData=0x3939ec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x628da999, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x628da999, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x628da999, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3e47, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 1 [0083.133] wcscmp (_String1="AppxBundleManifest.xml", _String2=".") returned 1 [0083.133] wcscmp (_String1="AppxBundleManifest.xml", _String2="..") returned 1 [0083.133] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0x74db258 [0085.066] wcscpy (in: _Dest=0x74db258, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0085.066] wcscat (in: _Dest=0x74db258, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\" [0085.066] wcscat (in: _Dest=0x74db258, _Source="AppxBundleManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" [0088.866] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74db258, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2090 [0088.867] FindNextFileW (in: hFindFile=0x5445280, lpFindFileData=0x3939ec0 | out: lpFindFileData=0x3939ec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x628da999, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x628da999, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x628da999, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3e47, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 0 [0088.867] FindClose (in: hFindFile=0x5445280 | out: hFindFile=0x5445280) returned 1 [0088.868] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3939ec0) returned 1 [0088.868] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f18b8) returned 1 [0088.868] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bb320) returned 1 Thread: id = 1093 os_tid = 0x1f58 [0083.133] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0083.134] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.134] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.134] GetLastError () returned 0x5 [0083.134] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.134] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b9288) returned 1 Thread: id = 1094 os_tid = 0x1f5c [0083.135] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0x74e5a28 [0085.063] wcscpy (in: _Dest=0x74e5a28, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" [0085.063] wcscat (in: _Dest=0x74e5a28, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0085.063] wcscat (in: _Dest=0x74e5a28, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0085.063] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a4680 [0085.063] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x53a4680 | out: lpFindFileData=0x53a4680*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc3123ced, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc3123ced, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc3123ced, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e740 [0085.063] wcscmp (_String1=".", _String2=".") returned 0 [0085.063] FindNextFileW (in: hFindFile=0x389e740, lpFindFileData=0x53a4680 | out: lpFindFileData=0x53a4680*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc3123ced, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc3123ced, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc3123ced, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.063] wcscmp (_String1="..", _String2=".") returned 1 [0085.063] wcscmp (_String1="..", _String2="..") returned 0 [0085.063] FindNextFileW (in: hFindFile=0x389e740, lpFindFileData=0x53a4680 | out: lpFindFileData=0x53a4680*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc3123ced, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc3123ced, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc3123ced, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0085.063] FindClose (in: hFindFile=0x389e740 | out: hFindFile=0x389e740) returned 1 [0085.064] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a4680) returned 1 [0085.064] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e5a28) returned 1 [0085.064] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74129a8) returned 1 Thread: id = 1095 os_tid = 0x1f60 [0083.136] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\ApplicationInsights.config" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\applicationinsights.config")) returned 0x20 [0085.064] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\ApplicationInsights.config", dwFileAttributes=0x20) returned 0 [0085.064] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\ApplicationInsights.config" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\applicationinsights.config"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0085.064] GetLastError () returned 0x5 [0085.065] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\ApplicationInsights.config", dwFileAttributes=0x20) returned 0 [0085.065] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54999f8) returned 1 Thread: id = 1096 os_tid = 0x1f64 [0083.136] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0083.138] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.140] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.141] GetLastError () returned 0x5 [0083.141] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.143] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b8928) returned 1 Thread: id = 1097 os_tid = 0x1f68 [0083.144] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0083.146] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0083.147] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.149] GetLastError () returned 0x5 [0083.149] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0083.150] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b9648) returned 1 Thread: id = 1098 os_tid = 0x1f6c [0083.151] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe4) returned 0x396f988 [0083.151] wcscpy (in: _Dest=0x396f988, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0083.151] wcscat (in: _Dest=0x396f988, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0083.151] wcscat (in: _Dest=0x396f988, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*" [0083.151] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393a128 [0083.151] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x393a128 | out: lpFindFileData=0x393a128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340ead73, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabf3049c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x340ead73, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444ac0 [0083.152] wcscmp (_String1=".", _String2=".") returned 0 [0083.152] FindNextFileW (in: hFindFile=0x5444ac0, lpFindFileData=0x393a128 | out: lpFindFileData=0x393a128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340ead73, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabf3049c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x340ead73, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.152] wcscmp (_String1="..", _String2=".") returned 1 [0083.152] wcscmp (_String1="..", _String2="..") returned 0 [0083.152] FindNextFileW (in: hFindFile=0x5444ac0, lpFindFileData=0x393a128 | out: lpFindFileData=0x393a128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x340ead73, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x34110fcc, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x34110fcc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x309a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1 [0083.152] wcscmp (_String1="CodeIntegrity.cat", _String2=".") returned 1 [0083.152] wcscmp (_String1="CodeIntegrity.cat", _String2="..") returned 1 [0083.152] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x104) returned 0x74e1e78 [0085.062] wcscpy (in: _Dest=0x74e1e78, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0085.062] wcscat (in: _Dest=0x74e1e78, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0085.062] wcscat (in: _Dest=0x74e1e78, _Source="CodeIntegrity.cat" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" [0088.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e1e78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2094 [0088.869] FindNextFileW (in: hFindFile=0x5444ac0, lpFindFileData=0x393a128 | out: lpFindFileData=0x393a128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x340ead73, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x34110fcc, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x34110fcc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x309a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 0 [0088.869] FindClose (in: hFindFile=0x5444ac0 | out: hFindFile=0x5444ac0) returned 1 [0088.869] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393a128) returned 1 [0088.869] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396f988) returned 1 [0088.869] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bbc30) returned 1 Thread: id = 1099 os_tid = 0x1f70 [0083.153] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0083.154] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.154] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.154] GetLastError () returned 0x5 [0083.154] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.154] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7285ee8) returned 1 Thread: id = 1100 os_tid = 0x1f74 [0083.155] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf6) returned 0x5ba34f8 [0083.155] wcscpy (in: _Dest=0x5ba34f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards" [0083.155] wcscat (in: _Dest=0x5ba34f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\" [0083.155] wcscat (in: _Dest=0x5ba34f8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\*" [0083.155] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3936ea0 [0083.155] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\*", lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342422a4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabf30abf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x342422a4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444b00 [0083.155] wcscmp (_String1=".", _String2=".") returned 0 [0083.155] FindNextFileW (in: hFindFile=0x5444b00, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342422a4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabf30abf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x342422a4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.155] wcscmp (_String1="..", _String2=".") returned 1 [0083.155] wcscmp (_String1="..", _String2="..") returned 0 [0083.155] FindNextFileW (in: hFindFile=0x5444b00, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342422a4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabf96d1f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x342b49b5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0083.155] wcscmp (_String1="Assets", _String2=".") returned 1 [0083.155] wcscmp (_String1="Assets", _String2="..") returned 1 [0083.155] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100) returned 0x7581ce8 [0083.155] wcscpy (in: _Dest=0x7581ce8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards" [0083.155] wcscat (in: _Dest=0x7581ce8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\" [0083.155] wcscat (in: _Dest=0x7581ce8, _Source="Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets" [0083.156] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x104) returned 0x74dfd58 [0085.060] wcscpy (in: _Dest=0x74dfd58, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets" [0085.060] wcscat (in: _Dest=0x74dfd58, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\" [0085.060] wcscat (in: _Dest=0x74dfd58, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\*" [0085.060] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a1b30 [0085.060] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\*", lpFindFileData=0x53a1b30 | out: lpFindFileData=0x53a1b30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342422a4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabf96d1f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x342b49b5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ea80 [0085.062] wcscmp (_String1=".", _String2=".") returned 0 [0085.062] FindNextFileW (in: hFindFile=0x389ea80, lpFindFileData=0x53a1b30 | out: lpFindFileData=0x53a1b30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342422a4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabf96d1f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x342b49b5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.062] wcscmp (_String1="..", _String2=".") returned 1 [0085.062] wcscmp (_String1="..", _String2="..") returned 0 [0085.062] FindNextFileW (in: hFindFile=0x389ea80, lpFindFileData=0x53a1b30 | out: lpFindFileData=0x53a1b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x342422a4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x34268502, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x34268502, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3af7, dwReserved0=0x0, dwReserved1=0x0, cFileName="3_awards_years_base.png", cAlternateFileName="")) returned 1 [0085.062] wcscmp (_String1="3_awards_years_base.png", _String2=".") returned 1 [0085.062] wcscmp (_String1="3_awards_years_base.png", _String2="..") returned 1 [0085.062] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x130) returned 0x7586b68 [0085.062] wcscpy (in: _Dest=0x7586b68, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets" [0085.062] wcscat (in: _Dest=0x7586b68, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\" [0085.062] wcscat (in: _Dest=0x7586b68, _Source="3_awards_years_base.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\3_awards_years_base.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\3_awards_years_base.png" [0088.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7586b68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2098 [0088.871] FindNextFileW (in: hFindFile=0x389ea80, lpFindFileData=0x53a1b30 | out: lpFindFileData=0x53a1b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34268502, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x34268502, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x34268502, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="awards_circle_gray.png", cAlternateFileName="")) returned 1 [0088.871] wcscmp (_String1="awards_circle_gray.png", _String2=".") returned 1 [0088.871] wcscmp (_String1="awards_circle_gray.png", _String2="..") returned 1 [0088.871] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12e) returned 0x5ba10e8 [0088.871] wcscpy (in: _Dest=0x5ba10e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets" [0088.871] wcscat (in: _Dest=0x5ba10e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\" [0088.871] wcscat (in: _Dest=0x5ba10e8, _Source="awards_circle_gray.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\awards_circle_gray.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\awards_circle_gray.png" [0088.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba10e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x39c [0088.871] FindNextFileW (in: hFindFile=0x389ea80, lpFindFileData=0x53a1b30 | out: lpFindFileData=0x53a1b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34268502, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3428e75b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3428e75b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x495, dwReserved0=0x0, dwReserved1=0x0, cFileName="awards_corner_gray.png", cAlternateFileName="")) returned 1 [0088.871] wcscmp (_String1="awards_corner_gray.png", _String2=".") returned 1 [0088.871] wcscmp (_String1="awards_corner_gray.png", _String2="..") returned 1 [0088.871] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12e) returned 0x5ba1838 [0088.871] wcscpy (in: _Dest=0x5ba1838, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets" [0088.871] wcscat (in: _Dest=0x5ba1838, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\" [0088.871] wcscat (in: _Dest=0x5ba1838, _Source="awards_corner_gray.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\awards_corner_gray.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\awards_corner_gray.png" [0088.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba1838, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x918 [0088.872] FindNextFileW (in: hFindFile=0x389ea80, lpFindFileData=0x53a1b30 | out: lpFindFileData=0x53a1b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3428e75b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3428e75b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3428e75b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xe3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Awards_cup.png", cAlternateFileName="")) returned 1 [0088.872] wcscmp (_String1="Awards_cup.png", _String2=".") returned 1 [0088.872] wcscmp (_String1="Awards_cup.png", _String2="..") returned 1 [0088.872] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11e) returned 0x74da040 [0088.872] wcscpy (in: _Dest=0x74da040, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets" [0088.872] wcscat (in: _Dest=0x74da040, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\" [0088.872] wcscat (in: _Dest=0x74da040, _Source="Awards_cup.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\Awards_cup.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\Awards_cup.png" [0088.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74da040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17c4 [0088.873] FindNextFileW (in: hFindFile=0x389ea80, lpFindFileData=0x53a1b30 | out: lpFindFileData=0x53a1b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3428e75b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3428e75b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3428e75b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x5a1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="awards_sign_in_tile.jpg", cAlternateFileName="")) returned 1 [0088.873] wcscmp (_String1="awards_sign_in_tile.jpg", _String2=".") returned 1 [0088.873] wcscmp (_String1="awards_sign_in_tile.jpg", _String2="..") returned 1 [0088.873] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x130) returned 0x5ba1220 [0088.873] wcscpy (in: _Dest=0x5ba1220, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets" [0088.873] wcscat (in: _Dest=0x5ba1220, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\" [0088.873] wcscat (in: _Dest=0x5ba1220, _Source="awards_sign_in_tile.jpg" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\awards_sign_in_tile.jpg") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\awards_sign_in_tile.jpg" [0088.873] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba1220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17c0 [0088.874] FindNextFileW (in: hFindFile=0x389ea80, lpFindFileData=0x53a1b30 | out: lpFindFileData=0x53a1b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3428e75b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x342b49b5, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x342b49b5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x40ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="awards_years_base.png", cAlternateFileName="")) returned 1 [0088.874] wcscmp (_String1="awards_years_base.png", _String2=".") returned 1 [0088.874] wcscmp (_String1="awards_years_base.png", _String2="..") returned 1 [0088.874] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12c) returned 0x5ba15c8 [0088.874] wcscpy (in: _Dest=0x5ba15c8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets" [0088.874] wcscat (in: _Dest=0x5ba15c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\" [0088.874] wcscat (in: _Dest=0x5ba15c8, _Source="awards_years_base.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\awards_years_base.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\awards_years_base.png" [0088.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba15c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17bc [0088.875] FindNextFileW (in: hFindFile=0x389ea80, lpFindFileData=0x53a1b30 | out: lpFindFileData=0x53a1b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x342b49b5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x342dac13, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x342dac13, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x339f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sign_in_size.jpg", cAlternateFileName="")) returned 1 [0088.875] wcscmp (_String1="Sign_in_size.jpg", _String2=".") returned 1 [0088.875] wcscmp (_String1="Sign_in_size.jpg", _String2="..") returned 1 [0088.875] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x122) returned 0x5ba1700 [0088.875] wcscpy (in: _Dest=0x5ba1700, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets" [0088.875] wcscat (in: _Dest=0x5ba1700, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\" [0088.875] wcscat (in: _Dest=0x5ba1700, _Source="Sign_in_size.jpg" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\Sign_in_size.jpg") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\Sign_in_size.jpg" [0088.875] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba1700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17b8 [0088.875] FindNextFileW (in: hFindFile=0x389ea80, lpFindFileData=0x53a1b30 | out: lpFindFileData=0x53a1b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x342b49b5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x342dac13, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x342dac13, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x339f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sign_in_size.jpg", cAlternateFileName="")) returned 0 [0088.875] FindClose (in: hFindFile=0x389ea80 | out: hFindFile=0x389ea80) returned 1 [0088.876] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a1b30) returned 1 [0088.876] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74dfd58) returned 1 [0088.876] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7581ce8) returned 1 [0088.876] FindNextFileW (in: hFindFile=0x5444b00, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342422a4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabf96d1f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x342b49b5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 0 [0088.876] FindClose (in: hFindFile=0x5444b00 | out: hFindFile=0x5444b00) returned 1 [0088.876] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3936ea0) returned 1 [0088.876] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba34f8) returned 1 [0088.877] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba2cf8) returned 1 Thread: id = 1101 os_tid = 0x1f78 [0083.156] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x108) returned 0x74dd8f0 [0085.058] wcscpy (in: _Dest=0x74dd8f0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges" [0085.058] wcscat (in: _Dest=0x74dd8f0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\" [0085.058] wcscat (in: _Dest=0x74dd8f0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\*" [0085.058] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a4418 [0085.058] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\*", lpFindFileData=0x53a4418 | out: lpFindFileData=0x53a4418*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342dac13, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabf9793f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x342dac13, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ed00 [0085.059] wcscmp (_String1=".", _String2=".") returned 0 [0085.059] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53a4418 | out: lpFindFileData=0x53a4418*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342dac13, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabf9793f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x342dac13, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.059] wcscmp (_String1="..", _String2=".") returned 1 [0085.059] wcscmp (_String1="..", _String2="..") returned 0 [0085.059] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53a4418 | out: lpFindFileData=0x53a4418*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342dac13, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabffc808, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3472fed7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0085.059] wcscmp (_String1="Assets", _String2=".") returned 1 [0085.059] wcscmp (_String1="Assets", _String2="..") returned 1 [0085.059] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x54bd4f8 [0085.060] wcscpy (in: _Dest=0x54bd4f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges" [0085.060] wcscat (in: _Dest=0x54bd4f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\" [0085.060] wcscat (in: _Dest=0x54bd4f8, _Source="Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets" [0088.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54bd4f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15a8 [0088.879] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53a4418 | out: lpFindFileData=0x53a4418*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342dac13, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabffc808, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3472fed7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 0 [0088.879] FindClose (in: hFindFile=0x389ed00 | out: hFindFile=0x389ed00) returned 1 [0088.879] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a4418) returned 1 [0088.879] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74dd8f0) Thread: id = 1102 os_tid = 0x1f7c [0083.157] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba36f8 [0083.157] wcscpy (in: _Dest=0x5ba36f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News" [0083.157] wcscat (in: _Dest=0x5ba36f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\" [0083.157] wcscat (in: _Dest=0x5ba36f8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\*" [0083.157] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3937370 [0083.157] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\*", lpFindFileData=0x3937370 | out: lpFindFileData=0x3937370*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3477c3bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac190436, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3477c3bd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444b80 [0083.158] wcscmp (_String1=".", _String2=".") returned 0 [0083.158] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x3937370 | out: lpFindFileData=0x3937370*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3477c3bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac190436, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3477c3bd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.158] wcscmp (_String1="..", _String2=".") returned 1 [0083.158] wcscmp (_String1="..", _String2="..") returned 0 [0083.158] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x3937370 | out: lpFindFileData=0x3937370*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3477c3bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac1fc576, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x347a261b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0083.158] wcscmp (_String1="Assets", _String2=".") returned 1 [0083.158] wcscmp (_String1="Assets", _String2="..") returned 1 [0083.158] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x7581df0 [0083.158] wcscpy (in: _Dest=0x7581df0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News" [0083.158] wcscat (in: _Dest=0x7581df0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\" [0083.158] wcscat (in: _Dest=0x7581df0, _Source="Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets" [0083.158] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100) returned 0x75818c8 [0083.158] wcscpy (in: _Dest=0x75818c8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets" [0083.158] wcscat (in: _Dest=0x75818c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\" [0083.158] wcscat (in: _Dest=0x75818c8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\*" [0083.158] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d1900 [0083.158] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\*", lpFindFileData=0x53d1900 | out: lpFindFileData=0x53d1900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3477c3bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac1fc576, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x347a261b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e9c0 [0085.059] wcscmp (_String1=".", _String2=".") returned 0 [0085.059] FindNextFileW (in: hFindFile=0x389e9c0, lpFindFileData=0x53d1900 | out: lpFindFileData=0x53d1900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3477c3bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac1fc576, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x347a261b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.059] wcscmp (_String1="..", _String2=".") returned 1 [0085.059] wcscmp (_String1="..", _String2="..") returned 0 [0085.059] FindNextFileW (in: hFindFile=0x389e9c0, lpFindFileData=0x53d1900 | out: lpFindFileData=0x53d1900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x347a261b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x347a261b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x347a261b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x19b, dwReserved0=0x0, dwReserved1=0x0, cFileName="newsBackground.html", cAlternateFileName="")) returned 1 [0085.059] wcscmp (_String1="newsBackground.html", _String2=".") returned 1 [0085.059] wcscmp (_String1="newsBackground.html", _String2="..") returned 1 [0085.059] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x124) returned 0x75868f8 [0085.059] wcscpy (in: _Dest=0x75868f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets" [0085.059] wcscat (in: _Dest=0x75868f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\" [0085.059] wcscat (in: _Dest=0x75868f8, _Source="newsBackground.html" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\newsBackground.html") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\newsBackground.html" [0088.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x75868f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x994 [0088.880] FindNextFileW (in: hFindFile=0x389e9c0, lpFindFileData=0x53d1900 | out: lpFindFileData=0x53d1900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3477c3bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3477c3bd, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3477c3bd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x83, dwReserved0=0x0, dwReserved1=0x0, cFileName="news_button.png", cAlternateFileName="")) returned 1 [0088.880] wcscmp (_String1="news_button.png", _String2=".") returned 1 [0088.880] wcscmp (_String1="news_button.png", _String2="..") returned 1 [0088.880] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11c) returned 0x74d9138 [0088.880] wcscpy (in: _Dest=0x74d9138, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets" [0088.880] wcscat (in: _Dest=0x74d9138, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\" [0088.880] wcscat (in: _Dest=0x74d9138, _Source="news_button.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\news_button.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\news_button.png" [0088.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74d9138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x159c [0088.880] FindNextFileW (in: hFindFile=0x389e9c0, lpFindFileData=0x53d1900 | out: lpFindFileData=0x53d1900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3477c3bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3477c3bd, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3477c3bd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="news_button_down.png", cAlternateFileName="")) returned 1 [0088.881] wcscmp (_String1="news_button_down.png", _String2=".") returned 1 [0088.881] wcscmp (_String1="news_button_down.png", _String2="..") returned 1 [0088.881] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x126) returned 0x74df4f8 [0088.881] wcscpy (in: _Dest=0x74df4f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets" [0088.881] wcscat (in: _Dest=0x74df4f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\" [0088.881] wcscat (in: _Dest=0x74df4f8, _Source="news_button_down.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\news_button_down.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\news_button_down.png" [0088.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74df4f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1590 [0088.881] FindNextFileW (in: hFindFile=0x389e9c0, lpFindFileData=0x53d1900 | out: lpFindFileData=0x53d1900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3477c3bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3477c3bd, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3477c3bd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="news_button_over.png", cAlternateFileName="")) returned 1 [0088.881] wcscmp (_String1="news_button_over.png", _String2=".") returned 1 [0088.881] wcscmp (_String1="news_button_over.png", _String2="..") returned 1 [0088.881] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x126) returned 0x74dfeb8 [0088.881] wcscpy (in: _Dest=0x74dfeb8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets" [0088.881] wcscat (in: _Dest=0x74dfeb8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\" [0088.881] wcscat (in: _Dest=0x74dfeb8, _Source="news_button_over.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\news_button_over.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\news_button_over.png" [0088.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74dfeb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418 [0088.882] FindNextFileW (in: hFindFile=0x389e9c0, lpFindFileData=0x53d1900 | out: lpFindFileData=0x53d1900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3477c3bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3477c3bd, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3477c3bd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x20a, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_icon-over.png", cAlternateFileName="")) returned 1 [0088.882] wcscmp (_String1="News_icon-over.png", _String2=".") returned 1 [0088.882] wcscmp (_String1="News_icon-over.png", _String2="..") returned 1 [0088.882] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x122) returned 0x74df150 [0088.882] wcscpy (in: _Dest=0x74df150, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets" [0088.882] wcscat (in: _Dest=0x74df150, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\" [0088.882] wcscat (in: _Dest=0x74df150, _Source="News_icon-over.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\News_icon-over.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\News_icon-over.png" [0088.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74df150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x209c [0088.883] FindNextFileW (in: hFindFile=0x389e9c0, lpFindFileData=0x53d1900 | out: lpFindFileData=0x53d1900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3477c3bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3477c3bd, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3477c3bd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_icon-press.png", cAlternateFileName="")) returned 1 [0088.883] wcscmp (_String1="News_icon-press.png", _String2=".") returned 1 [0088.883] wcscmp (_String1="News_icon-press.png", _String2="..") returned 1 [0088.883] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x124) returned 0x74e0ae8 [0088.883] wcscpy (in: _Dest=0x74e0ae8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets" [0088.883] wcscat (in: _Dest=0x74e0ae8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\" [0088.883] wcscat (in: _Dest=0x74e0ae8, _Source="News_icon-press.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\News_icon-press.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\News_icon-press.png" [0088.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e0ae8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x98c [0088.884] FindNextFileW (in: hFindFile=0x389e9c0, lpFindFileData=0x53d1900 | out: lpFindFileData=0x53d1900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3477c3bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3477c3bd, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3477c3bd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_icon-up.png", cAlternateFileName="")) returned 1 [0088.884] wcscmp (_String1="News_icon-up.png", _String2=".") returned 1 [0088.884] wcscmp (_String1="News_icon-up.png", _String2="..") returned 1 [0088.884] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11e) returned 0x74d9260 [0088.884] wcscpy (in: _Dest=0x74d9260, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets" [0088.884] wcscat (in: _Dest=0x74d9260, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\" [0088.884] wcscat (in: _Dest=0x74d9260, _Source="News_icon-up.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\News_icon-up.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\News_icon-up.png" [0088.884] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74d9260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17b4 [0088.884] FindNextFileW (in: hFindFile=0x389e9c0, lpFindFileData=0x53d1900 | out: lpFindFileData=0x53d1900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3477c3bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3477c3bd, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3477c3bd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_icon-up.png", cAlternateFileName="")) returned 0 [0088.884] FindClose (in: hFindFile=0x389e9c0 | out: hFindFile=0x389e9c0) returned 1 [0088.885] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d1900) returned 1 [0088.885] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75818c8) returned 1 [0088.885] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7581df0) returned 1 [0088.885] FindNextFileW (in: hFindFile=0x5444b80, lpFindFileData=0x3937370 | out: lpFindFileData=0x3937370*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3477c3bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac1fc576, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x347a261b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 0 [0088.885] FindClose (in: hFindFile=0x5444b80 | out: hFindFile=0x5444b80) returned 1 [0088.885] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3937370) returned 1 [0088.885] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba36f8) returned 1 [0088.885] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7287818) returned 1 Thread: id = 1103 os_tid = 0x1f80 [0083.159] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfa) returned 0x7582948 [0083.159] wcscpy (in: _Dest=0x7582948, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub" [0083.159] wcscat (in: _Dest=0x7582948, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\" [0083.159] wcscat (in: _Dest=0x7582948, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\*" [0083.159] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53cf750 [0083.159] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\*", lpFindFileData=0x53cf750 | out: lpFindFileData=0x53cf750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x347a261b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac1fd71d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x347a261b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e940 [0085.056] wcscmp (_String1=".", _String2=".") returned 0 [0085.056] FindNextFileW (in: hFindFile=0x389e940, lpFindFileData=0x53cf750 | out: lpFindFileData=0x53cf750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x347a261b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac1fd71d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x347a261b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.056] wcscmp (_String1="..", _String2=".") returned 1 [0085.056] wcscmp (_String1="..", _String2="..") returned 0 [0085.056] FindNextFileW (in: hFindFile=0x389e940, lpFindFileData=0x53cf750 | out: lpFindFileData=0x53cf750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x347a261b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac275cac, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3499a434, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0085.056] wcscmp (_String1="Assets", _String2=".") returned 1 [0085.056] wcscmp (_String1="Assets", _String2="..") returned 1 [0085.056] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x104) returned 0x75774f0 [0085.056] wcscpy (in: _Dest=0x75774f0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub" [0085.056] wcscat (in: _Dest=0x75774f0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\" [0085.056] wcscat (in: _Dest=0x75774f0, _Source="Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets" [0088.887] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x75774f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20a0 [0088.887] FindNextFileW (in: hFindFile=0x389e940, lpFindFileData=0x53cf750 | out: lpFindFileData=0x53cf750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x347a261b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac275cac, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3499a434, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 0 [0088.887] FindClose (in: hFindFile=0x389e940 | out: hFindFile=0x389e940) returned 1 [0088.887] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53cf750) returned 1 [0088.887] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7582948) returned 1 [0088.887] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba35f8) returned 1 Thread: id = 1104 os_tid = 0x1f84 [0083.159] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf6) returned 0x5ba39f8 [0083.159] wcscpy (in: _Dest=0x5ba39f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell" [0083.160] wcscat (in: _Dest=0x5ba39f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\" [0083.160] wcscat (in: _Dest=0x5ba39f8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\*" [0083.160] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53cf9b8 [0083.160] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\*", lpFindFileData=0x53cf9b8 | out: lpFindFileData=0x53cf9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3499a434, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac3703f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3499a434, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444c00 [0083.160] wcscmp (_String1=".", _String2=".") returned 0 [0083.160] FindNextFileW (in: hFindFile=0x5444c00, lpFindFileData=0x53cf9b8 | out: lpFindFileData=0x53cf9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3499a434, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac3703f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3499a434, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.161] wcscmp (_String1="..", _String2=".") returned 1 [0083.161] wcscmp (_String1="..", _String2="..") returned 0 [0083.161] FindNextFileW (in: hFindFile=0x5444c00, lpFindFileData=0x53cf9b8 | out: lpFindFileData=0x53cf9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3499a434, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac371336, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3499a434, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0083.161] wcscmp (_String1="Default", _String2=".") returned 1 [0083.161] wcscmp (_String1="Default", _String2="..") returned 1 [0083.161] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x102) returned 0x74d85f8 [0085.055] wcscpy (in: _Dest=0x74d85f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell" [0085.055] wcscat (in: _Dest=0x74d85f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\" [0085.055] wcscat (in: _Dest=0x74d85f8, _Source="Default" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\Default") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\Default" [0088.564] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x74d85f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x227c [0088.565] FindNextFileW (in: hFindFile=0x5444c00, lpFindFileData=0x53cf9b8 | out: lpFindFileData=0x53cf9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3499a434, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac371336, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3499a434, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 0 [0088.565] FindClose (in: hFindFile=0x5444c00 | out: hFindFile=0x5444c00) returned 1 [0088.565] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53cf9b8) returned 1 [0088.565] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba39f8) returned 1 [0088.565] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba28f8) returned 1 Thread: id = 1105 os_tid = 0x1f88 [0083.161] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x102) returned 0x74d6938 [0085.046] wcscpy (in: _Dest=0x74d6938, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Xaml.Toolkit" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Xaml.Toolkit") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Xaml.Toolkit" [0085.046] wcscat (in: _Dest=0x74d6938, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Xaml.Toolkit\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Xaml.Toolkit\\" [0085.046] wcscat (in: _Dest=0x74d6938, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Xaml.Toolkit\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Xaml.Toolkit\\*" [0085.046] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a24d0 [0085.046] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Xaml.Toolkit\\*", lpFindFileData=0x53a24d0 | out: lpFindFileData=0x53a24d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x349e68bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac371ee7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x349e68bd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ea80 [0085.047] wcscmp (_String1=".", _String2=".") returned 0 [0085.047] FindNextFileW (in: hFindFile=0x389ea80, lpFindFileData=0x53a24d0 | out: lpFindFileData=0x53a24d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x349e68bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac371ee7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x349e68bd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.047] wcscmp (_String1="..", _String2=".") returned 1 [0085.047] wcscmp (_String1="..", _String2="..") returned 0 [0085.047] FindNextFileW (in: hFindFile=0x389ea80, lpFindFileData=0x53a24d0 | out: lpFindFileData=0x53a24d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x349e68bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac487abd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34af1924, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0085.047] wcscmp (_String1="Assets", _String2=".") returned 1 [0085.047] wcscmp (_String1="Assets", _String2="..") returned 1 [0085.047] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10c) returned 0x74d6eb0 [0085.047] wcscpy (in: _Dest=0x74d6eb0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Xaml.Toolkit" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Xaml.Toolkit") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Xaml.Toolkit" [0085.047] wcscat (in: _Dest=0x74d6eb0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Xaml.Toolkit\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Xaml.Toolkit\\" [0085.047] wcscat (in: _Dest=0x74d6eb0, _Source="Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Xaml.Toolkit\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Xaml.Toolkit\\Assets" [0085.047] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x74d6eb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9cc [0085.048] FindNextFileW (in: hFindFile=0x389ea80, lpFindFileData=0x53a24d0 | out: lpFindFileData=0x53a24d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x349e68bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac487abd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34af1924, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 0 [0085.048] FindClose (in: hFindFile=0x389ea80 | out: hFindFile=0x389ea80) returned 1 [0085.048] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a24d0) returned 1 [0085.048] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74d6938) returned 1 [0085.048] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549a028) returned 1 Thread: id = 1106 os_tid = 0x1f8c [0083.162] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x53fcb00 [0083.162] wcscpy (in: _Dest=0x53fcb00, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0083.162] wcscat (in: _Dest=0x53fcb00, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0083.162] wcscat (in: _Dest=0x53fcb00, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\*" [0083.162] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53cfc20 [0083.162] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34b17b7d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac644067, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x377f6ca3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444c40 [0083.164] wcscmp (_String1=".", _String2=".") returned 0 [0083.164] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34b17b7d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac644067, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x377f6ca3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.165] wcscmp (_String1="..", _String2=".") returned 1 [0083.165] wcscmp (_String1="..", _String2="..") returned 0 [0083.165] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34b17b7d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x34b17b7d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x34b17b7d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4392, dwReserved0=0x0, dwReserved1=0x0, cFileName="ads_casualgames_300x250.png", cAlternateFileName="")) returned 1 [0083.165] wcscmp (_String1="ads_casualgames_300x250.png", _String2=".") returned 1 [0083.165] wcscmp (_String1="ads_casualgames_300x250.png", _String2="..") returned 1 [0083.166] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10c) returned 0x74d3c10 [0085.020] wcscpy (in: _Dest=0x74d3c10, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.020] wcscat (in: _Dest=0x74d3c10, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.020] wcscat (in: _Dest=0x74d3c10, _Source="ads_casualgames_300x250.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ads_casualgames_300x250.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ads_casualgames_300x250.png" [0085.020] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74d3c10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20ac [0085.020] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34b17b7d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x34b17b7d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x34b17b7d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3233, dwReserved0=0x0, dwReserved1=0x0, cFileName="ads_casualgames_728x90.png", cAlternateFileName="")) returned 1 [0085.020] wcscmp (_String1="ads_casualgames_728x90.png", _String2=".") returned 1 [0085.020] wcscmp (_String1="ads_casualgames_728x90.png", _String2="..") returned 1 [0085.020] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0x74d4818 [0085.020] wcscpy (in: _Dest=0x74d4818, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.020] wcscat (in: _Dest=0x74d4818, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.020] wcscat (in: _Dest=0x74d4818, _Source="ads_casualgames_728x90.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ads_casualgames_728x90.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ads_casualgames_728x90.png" [0085.020] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74d4818, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20b0 [0085.021] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34b3ddd7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x34b3ddd7, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x34b3ddd7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x110a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ads_premium.jpg", cAlternateFileName="")) returned 1 [0085.021] wcscmp (_String1="ads_premium.jpg", _String2=".") returned 1 [0085.021] wcscmp (_String1="ads_premium.jpg", _String2="..") returned 1 [0085.021] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf4) returned 0x5ba27f8 [0085.021] wcscpy (in: _Dest=0x5ba27f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.021] wcscat (in: _Dest=0x5ba27f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.021] wcscat (in: _Dest=0x5ba27f8, _Source="ads_premium.jpg" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ads_premium.jpg") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ads_premium.jpg" [0085.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba27f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd10 [0085.022] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34b3ddd7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x34b64035, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x34b64035, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xc1c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ads_win10_300x250.scale-200.jpg", cAlternateFileName="")) returned 1 [0085.022] wcscmp (_String1="ads_win10_300x250.scale-200.jpg", _String2=".") returned 1 [0085.022] wcscmp (_String1="ads_win10_300x250.scale-200.jpg", _String2="..") returned 1 [0085.022] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x114) returned 0x54bcf30 [0085.022] wcscpy (in: _Dest=0x54bcf30, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.022] wcscat (in: _Dest=0x54bcf30, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.022] wcscat (in: _Dest=0x54bcf30, _Source="ads_win10_300x250.scale-200.jpg" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ads_win10_300x250.scale-200.jpg") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ads_win10_300x250.scale-200.jpg" [0085.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bcf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcfc [0085.022] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34b64035, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x34b64035, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x34b64035, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xc61a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ads_win10_728x90.scale-200.jpg", cAlternateFileName="")) returned 1 [0085.022] wcscmp (_String1="ads_win10_728x90.scale-200.jpg", _String2=".") returned 1 [0085.022] wcscmp (_String1="ads_win10_728x90.scale-200.jpg", _String2="..") returned 1 [0085.022] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x54bd058 [0085.023] wcscpy (in: _Dest=0x54bd058, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.023] wcscat (in: _Dest=0x54bd058, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.023] wcscat (in: _Dest=0x54bd058, _Source="ads_win10_728x90.scale-200.jpg" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ads_win10_728x90.scale-200.jpg") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ads_win10_728x90.scale-200.jpg" [0085.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bd058, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3fc [0085.023] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34b64035, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac645b09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34b64035, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Advertisement", cAlternateFileName="ADVERT~1")) returned 1 [0085.023] wcscmp (_String1="Advertisement", _String2=".") returned 1 [0085.024] wcscmp (_String1="Advertisement", _String2="..") returned 1 [0085.024] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x7286c78 [0085.024] wcscpy (in: _Dest=0x7286c78, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.024] wcscat (in: _Dest=0x7286c78, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.024] wcscat (in: _Dest=0x7286c78, _Source="Advertisement" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Advertisement") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Advertisement" [0085.024] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7286c78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb8c [0085.024] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34b64035, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac6cbcfb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34c48e56, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Audio", cAlternateFileName="")) returned 1 [0085.024] wcscmp (_String1="Audio", _String2=".") returned 1 [0085.024] wcscmp (_String1="Audio", _String2="..") returned 1 [0085.024] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54f0ec0 [0085.024] wcscpy (in: _Dest=0x54f0ec0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.024] wcscat (in: _Dest=0x54f0ec0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.024] wcscat (in: _Dest=0x54f0ec0, _Source="Audio" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Audio") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Audio" [0085.025] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54f0ec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa64 [0085.025] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34c48e56, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac6cce12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x350306db, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Awards", cAlternateFileName="")) returned 1 [0085.025] wcscmp (_String1="Awards", _String2=".") returned 1 [0085.025] wcscmp (_String1="Awards", _String2="..") returned 1 [0085.025] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x54b9a08 [0085.025] wcscpy (in: _Dest=0x54b9a08, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.025] wcscat (in: _Dest=0x54b9a08, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.025] wcscat (in: _Dest=0x54b9a08, _Source="Awards" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Awards") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Awards" [0085.025] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54b9a08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa60 [0085.026] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x350f002f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x350f002f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x350f002f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x561, dwReserved0=0x0, dwReserved1=0x0, cFileName="backgroundTile.png", cAlternateFileName="")) returned 1 [0085.026] wcscmp (_String1="backgroundTile.png", _String2=".") returned 1 [0085.026] wcscmp (_String1="backgroundTile.png", _String2="..") returned 1 [0085.026] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfa) returned 0x549a130 [0085.026] wcscpy (in: _Dest=0x549a130, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.026] wcscat (in: _Dest=0x549a130, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.026] wcscat (in: _Dest=0x549a130, _Source="backgroundTile.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\backgroundTile.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\backgroundTile.png" [0085.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549a130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa5c [0085.027] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x350c904a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x350c904a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x350c904a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xb4ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="background_gradient.png", cAlternateFileName="")) returned 1 [0085.027] wcscmp (_String1="background_gradient.png", _String2=".") returned 1 [0085.027] wcscmp (_String1="background_gradient.png", _String2="..") returned 1 [0085.027] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x104) returned 0x74d4c78 [0085.027] wcscpy (in: _Dest=0x74d4c78, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.027] wcscat (in: _Dest=0x74d4c78, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.027] wcscat (in: _Dest=0x74d4c78, _Source="background_gradient.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\background_gradient.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\background_gradient.png" [0085.027] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74d4c78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa54 [0085.027] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x350c904a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x350f002f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x350f002f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x100ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="background_gradient_2.png", cAlternateFileName="")) returned 1 [0085.027] wcscmp (_String1="background_gradient_2.png", _String2=".") returned 1 [0085.027] wcscmp (_String1="background_gradient_2.png", _String2="..") returned 1 [0085.027] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x108) returned 0x74d3d28 [0085.027] wcscpy (in: _Dest=0x74d3d28, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.027] wcscat (in: _Dest=0x74d3d28, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.027] wcscat (in: _Dest=0x74d3d28, _Source="background_gradient_2.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\background_gradient_2.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\background_gradient_2.png" [0085.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74d3d28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa38 [0085.028] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x350f002f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac95a2c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x352c9059, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Buttons", cAlternateFileName="")) returned 1 [0085.028] wcscmp (_String1="Buttons", _String2=".") returned 1 [0085.028] wcscmp (_String1="Buttons", _String2="..") returned 1 [0085.028] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe4) returned 0x54b8928 [0085.028] wcscpy (in: _Dest=0x54b8928, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.028] wcscat (in: _Dest=0x54b8928, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.028] wcscat (in: _Dest=0x54b8928, _Source="Buttons" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Buttons") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Buttons" [0085.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54b8928, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa34 [0085.029] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x352f22cf, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x35317d60, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x35317d60, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x555a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cardsLoadingSequence.png", cAlternateFileName="")) returned 1 [0085.029] wcscmp (_String1="cardsLoadingSequence.png", _String2=".") returned 1 [0085.029] wcscmp (_String1="cardsLoadingSequence.png", _String2="..") returned 1 [0085.029] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x74d45e8 [0085.029] wcscpy (in: _Dest=0x74d45e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.029] wcscat (in: _Dest=0x74d45e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.029] wcscat (in: _Dest=0x74d45e8, _Source="cardsLoadingSequence.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\cardsLoadingSequence.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\cardsLoadingSequence.png" [0085.029] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74d45e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa30 [0085.030] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3533dfe8, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaccce3d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x355540e1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DailyChallenges", cAlternateFileName="DAILYC~1")) returned 1 [0085.030] wcscmp (_String1="DailyChallenges", _String2=".") returned 1 [0085.030] wcscmp (_String1="DailyChallenges", _String2="..") returned 1 [0085.030] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf4) returned 0x5ba59f8 [0085.030] wcscpy (in: _Dest=0x5ba59f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.030] wcscat (in: _Dest=0x5ba59f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.030] wcscat (in: _Dest=0x5ba59f8, _Source="DailyChallenges" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\DailyChallenges") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\DailyChallenges" [0085.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba59f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa2c [0085.030] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35317d60, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3533dfe8, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3533dfe8, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xdcd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="daily_challenge.jpg", cAlternateFileName="")) returned 1 [0085.031] wcscmp (_String1="daily_challenge.jpg", _String2=".") returned 1 [0085.031] wcscmp (_String1="daily_challenge.jpg", _String2="..") returned 1 [0085.031] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x549a238 [0085.031] wcscpy (in: _Dest=0x549a238, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.031] wcscat (in: _Dest=0x549a238, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.031] wcscat (in: _Dest=0x549a238, _Source="daily_challenge.jpg" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\daily_challenge.jpg") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\daily_challenge.jpg" [0085.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549a238, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa24 [0085.031] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3557a33f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacd9b495, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x355a0598, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fireworks", cAlternateFileName="FIREWO~1")) returned 1 [0085.031] wcscmp (_String1="Fireworks", _String2=".") returned 1 [0085.031] wcscmp (_String1="Fireworks", _String2="..") returned 1 [0085.031] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x54b8bf8 [0085.031] wcscpy (in: _Dest=0x54b8bf8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.031] wcscat (in: _Dest=0x54b8bf8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.031] wcscat (in: _Dest=0x54b8bf8, _Source="Fireworks" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Fireworks") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Fireworks" [0085.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54b8bf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa20 [0085.032] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x355c67f6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xace02661, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3576d4df, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fues", cAlternateFileName="")) returned 1 [0085.032] wcscmp (_String1="Fues", _String2=".") returned 1 [0085.032] wcscmp (_String1="Fues", _String2="..") returned 1 [0085.032] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xde) returned 0x54f1178 [0085.032] wcscpy (in: _Dest=0x54f1178, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.032] wcscat (in: _Dest=0x54f1178, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.032] wcscat (in: _Dest=0x54f1178, _Source="Fues" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Fues") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Fues" [0085.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54f1178, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa1c [0085.033] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35793738, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xace05649, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3582c0a2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameEnd", cAlternateFileName="")) returned 1 [0085.033] wcscmp (_String1="GameEnd", _String2=".") returned 1 [0085.033] wcscmp (_String1="GameEnd", _String2="..") returned 1 [0085.033] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe4) returned 0x54b8a18 [0085.033] wcscpy (in: _Dest=0x54b8a18, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.033] wcscat (in: _Dest=0x54b8a18, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.033] wcscat (in: _Dest=0x54b8a18, _Source="GameEnd" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\GameEnd") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\GameEnd" [0085.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54b8a18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa18 [0085.034] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35852300, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x35852300, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x35852300, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="gameEndBackground.html", cAlternateFileName="")) returned 1 [0085.034] wcscmp (_String1="gameEndBackground.html", _String2=".") returned 1 [0085.034] wcscmp (_String1="gameEndBackground.html", _String2="..") returned 1 [0085.034] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x102) returned 0x74d4700 [0085.034] wcscpy (in: _Dest=0x74d4700, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.034] wcscat (in: _Dest=0x74d4700, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.034] wcscat (in: _Dest=0x74d4700, _Source="gameEndBackground.html" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\gameEndBackground.html") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\gameEndBackground.html" [0085.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74d4700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa14 [0085.035] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3582c0a2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x35852300, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x35852300, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x5d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="gameEnd_background_symbols.jpg", cAlternateFileName="")) returned 1 [0085.035] wcscmp (_String1="gameEnd_background_symbols.jpg", _String2=".") returned 1 [0085.035] wcscmp (_String1="gameEnd_background_symbols.jpg", _String2="..") returned 1 [0085.035] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x54bce08 [0085.035] wcscpy (in: _Dest=0x54bce08, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.035] wcscat (in: _Dest=0x54bce08, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.035] wcscat (in: _Dest=0x54bce08, _Source="gameEnd_background_symbols.jpg" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\gameEnd_background_symbols.jpg") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\gameEnd_background_symbols.jpg" [0085.035] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bce08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa10 [0085.035] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35852300, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xace066b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35f531bc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GamePlayAssets", cAlternateFileName="GAMEPL~1")) returned 1 [0085.035] wcscmp (_String1="GamePlayAssets", _String2=".") returned 1 [0085.035] wcscmp (_String1="GamePlayAssets", _String2="..") returned 1 [0085.035] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba5af8 [0085.036] wcscpy (in: _Dest=0x5ba5af8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.036] wcscat (in: _Dest=0x5ba5af8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.036] wcscat (in: _Dest=0x5ba5af8, _Source="GamePlayAssets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\GamePlayAssets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\GamePlayAssets" [0085.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba5af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa0c [0085.036] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35febb26, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x35febb26, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x35febb26, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x661, dwReserved0=0x0, dwReserved1=0x0, cFileName="glow.png", cAlternateFileName="")) returned 1 [0085.036] wcscmp (_String1="glow.png", _String2=".") returned 1 [0085.036] wcscmp (_String1="glow.png", _String2="..") returned 1 [0085.036] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe6) returned 0x54b9af8 [0085.036] wcscpy (in: _Dest=0x54b9af8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.036] wcscat (in: _Dest=0x54b9af8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.036] wcscat (in: _Dest=0x54b9af8, _Source="glow.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\glow.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\glow.png" [0085.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54b9af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa08 [0085.037] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35febb26, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x35febb26, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x35febb26, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x959, dwReserved0=0x0, dwReserved1=0x0, cFileName="goldbar.png", cAlternateFileName="")) returned 1 [0085.037] wcscmp (_String1="goldbar.png", _String2=".") returned 1 [0085.037] wcscmp (_String1="goldbar.png", _String2="..") returned 1 [0085.037] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x7286d70 [0085.037] wcscpy (in: _Dest=0x7286d70, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.037] wcscat (in: _Dest=0x7286d70, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.037] wcscat (in: _Dest=0x7286d70, _Source="goldbar.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\goldbar.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\goldbar.png" [0085.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7286d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa04 [0085.038] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35febb26, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x36011d7f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x36011d7f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xaf30, dwReserved0=0x0, dwReserved1=0x0, cFileName="HalfPrice3.png", cAlternateFileName="")) returned 1 [0085.038] wcscmp (_String1="HalfPrice3.png", _String2=".") returned 1 [0085.038] wcscmp (_String1="HalfPrice3.png", _String2="..") returned 1 [0085.038] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba54f8 [0085.038] wcscpy (in: _Dest=0x5ba54f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.038] wcscat (in: _Dest=0x5ba54f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.038] wcscat (in: _Dest=0x5ba54f8, _Source="HalfPrice3.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\HalfPrice3.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\HalfPrice3.png" [0085.038] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba54f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa00 [0085.039] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36011d7f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacf21496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x363fa5db, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HowToPlay", cAlternateFileName="HOWTOP~1")) returned 1 [0085.039] wcscmp (_String1="HowToPlay", _String2=".") returned 1 [0085.039] wcscmp (_String1="HowToPlay", _String2="..") returned 1 [0085.039] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x54b9648 [0085.039] wcscpy (in: _Dest=0x54b9648, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.039] wcscat (in: _Dest=0x54b9648, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.039] wcscat (in: _Dest=0x54b9648, _Source="HowToPlay" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\HowToPlay") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\HowToPlay" [0085.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54b9648, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f8 [0085.040] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x364746b3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad239fed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3650d026, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icons", cAlternateFileName="")) returned 1 [0085.040] wcscmp (_String1="Icons", _String2=".") returned 1 [0085.040] wcscmp (_String1="Icons", _String2="..") returned 1 [0085.040] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54f1260 [0085.040] wcscpy (in: _Dest=0x54f1260, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.040] wcscat (in: _Dest=0x54f1260, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.040] wcscat (in: _Dest=0x54f1260, _Source="Icons" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Icons") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Icons" [0085.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54f1260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f4 [0085.040] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3650d026, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3650d026, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3650d026, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1bf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="light burst.png", cAlternateFileName="")) returned 1 [0085.041] wcscmp (_String1="light burst.png", _String2=".") returned 1 [0085.041] wcscmp (_String1="light burst.png", _String2="..") returned 1 [0085.041] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf4) returned 0x5ba52f8 [0085.041] wcscpy (in: _Dest=0x5ba52f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.041] wcscat (in: _Dest=0x5ba52f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.041] wcscat (in: _Dest=0x5ba52f8, _Source="light burst.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\light burst.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\light burst.png" [0085.041] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba52f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e8 [0085.041] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3650d026, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad2b592c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x365a5990, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Livetiles", cAlternateFileName="LIVETI~1")) returned 1 [0085.041] wcscmp (_String1="Livetiles", _String2=".") returned 1 [0085.041] wcscmp (_String1="Livetiles", _String2="..") returned 1 [0085.041] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x54b9288 [0085.041] wcscpy (in: _Dest=0x54b9288, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.041] wcscat (in: _Dest=0x54b9288, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.041] wcscat (in: _Dest=0x54b9288, _Source="Livetiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Livetiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Livetiles" [0085.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54b9288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e4 [0085.042] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x365a5990, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad3440cd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x365cbbe9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MainPage", cAlternateFileName="")) returned 1 [0085.042] wcscmp (_String1="MainPage", _String2=".") returned 1 [0085.042] wcscmp (_String1="MainPage", _String2="..") returned 1 [0085.042] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe6) returned 0x54b8b08 [0085.042] wcscpy (in: _Dest=0x54b8b08, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.042] wcscat (in: _Dest=0x54b8b08, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.042] wcscat (in: _Dest=0x54b8b08, _Source="MainPage" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\MainPage") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\MainPage" [0085.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54b8b08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e0 [0085.043] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x365cbbe9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x365cbbe9, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x365cbbe9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x0, cFileName="mainPageBackground.html", cAlternateFileName="")) returned 1 [0085.043] wcscmp (_String1="mainPageBackground.html", _String2=".") returned 1 [0085.043] wcscmp (_String1="mainPageBackground.html", _String2="..") returned 1 [0085.043] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x104) returned 0x74d4930 [0085.043] wcscpy (in: _Dest=0x74d4930, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.043] wcscat (in: _Dest=0x74d4930, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.043] wcscat (in: _Dest=0x74d4930, _Source="mainPageBackground.html" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\mainPageBackground.html") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\mainPageBackground.html" [0085.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74d4930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d8 [0085.044] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x365cbbe9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad346b82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36664553, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MainPageState2", cAlternateFileName="MAINPA~1")) returned 1 [0085.044] wcscmp (_String1="MainPageState2", _String2=".") returned 1 [0085.044] wcscmp (_String1="MainPageState2", _String2="..") returned 1 [0085.044] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba53f8 [0085.044] wcscpy (in: _Dest=0x5ba53f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.044] wcscat (in: _Dest=0x5ba53f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.044] wcscat (in: _Dest=0x5ba53f8, _Source="MainPageState2" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\MainPageState2") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\MainPageState2" [0085.044] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba53f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d4 [0085.045] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36664553, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x36664553, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x36664553, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x622a, dwReserved0=0x0, dwReserved1=0x0, cFileName="more2.jpg", cAlternateFileName="")) returned 1 [0085.049] wcscmp (_String1="more2.jpg", _String2=".") returned 1 [0085.049] wcscmp (_String1="more2.jpg", _String2="..") returned 1 [0085.049] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x54b90a8 [0085.049] wcscpy (in: _Dest=0x54b90a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.049] wcscat (in: _Dest=0x54b90a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.049] wcscat (in: _Dest=0x54b90a8, _Source="more2.jpg" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\more2.jpg") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\more2.jpg" [0085.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54b90a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d0 [0085.050] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36664553, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad34763e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36664553, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="News", cAlternateFileName="")) returned 1 [0085.050] wcscmp (_String1="News", _String2=".") returned 1 [0085.050] wcscmp (_String1="News", _String2="..") returned 1 [0085.050] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xde) returned 0x54f1a88 [0085.050] wcscpy (in: _Dest=0x54f1a88, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.050] wcscat (in: _Dest=0x54f1a88, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.050] wcscat (in: _Dest=0x54f1a88, _Source="News" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\News") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\News" [0085.050] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54f1a88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x56c [0085.050] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3668a7b1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad348156, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3668a7b1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OptInPopup", cAlternateFileName="OPTINP~1")) returned 1 [0085.050] wcscmp (_String1="OptInPopup", _String2=".") returned 1 [0085.051] wcscmp (_String1="OptInPopup", _String2="..") returned 1 [0085.051] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xea) returned 0x7287438 [0085.051] wcscpy (in: _Dest=0x7287438, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.051] wcscat (in: _Dest=0x7287438, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.051] wcscat (in: _Dest=0x7287438, _Source="OptInPopup" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\OptInPopup") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\OptInPopup" [0085.051] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7287438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c8 [0085.051] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x366b0a0a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x366b0a0a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x366b0a0a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xc8c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="pageBackground.png", cAlternateFileName="")) returned 1 [0085.051] wcscmp (_String1="pageBackground.png", _String2=".") returned 1 [0085.051] wcscmp (_String1="pageBackground.png", _String2="..") returned 1 [0085.051] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfa) returned 0x549a028 [0085.051] wcscpy (in: _Dest=0x549a028, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.051] wcscat (in: _Dest=0x549a028, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.051] wcscat (in: _Dest=0x549a028, _Source="pageBackground.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\pageBackground.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\pageBackground.png" [0085.052] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549a028, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c4 [0085.052] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x366b0a0a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad348e3e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x366b0a0a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PopUp", cAlternateFileName="")) returned 1 [0085.052] wcscmp (_String1="PopUp", _String2=".") returned 1 [0085.052] wcscmp (_String1="PopUp", _String2="..") returned 1 [0085.052] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54f1c58 [0085.052] wcscpy (in: _Dest=0x54f1c58, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.052] wcscat (in: _Dest=0x54f1c58, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.052] wcscat (in: _Dest=0x54f1c58, _Source="PopUp" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\PopUp") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\PopUp" [0085.052] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54f1c58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c0 [0085.053] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x366d6c5a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x366fcec2, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x366fcec2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x344ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="PremiumEdition_PopUp2.png", cAlternateFileName="")) returned 1 [0085.053] wcscmp (_String1="PremiumEdition_PopUp2.png", _String2=".") returned 1 [0085.053] wcscmp (_String1="PremiumEdition_PopUp2.png", _String2="..") returned 1 [0085.053] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x108) returned 0x74d6d98 [0085.053] wcscpy (in: _Dest=0x74d6d98, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.053] wcscat (in: _Dest=0x74d6d98, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.053] wcscat (in: _Dest=0x74d6d98, _Source="PremiumEdition_PopUp2.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\PremiumEdition_PopUp2.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\PremiumEdition_PopUp2.png" [0085.053] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74d6d98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9bc [0085.054] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x366b0a0a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x366b0a0a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x366b0a0a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xb63, dwReserved0=0x0, dwReserved1=0x0, cFileName="premium_background_icon.png", cAlternateFileName="")) returned 1 [0085.054] wcscmp (_String1="premium_background_icon.png", _String2=".") returned 1 [0085.054] wcscmp (_String1="premium_background_icon.png", _String2="..") returned 1 [0085.054] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10c) returned 0x74d6078 [0085.054] wcscpy (in: _Dest=0x74d6078, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0085.054] wcscat (in: _Dest=0x74d6078, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0085.054] wcscat (in: _Dest=0x74d6078, _Source="premium_background_icon.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\premium_background_icon.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\premium_background_icon.png" [0085.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74d6078, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2278 [0088.888] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x366b0a0a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x366b0a0a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x366b0a0a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xb2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Premium_badge_compact.png", cAlternateFileName="")) returned 1 [0088.888] wcscmp (_String1="Premium_badge_compact.png", _String2=".") returned 1 [0088.888] wcscmp (_String1="Premium_badge_compact.png", _String2="..") returned 1 [0088.888] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x108) returned 0x7579bd8 [0088.888] wcscpy (in: _Dest=0x7579bd8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0088.888] wcscat (in: _Dest=0x7579bd8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.888] wcscat (in: _Dest=0x7579bd8, _Source="Premium_badge_compact.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Premium_badge_compact.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Premium_badge_compact.png" [0088.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7579bd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b4 [0088.889] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x366d6c5a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x366d6c5a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x366d6c5a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1058, dwReserved0=0x0, dwReserved1=0x0, cFileName="Premium_base.jpg", cAlternateFileName="")) returned 1 [0088.889] wcscmp (_String1="Premium_base.jpg", _String2=".") returned 1 [0088.891] wcscmp (_String1="Premium_base.jpg", _String2="..") returned 1 [0088.891] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf6) returned 0x5ba39f8 [0088.891] wcscpy (in: _Dest=0x5ba39f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0088.891] wcscat (in: _Dest=0x5ba39f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.891] wcscat (in: _Dest=0x5ba39f8, _Source="Premium_base.jpg" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Premium_base.jpg") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Premium_base.jpg" [0088.891] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba39f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15b4 [0088.891] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x366d6c5a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x366d6c5a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x366d6c5a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1a3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="premium_ribbon.png", cAlternateFileName="")) returned 1 [0088.891] wcscmp (_String1="premium_ribbon.png", _String2=".") returned 1 [0088.891] wcscmp (_String1="premium_ribbon.png", _String2="..") returned 1 [0088.891] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfa) returned 0x75818c8 [0088.892] wcscpy (in: _Dest=0x75818c8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0088.892] wcscat (in: _Dest=0x75818c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.892] wcscat (in: _Dest=0x75818c8, _Source="premium_ribbon.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\premium_ribbon.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\premium_ribbon.png" [0088.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x75818c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15b0 [0088.892] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x366fcec2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad349c2a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36723120, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SampleHeader", cAlternateFileName="SAMPLE~1")) returned 1 [0088.892] wcscmp (_String1="SampleHeader", _String2=".") returned 1 [0088.892] wcscmp (_String1="SampleHeader", _String2="..") returned 1 [0088.892] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xee) returned 0x393df48 [0088.892] wcscpy (in: _Dest=0x393df48, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0088.892] wcscat (in: _Dest=0x393df48, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.892] wcscat (in: _Dest=0x393df48, _Source="SampleHeader" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader" [0088.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x393df48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b0 [0088.893] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36723120, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x36723120, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x36723120, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="shadow.png", cAlternateFileName="")) returned 1 [0088.893] wcscmp (_String1="shadow.png", _String2=".") returned 1 [0088.893] wcscmp (_String1="shadow.png", _String2="..") returned 1 [0088.893] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xea) returned 0x393e230 [0088.893] wcscpy (in: _Dest=0x393e230, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0088.893] wcscat (in: _Dest=0x393e230, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.893] wcscat (in: _Dest=0x393e230, _Source="shadow.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\shadow.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\shadow.png" [0088.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x393e230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17b0 [0088.894] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36723120, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x36723120, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x36723120, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3f30, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solitaire25.png", cAlternateFileName="")) returned 1 [0088.894] wcscmp (_String1="Solitaire25.png", _String2=".") returned 1 [0088.894] wcscmp (_String1="Solitaire25.png", _String2="..") returned 1 [0088.894] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf4) returned 0x5ba25f8 [0088.894] wcscpy (in: _Dest=0x5ba25f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0088.894] wcscat (in: _Dest=0x5ba25f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.894] wcscat (in: _Dest=0x5ba25f8, _Source="Solitaire25.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Solitaire25.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Solitaire25.png" [0088.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba25f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17ac [0088.895] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36723120, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad3af563, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36749379, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen", cAlternateFileName="SPLASH~1")) returned 1 [0088.895] wcscmp (_String1="SplashScreen", _String2=".") returned 1 [0088.895] wcscmp (_String1="SplashScreen", _String2="..") returned 1 [0088.895] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xee) returned 0x393e328 [0088.895] wcscpy (in: _Dest=0x393e328, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0088.895] wcscat (in: _Dest=0x393e328, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.895] wcscat (in: _Dest=0x393e328, _Source="SplashScreen" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen" [0088.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x393e328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12d0 [0088.896] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36723120, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x36723120, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x36723120, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x284d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.scale-200.png", cAlternateFileName="")) returned 1 [0088.896] wcscmp (_String1="SplashScreen.scale-200.png", _String2=".") returned 1 [0088.896] wcscmp (_String1="SplashScreen.scale-200.png", _String2="..") returned 1 [0088.896] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0x7579cf0 [0088.896] wcscpy (in: _Dest=0x7579cf0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0088.896] wcscat (in: _Dest=0x7579cf0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.896] wcscat (in: _Dest=0x7579cf0, _Source="SplashScreen.scale-200.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen.scale-200.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen.scale-200.png" [0088.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7579cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17a8 [0088.896] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3676f5d7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad3b11e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36795830, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="StarClub", cAlternateFileName="")) returned 1 [0088.896] wcscmp (_String1="StarClub", _String2=".") returned 1 [0088.896] wcscmp (_String1="StarClub", _String2="..") returned 1 [0088.896] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe6) returned 0x54b8ec8 [0088.896] wcscpy (in: _Dest=0x54b8ec8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0088.896] wcscat (in: _Dest=0x54b8ec8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.896] wcscat (in: _Dest=0x54b8ec8, _Source="StarClub" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\StarClub") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\StarClub" [0088.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54b8ec8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17a4 [0088.897] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x367bba89, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad3b1c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x367e1ce3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Statistics", cAlternateFileName="STATIS~1")) returned 1 [0088.897] wcscmp (_String1="Statistics", _String2=".") returned 1 [0088.897] wcscmp (_String1="Statistics", _String2="..") returned 1 [0088.897] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xea) returned 0x393da70 [0088.897] wcscpy (in: _Dest=0x393da70, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0088.897] wcscat (in: _Dest=0x393da70, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.897] wcscat (in: _Dest=0x393da70, _Source="Statistics" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Statistics") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Statistics" [0088.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x393da70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17a0 [0088.898] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36807f40, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x36807f40, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x36807f40, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1733, dwReserved0=0x0, dwReserved1=0x0, cFileName="sticker.png", cAlternateFileName="")) returned 1 [0088.898] wcscmp (_String1="sticker.png", _String2=".") returned 1 [0088.898] wcscmp (_String1="sticker.png", _String2="..") returned 1 [0088.898] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x393edd0 [0088.898] wcscpy (in: _Dest=0x393edd0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0088.898] wcscat (in: _Dest=0x393edd0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.898] wcscat (in: _Dest=0x393edd0, _Source="sticker.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\sticker.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\sticker.png" [0088.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x393edd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x179c [0088.899] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36807f40, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad3b269d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36807f40, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Store", cAlternateFileName="")) returned 1 [0088.899] wcscmp (_String1="Store", _String2=".") returned 1 [0088.899] wcscmp (_String1="Store", _String2="..") returned 1 [0088.899] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54f1600 [0088.899] wcscpy (in: _Dest=0x54f1600, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0088.899] wcscat (in: _Dest=0x54f1600, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.899] wcscat (in: _Dest=0x54f1600, _Source="Store" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Store") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Store" [0088.899] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54f1600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1798 [0088.900] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36807f40, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3682e19a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3682e19a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.png", cAlternateFileName="")) returned 1 [0088.900] wcscmp (_String1="StoreLogo.png", _String2=".") returned 1 [0088.900] wcscmp (_String1="StoreLogo.png", _String2="..") returned 1 [0088.900] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x393d880 [0088.900] wcscpy (in: _Dest=0x393d880, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0088.900] wcscat (in: _Dest=0x393d880, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.900] wcscat (in: _Dest=0x393d880, _Source="StoreLogo.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\StoreLogo.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\StoreLogo.png" [0088.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x393d880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1794 [0088.901] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3682e19a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad463d9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36a24610, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ThemeCreation", cAlternateFileName="THEMEC~1")) returned 1 [0088.901] wcscmp (_String1="ThemeCreation", _String2=".") returned 1 [0088.901] wcscmp (_String1="ThemeCreation", _String2="..") returned 1 [0088.901] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x393eec8 [0088.901] wcscpy (in: _Dest=0x393eec8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0088.901] wcscat (in: _Dest=0x393eec8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.901] wcscat (in: _Dest=0x393eec8, _Source="ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0088.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x393eec8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1790 [0088.902] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36a24610, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad4ddf83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36a4a88e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ThemeDownload", cAlternateFileName="THEMED~1")) returned 1 [0088.902] wcscmp (_String1="ThemeDownload", _String2=".") returned 1 [0088.902] wcscmp (_String1="ThemeDownload", _String2="..") returned 1 [0088.902] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x393db68 [0088.902] wcscpy (in: _Dest=0x393db68, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0088.902] wcscat (in: _Dest=0x393db68, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.902] wcscat (in: _Dest=0x393db68, _Source="ThemeDownload" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload" [0088.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x393db68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x178c [0088.902] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36a4a88e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad4de80d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36c3a737, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ThemePreview", cAlternateFileName="THEMEP~1")) returned 1 [0088.902] wcscmp (_String1="ThemePreview", _String2=".") returned 1 [0088.902] wcscmp (_String1="ThemePreview", _String2="..") returned 1 [0088.902] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xee) returned 0x393f1b0 [0088.902] wcscpy (in: _Dest=0x393f1b0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0088.903] wcscat (in: _Dest=0x393f1b0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.903] wcscat (in: _Dest=0x393f1b0, _Source="ThemePreview" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview" [0088.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x393f1b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1788 [0088.903] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36cf92fa, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad604f5a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x374f1a3e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1 [0088.903] wcscmp (_String1="Themes", _String2=".") returned 1 [0088.903] wcscmp (_String1="Themes", _String2="..") returned 1 [0088.903] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x54b9378 [0088.903] wcscpy (in: _Dest=0x54b9378, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0088.903] wcscat (in: _Dest=0x54b9378, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.903] wcscat (in: _Dest=0x54b9378, _Source="Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes" [0088.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54b9378, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1784 [0088.904] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3769e802, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb15f48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x376c4a60, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tiles", cAlternateFileName="")) returned 1 [0088.904] wcscmp (_String1="Tiles", _String2=".") returned 1 [0088.904] wcscmp (_String1="Tiles", _String2="..") returned 1 [0088.904] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54f04c8 [0088.904] wcscpy (in: _Dest=0x54f04c8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0088.904] wcscat (in: _Dest=0x54f04c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.904] wcscat (in: _Dest=0x54f04c8, _Source="Tiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles" [0088.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54f04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1780 [0088.907] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376c4a60, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x376c4a60, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x376c4a60, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xaed2, dwReserved0=0x0, dwReserved1=0x0, cFileName="TMP_tournament_trophy_blue.png", cAlternateFileName="")) returned 1 [0088.907] wcscmp (_String1="TMP_tournament_trophy_blue.png", _String2=".") returned 1 [0088.907] wcscmp (_String1="TMP_tournament_trophy_blue.png", _String2="..") returned 1 [0088.907] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x74d9f18 [0088.907] wcscpy (in: _Dest=0x74d9f18, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0088.907] wcscat (in: _Dest=0x74d9f18, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.907] wcscat (in: _Dest=0x74d9f18, _Source="TMP_tournament_trophy_blue.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\TMP_tournament_trophy_blue.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\TMP_tournament_trophy_blue.png" [0088.907] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74d9f18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x177c [0088.907] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x376ebbff, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb1841a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x377d0a4a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tournament", cAlternateFileName="TOURNA~1")) returned 1 [0088.907] wcscmp (_String1="Tournament", _String2=".") returned 1 [0088.907] wcscmp (_String1="Tournament", _String2="..") returned 1 [0088.907] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xea) returned 0x393dc60 [0088.907] wcscpy (in: _Dest=0x393dc60, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0088.907] wcscat (in: _Dest=0x393dc60, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.908] wcscat (in: _Dest=0x393dc60, _Source="Tournament" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" [0088.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x393dc60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1778 [0088.908] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x377d0a4a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x377d0a4a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x377d0a4a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x19c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="upPremium.jpg", cAlternateFileName="")) returned 1 [0088.908] wcscmp (_String1="upPremium.jpg", _String2=".") returned 1 [0088.908] wcscmp (_String1="upPremium.jpg", _String2="..") returned 1 [0088.908] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x393dd58 [0088.908] wcscpy (in: _Dest=0x393dd58, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0088.908] wcscat (in: _Dest=0x393dd58, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.908] wcscat (in: _Dest=0x393dd58, _Source="upPremium.jpg" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\upPremium.jpg") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\upPremium.jpg" [0088.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x393dd58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1774 [0088.909] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x377d0a4a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb19197, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x377f6ca3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XboxControl", cAlternateFileName="XBOXCO~1")) returned 1 [0088.909] wcscmp (_String1="XboxControl", _String2=".") returned 1 [0088.909] wcscmp (_String1="XboxControl", _String2="..") returned 1 [0088.909] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x393f2a8 [0088.909] wcscpy (in: _Dest=0x393f2a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0088.909] wcscat (in: _Dest=0x393f2a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.909] wcscat (in: _Dest=0x393f2a8, _Source="XboxControl" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxControl") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxControl" [0088.909] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x393f2a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1770 [0088.910] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x377f6ca3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb19d17, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x377f6ca3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XboxFlow", cAlternateFileName="")) returned 1 [0088.910] wcscmp (_String1="XboxFlow", _String2=".") returned 1 [0088.910] wcscmp (_String1="XboxFlow", _String2="..") returned 1 [0088.910] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe6) returned 0x54b8fb8 [0088.910] wcscpy (in: _Dest=0x54b8fb8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets" [0088.910] wcscat (in: _Dest=0x54b8fb8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.910] wcscat (in: _Dest=0x54b8fb8, _Source="XboxFlow" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxFlow") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxFlow" [0088.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54b8fb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12e0 [0088.911] FindNextFileW (in: hFindFile=0x5444c40, lpFindFileData=0x53cfc20 | out: lpFindFileData=0x53cfc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x377f6ca3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb19d17, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x377f6ca3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XboxFlow", cAlternateFileName="")) returned 0 [0088.911] FindClose (in: hFindFile=0x5444c40 | out: hFindFile=0x5444c40) returned 1 [0088.911] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53cfc20) returned 1 [0088.911] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fcb00) returned 1 [0088.911] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fc080) returned 1 Thread: id = 1107 os_tid = 0x1f90 [0083.165] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x54f1a88 [0083.165] wcscpy (in: _Dest=0x54f1a88, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars" [0083.165] wcscat (in: _Dest=0x54f1a88, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars\\" [0083.165] wcscat (in: _Dest=0x54f1a88, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars\\*" [0083.166] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53cfe88 [0083.166] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars\\*", lpFindFileData=0x53cfe88 | out: lpFindFileData=0x53cfe88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37974437, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb1ac8e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37974437, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444c80 [0083.166] wcscmp (_String1=".", _String2=".") returned 0 [0083.166] FindNextFileW (in: hFindFile=0x5444c80, lpFindFileData=0x53cfe88 | out: lpFindFileData=0x53cfe88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37974437, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb1ac8e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37974437, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.166] wcscmp (_String1="..", _String2=".") returned 1 [0083.167] wcscmp (_String1="..", _String2="..") returned 0 [0083.167] FindNextFileW (in: hFindFile=0x5444c80, lpFindFileData=0x53cfe88 | out: lpFindFileData=0x53cfe88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37974437, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb1bdb7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37974437, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0083.167] wcscmp (_String1="Assets", _String2=".") returned 1 [0083.167] wcscmp (_String1="Assets", _String2="..") returned 1 [0083.167] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe4) returned 0x396ee48 [0083.167] wcscpy (in: _Dest=0x396ee48, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars" [0083.167] wcscat (in: _Dest=0x396ee48, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars\\" [0083.167] wcscat (in: _Dest=0x396ee48, _Source="Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars\\Assets" [0083.167] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x396f3e8 [0083.167] wcscpy (in: _Dest=0x396f3e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars\\Assets" [0083.167] wcscat (in: _Dest=0x396f3e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars\\Assets\\" [0083.167] wcscat (in: _Dest=0x396f3e8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars\\Assets\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars\\Assets\\*" [0083.167] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d1b68 [0083.167] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars\\Assets\\*", lpFindFileData=0x53d1b68 | out: lpFindFileData=0x53d1b68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37974437, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb1bdb7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37974437, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444cc0 [0083.167] wcscmp (_String1=".", _String2=".") returned 0 [0083.167] FindNextFileW (in: hFindFile=0x5444cc0, lpFindFileData=0x53d1b68 | out: lpFindFileData=0x53d1b68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37974437, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb1bdb7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37974437, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.167] wcscmp (_String1="..", _String2=".") returned 1 [0083.167] wcscmp (_String1="..", _String2="..") returned 0 [0083.167] FindNextFileW (in: hFindFile=0x5444cc0, lpFindFileData=0x53d1b68 | out: lpFindFileData=0x53d1b68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37974437, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x37974437, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x37974437, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x39ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MissingDisplayPic.png", cAlternateFileName="")) returned 1 [0083.167] wcscmp (_String1="MissingDisplayPic.png", _String2=".") returned 1 [0083.167] wcscmp (_String1="MissingDisplayPic.png", _String2="..") returned 1 [0083.167] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x110) returned 0x74d1e38 [0085.018] wcscpy (in: _Dest=0x74d1e38, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars\\Assets" [0085.018] wcscat (in: _Dest=0x74d1e38, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars\\Assets\\" [0085.018] wcscat (in: _Dest=0x74d1e38, _Source="MissingDisplayPic.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars\\Assets\\MissingDisplayPic.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars\\Assets\\MissingDisplayPic.png" [0085.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74d1e38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20b4 [0085.018] FindNextFileW (in: hFindFile=0x5444cc0, lpFindFileData=0x53d1b68 | out: lpFindFileData=0x53d1b68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37974437, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x37974437, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x37974437, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x39ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MissingDisplayPic.png", cAlternateFileName="")) returned 0 [0085.018] FindClose (in: hFindFile=0x5444cc0 | out: hFindFile=0x5444cc0) returned 1 [0085.018] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d1b68) returned 1 [0085.018] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396f3e8) returned 1 [0085.018] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396ee48) returned 1 [0085.019] FindNextFileW (in: hFindFile=0x5444c80, lpFindFileData=0x53cfe88 | out: lpFindFileData=0x53cfe88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37974437, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb1bdb7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37974437, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 0 [0085.019] FindClose (in: hFindFile=0x5444c80 | out: hFindFile=0x5444c80) returned 1 [0085.019] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53cfe88) returned 1 [0085.019] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f1a88) returned 1 [0085.019] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fc400) returned 1 Thread: id = 1108 os_tid = 0x1f94 [0083.168] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\avatars.winmd")) returned 0x20 [0083.168] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars.winmd", dwFileAttributes=0x20) returned 0 [0083.168] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\avatars.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.168] GetLastError () returned 0x5 [0083.168] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars.winmd", dwFileAttributes=0x20) returned 0 [0083.168] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b90a8) returned 1 Thread: id = 1109 os_tid = 0x1f98 [0083.169] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x74d3e40 [0085.012] wcscpy (in: _Dest=0x74d3e40, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0085.012] wcscat (in: _Dest=0x74d3e40, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0085.012] wcscat (in: _Dest=0x74d3e40, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0085.012] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a2738 [0085.012] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x53a2738 | out: lpFindFileData=0x53a2738*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc96ea5b4, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xdae86288, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdae86288, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ed00 [0085.013] wcscmp (_String1=".", _String2=".") returned 0 [0085.013] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53a2738 | out: lpFindFileData=0x53a2738*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc96ea5b4, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xdae86288, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdae86288, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.013] wcscmp (_String1="..", _String2=".") returned 1 [0085.013] wcscmp (_String1="..", _String2="..") returned 0 [0085.013] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53a2738 | out: lpFindFileData=0x53a2738*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda39da73, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xda39da73, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xda39da73, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x22390, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.b010e8f2.pri", cAlternateFileName="RESOUR~1.PRI")) returned 1 [0085.013] wcscmp (_String1="resources.b010e8f2.pri", _String2=".") returned 1 [0085.013] wcscmp (_String1="resources.b010e8f2.pri", _String2="..") returned 1 [0085.013] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x138) returned 0x758a300 [0085.013] wcscpy (in: _Dest=0x758a300, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0085.013] wcscat (in: _Dest=0x758a300, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0085.013] wcscat (in: _Dest=0x758a300, _Source="resources.b010e8f2.pri" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\resources.b010e8f2.pri") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\resources.b010e8f2.pri" [0085.013] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x758a300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20b8 [0085.014] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53a2738 | out: lpFindFileData=0x53a2738*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda39da73, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xda39da73, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xda39da73, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x22390, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000-MergedResources-2.pri", cAlternateFileName="")) returned 1 [0085.014] wcscmp (_String1="S-1-5-21-1051304884-625712362-2192934891-1000-MergedResources-2.pri", _String2=".") returned 1 [0085.014] wcscmp (_String1="S-1-5-21-1051304884-625712362-2192934891-1000-MergedResources-2.pri", _String2="..") returned 1 [0085.014] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x192) returned 0x546e6f8 [0085.014] wcscpy (in: _Dest=0x546e6f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0085.014] wcscat (in: _Dest=0x546e6f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0085.014] wcscat (in: _Dest=0x546e6f8, _Source="S-1-5-21-1051304884-625712362-2192934891-1000-MergedResources-2.pri" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\S-1-5-21-1051304884-625712362-2192934891-1000-MergedResources-2.pri") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\S-1-5-21-1051304884-625712362-2192934891-1000-MergedResources-2.pri" [0085.014] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x546e6f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c8 [0085.015] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53a2738 | out: lpFindFileData=0x53a2738*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda39da73, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xda39da73, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xda39da73, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x22390, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000-MergedResources-2.pri", cAlternateFileName="")) returned 0 [0085.015] FindClose (in: hFindFile=0x389ed00 | out: hFindFile=0x389ed00) returned 1 [0085.015] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a2738) returned 1 [0085.015] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74d3e40) returned 1 [0085.015] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7412bd8) returned 1 Thread: id = 1110 os_tid = 0x1f9c [0083.170] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Microsoft.Xbox.Services.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\microsoft.xbox.services.winmd")) returned 0x20 [0085.016] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Microsoft.Xbox.Services.winmd", dwFileAttributes=0x20) returned 0 [0085.017] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Microsoft.Xbox.Services.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\microsoft.xbox.services.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0085.017] GetLastError () returned 0x5 [0085.017] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Microsoft.Xbox.Services.winmd", dwFileAttributes=0x20) returned 0 [0085.017] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7412cf0) returned 1 Thread: id = 1111 os_tid = 0x1fa0 [0083.170] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\resources.pri")) returned 0x20 [0083.171] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0083.171] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.171] GetLastError () returned 0x5 [0083.171] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0083.171] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b9198) returned 1 Thread: id = 1112 os_tid = 0x1fa4 [0083.172] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe6) returned 0x396f5c8 [0083.172] wcscpy (in: _Dest=0x396f5c8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine" [0083.172] wcscat (in: _Dest=0x396f5c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine\\" [0083.172] wcscat (in: _Dest=0x396f5c8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine\\*" [0083.173] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d00f0 [0083.173] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine\\*", lpFindFileData=0x53d00f0 | out: lpFindFileData=0x53d00f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37e86909, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb1ce25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37e86909, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444d40 [0083.173] wcscmp (_String1=".", _String2=".") returned 0 [0083.173] FindNextFileW (in: hFindFile=0x5444d40, lpFindFileData=0x53d00f0 | out: lpFindFileData=0x53d00f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37e86909, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb1ce25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37e86909, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.173] wcscmp (_String1="..", _String2=".") returned 1 [0083.173] wcscmp (_String1="..", _String2="..") returned 0 [0083.173] FindNextFileW (in: hFindFile=0x5444d40, lpFindFileData=0x53d00f0 | out: lpFindFileData=0x53d00f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37e86909, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb1d39d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37e86909, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rendering", cAlternateFileName="RENDER~1")) returned 1 [0083.173] wcscmp (_String1="Rendering", _String2=".") returned 1 [0083.173] wcscmp (_String1="Rendering", _String2="..") returned 1 [0083.173] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf6) returned 0x5ba27f8 [0083.173] wcscpy (in: _Dest=0x5ba27f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine" [0083.173] wcscat (in: _Dest=0x5ba27f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine\\" [0083.173] wcscat (in: _Dest=0x5ba27f8, _Source="Rendering" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine\\Rendering") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine\\Rendering" [0083.173] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfa) returned 0x75819d0 [0083.173] wcscpy (in: _Dest=0x75819d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine\\Rendering" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine\\Rendering") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine\\Rendering" [0083.173] wcscat (in: _Dest=0x75819d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine\\Rendering\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine\\Rendering\\" [0083.173] wcscat (in: _Dest=0x75819d0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine\\Rendering\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine\\Rendering\\*" [0083.173] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53cdf40 [0083.173] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine\\Rendering\\*", lpFindFileData=0x53cdf40 | out: lpFindFileData=0x53cdf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37e86909, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb1d39d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37e86909, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389eb80 [0085.008] wcscmp (_String1=".", _String2=".") returned 0 [0085.008] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x53cdf40 | out: lpFindFileData=0x53cdf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37e86909, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb1d39d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37e86909, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.008] wcscmp (_String1="..", _String2=".") returned 1 [0085.008] wcscmp (_String1="..", _String2="..") returned 0 [0085.008] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x53cdf40 | out: lpFindFileData=0x53cdf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37e86909, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb1d9b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37e86909, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shaders", cAlternateFileName="")) returned 1 [0085.008] wcscmp (_String1="Shaders", _String2=".") returned 1 [0085.008] wcscmp (_String1="Shaders", _String2="..") returned 1 [0085.008] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0xe138990 [0085.008] wcscpy (in: _Dest=0xe138990, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine\\Rendering" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine\\Rendering") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine\\Rendering" [0085.008] wcscat (in: _Dest=0xe138990, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine\\Rendering\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine\\Rendering\\" [0085.009] wcscat (in: _Dest=0xe138990, _Source="Shaders" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine\\Rendering\\Shaders") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine\\Rendering\\Shaders" [0085.009] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0xe138990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c0 [0085.009] FindNextFileW (in: hFindFile=0x389eb80, lpFindFileData=0x53cdf40 | out: lpFindFileData=0x53cdf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37e86909, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb1d9b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37e86909, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shaders", cAlternateFileName="")) returned 0 [0085.009] FindClose (in: hFindFile=0x389eb80 | out: hFindFile=0x389eb80) returned 1 [0085.010] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53cdf40) returned 1 [0085.010] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75819d0) returned 1 [0085.010] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba27f8) returned 1 [0085.010] FindNextFileW (in: hFindFile=0x5444d40, lpFindFileData=0x53d00f0 | out: lpFindFileData=0x53d00f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37e86909, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb1d39d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37e86909, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rendering", cAlternateFileName="RENDER~1")) returned 0 [0085.010] FindClose (in: hFindFile=0x5444d40 | out: hFindFile=0x5444d40) returned 1 [0085.010] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d00f0) returned 1 [0085.010] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396f5c8) returned 1 [0085.010] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54ba098) returned 1 Thread: id = 1113 os_tid = 0x1fa8 [0083.174] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\ThirdPartyNotices_Arkadium.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\thirdpartynotices_arkadium.txt")) returned 0x20 [0085.011] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\ThirdPartyNotices_Arkadium.txt", dwFileAttributes=0x20) returned 0 [0085.011] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\ThirdPartyNotices_Arkadium.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\thirdpartynotices_arkadium.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0085.011] GetLastError () returned 0x5 [0085.011] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\ThirdPartyNotices_Arkadium.txt", dwFileAttributes=0x20) returned 0 [0085.011] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7412e08) returned 1 Thread: id = 1114 os_tid = 0x1fac [0083.175] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\xboxservices.config" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\xboxservices.config")) returned 0x20 [0083.176] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\xboxservices.config", dwFileAttributes=0x20) returned 0 [0083.176] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\xboxservices.config" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\xboxservices.config"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.176] GetLastError () returned 0x5 [0083.176] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\xboxservices.config", dwFileAttributes=0x20) returned 0 [0083.176] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7287910) returned 1 Thread: id = 1115 os_tid = 0x1fb0 [0083.177] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54f1c58 [0083.177] wcscpy (in: _Dest=0x54f1c58, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources" [0083.177] wcscat (in: _Dest=0x54f1c58, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\" [0083.177] wcscat (in: _Dest=0x54f1c58, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\*" [0083.177] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d0358 [0083.177] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x53d0358 | out: lpFindFileData=0x53d0358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34110fcc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabf2fada, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3421c04b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444dc0 [0083.179] wcscmp (_String1=".", _String2=".") returned 0 [0083.179] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53d0358 | out: lpFindFileData=0x53d0358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34110fcc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabf2fada, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3421c04b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.179] wcscmp (_String1="..", _String2=".") returned 1 [0083.179] wcscmp (_String1="..", _String2="..") returned 0 [0083.179] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53d0358 | out: lpFindFileData=0x53d0358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34110fcc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x34110fcc, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x34110fcc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x36a, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.rsrc", cAlternateFileName="")) returned 1 [0083.179] wcscmp (_String1="0.rsrc", _String2=".") returned 1 [0083.179] wcscmp (_String1="0.rsrc", _String2="..") returned 1 [0083.179] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xea) returned 0x54502c0 [0083.179] wcscpy (in: _Dest=0x54502c0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources" [0083.179] wcscat (in: _Dest=0x54502c0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\" [0083.179] wcscat (in: _Dest=0x54502c0, _Source="0.rsrc" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc" [0083.179] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_resources\\0.rsrc")) returned 0x20 [0083.179] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc", dwFileAttributes=0x20) returned 0 [0083.179] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_resources\\0.rsrc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.179] GetLastError () returned 0x5 [0083.180] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc", dwFileAttributes=0x20) returned 0 [0083.180] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54502c0) returned 1 [0083.180] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53d0358 | out: lpFindFileData=0x53d0358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34110fcc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x34110fcc, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x34110fcc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x448, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.rsrc", cAlternateFileName="")) returned 1 [0083.180] wcscmp (_String1="1.rsrc", _String2=".") returned 1 [0083.180] wcscmp (_String1="1.rsrc", _String2="..") returned 1 [0083.180] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xea) returned 0x5450b78 [0083.180] wcscpy (in: _Dest=0x5450b78, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources" [0083.180] wcscat (in: _Dest=0x5450b78, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\" [0083.180] wcscat (in: _Dest=0x5450b78, _Source="1.rsrc" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\1.rsrc") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\1.rsrc" [0083.180] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\1.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_resources\\1.rsrc")) returned 0x20 [0083.180] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\1.rsrc", dwFileAttributes=0x20) returned 0 [0083.180] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\1.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_resources\\1.rsrc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.180] GetLastError () returned 0x5 [0083.180] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\1.rsrc", dwFileAttributes=0x20) returned 0 [0083.180] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5450b78) returned 1 [0083.180] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53d0358 | out: lpFindFileData=0x53d0358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34110fcc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x34110fcc, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x34110fcc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.rsrc", cAlternateFileName="")) returned 1 [0083.180] wcscmp (_String1="10.rsrc", _String2=".") returned 1 [0083.180] wcscmp (_String1="10.rsrc", _String2="..") returned 1 [0083.180] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x54502c0 [0083.181] wcscpy (in: _Dest=0x54502c0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources" [0083.181] wcscat (in: _Dest=0x54502c0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\" [0083.181] wcscat (in: _Dest=0x54502c0, _Source="10.rsrc" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\10.rsrc") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\10.rsrc" [0083.181] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\10.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_resources\\10.rsrc")) returned 0x20 [0083.181] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\10.rsrc", dwFileAttributes=0x20) returned 0 [0083.181] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\10.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_resources\\10.rsrc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.181] GetLastError () returned 0x5 [0083.182] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\10.rsrc", dwFileAttributes=0x20) returned 0 [0083.182] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54502c0) returned 1 [0083.182] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53d0358 | out: lpFindFileData=0x53d0358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34110fcc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x341a9936, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x341a9936, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2985, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.rsrc", cAlternateFileName="")) returned 1 [0083.182] wcscmp (_String1="11.rsrc", _String2=".") returned 1 [0083.182] wcscmp (_String1="11.rsrc", _String2="..") returned 1 [0083.182] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x544ffd8 [0083.182] wcscpy (in: _Dest=0x544ffd8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources" [0083.182] wcscat (in: _Dest=0x544ffd8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\" [0083.182] wcscat (in: _Dest=0x544ffd8, _Source="11.rsrc" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\11.rsrc") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\11.rsrc" [0083.182] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\11.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_resources\\11.rsrc")) returned 0x20 [0083.183] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\11.rsrc", dwFileAttributes=0x20) returned 0 [0083.183] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\11.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_resources\\11.rsrc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.183] GetLastError () returned 0x5 [0083.183] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\11.rsrc", dwFileAttributes=0x20) returned 0 [0083.183] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x544ffd8) returned 1 [0083.183] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53d0358 | out: lpFindFileData=0x53d0358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x341a9936, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x341cfb94, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x341cfb94, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4468, dwReserved0=0x0, dwReserved1=0x0, cFileName="12.rsrc", cAlternateFileName="")) returned 1 [0083.183] wcscmp (_String1="12.rsrc", _String2=".") returned 1 [0083.183] wcscmp (_String1="12.rsrc", _String2="..") returned 1 [0083.183] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x54502c0 [0083.183] wcscpy (in: _Dest=0x54502c0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources" [0083.183] wcscat (in: _Dest=0x54502c0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\" [0083.183] wcscat (in: _Dest=0x54502c0, _Source="12.rsrc" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\12.rsrc") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\12.rsrc" [0083.183] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\12.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_resources\\12.rsrc")) returned 0x20 [0083.184] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\12.rsrc", dwFileAttributes=0x20) returned 0 [0083.184] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\12.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_resources\\12.rsrc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.184] GetLastError () returned 0x5 [0083.184] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\12.rsrc", dwFileAttributes=0x20) returned 0 [0083.184] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54502c0) returned 1 [0083.184] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53d0358 | out: lpFindFileData=0x53d0358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x341cfb94, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x341cfb94, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x341cfb94, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x38f, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.rsrc", cAlternateFileName="")) returned 1 [0083.184] wcscmp (_String1="2.rsrc", _String2=".") returned 1 [0083.184] wcscmp (_String1="2.rsrc", _String2="..") returned 1 [0083.184] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xea) returned 0x5450b78 [0083.184] wcscpy (in: _Dest=0x5450b78, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources" [0083.184] wcscat (in: _Dest=0x5450b78, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\" [0083.185] wcscat (in: _Dest=0x5450b78, _Source="2.rsrc" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\2.rsrc") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\2.rsrc" [0083.185] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\2.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_resources\\2.rsrc")) returned 0x20 [0083.185] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\2.rsrc", dwFileAttributes=0x20) returned 0 [0083.185] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\2.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_resources\\2.rsrc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.185] GetLastError () returned 0x5 [0083.185] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\2.rsrc", dwFileAttributes=0x20) returned 0 [0083.186] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5450b78) returned 1 [0083.186] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53d0358 | out: lpFindFileData=0x53d0358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x341cfb94, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x341cfb94, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x341cfb94, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.rsrc", cAlternateFileName="")) returned 1 [0083.186] wcscmp (_String1="3.rsrc", _String2=".") returned 1 [0083.186] wcscmp (_String1="3.rsrc", _String2="..") returned 1 [0083.186] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xea) returned 0x54502c0 [0083.186] wcscpy (in: _Dest=0x54502c0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources" [0083.186] wcscat (in: _Dest=0x54502c0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\" [0083.186] wcscat (in: _Dest=0x54502c0, _Source="3.rsrc" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\3.rsrc") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\3.rsrc" [0083.186] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\3.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_resources\\3.rsrc")) returned 0x20 [0083.187] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\3.rsrc", dwFileAttributes=0x20) returned 0 [0083.187] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\3.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_resources\\3.rsrc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.187] GetLastError () returned 0x5 [0083.187] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\3.rsrc", dwFileAttributes=0x20) returned 0 [0083.187] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54502c0) returned 1 [0083.187] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53d0358 | out: lpFindFileData=0x53d0358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x341cfb94, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x341cfb94, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x341cfb94, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="4.rsrc", cAlternateFileName="")) returned 1 [0083.187] wcscmp (_String1="4.rsrc", _String2=".") returned 1 [0083.187] wcscmp (_String1="4.rsrc", _String2="..") returned 1 [0083.187] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xea) returned 0x54505a8 [0083.187] wcscpy (in: _Dest=0x54505a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources" [0083.187] wcscat (in: _Dest=0x54505a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\" [0083.187] wcscat (in: _Dest=0x54505a8, _Source="4.rsrc" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\4.rsrc") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\4.rsrc" [0083.187] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\4.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_resources\\4.rsrc")) returned 0x20 [0083.188] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\4.rsrc", dwFileAttributes=0x20) returned 0 [0083.188] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\4.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_resources\\4.rsrc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.188] GetLastError () returned 0x5 [0083.188] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\4.rsrc", dwFileAttributes=0x20) returned 0 [0083.188] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54505a8) returned 1 [0083.188] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53d0358 | out: lpFindFileData=0x53d0358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x341f5ded, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3421c04b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3421c04b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="5.rsrc", cAlternateFileName="")) returned 1 [0083.188] wcscmp (_String1="5.rsrc", _String2=".") returned 1 [0083.188] wcscmp (_String1="5.rsrc", _String2="..") returned 1 [0083.188] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xea) returned 0x54502c0 [0083.188] wcscpy (in: _Dest=0x54502c0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources" [0083.188] wcscat (in: _Dest=0x54502c0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\" [0083.188] wcscat (in: _Dest=0x54502c0, _Source="5.rsrc" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\5.rsrc") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\5.rsrc" [0083.189] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\5.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_resources\\5.rsrc")) returned 0x20 [0083.189] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\5.rsrc", dwFileAttributes=0x20) returned 0 [0083.189] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\5.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_resources\\5.rsrc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.189] GetLastError () returned 0x5 [0083.189] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\5.rsrc", dwFileAttributes=0x20) returned 0 [0083.189] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54502c0) returned 1 [0083.189] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53d0358 | out: lpFindFileData=0x53d0358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3421c04b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3421c04b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3421c04b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x65b, dwReserved0=0x0, dwReserved1=0x0, cFileName="6.rsrc", cAlternateFileName="")) returned 1 [0083.189] wcscmp (_String1="6.rsrc", _String2=".") returned 1 [0083.189] wcscmp (_String1="6.rsrc", _String2="..") returned 1 [0083.189] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xea) returned 0x5450b78 [0083.189] wcscpy (in: _Dest=0x5450b78, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources" [0083.189] wcscat (in: _Dest=0x5450b78, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\" [0083.189] wcscat (in: _Dest=0x5450b78, _Source="6.rsrc" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\6.rsrc") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\6.rsrc" [0083.189] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\6.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_resources\\6.rsrc")) returned 0x20 [0083.190] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\6.rsrc", dwFileAttributes=0x20) returned 0 [0083.190] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\6.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_resources\\6.rsrc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.190] GetLastError () returned 0x5 [0083.190] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\6.rsrc", dwFileAttributes=0x20) returned 0 [0083.190] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5450b78) returned 1 [0083.190] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53d0358 | out: lpFindFileData=0x53d0358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3421c04b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3421c04b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3421c04b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xb8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="7.rsrc", cAlternateFileName="")) returned 1 [0083.191] wcscmp (_String1="7.rsrc", _String2=".") returned 1 [0083.191] wcscmp (_String1="7.rsrc", _String2="..") returned 1 [0083.191] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xea) returned 0x5450b78 [0083.191] wcscpy (in: _Dest=0x5450b78, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources" [0083.191] wcscat (in: _Dest=0x5450b78, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\" [0083.191] wcscat (in: _Dest=0x5450b78, _Source="7.rsrc" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\7.rsrc") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\7.rsrc" [0083.191] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\7.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_resources\\7.rsrc")) returned 0x20 [0083.191] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\7.rsrc", dwFileAttributes=0x20) returned 0 [0083.191] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\7.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_resources\\7.rsrc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.191] GetLastError () returned 0x5 [0083.191] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\7.rsrc", dwFileAttributes=0x20) returned 0 [0083.191] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5450b78) returned 1 [0083.191] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53d0358 | out: lpFindFileData=0x53d0358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3421c04b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3421c04b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3421c04b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x872, dwReserved0=0x0, dwReserved1=0x0, cFileName="8.rsrc", cAlternateFileName="")) returned 1 [0083.191] wcscmp (_String1="8.rsrc", _String2=".") returned 1 [0083.191] wcscmp (_String1="8.rsrc", _String2="..") returned 1 [0083.191] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xea) returned 0x544ffd8 [0083.191] wcscpy (in: _Dest=0x544ffd8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources" [0083.191] wcscat (in: _Dest=0x544ffd8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\" [0083.191] wcscat (in: _Dest=0x544ffd8, _Source="8.rsrc" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\8.rsrc") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\8.rsrc" [0083.192] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\8.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_resources\\8.rsrc")) returned 0x20 [0083.192] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\8.rsrc", dwFileAttributes=0x20) returned 0 [0083.192] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\8.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_resources\\8.rsrc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.192] GetLastError () returned 0x5 [0083.192] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\8.rsrc", dwFileAttributes=0x20) returned 0 [0083.193] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x544ffd8) returned 1 [0083.193] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53d0358 | out: lpFindFileData=0x53d0358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3421c04b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3421c04b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3421c04b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x6e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="9.rsrc", cAlternateFileName="")) returned 1 [0083.193] wcscmp (_String1="9.rsrc", _String2=".") returned 1 [0083.193] wcscmp (_String1="9.rsrc", _String2="..") returned 1 [0083.193] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xea) returned 0x54502c0 [0083.193] wcscpy (in: _Dest=0x54502c0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources" [0083.193] wcscat (in: _Dest=0x54502c0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\" [0083.193] wcscat (in: _Dest=0x54502c0, _Source="9.rsrc" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\9.rsrc") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\9.rsrc" [0083.193] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\9.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_resources\\9.rsrc")) returned 0x20 [0083.193] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\9.rsrc", dwFileAttributes=0x20) returned 0 [0083.193] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\9.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_resources\\9.rsrc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.193] GetLastError () returned 0x5 [0083.193] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\9.rsrc", dwFileAttributes=0x20) returned 0 [0083.193] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54502c0) returned 1 [0083.193] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53d0358 | out: lpFindFileData=0x53d0358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3421c04b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3421c04b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3421c04b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x49e, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.txt", cAlternateFileName="")) returned 1 [0083.193] wcscmp (_String1="index.txt", _String2=".") returned 1 [0083.193] wcscmp (_String1="index.txt", _String2="..") returned 1 [0083.193] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x5450b78 [0083.194] wcscpy (in: _Dest=0x5450b78, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources" [0083.194] wcscat (in: _Dest=0x5450b78, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\" [0083.194] wcscat (in: _Dest=0x5450b78, _Source="index.txt" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt" [0083.194] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_resources\\index.txt")) returned 0x20 [0083.194] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt", dwFileAttributes=0x20) returned 0 [0083.194] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_resources\\index.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.194] GetLastError () returned 0x5 [0083.194] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt", dwFileAttributes=0x20) returned 0 [0083.194] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5450b78) returned 1 [0083.194] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53d0358 | out: lpFindFileData=0x53d0358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3421c04b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3421c04b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3421c04b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x49e, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.txt", cAlternateFileName="")) returned 0 [0083.194] FindClose (in: hFindFile=0x5444dc0 | out: hFindFile=0x5444dc0) returned 1 [0083.195] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d0358) returned 1 [0083.195] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f1c58) returned 1 [0083.195] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bba60) returned 1 Thread: id = 1116 os_tid = 0x1fb4 [0083.196] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0083.198] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.199] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.201] GetLastError () returned 0x5 [0083.201] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.202] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f0fa8) returned 1 Thread: id = 1117 os_tid = 0x1fb8 [0083.203] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x54f0fa8 [0083.203] wcscpy (in: _Dest=0x54f0fa8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0083.203] wcscat (in: _Dest=0x54f0fa8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\" [0083.203] wcscat (in: _Dest=0x54f0fa8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*" [0083.203] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d0358 [0083.203] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x53d0358 | out: lpFindFileData=0x53d0358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69c2543c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd6c838, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69c2543c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444dc0 [0083.204] wcscmp (_String1=".", _String2=".") returned 0 [0083.204] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53d0358 | out: lpFindFileData=0x53d0358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69c2543c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd6c838, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69c2543c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.204] wcscmp (_String1="..", _String2=".") returned 1 [0083.204] wcscmp (_String1="..", _String2="..") returned 0 [0083.204] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53d0358 | out: lpFindFileData=0x53d0358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69c2543c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69c4b69e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69c4b69e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x402d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 1 [0083.204] wcscmp (_String1="AppxBundleManifest.xml", _String2=".") returned 1 [0083.204] wcscmp (_String1="AppxBundleManifest.xml", _String2="..") returned 1 [0083.204] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x104) returned 0x74d0fb0 [0084.942] wcscpy (in: _Dest=0x74d0fb0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0084.942] wcscat (in: _Dest=0x74d0fb0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\" [0084.942] wcscat (in: _Dest=0x74d0fb0, _Source="AppxBundleManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" [0084.942] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74d0fb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20bc [0084.943] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53d0358 | out: lpFindFileData=0x53d0358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69c2543c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69c4b69e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69c4b69e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x402d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 0 [0084.943] FindClose (in: hFindFile=0x5444dc0 | out: hFindFile=0x5444dc0) returned 1 [0084.944] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d0358) returned 1 [0084.944] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f0fa8) returned 1 [0084.944] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fc780) returned 1 Thread: id = 1118 os_tid = 0x1fbc [0083.205] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0083.206] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.206] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.206] GetLastError () returned 0x5 [0083.206] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.206] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bb238) returned 1 Thread: id = 1119 os_tid = 0x1fc0 [0083.207] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x104) returned 0x74d1460 [0084.941] wcscpy (in: _Dest=0x74d1460, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" [0084.941] wcscat (in: _Dest=0x74d1460, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0084.941] wcscat (in: _Dest=0x74d1460, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0084.941] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a3a78 [0084.941] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcb2ee04f, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xcb2ee04f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcb2ee04f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e740 [0084.941] wcscmp (_String1=".", _String2=".") returned 0 [0084.941] FindNextFileW (in: hFindFile=0x389e740, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcb2ee04f, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xcb2ee04f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcb2ee04f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.941] wcscmp (_String1="..", _String2=".") returned 1 [0084.941] wcscmp (_String1="..", _String2="..") returned 0 [0084.941] FindNextFileW (in: hFindFile=0x389e740, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcb2ee04f, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xcb2ee04f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcb2ee04f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0084.941] FindClose (in: hFindFile=0x389e740 | out: hFindFile=0x389e740) returned 1 [0084.941] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a3a78) returned 1 [0084.941] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74d1460) returned 1 [0084.941] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549a238) returned 1 Thread: id = 1120 os_tid = 0x1fc4 [0083.212] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.mspaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0083.213] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.215] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.mspaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.216] GetLastError () returned 0x5 [0083.216] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.217] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3974330) returned 1 Thread: id = 1121 os_tid = 0x1fc8 [0083.219] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xca) returned 0x7580270 [0083.219] wcscpy (in: _Dest=0x7580270, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0083.219] wcscat (in: _Dest=0x7580270, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\" [0083.219] wcscat (in: _Dest=0x7580270, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*" [0083.219] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d05c0 [0083.219] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x53d05c0 | out: lpFindFileData=0x53d05c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa16112ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadea87cd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa16112ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444e00 [0083.220] wcscmp (_String1=".", _String2=".") returned 0 [0083.220] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53d05c0 | out: lpFindFileData=0x53d05c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa16112ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadea87cd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa16112ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.220] wcscmp (_String1="..", _String2=".") returned 1 [0083.221] wcscmp (_String1="..", _String2="..") returned 0 [0083.221] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53d05c0 | out: lpFindFileData=0x53d05c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa16112ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa1637513, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xa1637513, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x145b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 1 [0083.221] wcscmp (_String1="AppxBundleManifest.xml", _String2=".") returned 1 [0083.221] wcscmp (_String1="AppxBundleManifest.xml", _String2="..") returned 1 [0083.221] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf4) returned 0x5ba42f8 [0083.221] wcscpy (in: _Dest=0x5ba42f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0083.221] wcscat (in: _Dest=0x5ba42f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\" [0083.221] wcscat (in: _Dest=0x5ba42f8, _Source="AppxBundleManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" [0083.221] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.mspaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml")) returned 0x20 [0083.222] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml", dwFileAttributes=0x20) returned 0 [0083.222] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.mspaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.222] GetLastError () returned 0x5 [0083.222] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml", dwFileAttributes=0x20) returned 0 [0083.222] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba42f8) returned 1 [0083.222] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53d05c0 | out: lpFindFileData=0x53d05c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa16112ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa1637513, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xa1637513, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x145b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 0 [0083.222] FindClose (in: hFindFile=0x5444e00 | out: hFindFile=0x5444e00) returned 1 [0083.223] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d05c0) returned 1 [0083.223] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7580270) returned 1 [0083.223] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55fd398) returned 1 Thread: id = 1122 os_tid = 0x1fcc [0083.224] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.mspaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0083.226] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.227] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.mspaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.229] GetLastError () returned 0x5 [0083.229] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.231] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38fe800) returned 1 Thread: id = 1123 os_tid = 0x1fd0 [0083.232] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf4) returned 0x5ba50f8 [0083.232] wcscpy (in: _Dest=0x5ba50f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" [0083.232] wcscat (in: _Dest=0x5ba50f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0083.232] wcscat (in: _Dest=0x5ba50f8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0083.232] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d05c0 [0083.232] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x53d05c0 | out: lpFindFileData=0x53d05c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcd2853a0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xcd2853a0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcd2853a0, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444e00 [0083.234] wcscmp (_String1=".", _String2=".") returned 0 [0083.234] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53d05c0 | out: lpFindFileData=0x53d05c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcd2853a0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xcd2853a0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcd2853a0, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.234] wcscmp (_String1="..", _String2=".") returned 1 [0083.234] wcscmp (_String1="..", _String2="..") returned 0 [0083.234] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53d05c0 | out: lpFindFileData=0x53d05c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcd2853a0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xcd2853a0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcd2853a0, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0083.234] FindClose (in: hFindFile=0x5444e00 | out: hFindFile=0x5444e00) returned 1 [0083.235] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d05c0) returned 1 [0083.235] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba50f8) returned 1 [0083.235] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7285cf8) returned 1 Thread: id = 1124 os_tid = 0x1fd4 [0083.236] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0083.238] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.240] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.241] GetLastError () returned 0x5 [0083.241] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.243] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f0ec0) returned 1 Thread: id = 1125 os_tid = 0x1fd8 [0083.244] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0083.246] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0083.247] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.249] GetLastError () returned 0x5 [0083.249] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0083.250] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bb408) returned 1 Thread: id = 1126 os_tid = 0x1fdc [0083.251] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x54f1c58 [0083.251] wcscpy (in: _Dest=0x54f1c58, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0083.251] wcscat (in: _Dest=0x54f1c58, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0083.251] wcscat (in: _Dest=0x54f1c58, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*" [0083.251] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d05c0 [0083.251] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x53d05c0 | out: lpFindFileData=0x53d05c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb21ab500, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae4c3e79, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb21ab500, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444e00 [0083.252] wcscmp (_String1=".", _String2=".") returned 0 [0083.252] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53d05c0 | out: lpFindFileData=0x53d05c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb21ab500, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae4c3e79, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb21ab500, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.252] wcscmp (_String1="..", _String2=".") returned 1 [0083.252] wcscmp (_String1="..", _String2="..") returned 0 [0083.252] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53d05c0 | out: lpFindFileData=0x53d05c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb21ab500, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb21ab500, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb21ab500, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x29c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1 [0083.252] wcscmp (_String1="CodeIntegrity.cat", _String2=".") returned 1 [0083.252] wcscmp (_String1="CodeIntegrity.cat", _String2="..") returned 1 [0083.252] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x7582210 [0083.253] wcscpy (in: _Dest=0x7582210, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0083.253] wcscat (in: _Dest=0x7582210, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0083.253] wcscat (in: _Dest=0x7582210, _Source="CodeIntegrity.cat" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" [0083.253] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat")) returned 0x20 [0084.938] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0084.938] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.938] GetLastError () returned 0x5 [0084.938] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0084.938] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7582210) returned 1 [0084.938] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53d05c0 | out: lpFindFileData=0x53d05c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb21ab500, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb21ab500, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb21ab500, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x29c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 0 [0084.938] FindClose (in: hFindFile=0x5444e00 | out: hFindFile=0x5444e00) returned 1 [0084.939] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d05c0) returned 1 [0084.939] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f1c58) returned 1 [0084.939] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3935288) returned 1 Thread: id = 1127 os_tid = 0x1fe0 [0083.254] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0083.254] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.254] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.255] GetLastError () returned 0x5 [0083.255] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.255] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b8a18) returned 1 Thread: id = 1128 os_tid = 0x1fe4 [0083.256] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\logo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\logo.png")) returned 0x20 [0083.257] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x20) returned 0 [0083.257] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\logo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\logo.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.257] GetLastError () returned 0x5 [0083.257] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x20) returned 0 [0083.258] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ff2f8) returned 1 Thread: id = 1129 os_tid = 0x1fe8 [0083.259] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x74d1690 [0084.935] wcscpy (in: _Dest=0x74d1690, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0084.935] wcscat (in: _Dest=0x74d1690, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0084.935] wcscat (in: _Dest=0x74d1690, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0084.935] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a41b0 [0084.935] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x53a41b0 | out: lpFindFileData=0x53a41b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x69869570, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd88c5fc4, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd88c5fc4, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e940 [0084.935] wcscmp (_String1=".", _String2=".") returned 0 [0084.935] FindNextFileW (in: hFindFile=0x389e940, lpFindFileData=0x53a41b0 | out: lpFindFileData=0x53a41b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x69869570, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd88c5fc4, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd88c5fc4, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.935] wcscmp (_String1="..", _String2=".") returned 1 [0084.935] wcscmp (_String1="..", _String2="..") returned 0 [0084.935] FindNextFileW (in: hFindFile=0x389e940, lpFindFileData=0x53a41b0 | out: lpFindFileData=0x53a41b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd88c5fc4, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd88c5fc4, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd88c5fc4, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 1 [0084.935] wcscmp (_String1="Autogen", _String2=".") returned 1 [0084.935] wcscmp (_String1="Autogen", _String2="..") returned 1 [0084.935] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x75850a8 [0084.935] wcscpy (in: _Dest=0x75850a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0084.935] wcscat (in: _Dest=0x75850a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0084.935] wcscat (in: _Dest=0x75850a8, _Source="Autogen" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen" [0084.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x75850a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c4 [0084.936] FindNextFileW (in: hFindFile=0x389e940, lpFindFileData=0x53a41b0 | out: lpFindFileData=0x53a41b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd88c5fc4, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd88c5fc4, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd88c5fc4, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0084.936] FindClose (in: hFindFile=0x389e940 | out: hFindFile=0x389e940) returned 1 [0084.936] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a41b0) returned 1 [0084.936] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74d1690) returned 1 [0084.936] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7412f20) returned 1 Thread: id = 1130 os_tid = 0x1fec [0083.259] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0083.262] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.263] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.265] GetLastError () returned 0x5 [0083.265] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.267] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f0dd8) returned 1 Thread: id = 1131 os_tid = 0x1ff0 [0083.268] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0083.271] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0083.273] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.274] GetLastError () returned 0x5 [0083.275] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0083.276] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bb4f0) returned 1 Thread: id = 1132 os_tid = 0x1ff4 [0083.278] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x54f0698 [0083.278] wcscpy (in: _Dest=0x54f0698, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0083.278] wcscat (in: _Dest=0x54f0698, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0083.278] wcscat (in: _Dest=0x54f0698, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*" [0083.278] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d0828 [0083.278] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x53d0828 | out: lpFindFileData=0x53d0828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f97eba2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae6123e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4f97eba2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444e40 [0083.279] wcscmp (_String1=".", _String2=".") returned 0 [0083.279] FindNextFileW (in: hFindFile=0x5444e40, lpFindFileData=0x53d0828 | out: lpFindFileData=0x53d0828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f97eba2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae6123e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4f97eba2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.279] wcscmp (_String1="..", _String2=".") returned 1 [0083.279] wcscmp (_String1="..", _String2="..") returned 0 [0083.279] FindNextFileW (in: hFindFile=0x5444e40, lpFindFileData=0x53d0828 | out: lpFindFileData=0x53d0828*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f97eba2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4f97eba2, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4f97eba2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x29c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1 [0083.279] wcscmp (_String1="CodeIntegrity.cat", _String2=".") returned 1 [0083.279] wcscmp (_String1="CodeIntegrity.cat", _String2="..") returned 1 [0083.279] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x7582318 [0083.279] wcscpy (in: _Dest=0x7582318, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0083.279] wcscat (in: _Dest=0x7582318, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0083.279] wcscat (in: _Dest=0x7582318, _Source="CodeIntegrity.cat" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" [0083.280] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat")) returned 0x20 [0084.933] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0084.933] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.933] GetLastError () returned 0x5 [0084.933] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0084.933] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7582318) returned 1 [0084.933] FindNextFileW (in: hFindFile=0x5444e40, lpFindFileData=0x53d0828 | out: lpFindFileData=0x53d0828*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f97eba2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4f97eba2, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4f97eba2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x29c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 0 [0084.933] FindClose (in: hFindFile=0x5444e40 | out: hFindFile=0x5444e40) returned 1 [0084.934] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d0828) returned 1 [0084.934] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f0698) returned 1 [0084.934] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3933ca8) returned 1 Thread: id = 1133 os_tid = 0x1ff8 [0083.282] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0083.283] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.283] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.283] GetLastError () returned 0x5 [0083.283] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.283] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b8b08) returned 1 Thread: id = 1134 os_tid = 0x1ffc [0083.284] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\logo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\logo.png")) returned 0x20 [0083.284] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x20) returned 0 [0083.285] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\logo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\logo.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.287] GetLastError () returned 0x5 [0083.287] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x20) returned 0 [0083.287] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53bb760) returned 1 Thread: id = 1135 os_tid = 0x8d8 [0083.288] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x74d2ea0 [0084.927] wcscpy (in: _Dest=0x74d2ea0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0084.927] wcscat (in: _Dest=0x74d2ea0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0084.927] wcscat (in: _Dest=0x74d2ea0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0084.927] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a2000 [0084.927] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x53a2000 | out: lpFindFileData=0x53a2000*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5c39f778, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xdae53146, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdae53146, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e700 [0084.928] wcscmp (_String1=".", _String2=".") returned 0 [0084.928] FindNextFileW (in: hFindFile=0x389e700, lpFindFileData=0x53a2000 | out: lpFindFileData=0x53a2000*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5c39f778, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xdae53146, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdae53146, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.928] wcscmp (_String1="..", _String2=".") returned 1 [0084.928] wcscmp (_String1="..", _String2="..") returned 0 [0084.928] FindNextFileW (in: hFindFile=0x389e700, lpFindFileData=0x53a2000 | out: lpFindFileData=0x53a2000*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdae53146, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x12ce6df5, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x12ce6df5, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 1 [0084.928] wcscmp (_String1="Autogen", _String2=".") returned 1 [0084.928] wcscmp (_String1="Autogen", _String2="..") returned 1 [0084.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x7584f80 [0084.928] wcscpy (in: _Dest=0x7584f80, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0084.928] wcscat (in: _Dest=0x7584f80, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0084.928] wcscat (in: _Dest=0x7584f80, _Source="Autogen" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen" [0084.928] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7584f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20cc [0084.929] FindNextFileW (in: hFindFile=0x389e700, lpFindFileData=0x53a2000 | out: lpFindFileData=0x53a2000*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdae53146, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x12ce6df5, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x12ce6df5, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0084.929] FindClose (in: hFindFile=0x389e700 | out: hFindFile=0x389e700) returned 1 [0084.929] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a2000) returned 1 [0084.929] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74d2ea0) returned 1 [0084.929] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5baa150) returned 1 Thread: id = 1136 os_tid = 0x19f4 [0083.288] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0083.290] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.292] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.293] GetLastError () returned 0x5 [0083.293] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.294] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f0b20) returned 1 Thread: id = 1137 os_tid = 0x16b8 [0083.295] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0083.297] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0083.299] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.301] GetLastError () returned 0x5 [0083.301] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0083.302] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bb5d8) returned 1 Thread: id = 1138 os_tid = 0x16c0 [0083.303] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x54f0b20 [0083.303] wcscpy (in: _Dest=0x54f0b20, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxMetadata" [0083.303] wcscat (in: _Dest=0x54f0b20, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxMetadata\\" [0083.303] wcscat (in: _Dest=0x54f0b20, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*" [0083.303] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d0cf8 [0083.303] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x53d0cf8 | out: lpFindFileData=0x53d0cf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fbe1144, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae653223, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4fbe1144, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444e80 [0083.304] wcscmp (_String1=".", _String2=".") returned 0 [0083.304] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x53d0cf8 | out: lpFindFileData=0x53d0cf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fbe1144, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae653223, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4fbe1144, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.304] wcscmp (_String1="..", _String2=".") returned 1 [0083.304] wcscmp (_String1="..", _String2="..") returned 0 [0083.304] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x53d0cf8 | out: lpFindFileData=0x53d0cf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fbe1144, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4fbe1144, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4fbe1144, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x29c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1 [0083.304] wcscmp (_String1="CodeIntegrity.cat", _String2=".") returned 1 [0083.304] wcscmp (_String1="CodeIntegrity.cat", _String2="..") returned 1 [0083.304] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x7582420 [0083.304] wcscpy (in: _Dest=0x7582420, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxMetadata" [0083.304] wcscat (in: _Dest=0x7582420, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxMetadata\\" [0083.304] wcscat (in: _Dest=0x7582420, _Source="CodeIntegrity.cat" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" [0083.305] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat")) returned 0x20 [0084.930] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0084.930] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.930] GetLastError () returned 0x5 [0084.930] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0084.930] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7582420) returned 1 [0084.930] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x53d0cf8 | out: lpFindFileData=0x53d0cf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fbe1144, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4fbe1144, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4fbe1144, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x29c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 0 [0084.930] FindClose (in: hFindFile=0x5444e80 | out: hFindFile=0x5444e80) returned 1 [0084.931] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d0cf8) returned 1 [0084.931] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f0b20) returned 1 [0084.931] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bab1a0) returned 1 Thread: id = 1139 os_tid = 0x16c4 [0083.305] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0083.306] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.306] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.306] GetLastError () returned 0x5 [0083.306] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.306] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b9468) returned 1 Thread: id = 1140 os_tid = 0x16c8 [0083.308] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\logo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\logo.png")) returned 0x20 [0083.308] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x20) returned 0 [0083.308] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\logo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\logo.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.308] GetLastError () returned 0x5 [0083.308] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x20) returned 0 [0083.308] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53bb5b0) returned 1 Thread: id = 1141 os_tid = 0x16d0 [0083.310] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x74d26f8 [0084.921] wcscpy (in: _Dest=0x74d26f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0084.921] wcscat (in: _Dest=0x74d26f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0084.921] wcscat (in: _Dest=0x74d26f8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0084.921] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a3a78 [0084.921] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5be1c081, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xdb90dade, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdb90dade, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e700 [0084.922] wcscmp (_String1=".", _String2=".") returned 0 [0084.922] FindNextFileW (in: hFindFile=0x389e700, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5be1c081, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xdb90dade, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdb90dade, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.922] wcscmp (_String1="..", _String2=".") returned 1 [0084.922] wcscmp (_String1="..", _String2="..") returned 0 [0084.922] FindNextFileW (in: hFindFile=0x389e700, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdb90dade, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd257af62, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd257af62, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 1 [0084.922] wcscmp (_String1="Autogen", _String2=".") returned 1 [0084.922] wcscmp (_String1="Autogen", _String2="..") returned 1 [0084.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x7584d30 [0084.922] wcscpy (in: _Dest=0x7584d30, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0084.922] wcscat (in: _Dest=0x7584d30, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0084.922] wcscat (in: _Dest=0x7584d30, _Source="Autogen" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen" [0084.922] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7584d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xce8 [0084.923] FindNextFileW (in: hFindFile=0x389e700, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdb90dade, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd257af62, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd257af62, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0084.923] FindClose (in: hFindFile=0x389e700 | out: hFindFile=0x389e700) returned 1 [0084.923] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a3a78) returned 1 [0084.923] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74d26f8) returned 1 [0084.923] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5baa268) returned 1 Thread: id = 1142 os_tid = 0x16d8 [0083.310] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0083.312] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.314] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.315] GetLastError () returned 0x5 [0083.315] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.317] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f0a38) returned 1 Thread: id = 1143 os_tid = 0x14bc [0083.320] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0083.321] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0083.323] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.324] GetLastError () returned 0x5 [0083.324] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0083.325] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54ba840) returned 1 Thread: id = 1144 os_tid = 0x14e4 [0083.326] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x54f0a38 [0083.326] wcscpy (in: _Dest=0x54f0a38, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0083.326] wcscat (in: _Dest=0x54f0a38, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0083.326] wcscat (in: _Dest=0x54f0a38, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*" [0083.327] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d0f60 [0083.327] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x53d0f60 | out: lpFindFileData=0x53d0f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b6267, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae6c9f8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5b6267, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444ec0 [0083.327] wcscmp (_String1=".", _String2=".") returned 0 [0083.328] FindNextFileW (in: hFindFile=0x5444ec0, lpFindFileData=0x53d0f60 | out: lpFindFileData=0x53d0f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b6267, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae6c9f8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5b6267, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.328] wcscmp (_String1="..", _String2=".") returned 1 [0083.328] wcscmp (_String1="..", _String2="..") returned 0 [0083.328] FindNextFileW (in: hFindFile=0x5444ec0, lpFindFileData=0x53d0f60 | out: lpFindFileData=0x53d0f60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b6267, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b6267, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x5b6267, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x29c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1 [0083.328] wcscmp (_String1="CodeIntegrity.cat", _String2=".") returned 1 [0083.328] wcscmp (_String1="CodeIntegrity.cat", _String2="..") returned 1 [0083.328] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x7582528 [0083.328] wcscpy (in: _Dest=0x7582528, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0083.328] wcscat (in: _Dest=0x7582528, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0083.328] wcscat (in: _Dest=0x7582528, _Source="CodeIntegrity.cat" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" [0083.328] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat")) returned 0x20 [0084.925] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0084.925] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.925] GetLastError () returned 0x5 [0084.925] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0084.925] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7582528) returned 1 [0084.925] FindNextFileW (in: hFindFile=0x5444ec0, lpFindFileData=0x53d0f60 | out: lpFindFileData=0x53d0f60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b6267, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b6267, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x5b6267, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x29c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 0 [0084.925] FindClose (in: hFindFile=0x5444ec0 | out: hFindFile=0x5444ec0) returned 1 [0084.926] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d0f60) returned 1 [0084.926] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f0a38) returned 1 [0084.926] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bac940) returned 1 Thread: id = 1145 os_tid = 0x142c [0083.328] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0083.329] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.329] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.329] GetLastError () returned 0x5 [0083.329] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.329] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54ba188) returned 1 Thread: id = 1146 os_tid = 0x16e4 [0083.330] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\logo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\logo.png")) returned 0x20 [0083.331] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x20) returned 0 [0083.331] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\logo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\logo.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.331] GetLastError () returned 0x5 [0083.331] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x20) returned 0 [0083.332] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53bafc8) returned 1 Thread: id = 1147 os_tid = 0x16e8 [0083.333] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x74d2298 [0084.916] wcscpy (in: _Dest=0x74d2298, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0084.916] wcscat (in: _Dest=0x74d2298, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0084.916] wcscat (in: _Dest=0x74d2298, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0084.916] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a3a78 [0084.916] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb046ec20, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb046ec20, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xdb9fcec, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e740 [0084.919] wcscmp (_String1=".", _String2=".") returned 0 [0084.919] FindNextFileW (in: hFindFile=0x389e740, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb046ec20, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb046ec20, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xdb9fcec, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.919] wcscmp (_String1="..", _String2=".") returned 1 [0084.919] wcscmp (_String1="..", _String2="..") returned 0 [0084.919] FindNextFileW (in: hFindFile=0x389e740, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdb79a84, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xdb79a84, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdb79a84, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 1 [0084.919] wcscmp (_String1="Autogen", _String2=".") returned 1 [0084.919] wcscmp (_String1="Autogen", _String2="..") returned 1 [0084.919] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x7584c08 [0084.919] wcscpy (in: _Dest=0x7584c08, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0084.919] wcscat (in: _Dest=0x7584c08, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0084.919] wcscat (in: _Dest=0x7584c08, _Source="Autogen" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen" [0084.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7584c08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20d0 [0084.920] FindNextFileW (in: hFindFile=0x389e740, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdb79a84, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xdb79a84, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdb79a84, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0084.920] FindClose (in: hFindFile=0x389e740 | out: hFindFile=0x389e740) returned 1 [0084.920] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a3a78) returned 1 [0084.920] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74d2298) returned 1 [0084.920] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba9cf0) returned 1 Thread: id = 1148 os_tid = 0x126c [0083.333] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0083.334] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.336] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.337] GetLastError () returned 0x5 [0083.337] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.339] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f0868) returned 1 Thread: id = 1149 os_tid = 0x11ec [0083.340] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0083.342] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0083.343] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.344] GetLastError () returned 0x5 [0083.344] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0083.346] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54baa10) returned 1 Thread: id = 1150 os_tid = 0xf88 [0083.347] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x54f0868 [0083.347] wcscpy (in: _Dest=0x54f0868, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxMetadata" [0083.347] wcscat (in: _Dest=0x54f0868, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxMetadata\\" [0083.347] wcscat (in: _Dest=0x54f0868, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*" [0083.347] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d11c8 [0083.347] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x53d11c8 | out: lpFindFileData=0x53d11c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc44a0e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae726a29, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc44a0e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f00 [0083.348] wcscmp (_String1=".", _String2=".") returned 0 [0083.348] FindNextFileW (in: hFindFile=0x5444f00, lpFindFileData=0x53d11c8 | out: lpFindFileData=0x53d11c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc44a0e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae726a29, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc44a0e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.348] wcscmp (_String1="..", _String2=".") returned 1 [0083.348] wcscmp (_String1="..", _String2="..") returned 0 [0083.348] FindNextFileW (in: hFindFile=0x5444f00, lpFindFileData=0x53d11c8 | out: lpFindFileData=0x53d11c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc44a0e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc44a0e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xc44a0e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x29c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1 [0083.348] wcscmp (_String1="CodeIntegrity.cat", _String2=".") returned 1 [0083.348] wcscmp (_String1="CodeIntegrity.cat", _String2="..") returned 1 [0083.348] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x7582000 [0083.348] wcscpy (in: _Dest=0x7582000, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxMetadata" [0083.348] wcscat (in: _Dest=0x7582000, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxMetadata\\" [0083.348] wcscat (in: _Dest=0x7582000, _Source="CodeIntegrity.cat" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" [0083.349] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat")) returned 0x20 [0084.917] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0084.917] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.917] GetLastError () returned 0x5 [0084.917] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0084.917] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7582000) returned 1 [0084.917] FindNextFileW (in: hFindFile=0x5444f00, lpFindFileData=0x53d11c8 | out: lpFindFileData=0x53d11c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc44a0e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc44a0e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xc44a0e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x29c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 0 [0084.917] FindClose (in: hFindFile=0x5444f00 | out: hFindFile=0x5444f00) returned 1 [0084.918] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53d11c8) returned 1 [0084.918] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f0868) returned 1 [0084.918] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5baca20) returned 1 Thread: id = 1151 os_tid = 0x16f4 [0083.349] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0083.350] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.350] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.350] GetLastError () returned 0x5 [0083.350] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.350] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54ba278) returned 1 Thread: id = 1152 os_tid = 0x16f8 [0083.351] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\logo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\logo.png")) returned 0x20 [0083.351] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x20) returned 0 [0083.352] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\logo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\logo.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.352] GetLastError () returned 0x5 [0083.352] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x20) returned 0 [0083.352] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3974258) returned 1 Thread: id = 1153 os_tid = 0xa5c [0083.353] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x74d2068 [0084.911] wcscpy (in: _Dest=0x74d2068, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0084.912] wcscat (in: _Dest=0x74d2068, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0084.912] wcscat (in: _Dest=0x74d2068, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0084.912] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a4418 [0084.912] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x53a4418 | out: lpFindFileData=0x53a4418*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xaf7c444d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xaf7c444d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd96398a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389eac0 [0084.912] wcscmp (_String1=".", _String2=".") returned 0 [0084.912] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a4418 | out: lpFindFileData=0x53a4418*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xaf7c444d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xaf7c444d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd96398a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.912] wcscmp (_String1="..", _String2=".") returned 1 [0084.912] wcscmp (_String1="..", _String2="..") returned 0 [0084.913] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a4418 | out: lpFindFileData=0x53a4418*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd96398a, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd96398a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd96398a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 1 [0084.913] wcscmp (_String1="Autogen", _String2=".") returned 1 [0084.913] wcscmp (_String1="Autogen", _String2="..") returned 1 [0084.913] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x7584ae0 [0084.913] wcscpy (in: _Dest=0x7584ae0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0084.913] wcscat (in: _Dest=0x7584ae0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0084.913] wcscat (in: _Dest=0x7584ae0, _Source="Autogen" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen" [0084.913] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7584ae0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20d4 [0084.914] FindNextFileW (in: hFindFile=0x389eac0, lpFindFileData=0x53a4418 | out: lpFindFileData=0x53a4418*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd96398a, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd96398a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd96398a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0084.914] FindClose (in: hFindFile=0x389eac0 | out: hFindFile=0x389eac0) returned 1 [0084.914] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a4418) returned 1 [0084.914] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74d2068) returned 1 [0084.914] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba9e08) returned 1 Thread: id = 1154 os_tid = 0xc30 [0083.353] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0083.357] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.359] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.360] GetLastError () returned 0x5 [0083.360] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.361] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f0780) returned 1 Thread: id = 1155 os_tid = 0x1390 [0083.480] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0083.481] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0083.483] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.484] GetLastError () returned 0x5 [0083.484] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0083.486] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54baaf8) returned 1 Thread: id = 1156 os_tid = 0x1708 [0083.489] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x54f1f10 [0083.489] wcscpy (in: _Dest=0x54f1f10, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0083.489] wcscat (in: _Dest=0x54f1f10, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0083.489] wcscat (in: _Dest=0x54f1f10, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*" [0083.489] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53ce678 [0083.489] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x53ce678 | out: lpFindFileData=0x53ce678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11909f6c, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xae7e4415, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x11909f6c, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ec40 [0083.491] wcscmp (_String1=".", _String2=".") returned 0 [0083.491] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x53ce678 | out: lpFindFileData=0x53ce678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11909f6c, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xae7e4415, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x11909f6c, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.491] wcscmp (_String1="..", _String2=".") returned 1 [0083.491] wcscmp (_String1="..", _String2="..") returned 0 [0083.491] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x53ce678 | out: lpFindFileData=0x53ce678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11909f6c, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x11909f6c, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x12d01ea9, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x29b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="CODEIN~1.CAT")) returned 1 [0083.491] wcscmp (_String1="CodeIntegrity.cat", _String2=".") returned 1 [0083.491] wcscmp (_String1="CodeIntegrity.cat", _String2="..") returned 1 [0083.491] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x7582d68 [0083.491] wcscpy (in: _Dest=0x7582d68, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0083.491] wcscat (in: _Dest=0x7582d68, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0083.491] wcscat (in: _Dest=0x7582d68, _Source="CodeIntegrity.cat" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" [0083.491] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat")) returned 0x20 [0084.889] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0084.889] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.889] GetLastError () returned 0x5 [0084.889] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0084.889] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7582d68) returned 1 [0084.889] FindNextFileW (in: hFindFile=0x389ec40, lpFindFileData=0x53ce678 | out: lpFindFileData=0x53ce678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11909f6c, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x11909f6c, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x12d01ea9, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x29b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="CODEIN~1.CAT")) returned 0 [0084.889] FindClose (in: hFindFile=0x389ec40 | out: hFindFile=0x389ec40) returned 1 [0084.889] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ce678) returned 1 [0084.889] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f1f10) returned 1 [0084.889] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bacb00) returned 1 Thread: id = 1157 os_tid = 0x124c [0083.492] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0083.492] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.492] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.492] GetLastError () returned 0x5 [0083.492] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.492] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54ba368) returned 1 Thread: id = 1158 os_tid = 0xfa8 [0083.493] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\logo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\logo.png")) returned 0x20 [0083.495] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x20) returned 0 [0083.495] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\logo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\logo.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.495] GetLastError () returned 0x5 [0083.495] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x20) returned 0 [0083.495] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39729e0) returned 1 Thread: id = 1159 os_tid = 0x12c8 [0083.496] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x757a498 [0084.886] wcscpy (in: _Dest=0x757a498, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0084.886] wcscat (in: _Dest=0x757a498, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0084.886] wcscat (in: _Dest=0x757a498, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0084.886] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a2e70 [0084.886] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x53a2e70 | out: lpFindFileData=0x53a2e70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12f3e2a7, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xdbfe8744, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdbfe8744, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ecc0 [0084.887] wcscmp (_String1=".", _String2=".") returned 0 [0084.887] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x53a2e70 | out: lpFindFileData=0x53a2e70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12f3e2a7, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xdbfe8744, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdbfe8744, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.887] wcscmp (_String1="..", _String2=".") returned 1 [0084.887] wcscmp (_String1="..", _String2="..") returned 0 [0084.887] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x53a2e70 | out: lpFindFileData=0x53a2e70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdbfe8744, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa8c8ab51, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa8c8ab51, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 1 [0084.887] wcscmp (_String1="Autogen", _String2=".") returned 1 [0084.887] wcscmp (_String1="Autogen", _String2="..") returned 1 [0084.887] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x7584e58 [0084.887] wcscpy (in: _Dest=0x7584e58, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0084.887] wcscat (in: _Dest=0x7584e58, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0084.887] wcscat (in: _Dest=0x7584e58, _Source="Autogen" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen" [0084.887] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7584e58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x165c [0084.888] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x53a2e70 | out: lpFindFileData=0x53a2e70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdbfe8744, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa8c8ab51, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa8c8ab51, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0084.888] FindClose (in: hFindFile=0x389ecc0 | out: hFindFile=0x389ecc0) returned 1 [0084.888] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a2e70) returned 1 [0084.888] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757a498) returned 1 [0084.888] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba9f20) returned 1 Thread: id = 1160 os_tid = 0xdd4 [0083.496] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0083.498] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.500] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.501] GetLastError () returned 0x5 [0083.501] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.503] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f05b0) returned 1 Thread: id = 1161 os_tid = 0xc20 [0083.504] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0083.506] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0083.508] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.509] GetLastError () returned 0x5 [0083.509] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0083.511] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54babe0) returned 1 Thread: id = 1162 os_tid = 0x1420 [0083.512] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x54f05b0 [0083.512] wcscpy (in: _Dest=0x54f05b0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxMetadata" [0083.512] wcscat (in: _Dest=0x54f05b0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxMetadata\\" [0083.512] wcscat (in: _Dest=0x54f05b0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*" [0083.512] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53ce8e0 [0083.512] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x53ce8e0 | out: lpFindFileData=0x53ce8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14120099, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xae88003f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x14120099, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ecc0 [0083.513] wcscmp (_String1=".", _String2=".") returned 0 [0083.513] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x53ce8e0 | out: lpFindFileData=0x53ce8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14120099, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xae88003f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x14120099, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.513] wcscmp (_String1="..", _String2=".") returned 1 [0083.513] wcscmp (_String1="..", _String2="..") returned 0 [0083.513] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x53ce8e0 | out: lpFindFileData=0x53ce8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14120099, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x14120099, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x164250c2, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x29b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="CODEIN~1.CAT")) returned 1 [0083.513] wcscmp (_String1="CodeIntegrity.cat", _String2=".") returned 1 [0083.513] wcscmp (_String1="CodeIntegrity.cat", _String2="..") returned 1 [0083.513] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x7582e70 [0083.513] wcscpy (in: _Dest=0x7582e70, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxMetadata" [0083.513] wcscat (in: _Dest=0x7582e70, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxMetadata\\" [0083.513] wcscat (in: _Dest=0x7582e70, _Source="CodeIntegrity.cat" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" [0083.513] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat")) returned 0x20 [0084.885] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0084.885] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.885] GetLastError () returned 0x5 [0084.885] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0084.885] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7582e70) returned 1 [0084.885] FindNextFileW (in: hFindFile=0x389ecc0, lpFindFileData=0x53ce8e0 | out: lpFindFileData=0x53ce8e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14120099, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x14120099, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x164250c2, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x29b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="CODEIN~1.CAT")) returned 0 [0084.885] FindClose (in: hFindFile=0x389ecc0 | out: hFindFile=0x389ecc0) returned 1 [0084.885] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ce8e0) returned 1 [0084.885] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f05b0) returned 1 [0084.886] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5baafe0) returned 1 Thread: id = 1163 os_tid = 0x1434 [0083.514] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0083.514] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.515] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.515] GetLastError () returned 0x5 [0083.515] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.515] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54ba458) returned 1 Thread: id = 1164 os_tid = 0x1438 [0083.521] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\logo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\logo.png")) returned 0x20 [0083.521] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x20) returned 0 [0083.521] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\logo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\logo.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.521] GetLastError () returned 0x5 [0083.522] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x20) returned 0 [0083.522] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757f850) returned 1 Thread: id = 1165 os_tid = 0x1468 [0083.523] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x757b0a0 [0084.881] wcscpy (in: _Dest=0x757b0a0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0084.882] wcscat (in: _Dest=0x757b0a0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0084.882] wcscat (in: _Dest=0x757b0a0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0084.882] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a48e8 [0084.882] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x53a48e8 | out: lpFindFileData=0x53a48e8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x164e3d2d, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xdc925941, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdc925941, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ed00 [0084.883] wcscmp (_String1=".", _String2=".") returned 0 [0084.883] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53a48e8 | out: lpFindFileData=0x53a48e8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x164e3d2d, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xdc925941, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdc925941, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.883] wcscmp (_String1="..", _String2=".") returned 1 [0084.883] wcscmp (_String1="..", _String2="..") returned 0 [0084.883] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53a48e8 | out: lpFindFileData=0x53a48e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdc925941, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa8e2e542, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa8e2e542, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 1 [0084.883] wcscmp (_String1="Autogen", _String2=".") returned 1 [0084.883] wcscmp (_String1="Autogen", _String2="..") returned 1 [0084.883] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x7584640 [0084.883] wcscpy (in: _Dest=0x7584640, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0084.883] wcscat (in: _Dest=0x7584640, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0084.883] wcscat (in: _Dest=0x7584640, _Source="Autogen" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen" [0084.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7584640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd4c [0084.884] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53a48e8 | out: lpFindFileData=0x53a48e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdc925941, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa8e2e542, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa8e2e542, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0084.884] FindClose (in: hFindFile=0x389ed00 | out: hFindFile=0x389ed00) returned 1 [0084.884] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a48e8) returned 1 [0084.884] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757b0a0) returned 1 [0084.884] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5baa380) returned 1 Thread: id = 1166 os_tid = 0x1474 [0083.523] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0083.525] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.527] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.528] GetLastError () returned 0x5 [0083.528] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.529] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f03e0) returned 1 Thread: id = 1167 os_tid = 0x1478 [0083.531] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0083.532] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0083.534] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.536] GetLastError () returned 0x5 [0083.536] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0083.537] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bacc8) returned 1 Thread: id = 1168 os_tid = 0x1480 [0083.539] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x39348e8 [0083.539] wcscpy (in: _Dest=0x39348e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0083.539] wcscat (in: _Dest=0x39348e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0083.539] wcscat (in: _Dest=0x39348e8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*" [0083.539] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53ceb48 [0083.539] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb2696342, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae900a2d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2696342, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ed00 [0083.540] wcscmp (_String1=".", _String2=".") returned 0 [0083.540] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb2696342, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae900a2d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2696342, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.540] wcscmp (_String1="..", _String2=".") returned 1 [0083.540] wcscmp (_String1="..", _String2="..") returned 0 [0083.540] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2696342, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb2696342, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb2696342, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2b4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1 [0083.540] wcscmp (_String1="CodeIntegrity.cat", _String2=".") returned 1 [0083.540] wcscmp (_String1="CodeIntegrity.cat", _String2="..") returned 1 [0083.540] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf8) returned 0x5ba46f8 [0083.540] wcscpy (in: _Dest=0x5ba46f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0083.540] wcscat (in: _Dest=0x5ba46f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0083.540] wcscat (in: _Dest=0x5ba46f8, _Source="CodeIntegrity.cat" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" [0083.540] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba46f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1654 [0083.541] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2696342, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb2696342, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb2696342, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2b4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 0 [0083.541] FindClose (in: hFindFile=0x389ed00 | out: hFindFile=0x389ed00) returned 1 [0083.542] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ceb48) returned 1 [0083.542] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39348e8) returned 1 [0083.542] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bab0c0) returned 1 Thread: id = 1169 os_tid = 0x1488 [0083.544] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0083.546] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.548] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.549] GetLastError () returned 0x5 [0083.549] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.550] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bb890) returned 1 Thread: id = 1170 os_tid = 0x14d8 [0083.552] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\logo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\logo.png")) returned 0x20 [0083.556] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x20) returned 0 [0083.557] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\logo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\logo.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.558] GetLastError () returned 0x5 [0083.559] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x20) returned 0 [0083.560] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757f340) returned 1 Thread: id = 1171 os_tid = 0x14e0 [0083.561] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x102) returned 0x75785a8 [0084.878] wcscpy (in: _Dest=0x75785a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0084.878] wcscat (in: _Dest=0x75785a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0084.878] wcscat (in: _Dest=0x75785a8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0084.878] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a4680 [0084.878] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x53a4680 | out: lpFindFileData=0x53a4680*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x69da07d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xdd0e53b5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdd0e53b5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e9c0 [0084.879] wcscmp (_String1=".", _String2=".") returned 0 [0084.879] FindNextFileW (in: hFindFile=0x389e9c0, lpFindFileData=0x53a4680 | out: lpFindFileData=0x53a4680*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x69da07d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xdd0e53b5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdd0e53b5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.879] wcscmp (_String1="..", _String2=".") returned 1 [0084.879] wcscmp (_String1="..", _String2="..") returned 0 [0084.879] FindNextFileW (in: hFindFile=0x389e9c0, lpFindFileData=0x53a4680 | out: lpFindFileData=0x53a4680*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdd0e53b5, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xdd0e53b5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdd0e53b5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 1 [0084.879] wcscmp (_String1="Autogen", _String2=".") returned 1 [0084.879] wcscmp (_String1="Autogen", _String2="..") returned 1 [0084.879] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x7577f18 [0084.879] wcscpy (in: _Dest=0x7577f18, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0084.879] wcscat (in: _Dest=0x7577f18, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0084.879] wcscat (in: _Dest=0x7577f18, _Source="Autogen" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen" [0084.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7577f18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd50 [0084.880] FindNextFileW (in: hFindFile=0x389e9c0, lpFindFileData=0x53a4680 | out: lpFindFileData=0x53a4680*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdd0e53b5, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xdd0e53b5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdd0e53b5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0084.880] FindClose (in: hFindFile=0x389e9c0 | out: hFindFile=0x389e9c0) returned 1 [0084.881] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a4680) returned 1 [0084.881] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75785a8) returned 1 [0084.881] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549a130) returned 1 Thread: id = 1172 os_tid = 0x155c [0083.561] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0083.564] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.565] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.567] GetLastError () returned 0x5 [0083.567] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.568] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f02f8) returned 1 Thread: id = 1173 os_tid = 0x1588 [0083.569] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0083.571] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0083.572] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.574] GetLastError () returned 0x5 [0083.574] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0083.575] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54badb0) returned 1 Thread: id = 1174 os_tid = 0x1590 [0083.576] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x39348e8 [0083.576] wcscpy (in: _Dest=0x39348e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxMetadata" [0083.577] wcscat (in: _Dest=0x39348e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxMetadata\\" [0083.577] wcscat (in: _Dest=0x39348e8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*" [0083.577] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53ceb48 [0083.577] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb2708a61, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae9b8a01, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2708a61, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ed00 [0083.577] wcscmp (_String1=".", _String2=".") returned 0 [0083.577] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb2708a61, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae9b8a01, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2708a61, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.578] wcscmp (_String1="..", _String2=".") returned 1 [0083.578] wcscmp (_String1="..", _String2="..") returned 0 [0083.578] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2708a61, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb2708a61, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb2708a61, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2b4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1 [0083.578] wcscmp (_String1="CodeIntegrity.cat", _String2=".") returned 1 [0083.578] wcscmp (_String1="CodeIntegrity.cat", _String2="..") returned 1 [0083.578] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf8) returned 0x5ba47f8 [0083.578] wcscpy (in: _Dest=0x5ba47f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxMetadata" [0083.578] wcscat (in: _Dest=0x5ba47f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxMetadata\\" [0083.578] wcscat (in: _Dest=0x5ba47f8, _Source="CodeIntegrity.cat" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" [0083.578] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba47f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1650 [0083.578] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2708a61, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb2708a61, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb2708a61, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2b4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 0 [0083.578] FindClose (in: hFindFile=0x389ed00 | out: hFindFile=0x389ed00) returned 1 [0083.579] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ceb48) returned 1 [0083.579] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39348e8) returned 1 [0083.579] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bab280) returned 1 Thread: id = 1175 os_tid = 0x1598 [0083.580] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0083.582] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.584] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.585] GetLastError () returned 0x5 [0083.585] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.587] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bb978) returned 1 Thread: id = 1176 os_tid = 0x15c0 [0083.588] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\logo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\logo.png")) returned 0x20 [0083.589] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x20) returned 0 [0083.590] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\logo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\logo.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.594] GetLastError () returned 0x5 [0083.594] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x20) returned 0 [0083.595] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757f418) returned 1 Thread: id = 1177 os_tid = 0x15d0 [0083.596] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x102) returned 0x7576140 [0084.874] wcscpy (in: _Dest=0x7576140, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0084.874] wcscat (in: _Dest=0x7576140, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0084.874] wcscat (in: _Dest=0x7576140, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0084.875] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a41b0 [0084.875] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x53a41b0 | out: lpFindFileData=0x53a41b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x69fb68e3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xddc386b4, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xddc386b4, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e940 [0084.875] wcscmp (_String1=".", _String2=".") returned 0 [0084.875] FindNextFileW (in: hFindFile=0x389e940, lpFindFileData=0x53a41b0 | out: lpFindFileData=0x53a41b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x69fb68e3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xddc386b4, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xddc386b4, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.875] wcscmp (_String1="..", _String2=".") returned 1 [0084.875] wcscmp (_String1="..", _String2="..") returned 0 [0084.875] FindNextFileW (in: hFindFile=0x389e940, lpFindFileData=0x53a41b0 | out: lpFindFileData=0x53a41b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xddc386b4, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xddc386b4, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xddc386b4, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 1 [0084.875] wcscmp (_String1="Autogen", _String2=".") returned 1 [0084.875] wcscmp (_String1="Autogen", _String2="..") returned 1 [0084.876] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x7575998 [0084.876] wcscpy (in: _Dest=0x7575998, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0084.876] wcscat (in: _Dest=0x7575998, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0084.876] wcscat (in: _Dest=0x7575998, _Source="Autogen" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen" [0084.876] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7575998, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd54 [0084.876] FindNextFileW (in: hFindFile=0x389e940, lpFindFileData=0x53a41b0 | out: lpFindFileData=0x53a41b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xddc386b4, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xddc386b4, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xddc386b4, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0084.876] FindClose (in: hFindFile=0x389e940 | out: hFindFile=0x389e940) returned 1 [0084.877] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a41b0) returned 1 [0084.877] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7576140) returned 1 [0084.877] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7581190) returned 1 Thread: id = 1178 os_tid = 0x1638 [0083.597] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0083.599] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.601] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.602] GetLastError () returned 0x5 [0083.602] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.603] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f0210) returned 1 Thread: id = 1179 os_tid = 0x1318 [0083.604] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0083.608] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0083.609] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.610] GetLastError () returned 0x5 [0083.610] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0083.612] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bae98) returned 1 Thread: id = 1180 os_tid = 0x1918 [0083.613] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x39348e8 [0083.613] wcscpy (in: _Dest=0x39348e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0083.613] wcscat (in: _Dest=0x39348e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0083.613] wcscat (in: _Dest=0x39348e8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*" [0083.613] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53ceb48 [0083.613] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ff74b34, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaea3adf2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4ff74b34, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ed00 [0083.614] wcscmp (_String1=".", _String2=".") returned 0 [0083.614] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ff74b34, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaea3adf2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4ff74b34, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.614] wcscmp (_String1="..", _String2=".") returned 1 [0083.614] wcscmp (_String1="..", _String2="..") returned 0 [0083.614] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff74b34, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4ff74b34, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4ff74b34, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2a8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1 [0083.614] wcscmp (_String1="CodeIntegrity.cat", _String2=".") returned 1 [0083.614] wcscmp (_String1="CodeIntegrity.cat", _String2="..") returned 1 [0083.614] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf8) returned 0x5ba48f8 [0083.614] wcscpy (in: _Dest=0x5ba48f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0083.614] wcscat (in: _Dest=0x5ba48f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0083.614] wcscat (in: _Dest=0x5ba48f8, _Source="CodeIntegrity.cat" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" [0083.614] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba48f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1648 [0083.615] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff74b34, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4ff74b34, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4ff74b34, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2a8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 0 [0083.615] FindClose (in: hFindFile=0x389ed00 | out: hFindFile=0x389ed00) returned 1 [0083.616] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ceb48) returned 1 [0083.616] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39348e8) returned 1 [0083.616] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bab360) returned 1 Thread: id = 1181 os_tid = 0x1980 [0083.617] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0083.619] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.620] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.622] GetLastError () returned 0x5 [0083.622] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.623] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bbb48) returned 1 Thread: id = 1182 os_tid = 0x19e4 [0083.624] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\logo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\logo.png")) returned 0x20 [0083.625] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x20) returned 0 [0083.627] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\logo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\logo.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.628] GetLastError () returned 0x5 [0083.628] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x20) returned 0 [0083.630] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757f4f0) returned 1 Thread: id = 1183 os_tid = 0x19e8 [0083.631] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x102) returned 0xe139020 [0084.871] wcscpy (in: _Dest=0xe139020, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0084.871] wcscat (in: _Dest=0xe139020, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0084.871] wcscat (in: _Dest=0xe139020, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0084.871] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a3ce0 [0084.871] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x53a3ce0 | out: lpFindFileData=0x53a3ce0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5c77f49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xde4445ea, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xde4445ea, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ed00 [0084.872] wcscmp (_String1=".", _String2=".") returned 0 [0084.872] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53a3ce0 | out: lpFindFileData=0x53a3ce0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5c77f49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xde4445ea, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xde4445ea, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.872] wcscmp (_String1="..", _String2=".") returned 1 [0084.872] wcscmp (_String1="..", _String2="..") returned 0 [0084.872] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53a3ce0 | out: lpFindFileData=0x53a3ce0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xde4445ea, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd28c236f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd28c236f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 1 [0084.872] wcscmp (_String1="Autogen", _String2=".") returned 1 [0084.872] wcscmp (_String1="Autogen", _String2="..") returned 1 [0084.872] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0xe13a088 [0084.872] wcscpy (in: _Dest=0xe13a088, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0084.872] wcscat (in: _Dest=0xe13a088, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0084.872] wcscat (in: _Dest=0xe13a088, _Source="Autogen" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen" [0084.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0xe13a088, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd58 [0084.873] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53a3ce0 | out: lpFindFileData=0x53a3ce0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xde4445ea, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd28c236f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd28c236f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0084.873] FindClose (in: hFindFile=0x389ed00 | out: hFindFile=0x389ed00) returned 1 [0084.874] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a3ce0) returned 1 [0084.874] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe139020) returned 1 [0084.874] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7582108) returned 1 Thread: id = 1184 os_tid = 0x19ec [0083.631] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0083.633] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.635] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.636] GetLastError () returned 0x5 [0083.636] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.637] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f04c8) returned 1 Thread: id = 1185 os_tid = 0x1b38 [0083.638] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0083.640] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0083.642] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.643] GetLastError () returned 0x5 [0083.643] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0083.645] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bbd18) returned 1 Thread: id = 1186 os_tid = 0x1cbc [0083.646] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x39348e8 [0083.646] wcscpy (in: _Dest=0x39348e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxMetadata" [0083.646] wcscat (in: _Dest=0x39348e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxMetadata\\" [0083.646] wcscat (in: _Dest=0x39348e8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*" [0083.646] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53ceb48 [0083.646] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ffc0fdc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaeaf6ce9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4ffc0fdc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ed00 [0083.647] wcscmp (_String1=".", _String2=".") returned 0 [0083.647] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ffc0fdc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaeaf6ce9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4ffc0fdc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.647] wcscmp (_String1="..", _String2=".") returned 1 [0083.647] wcscmp (_String1="..", _String2="..") returned 0 [0083.647] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ffc0fdc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4ffc0fdc, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4ffc0fdc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2a8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1 [0083.647] wcscmp (_String1="CodeIntegrity.cat", _String2=".") returned 1 [0083.647] wcscmp (_String1="CodeIntegrity.cat", _String2="..") returned 1 [0083.647] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf8) returned 0x5ba49f8 [0083.648] wcscpy (in: _Dest=0x5ba49f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxMetadata" [0083.648] wcscat (in: _Dest=0x5ba49f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxMetadata\\" [0083.648] wcscat (in: _Dest=0x5ba49f8, _Source="CodeIntegrity.cat" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" [0083.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba49f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13dc [0083.648] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ffc0fdc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4ffc0fdc, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4ffc0fdc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2a8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 0 [0083.648] FindClose (in: hFindFile=0x389ed00 | out: hFindFile=0x389ed00) returned 1 [0083.649] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ceb48) returned 1 [0083.649] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39348e8) returned 1 [0083.649] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bab440) returned 1 Thread: id = 1187 os_tid = 0x1c60 [0083.650] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0083.651] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.653] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.654] GetLastError () returned 0x5 [0083.654] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.655] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bbe00) returned 1 Thread: id = 1188 os_tid = 0x1c24 [0083.658] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\logo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\logo.png")) returned 0x20 [0083.659] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x20) returned 0 [0083.661] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\logo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\logo.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.663] GetLastError () returned 0x5 [0083.663] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\logo.png", dwFileAttributes=0x20) returned 0 [0083.665] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757fe38) returned 1 Thread: id = 1189 os_tid = 0x150c [0083.666] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x102) returned 0xe137d38 [0084.867] wcscpy (in: _Dest=0xe137d38, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0084.867] wcscat (in: _Dest=0xe137d38, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0084.867] wcscat (in: _Dest=0xe137d38, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0084.867] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a5020 [0084.867] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x53a5020 | out: lpFindFileData=0x53a5020*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5c58f618, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xdefbdb44, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdefbdb44, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ee00 [0084.868] wcscmp (_String1=".", _String2=".") returned 0 [0084.868] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53a5020 | out: lpFindFileData=0x53a5020*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5c58f618, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xdefbdb44, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdefbdb44, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.868] wcscmp (_String1="..", _String2=".") returned 1 [0084.868] wcscmp (_String1="..", _String2="..") returned 0 [0084.868] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53a5020 | out: lpFindFileData=0x53a5020*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdefbdb44, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd28e85c8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd28e85c8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 1 [0084.868] wcscmp (_String1="Autogen", _String2=".") returned 1 [0084.868] wcscmp (_String1="Autogen", _String2="..") returned 1 [0084.868] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0xe137478 [0084.868] wcscpy (in: _Dest=0xe137478, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0084.869] wcscat (in: _Dest=0xe137478, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0084.869] wcscat (in: _Dest=0xe137478, _Source="Autogen" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen" [0084.869] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0xe137478, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd5c [0084.869] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53a5020 | out: lpFindFileData=0x53a5020*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdefbdb44, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd28e85c8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd28e85c8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0084.869] FindClose (in: hFindFile=0x389ee00 | out: hFindFile=0x389ee00) returned 1 [0084.870] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a5020) returned 1 [0084.870] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe137d38) returned 1 [0084.870] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7581298) returned 1 Thread: id = 1190 os_tid = 0x16cc [0083.666] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0083.668] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.669] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.670] GetLastError () returned 0x5 [0083.670] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.672] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a4900) returned 1 Thread: id = 1191 os_tid = 0x1498 [0083.673] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xee) returned 0x544ffd8 [0083.673] wcscpy (in: _Dest=0x544ffd8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0083.673] wcscat (in: _Dest=0x544ffd8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\" [0083.673] wcscat (in: _Dest=0x544ffd8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*" [0083.673] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53ceb48 [0083.673] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33798b5a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabec308c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33798b5a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ed00 [0083.674] wcscmp (_String1=".", _String2=".") returned 0 [0083.674] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33798b5a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabec308c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33798b5a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.674] wcscmp (_String1="..", _String2=".") returned 1 [0083.674] wcscmp (_String1="..", _String2="..") returned 0 [0083.674] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33798b5a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x337bedb8, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x337bedb8, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x41c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 1 [0083.674] wcscmp (_String1="AppxBundleManifest.xml", _String2=".") returned 1 [0083.674] wcscmp (_String1="AppxBundleManifest.xml", _String2="..") returned 1 [0083.674] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x118) returned 0x75849b8 [0083.674] wcscpy (in: _Dest=0x75849b8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0083.674] wcscat (in: _Dest=0x75849b8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\" [0083.674] wcscat (in: _Dest=0x75849b8, _Source="AppxBundleManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" [0083.674] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x75849b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1640 [0083.747] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33798b5a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x337bedb8, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x337bedb8, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x41c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 0 [0083.748] FindClose (in: hFindFile=0x389ed00 | out: hFindFile=0x389ed00) returned 1 [0083.748] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ceb48) returned 1 [0083.748] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x544ffd8) returned 1 [0083.748] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7285df0) returned 1 Thread: id = 1192 os_tid = 0xd1c [0083.749] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0083.751] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.752] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.754] GetLastError () returned 0x5 [0083.754] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.755] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba22f8) returned 1 Thread: id = 1193 os_tid = 0x1594 [0083.757] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x118) returned 0x75851d0 [0083.757] wcscpy (in: _Dest=0x75851d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" [0083.757] wcscat (in: _Dest=0x75851d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0083.757] wcscat (in: _Dest=0x75851d0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0083.757] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53ceb48 [0083.757] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc96c435e, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc96c435e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc96c435e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ed00 [0083.758] wcscmp (_String1=".", _String2=".") returned 0 [0083.758] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc96c435e, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc96c435e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc96c435e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.758] wcscmp (_String1="..", _String2=".") returned 1 [0083.758] wcscmp (_String1="..", _String2="..") returned 0 [0083.758] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc96c435e, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc96c435e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc96c435e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0083.758] FindClose (in: hFindFile=0x389ed00 | out: hFindFile=0x389ed00) returned 1 [0083.759] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ceb48) returned 1 [0083.759] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75851d0) returned 1 [0083.759] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bcf30) returned 1 Thread: id = 1194 os_tid = 0x1648 [0083.760] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0083.764] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.765] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.766] GetLastError () returned 0x5 [0083.766] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0083.768] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b1ab8) returned 1 Thread: id = 1195 os_tid = 0x1688 [0083.817] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0083.819] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0083.820] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.822] GetLastError () returned 0x5 [0083.822] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0083.823] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5babfa0) returned 1 Thread: id = 1196 os_tid = 0x15c4 [0083.825] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x7580270 [0083.825] wcscpy (in: _Dest=0x7580270, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0083.826] wcscat (in: _Dest=0x7580270, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0083.826] wcscat (in: _Dest=0x7580270, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*" [0083.826] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53ceb48 [0083.826] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69e3b535, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd6eb7b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69e3b535, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ed00 [0083.827] wcscmp (_String1=".", _String2=".") returned 0 [0083.827] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69e3b535, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd6eb7b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69e3b535, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.827] wcscmp (_String1="..", _String2=".") returned 1 [0083.827] wcscmp (_String1="..", _String2="..") returned 0 [0083.827] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e3b535, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69e3b535, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69e3b535, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3263, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1 [0083.827] wcscmp (_String1="CodeIntegrity.cat", _String2=".") returned 1 [0083.827] wcscmp (_String1="CodeIntegrity.cat", _String2="..") returned 1 [0083.827] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x54505a8 [0083.827] wcscpy (in: _Dest=0x54505a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0083.827] wcscat (in: _Dest=0x54505a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0083.828] wcscat (in: _Dest=0x54505a8, _Source="CodeIntegrity.cat" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" [0083.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54505a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x163c [0083.828] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e3b535, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69e3b535, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69e3b535, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3263, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 0 [0083.828] FindClose (in: hFindFile=0x389ed00 | out: hFindFile=0x389ed00) returned 1 [0083.829] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ceb48) returned 1 [0083.829] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7580270) returned 1 [0083.829] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757f5c8) returned 1 Thread: id = 1197 os_tid = 0x185c [0083.830] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0083.833] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.834] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.835] GetLastError () returned 0x5 [0083.835] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0083.837] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5babd00) returned 1 Thread: id = 1198 os_tid = 0x1864 [0083.838] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x3971640 [0083.838] wcscpy (in: _Dest=0x3971640, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" [0083.838] wcscat (in: _Dest=0x3971640, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\" [0083.838] wcscat (in: _Dest=0x3971640, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\*" [0083.838] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53ceb48 [0083.838] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69e879ec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaddf87aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69efa0fc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ed00 [0083.840] wcscmp (_String1=".", _String2=".") returned 0 [0083.840] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69e879ec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaddf87aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69efa0fc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.840] wcscmp (_String1="..", _String2=".") returned 1 [0083.840] wcscmp (_String1="..", _String2="..") returned 0 [0083.840] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e879ec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69e879ec, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69e879ec, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="LockScreenLogo.scale-200.png", cAlternateFileName="")) returned 1 [0083.840] wcscmp (_String1="LockScreenLogo.scale-200.png", _String2=".") returned 1 [0083.840] wcscmp (_String1="LockScreenLogo.scale-200.png", _String2="..") returned 1 [0083.841] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfa) returned 0x7582738 [0083.841] wcscpy (in: _Dest=0x7582738, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" [0083.841] wcscat (in: _Dest=0x7582738, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\" [0083.841] wcscat (in: _Dest=0x7582738, _Source="LockScreenLogo.scale-200.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\LockScreenLogo.scale-200.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\LockScreenLogo.scale-200.png" [0083.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7582738, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1634 [0083.841] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e879ec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69e879ec, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69e879ec, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Preview.scale-200_layoutdir-LTR.png", cAlternateFileName="")) returned 1 [0083.841] wcscmp (_String1="Preview.scale-200_layoutdir-LTR.png", _String2=".") returned 1 [0083.841] wcscmp (_String1="Preview.scale-200_layoutdir-LTR.png", _String2="..") returned 1 [0083.841] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x108) returned 0xe1341d8 [0084.855] wcscpy (in: _Dest=0xe1341d8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" [0084.855] wcscat (in: _Dest=0xe1341d8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\" [0084.855] wcscat (in: _Dest=0xe1341d8, _Source="Preview.scale-200_layoutdir-LTR.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\Preview.scale-200_layoutdir-LTR.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\Preview.scale-200_layoutdir-LTR.png" [0084.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0xe1341d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1630 [0084.855] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e879ec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69eadc4a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69eadc4a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1446, dwReserved0=0x0, dwReserved1=0x0, cFileName="Preview.scale-200_layoutdir-RTL.png", cAlternateFileName="")) returned 1 [0084.855] wcscmp (_String1="Preview.scale-200_layoutdir-RTL.png", _String2=".") returned 1 [0084.855] wcscmp (_String1="Preview.scale-200_layoutdir-RTL.png", _String2="..") returned 1 [0084.856] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x108) returned 0xe134bb0 [0084.856] wcscpy (in: _Dest=0xe134bb0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" [0084.856] wcscat (in: _Dest=0xe134bb0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\" [0084.856] wcscat (in: _Dest=0xe134bb0, _Source="Preview.scale-200_layoutdir-RTL.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\Preview.scale-200_layoutdir-RTL.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\Preview.scale-200_layoutdir-RTL.png" [0084.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0xe134bb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe70 [0084.856] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69eadc4a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69eadc4a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69eadc4a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3839, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.scale-200.png", cAlternateFileName="")) returned 1 [0084.856] wcscmp (_String1="SplashScreen.scale-200.png", _String2=".") returned 1 [0084.856] wcscmp (_String1="SplashScreen.scale-200.png", _String2="..") returned 1 [0084.856] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf6) returned 0x5ba24f8 [0084.856] wcscpy (in: _Dest=0x5ba24f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" [0084.856] wcscat (in: _Dest=0x5ba24f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\" [0084.856] wcscat (in: _Dest=0x5ba24f8, _Source="SplashScreen.scale-200.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen.scale-200.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen.scale-200.png" [0084.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba24f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe40 [0084.857] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69eadc4a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69eadc4a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69eadc4a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x899, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square150x150Logo.scale-200.png", cAlternateFileName="")) returned 1 [0084.857] wcscmp (_String1="Square150x150Logo.scale-200.png", _String2=".") returned 1 [0084.857] wcscmp (_String1="Square150x150Logo.scale-200.png", _String2="..") returned 1 [0084.857] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100) returned 0x7582b58 [0084.857] wcscpy (in: _Dest=0x7582b58, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" [0084.857] wcscat (in: _Dest=0x7582b58, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\" [0084.857] wcscat (in: _Dest=0x7582b58, _Source="Square150x150Logo.scale-200.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\Square150x150Logo.scale-200.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\Square150x150Logo.scale-200.png" [0084.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7582b58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe00 [0084.858] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69eadc4a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69eadc4a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69eadc4a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1ed9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square310x310Logo.scale-200.png", cAlternateFileName="")) returned 1 [0084.858] wcscmp (_String1="Square310x310Logo.scale-200.png", _String2=".") returned 1 [0084.858] wcscmp (_String1="Square310x310Logo.scale-200.png", _String2="..") returned 1 [0084.858] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100) returned 0x7582c60 [0084.858] wcscpy (in: _Dest=0x7582c60, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" [0084.858] wcscat (in: _Dest=0x7582c60, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\" [0084.858] wcscat (in: _Dest=0x7582c60, _Source="Square310x310Logo.scale-200.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\Square310x310Logo.scale-200.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\Square310x310Logo.scale-200.png" [0084.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7582c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd0 [0084.858] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69eadc4a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69eadc4a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69eadc4a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square44x44Logo.scale-200.png", cAlternateFileName="")) returned 1 [0084.858] wcscmp (_String1="Square44x44Logo.scale-200.png", _String2=".") returned 1 [0084.858] wcscmp (_String1="Square44x44Logo.scale-200.png", _String2="..") returned 1 [0084.858] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x7582f78 [0084.858] wcscpy (in: _Dest=0x7582f78, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" [0084.858] wcscat (in: _Dest=0x7582f78, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\" [0084.859] wcscat (in: _Dest=0x7582f78, _Source="Square44x44Logo.scale-200.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\Square44x44Logo.scale-200.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\Square44x44Logo.scale-200.png" [0084.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7582f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdbc [0084.859] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69eadc4a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69eadc4a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69eadc4a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square44x44Logo.targetsize-16_altform-unplated.png", cAlternateFileName="")) returned 1 [0084.859] wcscmp (_String1="Square44x44Logo.targetsize-16_altform-unplated.png", _String2=".") returned 1 [0084.859] wcscmp (_String1="Square44x44Logo.targetsize-16_altform-unplated.png", _String2="..") returned 1 [0084.859] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x126) returned 0x75872b8 [0084.859] wcscpy (in: _Dest=0x75872b8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" [0084.859] wcscat (in: _Dest=0x75872b8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\" [0084.859] wcscat (in: _Dest=0x75872b8, _Source="Square44x44Logo.targetsize-16_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\Square44x44Logo.targetsize-16_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\Square44x44Logo.targetsize-16_altform-unplated.png" [0084.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x75872b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb8 [0084.860] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69ed3ea3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69ed3ea3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69ed3ea3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square44x44Logo.targetsize-24_altform-unplated.png", cAlternateFileName="")) returned 1 [0084.860] wcscmp (_String1="Square44x44Logo.targetsize-24_altform-unplated.png", _String2=".") returned 1 [0084.860] wcscmp (_String1="Square44x44Logo.targetsize-24_altform-unplated.png", _String2="..") returned 1 [0084.860] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x126) returned 0x7586a30 [0084.860] wcscpy (in: _Dest=0x7586a30, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" [0084.860] wcscat (in: _Dest=0x7586a30, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\" [0084.860] wcscat (in: _Dest=0x7586a30, _Source="Square44x44Logo.targetsize-24_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\Square44x44Logo.targetsize-24_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\Square44x44Logo.targetsize-24_altform-unplated.png" [0084.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7586a30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb4 [0084.860] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69ed3ea3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69ed3ea3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69ed3ea3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x847, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square44x44Logo.targetsize-256_altform-unplated.png", cAlternateFileName="")) returned 1 [0084.860] wcscmp (_String1="Square44x44Logo.targetsize-256_altform-unplated.png", _String2=".") returned 1 [0084.861] wcscmp (_String1="Square44x44Logo.targetsize-256_altform-unplated.png", _String2="..") returned 1 [0084.861] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x128) returned 0x7586dd8 [0084.861] wcscpy (in: _Dest=0x7586dd8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" [0084.861] wcscat (in: _Dest=0x7586dd8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\" [0084.861] wcscat (in: _Dest=0x7586dd8, _Source="Square44x44Logo.targetsize-256_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\Square44x44Logo.targetsize-256_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\Square44x44Logo.targetsize-256_altform-unplated.png" [0084.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7586dd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcd4 [0084.861] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69ed3ea3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69ed3ea3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69ed3ea3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square44x44Logo.targetsize-48_altform-unplated.png", cAlternateFileName="")) returned 1 [0084.861] wcscmp (_String1="Square44x44Logo.targetsize-48_altform-unplated.png", _String2=".") returned 1 [0084.861] wcscmp (_String1="Square44x44Logo.targetsize-48_altform-unplated.png", _String2="..") returned 1 [0084.861] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x126) returned 0x7587798 [0084.861] wcscpy (in: _Dest=0x7587798, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" [0084.861] wcscat (in: _Dest=0x7587798, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\" [0084.861] wcscat (in: _Dest=0x7587798, _Source="Square44x44Logo.targetsize-48_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\Square44x44Logo.targetsize-48_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\Square44x44Logo.targetsize-48_altform-unplated.png" [0084.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7587798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcdc [0084.862] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69ed3ea3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69ed3ea3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69ed3ea3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x322, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square71x71Logo.scale-200.png", cAlternateFileName="")) returned 1 [0084.862] wcscmp (_String1="Square71x71Logo.scale-200.png", _String2=".") returned 1 [0084.862] wcscmp (_String1="Square71x71Logo.scale-200.png", _String2="..") returned 1 [0084.862] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x549a448 [0084.862] wcscpy (in: _Dest=0x549a448, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" [0084.862] wcscat (in: _Dest=0x549a448, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\" [0084.862] wcscat (in: _Dest=0x549a448, _Source="Square71x71Logo.scale-200.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\Square71x71Logo.scale-200.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\Square71x71Logo.scale-200.png" [0084.862] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549a448, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xce0 [0084.863] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69efa0fc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69efa0fc, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69efa0fc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.scale-200.png", cAlternateFileName="")) returned 1 [0084.863] wcscmp (_String1="StoreLogo.scale-200.png", _String2=".") returned 1 [0084.863] wcscmp (_String1="StoreLogo.scale-200.png", _String2="..") returned 1 [0084.863] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x7287910 [0084.863] wcscpy (in: _Dest=0x7287910, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" [0084.863] wcscat (in: _Dest=0x7287910, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\" [0084.863] wcscat (in: _Dest=0x7287910, _Source="StoreLogo.scale-200.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\StoreLogo.scale-200.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\StoreLogo.scale-200.png" [0084.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7287910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd6c [0084.863] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69efa0fc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69efa0fc, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69efa0fc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wide310x150Logo.scale-200.png", cAlternateFileName="")) returned 1 [0084.863] wcscmp (_String1="Wide310x150Logo.scale-200.png", _String2=".") returned 1 [0084.863] wcscmp (_String1="Wide310x150Logo.scale-200.png", _String2="..") returned 1 [0084.863] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x549a550 [0084.863] wcscpy (in: _Dest=0x549a550, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" [0084.864] wcscat (in: _Dest=0x549a550, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\" [0084.864] wcscat (in: _Dest=0x549a550, _Source="Wide310x150Logo.scale-200.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\Wide310x150Logo.scale-200.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\Wide310x150Logo.scale-200.png" [0084.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549a550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd68 [0084.864] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69efa0fc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69efa0fc, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69efa0fc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1286, dwReserved0=0x0, dwReserved1=0x0, cFileName="YellowAbstractNote.scale-200.png", cAlternateFileName="")) returned 1 [0084.864] wcscmp (_String1="YellowAbstractNote.scale-200.png", _String2=".") returned 1 [0084.864] wcscmp (_String1="YellowAbstractNote.scale-200.png", _String2="..") returned 1 [0084.864] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x102) returned 0xe135470 [0084.864] wcscpy (in: _Dest=0xe135470, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets" [0084.864] wcscat (in: _Dest=0xe135470, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\" [0084.864] wcscat (in: _Dest=0xe135470, _Source="YellowAbstractNote.scale-200.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\YellowAbstractNote.scale-200.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\YellowAbstractNote.scale-200.png" [0084.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0xe135470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd64 [0084.865] FindNextFileW (in: hFindFile=0x389ed00, lpFindFileData=0x53ceb48 | out: lpFindFileData=0x53ceb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69efa0fc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69efa0fc, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69efa0fc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1286, dwReserved0=0x0, dwReserved1=0x0, cFileName="YellowAbstractNote.scale-200.png", cAlternateFileName="")) returned 0 [0084.865] FindClose (in: hFindFile=0x389ed00 | out: hFindFile=0x389ed00) returned 1 [0084.866] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ceb48) returned 1 [0084.866] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3971640) returned 1 [0084.866] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3975720) returned 1 Thread: id = 1199 os_tid = 0x186c [0083.842] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.Applications.Telemetry.Windows.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.applications.telemetry.windows.winmd")) returned 0x20 [0083.842] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.Applications.Telemetry.Windows.winmd", dwFileAttributes=0x20) returned 0 [0083.843] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.Applications.Telemetry.Windows.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.applications.telemetry.windows.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.843] GetLastError () returned 0x5 [0083.843] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.Applications.Telemetry.Windows.winmd", dwFileAttributes=0x20) returned 0 [0083.843] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8fd0) returned 1 Thread: id = 1200 os_tid = 0x1874 [0083.844] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.Graphics.Canvas.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.graphics.canvas.winmd")) returned 0x20 [0083.845] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.Graphics.Canvas.winmd", dwFileAttributes=0x20) returned 0 [0083.845] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.Graphics.Canvas.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.graphics.canvas.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.845] GetLastError () returned 0x5 [0083.845] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.Graphics.Canvas.winmd", dwFileAttributes=0x20) returned 0 [0083.845] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba23f8) returned 1 Thread: id = 1201 os_tid = 0x187c [0083.846] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.Input.Ink.Analysis.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.input.ink.analysis.winmd")) returned 0x20 [0083.846] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.Input.Ink.Analysis.winmd", dwFileAttributes=0x20) returned 0 [0083.846] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.Input.Ink.Analysis.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.input.ink.analysis.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.846] GetLastError () returned 0x5 [0083.847] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.Input.Ink.Analysis.winmd", dwFileAttributes=0x20) returned 0 [0083.847] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba26f8) returned 1 Thread: id = 1202 os_tid = 0x1880 [0083.848] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.Notes.Upgrade.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.notes.upgrade.winmd")) returned 0x20 [0083.849] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.Notes.Upgrade.winmd", dwFileAttributes=0x20) returned 0 [0083.849] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.Notes.Upgrade.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.notes.upgrade.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.849] GetLastError () returned 0x5 [0083.849] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.Notes.Upgrade.winmd", dwFileAttributes=0x20) returned 0 [0083.849] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7285fe0) returned 1 Thread: id = 1203 os_tid = 0x1884 [0083.850] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xee) returned 0x544ffd8 [0083.850] wcscpy (in: _Dest=0x544ffd8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.StickyNotes.Views" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.StickyNotes.Views") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.StickyNotes.Views" [0083.850] wcscat (in: _Dest=0x544ffd8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.StickyNotes.Views\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.StickyNotes.Views\\" [0083.850] wcscat (in: _Dest=0x544ffd8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.StickyNotes.Views\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.StickyNotes.Views\\*" [0083.850] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53cedb0 [0083.850] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.StickyNotes.Views\\*", lpFindFileData=0x53cedb0 | out: lpFindFileData=0x53cedb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a8a9a20, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaddf973d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a8a9a20, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ed40 [0083.851] wcscmp (_String1=".", _String2=".") returned 0 [0083.851] FindNextFileW (in: hFindFile=0x389ed40, lpFindFileData=0x53cedb0 | out: lpFindFileData=0x53cedb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a8a9a20, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaddf973d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a8a9a20, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.851] wcscmp (_String1="..", _String2=".") returned 1 [0083.851] wcscmp (_String1="..", _String2="..") returned 0 [0083.851] FindNextFileW (in: hFindFile=0x389ed40, lpFindFileData=0x53cedb0 | out: lpFindFileData=0x53cedb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a8a9a20, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaddfa4dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a8a9a20, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Images", cAlternateFileName="")) returned 1 [0083.851] wcscmp (_String1="Images", _String2=".") returned 1 [0083.851] wcscmp (_String1="Images", _String2="..") returned 1 [0083.851] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf8) returned 0x5ba26f8 [0083.851] wcscpy (in: _Dest=0x5ba26f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.StickyNotes.Views" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.StickyNotes.Views") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.StickyNotes.Views" [0083.851] wcscat (in: _Dest=0x5ba26f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.StickyNotes.Views\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.StickyNotes.Views\\" [0083.851] wcscat (in: _Dest=0x5ba26f8, _Source="Images" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.StickyNotes.Views\\Images") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.StickyNotes.Views\\Images" [0083.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba26f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1628 [0083.852] FindNextFileW (in: hFindFile=0x389ed40, lpFindFileData=0x53cedb0 | out: lpFindFileData=0x53cedb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a8a9a20, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaddfa4dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a8a9a20, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Images", cAlternateFileName="")) returned 0 [0083.852] FindClose (in: hFindFile=0x389ed40 | out: hFindFile=0x389ed40) returned 1 [0083.852] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53cedb0) returned 1 [0083.852] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x544ffd8) returned 1 [0083.852] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x72860d8) returned 1 Thread: id = 1204 os_tid = 0x1888 [0083.853] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfa) returned 0x7582b58 [0083.853] wcscpy (in: _Dest=0x7582b58, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0083.853] wcscat (in: _Dest=0x7582b58, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0083.853] wcscat (in: _Dest=0x7582b58, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0083.853] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53cedb0 [0083.853] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x53cedb0 | out: lpFindFileData=0x53cedb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcb2ee04f, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xd8b5b46d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8b5b46d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ed40 [0083.854] wcscmp (_String1=".", _String2=".") returned 0 [0083.854] FindNextFileW (in: hFindFile=0x389ed40, lpFindFileData=0x53cedb0 | out: lpFindFileData=0x53cedb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcb2ee04f, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xd8b5b46d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8b5b46d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.854] wcscmp (_String1="..", _String2=".") returned 1 [0083.854] wcscmp (_String1="..", _String2="..") returned 0 [0083.854] FindNextFileW (in: hFindFile=0x389ed40, lpFindFileData=0x53cedb0 | out: lpFindFileData=0x53cedb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda83c36b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xda83c36b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xda83c36b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x37f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.44828b84.pri", cAlternateFileName="RESOUR~1.PRI")) returned 1 [0083.854] wcscmp (_String1="resources.44828b84.pri", _String2=".") returned 1 [0083.854] wcscmp (_String1="resources.44828b84.pri", _String2="..") returned 1 [0083.854] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x124) returned 0x75867c0 [0083.854] wcscpy (in: _Dest=0x75867c0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0083.854] wcscat (in: _Dest=0x75867c0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0083.854] wcscat (in: _Dest=0x75867c0, _Source="resources.44828b84.pri" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\resources.44828b84.pri") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\resources.44828b84.pri" [0083.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x75867c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13e4 [0083.855] FindNextFileW (in: hFindFile=0x389ed40, lpFindFileData=0x53cedb0 | out: lpFindFileData=0x53cedb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda83c36b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xda83c36b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xda83c36b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x37f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000-MergedResources-0.pri", cAlternateFileName="")) returned 1 [0083.855] wcscmp (_String1="S-1-5-21-1051304884-625712362-2192934891-1000-MergedResources-0.pri", _String2=".") returned 1 [0083.855] wcscmp (_String1="S-1-5-21-1051304884-625712362-2192934891-1000-MergedResources-0.pri", _String2="..") returned 1 [0083.855] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x17e) returned 0x546eda0 [0084.853] wcscpy (in: _Dest=0x546eda0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0084.853] wcscat (in: _Dest=0x546eda0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0084.853] wcscat (in: _Dest=0x546eda0, _Source="S-1-5-21-1051304884-625712362-2192934891-1000-MergedResources-0.pri" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\S-1-5-21-1051304884-625712362-2192934891-1000-MergedResources-0.pri") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\S-1-5-21-1051304884-625712362-2192934891-1000-MergedResources-0.pri" [0084.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x546eda0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeb8 [0084.853] FindNextFileW (in: hFindFile=0x389ed40, lpFindFileData=0x53cedb0 | out: lpFindFileData=0x53cedb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda83c36b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xda83c36b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xda83c36b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x37f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000-MergedResources-0.pri", cAlternateFileName="")) returned 0 [0084.853] FindClose (in: hFindFile=0x389ed40 | out: hFindFile=0x389ed40) returned 1 [0084.853] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53cedb0) returned 1 [0084.853] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7582b58) returned 1 [0084.853] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba24f8) returned 1 Thread: id = 1205 os_tid = 0x188c [0083.855] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xca) returned 0x7580270 [0083.855] wcscpy (in: _Dest=0x7580270, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Resources" [0083.856] wcscat (in: _Dest=0x7580270, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Resources\\" [0083.856] wcscat (in: _Dest=0x7580270, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Resources\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Resources\\*" [0083.856] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53cf4e8 [0083.856] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Resources\\*", lpFindFileData=0x53cf4e8 | out: lpFindFileData=0x53cf4e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a8cfc83, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaddfb0cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a8cfc83, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ee00 [0083.856] wcscmp (_String1=".", _String2=".") returned 0 [0083.856] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53cf4e8 | out: lpFindFileData=0x53cf4e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a8cfc83, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaddfb0cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a8cfc83, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.856] wcscmp (_String1="..", _String2=".") returned 1 [0083.856] wcscmp (_String1="..", _String2="..") returned 0 [0083.856] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53cf4e8 | out: lpFindFileData=0x53cf4e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a8cfc83, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x6a8cfc83, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x6a8cfc83, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4bac, dwReserved0=0x0, dwReserved1=0x0, cFileName="DemoModeInk.dat", cAlternateFileName="")) returned 1 [0083.856] wcscmp (_String1="DemoModeInk.dat", _String2=".") returned 1 [0083.856] wcscmp (_String1="DemoModeInk.dat", _String2="..") returned 1 [0083.856] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe6) returned 0x54b9198 [0083.856] wcscpy (in: _Dest=0x54b9198, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Resources" [0083.856] wcscat (in: _Dest=0x54b9198, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Resources\\" [0083.856] wcscat (in: _Dest=0x54b9198, _Source="DemoModeInk.dat" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Resources\\DemoModeInk.dat") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Resources\\DemoModeInk.dat" [0083.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54b9198, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13e8 [0083.857] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53cf4e8 | out: lpFindFileData=0x53cf4e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a8cfc83, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x6a8cfc83, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x6a8cfc83, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4bac, dwReserved0=0x0, dwReserved1=0x0, cFileName="DemoModeInk.dat", cAlternateFileName="")) returned 0 [0083.857] FindClose (in: hFindFile=0x389ee00 | out: hFindFile=0x389ee00) returned 1 [0083.857] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53cf4e8) returned 1 [0083.857] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7580270) returned 1 [0083.857] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55fc908) returned 1 Thread: id = 1206 os_tid = 0x2004 [0083.858] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\resources.pri")) returned 0x20 [0083.859] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0083.859] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.859] GetLastError () returned 0x5 [0083.859] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0083.859] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757fad8) returned 1 Thread: id = 1207 os_tid = 0x2008 [0083.861] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x7580270 [0083.861] wcscpy (in: _Dest=0x7580270, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources" [0083.861] wcscat (in: _Dest=0x7580270, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\" [0083.861] wcscat (in: _Dest=0x7580270, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\*" [0083.861] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53cf4e8 [0083.861] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x53cf4e8 | out: lpFindFileData=0x53cf4e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69e61793, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd6e3ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69e61793, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ee00 [0083.861] wcscmp (_String1=".", _String2=".") returned 0 [0083.861] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53cf4e8 | out: lpFindFileData=0x53cf4e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69e61793, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd6e3ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69e61793, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.862] wcscmp (_String1="..", _String2=".") returned 1 [0083.862] wcscmp (_String1="..", _String2="..") returned 0 [0083.862] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53cf4e8 | out: lpFindFileData=0x53cf4e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e61793, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69e61793, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69e61793, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xaf1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.rsrc", cAlternateFileName="")) returned 1 [0083.862] wcscmp (_String1="0.rsrc", _String2=".") returned 1 [0083.862] wcscmp (_String1="0.rsrc", _String2="..") returned 1 [0083.862] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd6) returned 0x3934488 [0083.862] wcscpy (in: _Dest=0x3934488, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources" [0083.862] wcscat (in: _Dest=0x3934488, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\" [0083.862] wcscat (in: _Dest=0x3934488, _Source="0.rsrc" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc" [0083.862] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3934488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1618 [0083.863] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53cf4e8 | out: lpFindFileData=0x53cf4e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e61793, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69e61793, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69e61793, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xaf1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.rsrc", cAlternateFileName="")) returned 1 [0083.863] wcscmp (_String1="1.rsrc", _String2=".") returned 1 [0083.863] wcscmp (_String1="1.rsrc", _String2="..") returned 1 [0083.863] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd6) returned 0x39348e8 [0083.863] wcscpy (in: _Dest=0x39348e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources" [0083.863] wcscat (in: _Dest=0x39348e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\" [0083.863] wcscat (in: _Dest=0x39348e8, _Source="1.rsrc" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\1.rsrc") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\1.rsrc" [0083.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x39348e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1614 [0083.863] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53cf4e8 | out: lpFindFileData=0x53cf4e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e61793, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69e61793, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69e61793, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x507, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.rsrc", cAlternateFileName="")) returned 1 [0083.863] wcscmp (_String1="2.rsrc", _String2=".") returned 1 [0083.863] wcscmp (_String1="2.rsrc", _String2="..") returned 1 [0083.863] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd6) returned 0x39349c8 [0083.863] wcscpy (in: _Dest=0x39349c8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources" [0083.863] wcscat (in: _Dest=0x39349c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\" [0083.863] wcscat (in: _Dest=0x39349c8, _Source="2.rsrc" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\2.rsrc") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\2.rsrc" [0083.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x39349c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x160c [0083.864] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53cf4e8 | out: lpFindFileData=0x53cf4e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e61793, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69e61793, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69e61793, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x83f, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.rsrc", cAlternateFileName="")) returned 1 [0083.864] wcscmp (_String1="3.rsrc", _String2=".") returned 1 [0083.864] wcscmp (_String1="3.rsrc", _String2="..") returned 1 [0083.864] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd6) returned 0x3934aa8 [0083.864] wcscpy (in: _Dest=0x3934aa8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources" [0083.864] wcscat (in: _Dest=0x3934aa8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\" [0083.864] wcscat (in: _Dest=0x3934aa8, _Source="3.rsrc" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\3.rsrc") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\3.rsrc" [0083.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3934aa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13ec [0083.865] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53cf4e8 | out: lpFindFileData=0x53cf4e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e61793, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69e61793, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69e61793, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.txt", cAlternateFileName="")) returned 1 [0083.865] wcscmp (_String1="index.txt", _String2=".") returned 1 [0083.865] wcscmp (_String1="index.txt", _String2="..") returned 1 [0083.865] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x54f0210 [0083.865] wcscpy (in: _Dest=0x54f0210, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources" [0083.865] wcscat (in: _Dest=0x54f0210, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\" [0083.865] wcscat (in: _Dest=0x54f0210, _Source="index.txt" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt" [0083.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f0210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1604 [0083.865] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53cf4e8 | out: lpFindFileData=0x53cf4e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e61793, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69e61793, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69e61793, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.txt", cAlternateFileName="")) returned 0 [0083.866] FindClose (in: hFindFile=0x389ee00 | out: hFindFile=0x389ee00) returned 1 [0083.866] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53cf4e8) returned 1 [0083.866] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7580270) returned 1 [0083.866] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55fd058) returned 1 Thread: id = 1208 os_tid = 0x200c [0083.867] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat")) returned 0x20 [0087.918] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0087.918] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.918] GetLastError () returned 0x5 [0087.918] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0087.918] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396f118) returned 1 Thread: id = 1209 os_tid = 0x2010 [0083.868] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\8U_O3t04F3 Mtr.pps" (normalized: "c:\\users\\fd1hvy\\documents\\0qz1ven\\8u_o3t04f3 mtr.pps")) returned 0x20 [0083.868] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\8U_O3t04F3 Mtr.pps", dwFileAttributes=0x20) returned 1 [0083.869] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\8U_O3t04F3 Mtr.pps" (normalized: "c:\\users\\fd1hvy\\documents\\0qz1ven\\8u_o3t04f3 mtr.pps"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1620 [0083.869] GetFileSizeEx (in: hFile=0x1620, lpFileSize=0x2b1ffeec | out: lpFileSize=0x2b1ffeec*=51473) returned 1 [0083.869] SetFilePointerEx (in: hFile=0x1620, liDistanceToMove=0xc90d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.869] ReadFile (in: hFile=0x1620, lpBuffer=0x2b1ffe70, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b1ffe6c, lpOverlapped=0x0 | out: lpBuffer=0x2b1ffe70*, lpNumberOfBytesRead=0x2b1ffe6c*=0x4, lpOverlapped=0x0) returned 1 [0083.869] SetFilePointerEx (in: hFile=0x1620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.869] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe11a7e8 [0084.834] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe11a860 [0084.834] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe11aa40 [0084.834] NtQuerySystemTime (in: CurrentTime=0x2b1ffe4c | out: CurrentTime=0x2b1ffe4c*=132260136419862120) returned 0x0 [0084.834] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0x3291dfcb [0084.835] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0xe15e42c2 [0084.835] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0xd63b9ac0 [0084.835] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0x73582933 [0084.835] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0xcfd7482d [0084.835] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0x1916c8f8 [0084.835] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0xf6fc02be [0084.835] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0xaef2ea69 [0084.835] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0x7a2834d3 [0084.835] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0x632ebe91 [0084.835] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0x8ca08153 [0084.835] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0x9f721871 [0084.835] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0xefabcb01 [0084.835] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0x9753ea91 [0084.835] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0x96d91876 [0084.835] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0x559ffc6a [0084.835] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0x7ee4be4a [0084.835] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0x32c6b720 [0084.835] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0x77ba61b [0084.835] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0xada32fc1 [0084.835] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0xac7ef204 [0084.835] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0xf098d40a [0084.835] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0x733c9384 [0084.835] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0xdc97cbc9 [0084.835] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0x31fdf229 [0084.835] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0xd902713c [0084.835] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0xde5d0384 [0084.835] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0x2ca06679 [0084.835] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0xf98da95d [0084.835] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0x4da8126f [0084.835] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0x63fd7dd9 [0084.835] RtlRandom (in: Seed=0x2b1ffe58 | out: Seed=0x2b1ffe58) returned 0x467bc6fc [0084.845] SetFilePointerEx (in: hFile=0x1620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.845] ReadFile (in: hFile=0x1620, lpBuffer=0xe11b1a0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2b1ffe2c, lpOverlapped=0x0 | out: lpBuffer=0xe11b1a0*, lpNumberOfBytesRead=0x2b1ffe2c*=0xc800, lpOverlapped=0x0) returned 1 [0084.845] SetFilePointerEx (in: hFile=0x1620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.845] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8408 [0084.845] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x75752f8 [0084.845] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe11ab80 [0084.845] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe11ab80) returned 1 [0084.846] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe1279a8 [0084.852] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe11a9a0 [0084.852] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe11a888 [0084.852] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe11a888) returned 1 [0084.852] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75752f8) returned 1 [0084.852] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8408) returned 1 [0084.852] WriteFile (in: hFile=0x1620, lpBuffer=0xe1279a8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2b1ffe2c, lpOverlapped=0x0 | out: lpBuffer=0xe1279a8*, lpNumberOfBytesWritten=0x2b1ffe2c*=0xc800, lpOverlapped=0x0) returned 1 [0088.940] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe1279a8) returned 1 [0089.151] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe11b1a0) returned 1 [0089.151] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x31) returned 0x5445480 [0089.151] SetFilePointerEx (in: hFile=0x1620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.151] WriteFile (in: hFile=0x1620, lpBuffer=0x7585420*, nNumberOfBytesToWrite=0x115, lpNumberOfBytesWritten=0x2b1ffeac, lpOverlapped=0x0 | out: lpBuffer=0x7585420*, lpNumberOfBytesWritten=0x2b1ffeac*=0x115, lpOverlapped=0x0) returned 1 [0092.233] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7585420) returned 1 [0092.233] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445980) returned 1 [0092.233] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282ff0) returned 1 [0092.233] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445480) returned 1 [0092.233] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe11a9a0) returned 1 [0092.233] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe11a860) returned 1 [0092.233] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe11a7c0) returned 1 [0092.233] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe11a838) Thread: id = 1210 os_tid = 0x2014 [0083.869] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0xe018a48 [0084.830] wcscpy (in: _Dest=0xe018a48, _Source="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\BP97_PDOR-hsoX09Mvv" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\BP97_PDOR-hsoX09Mvv") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\BP97_PDOR-hsoX09Mvv" [0084.830] wcscat (in: _Dest=0xe018a48, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\BP97_PDOR-hsoX09Mvv\\") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\BP97_PDOR-hsoX09Mvv\\" [0084.830] wcscat (in: _Dest=0xe018a48, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\BP97_PDOR-hsoX09Mvv\\*") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\BP97_PDOR-hsoX09Mvv\\*" [0084.830] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a24d0 [0084.830] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\BP97_PDOR-hsoX09Mvv\\*", lpFindFileData=0x53a24d0 | out: lpFindFileData=0x53a24d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x597cb370, ftCreationTime.dwHighDateTime=0x1d5cb04, ftLastAccessTime.dwLowDateTime=0xf62673c0, ftLastAccessTime.dwHighDateTime=0x1d5d241, ftLastWriteTime.dwLowDateTime=0xf62673c0, ftLastWriteTime.dwHighDateTime=0x1d5d241, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e940 [0084.831] wcscmp (_String1=".", _String2=".") returned 0 [0084.831] FindNextFileW (in: hFindFile=0x389e940, lpFindFileData=0x53a24d0 | out: lpFindFileData=0x53a24d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x597cb370, ftCreationTime.dwHighDateTime=0x1d5cb04, ftLastAccessTime.dwLowDateTime=0xf62673c0, ftLastAccessTime.dwHighDateTime=0x1d5d241, ftLastWriteTime.dwLowDateTime=0xf62673c0, ftLastWriteTime.dwHighDateTime=0x1d5d241, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.831] wcscmp (_String1="..", _String2=".") returned 1 [0084.831] wcscmp (_String1="..", _String2="..") returned 0 [0084.831] FindNextFileW (in: hFindFile=0x389e940, lpFindFileData=0x53a24d0 | out: lpFindFileData=0x53a24d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x984b1d30, ftCreationTime.dwHighDateTime=0x1d5d5a4, ftLastAccessTime.dwLowDateTime=0x9bcfd9b0, ftLastAccessTime.dwHighDateTime=0x1d5ceaa, ftLastWriteTime.dwLowDateTime=0x9bcfd9b0, ftLastWriteTime.dwHighDateTime=0x1d5ceaa, nFileSizeHigh=0x0, nFileSizeLow=0x1627c, dwReserved0=0x0, dwReserved1=0x0, cFileName="8Eub_q0yrLG.docx", cAlternateFileName="8EUB_Q~1.DOC")) returned 1 [0084.831] wcscmp (_String1="8Eub_q0yrLG.docx", _String2=".") returned 1 [0084.831] wcscmp (_String1="8Eub_q0yrLG.docx", _String2="..") returned 1 [0084.831] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8e) returned 0x549fdb8 [0084.831] wcscpy (in: _Dest=0x549fdb8, _Source="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\BP97_PDOR-hsoX09Mvv" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\BP97_PDOR-hsoX09Mvv") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\BP97_PDOR-hsoX09Mvv" [0084.831] wcscat (in: _Dest=0x549fdb8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\BP97_PDOR-hsoX09Mvv\\") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\BP97_PDOR-hsoX09Mvv\\" [0084.831] wcscat (in: _Dest=0x549fdb8, _Source="8Eub_q0yrLG.docx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\BP97_PDOR-hsoX09Mvv\\8Eub_q0yrLG.docx") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\BP97_PDOR-hsoX09Mvv\\8Eub_q0yrLG.docx" [0084.831] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549fdb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xea4 [0084.832] FindNextFileW (in: hFindFile=0x389e940, lpFindFileData=0x53a24d0 | out: lpFindFileData=0x53a24d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26656880, ftCreationTime.dwHighDateTime=0x1d5ca67, ftLastAccessTime.dwLowDateTime=0x20e8d340, ftLastAccessTime.dwHighDateTime=0x1d5cc35, ftLastWriteTime.dwLowDateTime=0x20e8d340, ftLastWriteTime.dwHighDateTime=0x1d5cc35, nFileSizeHigh=0x0, nFileSizeLow=0x170b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wkugqzd.rtf", cAlternateFileName="")) returned 1 [0084.832] wcscmp (_String1="Wkugqzd.rtf", _String2=".") returned 1 [0084.832] wcscmp (_String1="Wkugqzd.rtf", _String2="..") returned 1 [0084.832] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x84) returned 0x549d0e8 [0084.832] wcscpy (in: _Dest=0x549d0e8, _Source="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\BP97_PDOR-hsoX09Mvv" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\BP97_PDOR-hsoX09Mvv") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\BP97_PDOR-hsoX09Mvv" [0084.832] wcscat (in: _Dest=0x549d0e8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\BP97_PDOR-hsoX09Mvv\\") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\BP97_PDOR-hsoX09Mvv\\" [0084.832] wcscat (in: _Dest=0x549d0e8, _Source="Wkugqzd.rtf" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\BP97_PDOR-hsoX09Mvv\\Wkugqzd.rtf") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\BP97_PDOR-hsoX09Mvv\\Wkugqzd.rtf" [0084.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549d0e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcb8 [0084.833] FindNextFileW (in: hFindFile=0x389e940, lpFindFileData=0x53a24d0 | out: lpFindFileData=0x53a24d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefc4f1d0, ftCreationTime.dwHighDateTime=0x1d5cee2, ftLastAccessTime.dwLowDateTime=0x91453360, ftLastAccessTime.dwHighDateTime=0x1d5d291, ftLastWriteTime.dwLowDateTime=0x91453360, ftLastWriteTime.dwHighDateTime=0x1d5d291, nFileSizeHigh=0x0, nFileSizeLow=0xcf6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZeeJEsHRE-uVB.pps", cAlternateFileName="ZEEJES~1.PPS")) returned 1 [0084.833] wcscmp (_String1="ZeeJEsHRE-uVB.pps", _String2=".") returned 1 [0084.833] wcscmp (_String1="ZeeJEsHRE-uVB.pps", _String2="..") returned 1 [0084.833] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x90) returned 0x549fac0 [0084.833] wcscpy (in: _Dest=0x549fac0, _Source="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\BP97_PDOR-hsoX09Mvv" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\BP97_PDOR-hsoX09Mvv") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\BP97_PDOR-hsoX09Mvv" [0084.833] wcscat (in: _Dest=0x549fac0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\BP97_PDOR-hsoX09Mvv\\") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\BP97_PDOR-hsoX09Mvv\\" [0084.833] wcscat (in: _Dest=0x549fac0, _Source="ZeeJEsHRE-uVB.pps" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\BP97_PDOR-hsoX09Mvv\\ZeeJEsHRE-uVB.pps") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\BP97_PDOR-hsoX09Mvv\\ZeeJEsHRE-uVB.pps" [0084.833] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549fac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe7c [0084.833] FindNextFileW (in: hFindFile=0x389e940, lpFindFileData=0x53a24d0 | out: lpFindFileData=0x53a24d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefc4f1d0, ftCreationTime.dwHighDateTime=0x1d5cee2, ftLastAccessTime.dwLowDateTime=0x91453360, ftLastAccessTime.dwHighDateTime=0x1d5d291, ftLastWriteTime.dwLowDateTime=0x91453360, ftLastWriteTime.dwHighDateTime=0x1d5d291, nFileSizeHigh=0x0, nFileSizeLow=0xcf6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZeeJEsHRE-uVB.pps", cAlternateFileName="ZEEJES~1.PPS")) returned 0 [0084.833] FindClose (in: hFindFile=0x389e940 | out: hFindFile=0x389e940) returned 1 [0084.834] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a24d0) returned 1 [0084.834] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe018a48) returned 1 [0084.834] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5467d28) returned 1 Thread: id = 1211 os_tid = 0x2018 [0083.870] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x5468d30 [0083.870] wcscpy (in: _Dest=0x5468d30, _Source="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\NLhaD5NP4PeFv" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\NLhaD5NP4PeFv") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\NLhaD5NP4PeFv" [0083.870] wcscat (in: _Dest=0x5468d30, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\NLhaD5NP4PeFv\\") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\NLhaD5NP4PeFv\\" [0083.870] wcscat (in: _Dest=0x5468d30, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\NLhaD5NP4PeFv\\*") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\NLhaD5NP4PeFv\\*" [0083.870] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53cf4e8 [0083.870] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\NLhaD5NP4PeFv\\*", lpFindFileData=0x53cf4e8 | out: lpFindFileData=0x53cf4e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae6dc380, ftCreationTime.dwHighDateTime=0x1d5cb57, ftLastAccessTime.dwLowDateTime=0x7ae0cb40, ftLastAccessTime.dwHighDateTime=0x1d5c7b8, ftLastWriteTime.dwLowDateTime=0x7ae0cb40, ftLastWriteTime.dwHighDateTime=0x1d5c7b8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ee00 [0084.826] wcscmp (_String1=".", _String2=".") returned 0 [0084.826] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53cf4e8 | out: lpFindFileData=0x53cf4e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae6dc380, ftCreationTime.dwHighDateTime=0x1d5cb57, ftLastAccessTime.dwLowDateTime=0x7ae0cb40, ftLastAccessTime.dwHighDateTime=0x1d5c7b8, ftLastWriteTime.dwLowDateTime=0x7ae0cb40, ftLastWriteTime.dwHighDateTime=0x1d5c7b8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.826] wcscmp (_String1="..", _String2=".") returned 1 [0084.826] wcscmp (_String1="..", _String2="..") returned 0 [0084.826] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53cf4e8 | out: lpFindFileData=0x53cf4e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x112ef480, ftCreationTime.dwHighDateTime=0x1d5d7b5, ftLastAccessTime.dwLowDateTime=0x87cfd6f0, ftLastAccessTime.dwHighDateTime=0x1d5d723, ftLastWriteTime.dwLowDateTime=0x87cfd6f0, ftLastWriteTime.dwHighDateTime=0x1d5d723, nFileSizeHigh=0x0, nFileSizeLow=0x175f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="cMKJ.odt", cAlternateFileName="")) returned 1 [0084.827] wcscmp (_String1="cMKJ.odt", _String2=".") returned 1 [0084.827] wcscmp (_String1="cMKJ.odt", _String2="..") returned 1 [0084.827] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x72) returned 0x38d2220 [0084.827] wcscpy (in: _Dest=0x38d2220, _Source="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\NLhaD5NP4PeFv" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\NLhaD5NP4PeFv") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\NLhaD5NP4PeFv" [0084.827] wcscat (in: _Dest=0x38d2220, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\NLhaD5NP4PeFv\\") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\NLhaD5NP4PeFv\\" [0084.827] wcscat (in: _Dest=0x38d2220, _Source="cMKJ.odt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\NLhaD5NP4PeFv\\cMKJ.odt") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\NLhaD5NP4PeFv\\cMKJ.odt" [0084.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d2220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeb0 [0084.828] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53cf4e8 | out: lpFindFileData=0x53cf4e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xba5034b0, ftCreationTime.dwHighDateTime=0x1d5cdde, ftLastAccessTime.dwLowDateTime=0xa6221c00, ftLastAccessTime.dwHighDateTime=0x1d5d4b5, ftLastWriteTime.dwLowDateTime=0xa6221c00, ftLastWriteTime.dwHighDateTime=0x1d5d4b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KYbRrWHJUOWCG", cAlternateFileName="KYBRRW~1")) returned 1 [0084.828] wcscmp (_String1="KYbRrWHJUOWCG", _String2=".") returned 1 [0084.828] wcscmp (_String1="KYbRrWHJUOWCG", _String2="..") returned 1 [0084.828] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7c) returned 0x3976cd0 [0084.828] wcscpy (in: _Dest=0x3976cd0, _Source="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\NLhaD5NP4PeFv" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\NLhaD5NP4PeFv") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\NLhaD5NP4PeFv" [0084.828] wcscat (in: _Dest=0x3976cd0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\NLhaD5NP4PeFv\\") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\NLhaD5NP4PeFv\\" [0084.828] wcscat (in: _Dest=0x3976cd0, _Source="KYbRrWHJUOWCG" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\NLhaD5NP4PeFv\\KYbRrWHJUOWCG") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\NLhaD5NP4PeFv\\KYbRrWHJUOWCG" [0084.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3976cd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeac [0084.828] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53cf4e8 | out: lpFindFileData=0x53cf4e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59ad3b50, ftCreationTime.dwHighDateTime=0x1d5caee, ftLastAccessTime.dwLowDateTime=0x2415e4b0, ftLastAccessTime.dwHighDateTime=0x1d5cadf, ftLastWriteTime.dwLowDateTime=0x2415e4b0, ftLastWriteTime.dwHighDateTime=0x1d5cadf, nFileSizeHigh=0x0, nFileSizeLow=0xfb3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMUEn2Z.ppt", cAlternateFileName="")) returned 1 [0084.828] wcscmp (_String1="RMUEn2Z.ppt", _String2=".") returned 1 [0084.829] wcscmp (_String1="RMUEn2Z.ppt", _String2="..") returned 1 [0084.829] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x78) returned 0x38d1aa0 [0084.829] wcscpy (in: _Dest=0x38d1aa0, _Source="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\NLhaD5NP4PeFv" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\NLhaD5NP4PeFv") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\NLhaD5NP4PeFv" [0084.829] wcscat (in: _Dest=0x38d1aa0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\NLhaD5NP4PeFv\\") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\NLhaD5NP4PeFv\\" [0084.829] wcscat (in: _Dest=0x38d1aa0, _Source="RMUEn2Z.ppt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\NLhaD5NP4PeFv\\RMUEn2Z.ppt") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\NLhaD5NP4PeFv\\RMUEn2Z.ppt" [0084.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d1aa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xea8 [0084.829] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53cf4e8 | out: lpFindFileData=0x53cf4e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59ad3b50, ftCreationTime.dwHighDateTime=0x1d5caee, ftLastAccessTime.dwLowDateTime=0x2415e4b0, ftLastAccessTime.dwHighDateTime=0x1d5cadf, ftLastWriteTime.dwLowDateTime=0x2415e4b0, ftLastWriteTime.dwHighDateTime=0x1d5cadf, nFileSizeHigh=0x0, nFileSizeLow=0xfb3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMUEn2Z.ppt", cAlternateFileName="")) returned 0 [0084.829] FindClose (in: hFindFile=0x389ee00 | out: hFindFile=0x389ee00) returned 1 [0084.829] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53cf4e8) returned 1 [0084.829] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5468d30) returned 1 [0084.829] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x6e958f8) returned 1 Thread: id = 1212 os_tid = 0x201c [0083.870] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\PXlpnL8zaDXPEQqI.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\0qz1ven\\pxlpnl8zadxpeqqi.pptx")) returned 0x20 [0083.870] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\PXlpnL8zaDXPEQqI.pptx", dwFileAttributes=0x20) returned 1 [0083.871] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\PXlpnL8zaDXPEQqI.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\0qz1ven\\pxlpnl8zadxpeqqi.pptx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1600 [0083.871] GetFileSizeEx (in: hFile=0x1600, lpFileSize=0x2b37f7b4 | out: lpFileSize=0x2b37f7b4*=48604) returned 1 [0083.871] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0xbdd8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.871] ReadFile (in: hFile=0x1600, lpBuffer=0x2b37f738, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b37f734, lpOverlapped=0x0 | out: lpBuffer=0x2b37f738*, lpNumberOfBytesRead=0x2b37f734*=0x4, lpOverlapped=0x0) returned 1 [0083.871] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.871] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe1008e8 [0084.814] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe100b18 [0084.814] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe100b40 [0084.814] NtQuerySystemTime (in: CurrentTime=0x2b37f714 | out: CurrentTime=0x2b37f714*=132260136419705379) returned 0x0 [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0xcda5e634 [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0xb5c0bb9d [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0x608f156b [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0xda746b8 [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0xca435bb2 [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0x2fa2dced [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0xc81a2756 [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0xab001361 [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0xef963275 [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0xa569fb29 [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0xc6b6ea05 [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0xa145db91 [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0xe7d5dcf [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0x18b60cc4 [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0xd29dcbf6 [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0x9a045eb7 [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0xd5c9e724 [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0xcfa45f66 [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0x97f6e91 [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0x976fe002 [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0x329f1815 [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0xf860d375 [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0xe466b601 [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0x988e006 [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0x1ee95148 [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0xfc26e1e7 [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0xe86002cd [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0x9ed812f9 [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0x6daa1cbe [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0xfc5dc5ef [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0x68555e8b [0084.814] RtlRandom (in: Seed=0x2b37f720 | out: Seed=0x2b37f720) returned 0x8d027dbd [0084.824] ReadFile (in: hFile=0x1600, lpBuffer=0xe101188, nNumberOfBytesToRead=0xbddc, lpNumberOfBytesRead=0x2b37f710, lpOverlapped=0x0 | out: lpBuffer=0xe101188*, lpNumberOfBytesRead=0x2b37f710*=0xbddc, lpOverlapped=0x0) returned 1 [0084.826] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.826] WriteFile (in: hFile=0x1600, lpBuffer=0xe10d990*, nNumberOfBytesToWrite=0xbddc, lpNumberOfBytesWritten=0x2b37f70c, lpOverlapped=0x0 | out: lpBuffer=0xe10d990*, lpNumberOfBytesWritten=0x2b37f70c*=0xbddc, lpOverlapped=0x0) returned 1 [0088.930] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7280db0 [0088.930] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281058 [0088.930] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7281058) returned 1 [0088.930] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe10d990) returned 1 [0089.152] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe101188) returned 1 [0089.152] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7575280) returned 1 [0089.152] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba83c0) returned 1 [0089.152] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x37) returned 0x54454c0 [0089.152] SetFilePointerEx (in: hFile=0x1600, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.152] WriteFile (in: hFile=0x1600, lpBuffer=0x7585548*, nNumberOfBytesToWrite=0x11b, lpNumberOfBytesWritten=0x2b37f774, lpOverlapped=0x0 | out: lpBuffer=0x7585548*, lpNumberOfBytesWritten=0x2b37f774*=0x11b, lpOverlapped=0x0) returned 1 [0092.235] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7585548) returned 1 [0092.235] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54459c0) returned 1 [0092.235] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7283018) returned 1 [0092.235] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54454c0) returned 1 [0092.235] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7280db0) returned 1 [0092.235] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe100b18) returned 1 [0092.235] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe100708) returned 1 [0092.235] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe100820) Thread: id = 1213 os_tid = 0x2020 [0083.871] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\QBl0VZJKsl_M.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\0qz1ven\\qbl0vzjksl_m.pdf")) returned 0x20 [0084.795] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\QBl0VZJKsl_M.pdf", dwFileAttributes=0x20) returned 1 [0084.795] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\QBl0VZJKsl_M.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\0qz1ven\\qbl0vzjksl_m.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xcb0 [0084.795] GetFileSizeEx (in: hFile=0xcb0, lpFileSize=0x2b3ffbe4 | out: lpFileSize=0x2b3ffbe4*=55548) returned 1 [0084.795] SetFilePointerEx (in: hFile=0xcb0, liDistanceToMove=0xd8f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.795] ReadFile (in: hFile=0xcb0, lpBuffer=0x2b3ffb68, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b3ffb64, lpOverlapped=0x0 | out: lpBuffer=0x2b3ffb68*, lpNumberOfBytesRead=0x2b3ffb64*=0x4, lpOverlapped=0x0) returned 1 [0084.795] SetFilePointerEx (in: hFile=0xcb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.795] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0b4590 [0084.795] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0b4248 [0084.795] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0b4180 [0084.795] NtQuerySystemTime (in: CurrentTime=0x2b3ffb44 | out: CurrentTime=0x2b3ffb44*=132260136419549191) returned 0x0 [0084.795] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0x13bd5f4e [0084.795] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0xb2d332b3 [0084.795] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0x2a61551a [0084.795] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0xddff4219 [0084.795] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0xba0e1b8d [0084.795] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0x250a3ba2 [0084.795] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0x7c5fb255 [0084.795] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0x3cb522ef [0084.795] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0x438128b7 [0084.796] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0xa7fadd0a [0084.796] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0x275c0d9e [0084.796] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0xd157279e [0084.796] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0xf463cc07 [0084.796] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0xd7ac163b [0084.796] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0x319b277f [0084.796] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0x44cf396d [0084.796] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0x5ac5ed9a [0084.796] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0xf5b4d753 [0084.796] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0x26a53f3a [0084.796] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0x88621b1a [0084.796] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0xaacd47d5 [0084.796] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0xf2e05299 [0084.796] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0xed3eb914 [0084.796] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0x5deecab4 [0084.796] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0xedfef92d [0084.796] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0xa3ea5097 [0084.796] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0x94dcee52 [0084.796] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0x98ad2db [0084.796] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0xe218dbce [0084.796] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0x1a597e20 [0084.796] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0x8ae0fec7 [0084.796] RtlRandom (in: Seed=0x2b3ffb50 | out: Seed=0x2b3ffb50) returned 0xd3171ac2 [0084.806] SetFilePointerEx (in: hFile=0xcb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.806] ReadFile (in: hFile=0xcb0, lpBuffer=0xe0e7170, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2b3ffb24, lpOverlapped=0x0 | out: lpBuffer=0xe0e7170*, lpNumberOfBytesRead=0x2b3ffb24*=0xc800, lpOverlapped=0x0) returned 1 [0084.806] SetFilePointerEx (in: hFile=0xcb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.806] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba83c0 [0084.806] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x7575280 [0084.806] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0b4630 [0084.806] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0b4630) returned 1 [0084.807] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe0f3978 [0084.813] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0b4450 [0084.813] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0b4360 [0084.813] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0b4360) returned 1 [0084.813] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7575280) returned 1 [0084.813] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba83c0) returned 1 [0084.813] WriteFile (in: hFile=0xcb0, lpBuffer=0xe0f3978*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2b3ffb24, lpOverlapped=0x0 | out: lpBuffer=0xe0f3978*, lpNumberOfBytesWritten=0x2b3ffb24*=0xc800, lpOverlapped=0x0) returned 1 [0088.927] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0f3978) returned 1 [0089.153] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0e7170) returned 1 [0089.153] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2d) returned 0x54b73d0 [0089.153] SetFilePointerEx (in: hFile=0xcb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.153] WriteFile (in: hFile=0xcb0, lpBuffer=0x7585798*, nNumberOfBytesToWrite=0x111, lpNumberOfBytesWritten=0x2b3ffba4, lpOverlapped=0x0 | out: lpBuffer=0x7585798*, lpNumberOfBytesWritten=0x2b3ffba4*=0x111, lpOverlapped=0x0) returned 1 [0092.237] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7585798) returned 1 [0092.237] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b78a0) returned 1 [0092.237] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7283068) returned 1 [0092.237] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b73d0) returned 1 [0092.237] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0b4450) returned 1 [0092.237] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0b4248) returned 1 [0092.237] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0b41a8) returned 1 [0092.237] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0b4338) returned 1 [0092.237] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa6) returned 0x74e0a18 [0092.237] wcscpy (in: _Dest=0x74e0a18, _Source="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\QBl0VZJKsl_M.pdf" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\QBl0VZJKsl_M.pdf") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\QBl0VZJKsl_M.pdf" [0092.237] wcscat (in: _Dest=0x74e0a18, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\QBl0VZJKsl_M.pdf.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\QBl0VZJKsl_M.pdf.mailto[knoocknoo@cock.li].a0a70" [0092.237] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\QBl0VZJKsl_M.pdf.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x2b3ffb5c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\Documents\\0qZ1VEn\\QBl0VZJKsl_M.pdf.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.237] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x53e8418 Thread: id = 1214 os_tid = 0x2024 [0083.872] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\0KnmiLXS1V6M1uAu.mp3" (normalized: "c:\\users\\fd1hvy\\music\\_plqwb\\0knmilxs1v6m1uau.mp3")) returned 0x20 [0084.781] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\0KnmiLXS1V6M1uAu.mp3", dwFileAttributes=0x20) returned 1 [0084.781] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\0KnmiLXS1V6M1uAu.mp3" (normalized: "c:\\users\\fd1hvy\\music\\_plqwb\\0knmilxs1v6m1uau.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfa8 [0084.781] GetFileSizeEx (in: hFile=0xfa8, lpFileSize=0x2b47fb60 | out: lpFileSize=0x2b47fb60*=47209) returned 1 [0084.781] SetFilePointerEx (in: hFile=0xfa8, liDistanceToMove=0xb865, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.781] ReadFile (in: hFile=0xfa8, lpBuffer=0x2b47fae4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b47fae0, lpOverlapped=0x0 | out: lpBuffer=0x2b47fae4*, lpNumberOfBytesRead=0x2b47fae0*=0x4, lpOverlapped=0x0) returned 1 [0084.782] SetFilePointerEx (in: hFile=0xfa8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.782] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0b4338 [0084.782] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0b4518 [0084.782] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0b41a8 [0084.782] NtQuerySystemTime (in: CurrentTime=0x2b47fac0 | out: CurrentTime=0x2b47fac0*=132260136419394248) returned 0x0 [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0xf023e6da [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0x2e83701c [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0xe32c2b14 [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0x18674eeb [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0x1b07033e [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0x1dd679ac [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0x1f888ed2 [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0xe9d072c1 [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0xfe371720 [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0x8087a1c9 [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0xfae76ffc [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0xa14603d5 [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0x8a40e398 [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0xa538ec91 [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0x71be069f [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0xc8949d19 [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0xe9674d2 [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0xe2089c2d [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0xe74cf281 [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0xc75bad47 [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0xc2822115 [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0x523c58b [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0x36168686 [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0x9a07b0e5 [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0x3c151d4f [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0xf7072123 [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0xba356090 [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0xe9300c10 [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0x5f2afa0f [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0x181f869b [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0x6de8b47f [0084.782] RtlRandom (in: Seed=0x2b47facc | out: Seed=0x2b47facc) returned 0x8296422d [0084.792] ReadFile (in: hFile=0xfa8, lpBuffer=0xe0ce160, nNumberOfBytesToRead=0xb869, lpNumberOfBytesRead=0x2b47fabc, lpOverlapped=0x0 | out: lpBuffer=0xe0ce160*, lpNumberOfBytesRead=0x2b47fabc*=0xb869, lpOverlapped=0x0) returned 1 [0084.794] SetFilePointerEx (in: hFile=0xfa8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.794] WriteFile (in: hFile=0xfa8, lpBuffer=0xe0da968*, nNumberOfBytesToWrite=0xb869, lpNumberOfBytesWritten=0x2b47fab8, lpOverlapped=0x0 | out: lpBuffer=0xe0da968*, lpNumberOfBytesWritten=0x2b47fab8*=0xb869, lpOverlapped=0x0) returned 1 [0088.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7280d88 [0088.928] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281058 [0088.928] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7281058) returned 1 [0088.928] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0da968) returned 1 [0089.152] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0ce160) returned 1 [0089.152] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7575208) returned 1 [0089.152] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8378) returned 1 [0089.152] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x35) returned 0x5445580 [0089.152] SetFilePointerEx (in: hFile=0xfa8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.153] WriteFile (in: hFile=0xfa8, lpBuffer=0x7585670*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x2b47fb20, lpOverlapped=0x0 | out: lpBuffer=0x7585670*, lpNumberOfBytesWritten=0x2b47fb20*=0x119, lpOverlapped=0x0) returned 1 [0092.239] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7585670) returned 1 [0092.239] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445a00) returned 1 [0092.239] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7283040) returned 1 [0092.239] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445580) returned 1 [0092.239] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7280d88) Thread: id = 1215 os_tid = 0x2028 [0083.872] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\1B6Fp9MVEOF.mp3" (normalized: "c:\\users\\fd1hvy\\music\\_plqwb\\1b6fp9mveof.mp3")) returned 0x20 [0083.872] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\1B6Fp9MVEOF.mp3", dwFileAttributes=0x20) returned 1 [0083.872] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\1B6Fp9MVEOF.mp3" (normalized: "c:\\users\\fd1hvy\\music\\_plqwb\\1b6fp9mveof.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15f8 [0083.872] GetFileSizeEx (in: hFile=0x15f8, lpFileSize=0x2b4ffa7c | out: lpFileSize=0x2b4ffa7c*=48988) returned 1 [0083.873] SetFilePointerEx (in: hFile=0x15f8, liDistanceToMove=0xbf58, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.873] ReadFile (in: hFile=0x15f8, lpBuffer=0x2b4ffa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b4ff9fc, lpOverlapped=0x0 | out: lpBuffer=0x2b4ffa00*, lpNumberOfBytesRead=0x2b4ff9fc*=0x4, lpOverlapped=0x0) returned 1 [0083.873] SetFilePointerEx (in: hFile=0x15f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.873] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0b41f8 [0084.768] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0b4220 [0084.768] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0b4428 [0084.768] NtQuerySystemTime (in: CurrentTime=0x2b4ff9dc | out: CurrentTime=0x2b4ff9dc*=132260136419236699) returned 0x0 [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0x5f6492b3 [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0x301dd24b [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0x7e5a73a0 [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0x30f6c8d3 [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0x9010d616 [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0xea4868b8 [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0x2b0c2d48 [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0x836bb9c6 [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0xdf7c7cf6 [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0x9158f915 [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0x810fbf2a [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0x337f9e73 [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0x637d344 [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0xf3c97582 [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0x21b14c79 [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0x7f9f6675 [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0xa18ac32f [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0x7fd0e2c2 [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0xd98da711 [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0x4f4582d0 [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0xd66a3de5 [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0xb3a9b709 [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0x8e8f33a3 [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0x47ee254b [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0xc5cf44b2 [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0xd5670850 [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0x431c300d [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0x98766bb9 [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0xbb002ff2 [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0xd0900961 [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0x414d4a16 [0084.768] RtlRandom (in: Seed=0x2b4ff9e8 | out: Seed=0x2b4ff9e8) returned 0x557b6ecc [0084.779] ReadFile (in: hFile=0x15f8, lpBuffer=0xe0b5150, nNumberOfBytesToRead=0xbf5c, lpNumberOfBytesRead=0x2b4ff9d8, lpOverlapped=0x0 | out: lpBuffer=0xe0b5150*, lpNumberOfBytesRead=0x2b4ff9d8*=0xbf5c, lpOverlapped=0x0) returned 1 [0084.781] SetFilePointerEx (in: hFile=0x15f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.781] WriteFile (in: hFile=0x15f8, lpBuffer=0xe0c1958*, nNumberOfBytesToWrite=0xbf5c, lpNumberOfBytesWritten=0x2b4ff9d4, lpOverlapped=0x0 | out: lpBuffer=0xe0c1958*, lpNumberOfBytesWritten=0x2b4ff9d4*=0xbf5c, lpOverlapped=0x0) returned 1 [0088.923] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032810 [0088.923] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032900 [0088.923] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe032900) returned 1 [0088.923] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0c1958) returned 1 [0089.153] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0b5150) returned 1 [0089.153] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7566bd0) returned 1 [0089.153] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8330) returned 1 [0089.153] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2b) returned 0x54b79f0 [0089.154] SetFilePointerEx (in: hFile=0x15f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.154] WriteFile (in: hFile=0x15f8, lpBuffer=0x757ae70*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x2b4ffa3c, lpOverlapped=0x0 | out: lpBuffer=0x757ae70*, lpNumberOfBytesWritten=0x2b4ffa3c*=0x10f, lpOverlapped=0x0) returned 1 [0092.243] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757ae70) returned 1 [0092.243] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b7ad0) returned 1 [0092.243] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x72830b8) returned 1 [0092.243] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b79f0) returned 1 [0092.243] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe032810) returned 1 [0092.243] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0b4220) returned 1 [0092.243] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0b43d8) returned 1 [0092.243] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0b42e8) returned 1 [0092.243] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9a) returned 0x38ac3a0 [0092.243] wcscpy (in: _Dest=0x38ac3a0, _Source="C:\\Users\\FD1HVy\\Music\\_PLqwB\\1B6Fp9MVEOF.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\1B6Fp9MVEOF.mp3") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\1B6Fp9MVEOF.mp3" [0092.243] wcscat (in: _Dest=0x38ac3a0, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\1B6Fp9MVEOF.mp3.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\1B6Fp9MVEOF.mp3.mailto[knoocknoo@cock.li].a0a70" [0092.243] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\1B6Fp9MVEOF.mp3.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x2b4ff9f4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\Music\\_PLqwB\\1B6Fp9MVEOF.mp3.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.243] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x54462b0 Thread: id = 1216 os_tid = 0x202c [0083.873] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\94TVfm.wav" (normalized: "c:\\users\\fd1hvy\\music\\_plqwb\\94tvfm.wav")) returned 0x20 [0083.873] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\94TVfm.wav", dwFileAttributes=0x20) returned 1 [0083.873] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\94TVfm.wav" (normalized: "c:\\users\\fd1hvy\\music\\_plqwb\\94tvfm.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13f0 [0083.874] GetFileSizeEx (in: hFile=0x13f0, lpFileSize=0x2b57fdb0 | out: lpFileSize=0x2b57fdb0*=44412) returned 1 [0083.874] SetFilePointerEx (in: hFile=0x13f0, liDistanceToMove=0xad78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.874] ReadFile (in: hFile=0x13f0, lpBuffer=0x2b57fd34, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b57fd30, lpOverlapped=0x0 | out: lpBuffer=0x2b57fd34*, lpNumberOfBytesRead=0x2b57fd30*=0x4, lpOverlapped=0x0) returned 1 [0083.874] SetFilePointerEx (in: hFile=0x13f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.874] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09af28 [0084.755] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09afc8 [0084.755] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe09acf8 [0084.755] NtQuerySystemTime (in: CurrentTime=0x2b57fd10 | out: CurrentTime=0x2b57fd10*=132260136419082569) returned 0x0 [0084.755] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0xda8fbd3f [0084.755] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0xc321352b [0084.755] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0xed7840c4 [0084.755] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0xa43cbe6b [0084.755] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0x91064788 [0084.755] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0x8112b8a2 [0084.755] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0xe30b917 [0084.755] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0x72bacde2 [0084.755] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0xb978ef0a [0084.755] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0xe8356655 [0084.755] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0xa577bd28 [0084.755] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0xfad7b0f3 [0084.755] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0xae677ae8 [0084.755] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0x4bd01f77 [0084.755] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0x3093723f [0084.755] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0x1604e21d [0084.755] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0xdae94e2e [0084.755] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0xb8dd8ab2 [0084.756] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0xe01b266b [0084.756] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0x6b034cea [0084.756] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0x8bbd9e78 [0084.756] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0xdfb74d0a [0084.756] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0x2224494f [0084.756] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0xd3ff9c23 [0084.756] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0x980029a3 [0084.756] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0xa711466 [0084.756] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0x34b5f8cc [0084.756] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0x1deabc9d [0084.756] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0xb6101d7c [0084.756] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0xe7aec875 [0084.756] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0x597ef7ec [0084.756] RtlRandom (in: Seed=0x2b57fd1c | out: Seed=0x2b57fd1c) returned 0xd1957bc0 [0084.766] ReadFile (in: hFile=0x13f0, lpBuffer=0xe09b138, nNumberOfBytesToRead=0xad7c, lpNumberOfBytesRead=0x2b57fd0c, lpOverlapped=0x0 | out: lpBuffer=0xe09b138*, lpNumberOfBytesRead=0x2b57fd0c*=0xad7c, lpOverlapped=0x0) returned 1 [0084.767] SetFilePointerEx (in: hFile=0x13f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.767] WriteFile (in: hFile=0x13f0, lpBuffer=0xe0a7940*, nNumberOfBytesToWrite=0xad7c, lpNumberOfBytesWritten=0x2b57fd08, lpOverlapped=0x0 | out: lpBuffer=0xe0a7940*, lpNumberOfBytesWritten=0x2b57fd08*=0xad7c, lpOverlapped=0x0) returned 1 [0088.926] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032900 [0088.926] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281058 [0088.926] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7281058) returned 1 [0088.926] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0a7940) returned 1 [0089.153] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09b138) returned 1 [0089.153] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7566b58) returned 1 [0089.153] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba82e8) returned 1 [0089.153] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x21) returned 0x38a6820 [0089.153] SetFilePointerEx (in: hFile=0x13f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.153] WriteFile (in: hFile=0x13f0, lpBuffer=0x757ad58*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x2b57fd70, lpOverlapped=0x0 | out: lpBuffer=0x757ad58*, lpNumberOfBytesWritten=0x2b57fd70*=0x105, lpOverlapped=0x0) returned 1 [0092.244] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757ad58) returned 1 [0092.244] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a68b0) returned 1 [0092.244] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7283090) returned 1 [0092.244] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6820) returned 1 [0092.244] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe032900) returned 1 [0092.244] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09afc8) returned 1 [0092.244] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09aff0) returned 1 [0092.244] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe09acd0) returned 1 [0092.244] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x90) returned 0x54a0018 [0092.244] wcscpy (in: _Dest=0x54a0018, _Source="C:\\Users\\FD1HVy\\Music\\_PLqwB\\94TVfm.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\94TVfm.wav") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\94TVfm.wav" [0092.244] wcscat (in: _Dest=0x54a0018, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\94TVfm.wav.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\94TVfm.wav.mailto[knoocknoo@cock.li].a0a70" [0092.244] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\94TVfm.wav.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x2b57fd28, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\Music\\_PLqwB\\94TVfm.wav.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.244] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa6) returned 0x74e0ac8 Thread: id = 1217 os_tid = 0x2030 [0083.874] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\azZQ4sJMcGr2Gf.wav" (normalized: "c:\\users\\fd1hvy\\music\\_plqwb\\azzq4sjmcgr2gf.wav")) returned 0x20 [0083.874] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\azZQ4sJMcGr2Gf.wav", dwFileAttributes=0x20) returned 1 [0083.874] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\azZQ4sJMcGr2Gf.wav" (normalized: "c:\\users\\fd1hvy\\music\\_plqwb\\azzq4sjmcgr2gf.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15f4 [0083.875] GetFileSizeEx (in: hFile=0x15f4, lpFileSize=0x2b5ffc94 | out: lpFileSize=0x2b5ffc94*=35147) returned 1 [0083.875] SetFilePointerEx (in: hFile=0x15f4, liDistanceToMove=0x8947, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.875] ReadFile (in: hFile=0x15f4, lpBuffer=0x2b5ffc18, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b5ffc14, lpOverlapped=0x0 | out: lpBuffer=0x2b5ffc18*, lpNumberOfBytesRead=0x2b5ffc14*=0x4, lpOverlapped=0x0) returned 1 [0083.875] SetFilePointerEx (in: hFile=0x15f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.875] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080718 [0084.668] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080790 [0084.668] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0807b8 [0084.668] NtQuerySystemTime (in: CurrentTime=0x2b5ffbf4 | out: CurrentTime=0x2b5ffbf4*=132260136418299533) returned 0x0 [0084.668] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0x8f122bb9 [0084.668] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0x5beb145f [0084.668] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0xc6499e4f [0084.668] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0x7832be2f [0084.668] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0x74575308 [0084.668] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0xa23cbe80 [0084.668] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0x849f3b60 [0084.668] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0xd2323f3a [0084.669] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0x4a13f0e1 [0084.669] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0x31f85771 [0084.669] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0x1409a456 [0084.669] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0xf77d9177 [0084.669] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0x656a1610 [0084.669] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0x63bc0a9c [0084.669] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0xd4abc592 [0084.669] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0x57a9eb85 [0084.669] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0x97e83689 [0084.669] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0xcadd614 [0084.669] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0xf34c2e19 [0084.669] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0x96782a88 [0084.669] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0x8c857b57 [0084.669] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0xe37076e4 [0084.669] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0x3e145596 [0084.669] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0xcf586677 [0084.669] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0x4cf06c0a [0084.669] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0x277786f0 [0084.669] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0x4a0b9cb [0084.669] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0xb4248ae0 [0084.669] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0x381ae187 [0084.669] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0xc3a41084 [0084.669] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0x700d960d [0084.669] RtlRandom (in: Seed=0x2b5ffc00 | out: Seed=0x2b5ffc00) returned 0x88d17fa8 [0084.679] ReadFile (in: hFile=0x15f4, lpBuffer=0xe081120, nNumberOfBytesToRead=0x894b, lpNumberOfBytesRead=0x2b5ffbf0, lpOverlapped=0x0 | out: lpBuffer=0xe081120*, lpNumberOfBytesRead=0x2b5ffbf0*=0x894b, lpOverlapped=0x0) returned 1 [0084.755] SetFilePointerEx (in: hFile=0x15f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.755] WriteFile (in: hFile=0x15f4, lpBuffer=0xe08d928*, nNumberOfBytesToWrite=0x894b, lpNumberOfBytesWritten=0x2b5ffbec, lpOverlapped=0x0 | out: lpBuffer=0xe08d928*, lpNumberOfBytesWritten=0x2b5ffbec*=0x894b, lpOverlapped=0x0) returned 1 [0088.920] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0327e8 [0088.920] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032810 [0088.920] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe032810) returned 1 [0088.920] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe08d928) returned 1 [0089.154] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe081120) returned 1 [0089.154] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7566ae0) returned 1 [0089.154] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba82a0) returned 1 [0089.154] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x31) returned 0x54455c0 [0089.154] SetFilePointerEx (in: hFile=0x15f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.154] WriteFile (in: hFile=0x15f4, lpBuffer=0x75858c0*, nNumberOfBytesToWrite=0x115, lpNumberOfBytesWritten=0x2b5ffc54, lpOverlapped=0x0 | out: lpBuffer=0x75858c0*, lpNumberOfBytesWritten=0x2b5ffc54*=0x115, lpOverlapped=0x0) returned 1 [0092.246] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75858c0) returned 1 [0092.246] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5445a40) returned 1 [0092.246] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x72830e0) returned 1 [0092.246] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54455c0) returned 1 [0092.246] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0327e8) returned 1 [0092.246] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe080790) returned 1 [0092.246] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0806a0) returned 1 [0092.246] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0807e0) returned 1 [0092.246] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa0) returned 0x38abbc0 [0092.246] wcscpy (in: _Dest=0x38abbc0, _Source="C:\\Users\\FD1HVy\\Music\\_PLqwB\\azZQ4sJMcGr2Gf.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\azZQ4sJMcGr2Gf.wav") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\azZQ4sJMcGr2Gf.wav" [0092.246] wcscat (in: _Dest=0x38abbc0, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\azZQ4sJMcGr2Gf.wav.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\azZQ4sJMcGr2Gf.wav.mailto[knoocknoo@cock.li].a0a70" [0092.246] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\azZQ4sJMcGr2Gf.wav.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x2b5ffc0c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\Music\\_PLqwB\\azZQ4sJMcGr2Gf.wav.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.246] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb6) returned 0x5b17210 Thread: id = 1218 os_tid = 0x2034 [0083.875] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\C9PNUHen.mp3" (normalized: "c:\\users\\fd1hvy\\music\\_plqwb\\c9pnuhen.mp3")) returned 0x20 [0083.875] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\C9PNUHen.mp3", dwFileAttributes=0x20) returned 1 [0083.875] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\C9PNUHen.mp3" (normalized: "c:\\users\\fd1hvy\\music\\_plqwb\\c9pnuhen.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15f0 [0083.876] GetFileSizeEx (in: hFile=0x15f0, lpFileSize=0x2b67fee0 | out: lpFileSize=0x2b67fee0*=24031) returned 1 [0083.876] SetFilePointerEx (in: hFile=0x15f0, liDistanceToMove=0x5ddb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.876] ReadFile (in: hFile=0x15f0, lpBuffer=0x2b67fe64, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b67fe60, lpOverlapped=0x0 | out: lpBuffer=0x2b67fe64*, lpNumberOfBytesRead=0x2b67fe60*=0x4, lpOverlapped=0x0) returned 1 [0083.876] SetFilePointerEx (in: hFile=0x15f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.876] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066548 [0084.656] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0663e0 [0084.656] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066368 [0084.656] NtQuerySystemTime (in: CurrentTime=0x2b67fe40 | out: CurrentTime=0x2b67fe40*=132260136418142077) returned 0x0 [0084.656] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0x2d87db89 [0084.656] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0xcb7deaa5 [0084.656] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0x9a02fb24 [0084.656] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0x9ec65cec [0084.656] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0x6e2bf53a [0084.656] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0xcc1187db [0084.656] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0x11cd0515 [0084.656] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0x1447927b [0084.657] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0xf6e55343 [0084.657] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0x2fef3088 [0084.657] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0x51d57458 [0084.657] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0xf9af2acf [0084.657] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0x904df9e8 [0084.657] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0xf6a563dd [0084.657] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0xf7f7ab68 [0084.657] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0xbd67119b [0084.657] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0xac3afe5e [0084.657] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0xfccd0e11 [0084.657] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0x21b4c81e [0084.657] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0x474d87c8 [0084.657] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0x5dcdf2dc [0084.657] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0x60e86b2a [0084.657] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0xb7f47450 [0084.657] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0x24648eaf [0084.657] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0x74d6c9c4 [0084.657] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0xc08900e2 [0084.657] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0xe466134a [0084.657] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0x4317974d [0084.657] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0xa6c4b8c0 [0084.657] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0xef974ac6 [0084.657] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0x4ba0a1b1 [0084.657] RtlRandom (in: Seed=0x2b67fe4c | out: Seed=0x2b67fe4c) returned 0xec12b242 [0084.667] ReadFile (in: hFile=0x15f0, lpBuffer=0xe067108, nNumberOfBytesToRead=0x5ddf, lpNumberOfBytesRead=0x2b67fe3c, lpOverlapped=0x0 | out: lpBuffer=0xe067108*, lpNumberOfBytesRead=0x2b67fe3c*=0x5ddf, lpOverlapped=0x0) returned 1 [0084.668] SetFilePointerEx (in: hFile=0x15f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.668] WriteFile (in: hFile=0x15f0, lpBuffer=0xe073910*, nNumberOfBytesToWrite=0x5ddf, lpNumberOfBytesWritten=0x2b67fe38, lpOverlapped=0x0 | out: lpBuffer=0xe073910*, lpNumberOfBytesWritten=0x2b67fe38*=0x5ddf, lpOverlapped=0x0) returned 1 [0088.919] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0327c0 [0088.919] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0327e8 [0088.919] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0327e8) returned 1 [0088.919] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe073910) returned 1 [0089.154] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe067108) returned 1 [0089.154] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7566a68) returned 1 [0089.154] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8258) returned 1 [0089.154] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x25) returned 0x38a68e0 [0089.154] SetFilePointerEx (in: hFile=0x15f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.154] WriteFile (in: hFile=0x15f0, lpBuffer=0x757af88*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x2b67fea0, lpOverlapped=0x0 | out: lpBuffer=0x757af88*, lpNumberOfBytesWritten=0x2b67fea0*=0x109, lpOverlapped=0x0) returned 1 [0092.248] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757af88) returned 1 [0092.248] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6970) returned 1 [0092.248] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7283180) returned 1 [0092.248] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a68e0) returned 1 [0092.248] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0327c0) returned 1 [0092.248] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0663e0) returned 1 [0092.248] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe066188) returned 1 [0092.248] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0662a0) returned 1 [0092.248] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x94) returned 0x55c57b8 [0092.248] wcscpy (in: _Dest=0x55c57b8, _Source="C:\\Users\\FD1HVy\\Music\\_PLqwB\\C9PNUHen.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\C9PNUHen.mp3") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\C9PNUHen.mp3" [0092.248] wcscat (in: _Dest=0x55c57b8, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\C9PNUHen.mp3.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\C9PNUHen.mp3.mailto[knoocknoo@cock.li].a0a70" [0092.248] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\C9PNUHen.mp3.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x2b67fe58, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\Music\\_PLqwB\\C9PNUHen.mp3.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.248] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xaa) returned 0x5446368 Thread: id = 1219 os_tid = 0x2038 [0083.876] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\iFFa.m4a" (normalized: "c:\\users\\fd1hvy\\music\\_plqwb\\iffa.m4a")) returned 0x20 [0083.876] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\iFFa.m4a", dwFileAttributes=0x20) returned 1 [0083.877] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\iFFa.m4a" (normalized: "c:\\users\\fd1hvy\\music\\_plqwb\\iffa.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13f4 [0083.877] GetFileSizeEx (in: hFile=0x13f4, lpFileSize=0x2b6ffca0 | out: lpFileSize=0x2b6ffca0*=58292) returned 1 [0083.877] SetFilePointerEx (in: hFile=0x13f4, liDistanceToMove=0xe3b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.877] ReadFile (in: hFile=0x13f4, lpBuffer=0x2b6ffc24, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b6ffc20, lpOverlapped=0x0 | out: lpBuffer=0x2b6ffc24*, lpNumberOfBytesRead=0x2b6ffc20*=0x4, lpOverlapped=0x0) returned 1 [0083.877] SetFilePointerEx (in: hFile=0x13f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.877] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe04c558 [0084.600] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe04c440 [0084.600] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe04c508 [0084.600] NtQuerySystemTime (in: CurrentTime=0x2b6ffc00 | out: CurrentTime=0x2b6ffc00*=132260136417629533) returned 0x0 [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0xa879e6a3 [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0x73ab8878 [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0x3282c906 [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0xf1767db4 [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0x6be541f2 [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0xd77b7f5 [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0x3309cf36 [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0x106858ed [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0xee361913 [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0x5d25089f [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0xc7c04ad [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0x75b2f577 [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0x95b2c9a2 [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0xe9dd108a [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0x7dd58915 [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0x52d673a9 [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0xdd5e57e0 [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0x36e0e802 [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0x63dbea84 [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0x28d82579 [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0x80748286 [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0x81d49d33 [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0x45722b4 [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0x1eed6da [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0x6603e6db [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0x152a481e [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0x80858196 [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0x63b9a75 [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0x3ca70337 [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0x49f094af [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0x569c0f99 [0084.600] RtlRandom (in: Seed=0x2b6ffc0c | out: Seed=0x2b6ffc0c) returned 0x4333e6e8 [0084.610] SetFilePointerEx (in: hFile=0x13f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.610] ReadFile (in: hFile=0x13f4, lpBuffer=0xe04d0f0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2b6ffbe0, lpOverlapped=0x0 | out: lpBuffer=0xe04d0f0*, lpNumberOfBytesRead=0x2b6ffbe0*=0xc800, lpOverlapped=0x0) returned 1 [0084.610] SetFilePointerEx (in: hFile=0x13f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.610] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8258 [0084.610] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x7566a68 [0084.610] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe04c5d0 [0084.610] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe04c5d0) returned 1 [0084.611] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe0598f8 [0084.617] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe04c3f0 [0084.617] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe04c2b0 [0084.617] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe04c2b0) returned 1 [0084.617] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7566a68) returned 1 [0084.617] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8258) returned 1 [0084.617] WriteFile (in: hFile=0x13f4, lpBuffer=0xe0598f8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2b6ffbe0, lpOverlapped=0x0 | out: lpBuffer=0xe0598f8*, lpNumberOfBytesWritten=0x2b6ffbe0*=0xc800, lpOverlapped=0x0) returned 1 [0088.917] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0598f8) returned 1 [0089.155] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe04d0f0) returned 1 [0089.155] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d) returned 0x7282dc0 [0089.155] SetFilePointerEx (in: hFile=0x13f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.155] WriteFile (in: hFile=0x13f4, lpBuffer=0x757b0a0*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0x2b6ffc60, lpOverlapped=0x0 | out: lpBuffer=0x757b0a0*, lpNumberOfBytesWritten=0x2b6ffc60*=0x101, lpOverlapped=0x0) returned 1 [0092.254] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757b0a0) returned 1 [0092.254] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x72831d0) returned 1 [0092.254] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282cf8) returned 1 [0092.254] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282dc0) returned 1 [0092.254] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe04c3f0) returned 1 [0092.254] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe04c440) returned 1 [0092.254] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe04c378) returned 1 [0092.254] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe04c288) Thread: id = 1220 os_tid = 0x203c [0083.877] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\lQ0I7gC_.m4a" (normalized: "c:\\users\\fd1hvy\\music\\_plqwb\\lq0i7gc_.m4a")) returned 0x20 [0083.877] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\lQ0I7gC_.m4a", dwFileAttributes=0x20) returned 1 [0083.878] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\lQ0I7gC_.m4a" (normalized: "c:\\users\\fd1hvy\\music\\_plqwb\\lq0i7gc_.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15e8 [0083.878] GetFileSizeEx (in: hFile=0x15e8, lpFileSize=0x2b77fa04 | out: lpFileSize=0x2b77fa04*=16419) returned 1 [0083.878] SetFilePointerEx (in: hFile=0x15e8, liDistanceToMove=0x401f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.878] ReadFile (in: hFile=0x15e8, lpBuffer=0x2b77f988, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b77f984, lpOverlapped=0x0 | out: lpBuffer=0x2b77f988*, lpNumberOfBytesRead=0x2b77f984*=0x4, lpOverlapped=0x0) returned 1 [0083.879] SetFilePointerEx (in: hFile=0x15e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.879] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032b58 [0084.588] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032ba8 [0084.588] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032ce8 [0084.588] NtQuerySystemTime (in: CurrentTime=0x2b77f964 | out: CurrentTime=0x2b77f964*=132260136417473676) returned 0x0 [0084.588] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0xacbb306d [0084.588] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0x1915efed [0084.588] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0x7997ccd4 [0084.588] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0xbfd325e7 [0084.588] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0x758d1b [0084.588] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0x70005f92 [0084.588] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0x8cf7ccb9 [0084.588] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0x231d6950 [0084.588] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0x14a44b69 [0084.588] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0x3fea016 [0084.588] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0x723575cd [0084.588] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0x353f89a7 [0084.588] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0x63297f68 [0084.588] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0x19180943 [0084.588] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0x7aed6ded [0084.588] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0x9a433d63 [0084.588] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0x775b606f [0084.588] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0x43743b21 [0084.588] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0x2136bce4 [0084.588] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0xfd51259d [0084.588] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0xa7154285 [0084.588] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0xc1f6168b [0084.588] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0xc90bcb2e [0084.588] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0x96cf1c4 [0084.588] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0xe385ed38 [0084.588] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0xdceda7a3 [0084.588] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0x4e8bddbc [0084.589] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0xa6f782bc [0084.589] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0xc214d0cc [0084.589] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0x96d5a384 [0084.589] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0x5ea804e9 [0084.589] RtlRandom (in: Seed=0x2b77f970 | out: Seed=0x2b77f970) returned 0xc98bb0df [0084.599] ReadFile (in: hFile=0x15e8, lpBuffer=0xe0330d8, nNumberOfBytesToRead=0x4023, lpNumberOfBytesRead=0x2b77f960, lpOverlapped=0x0 | out: lpBuffer=0xe0330d8*, lpNumberOfBytesRead=0x2b77f960*=0x4023, lpOverlapped=0x0) returned 1 [0084.599] SetFilePointerEx (in: hFile=0x15e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.599] WriteFile (in: hFile=0x15e8, lpBuffer=0xe03f8e0*, nNumberOfBytesToWrite=0x4023, lpNumberOfBytesWritten=0x2b77f95c, lpOverlapped=0x0 | out: lpBuffer=0xe03f8e0*, lpNumberOfBytesWritten=0x2b77f95c*=0x4023, lpOverlapped=0x0) returned 1 [0088.916] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032748 [0088.916] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0327c0 [0088.916] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0327c0) returned 1 [0088.916] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe03f8e0) returned 1 [0089.155] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0330d8) returned 1 [0089.155] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75669f0) returned 1 [0089.155] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8210) returned 1 [0089.155] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x25) returned 0x38a69a0 [0089.155] SetFilePointerEx (in: hFile=0x15e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.155] WriteFile (in: hFile=0x15e8, lpBuffer=0x757b1b8*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x2b77f9c4, lpOverlapped=0x0 | out: lpBuffer=0x757b1b8*, lpNumberOfBytesWritten=0x2b77f9c4*=0x109, lpOverlapped=0x0) returned 1 [0092.251] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757b1b8) returned 1 [0092.251] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a6a30) returned 1 [0092.251] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7282d20) returned 1 [0092.251] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a69a0) returned 1 [0092.251] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe032748) returned 1 [0092.251] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe032ba8) returned 1 [0092.251] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe032e28) returned 1 [0092.251] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe032c70) returned 1 [0092.251] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x94) returned 0x55c5858 [0092.252] wcscpy (in: _Dest=0x55c5858, _Source="C:\\Users\\FD1HVy\\Music\\_PLqwB\\lQ0I7gC_.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\lQ0I7gC_.m4a") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\lQ0I7gC_.m4a" [0092.252] wcscat (in: _Dest=0x55c5858, _Source=".mailto[knoocknoo@cock.li].a0a70" | out: _Dest="C:\\Users\\FD1HVy\\Music\\_PLqwB\\lQ0I7gC_.m4a.mailto[knoocknoo@cock.li].a0a70") returned="C:\\Users\\FD1HVy\\Music\\_PLqwB\\lQ0I7gC_.m4a.mailto[knoocknoo@cock.li].a0a70" [0092.252] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\lQ0I7gC_.m4a.mailto[knoocknoo@cock.li].a0a70", NtPathName=0x2b77f97c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\FD1HVy\\Music\\_PLqwB\\lQ0I7gC_.m4a.mailto[knoocknoo@cock.li].a0a70", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.252] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xaa) returned 0x5446420 Thread: id = 1221 os_tid = 0x2040 [0083.880] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\orND3Tchiwkya4H5.wav" (normalized: "c:\\users\\fd1hvy\\music\\_plqwb\\ornd3tchiwkya4h5.wav")) returned 0x20 [0084.570] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\orND3Tchiwkya4H5.wav", dwFileAttributes=0x20) returned 1 [0084.570] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\orND3Tchiwkya4H5.wav" (normalized: "c:\\users\\fd1hvy\\music\\_plqwb\\ornd3tchiwkya4h5.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfac [0084.570] GetFileSizeEx (in: hFile=0xfac, lpFileSize=0x2b7ffce4 | out: lpFileSize=0x2b7ffce4*=60410) returned 1 [0084.570] SetFilePointerEx (in: hFile=0xfac, liDistanceToMove=0xebf6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.571] ReadFile (in: hFile=0xfac, lpBuffer=0x2b7ffc68, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b7ffc64, lpOverlapped=0x0 | out: lpBuffer=0x2b7ffc68*, lpNumberOfBytesRead=0x2b7ffc64*=0x4, lpOverlapped=0x0) returned 1 [0084.571] SetFilePointerEx (in: hFile=0xfac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.571] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x76679c0 [0084.571] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7667948 [0084.571] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x76677e0 [0084.571] NtQuerySystemTime (in: CurrentTime=0x2b7ffc44 | out: CurrentTime=0x2b7ffc44*=132260136417342534) returned 0x0 [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0x7cc68e99 [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0xa35c42a0 [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0xff27e00d [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0x3f334fb [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0x9591ed71 [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0x5e246876 [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0xf6e1fe6 [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0xf0febaf2 [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0x6995f25b [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0xca7d142c [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0x68a7b9a8 [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0x2a2ae64b [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0x334f2d1 [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0x947ddc55 [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0xde1b0daa [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0xa4fe5ce2 [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0x29b6269a [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0xacce28f [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0xaae92464 [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0x9f71793 [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0xa798d0ef [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0x51e83b79 [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0x924050f [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0xb1274b22 [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0x3723266e [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0x4ecd32d5 [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0xd816e309 [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0x4c6cc82 [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0xd3347b04 [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0xc738eac8 [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0x27543055 [0084.571] RtlRandom (in: Seed=0x2b7ffc50 | out: Seed=0x2b7ffc50) returned 0x327ac5bf [0084.581] SetFilePointerEx (in: hFile=0xfac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.581] ReadFile (in: hFile=0xfac, lpBuffer=0xe0190c0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2b7ffc24, lpOverlapped=0x0 | out: lpBuffer=0xe0190c0*, lpNumberOfBytesRead=0x2b7ffc24*=0xc800, lpOverlapped=0x0) returned 1 [0084.581] SetFilePointerEx (in: hFile=0xfac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.581] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8210 [0084.581] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x75669f0 [0084.581] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7667ab0 [0084.581] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7667ab0) returned 1 [0084.582] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe0258c8 [0084.587] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7667970 [0084.587] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x76677b8 [0084.587] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x76677b8) returned 1 [0084.587] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75669f0) returned 1 [0084.587] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8210) returned 1 [0084.587] WriteFile (in: hFile=0xfac, lpBuffer=0xe0258c8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2b7ffc24, lpOverlapped=0x0 | out: lpBuffer=0xe0258c8*, lpNumberOfBytesWritten=0x2b7ffc24*=0xc800, lpOverlapped=0x0) returned 1 [0088.915] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0258c8) Thread: id = 1222 os_tid = 0x2044 [0083.880] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\rwHfI4_h.wav" (normalized: "c:\\users\\fd1hvy\\music\\_plqwb\\rwhfi4_h.wav")) returned 0x20 [0083.881] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\rwHfI4_h.wav", dwFileAttributes=0x20) returned 1 [0083.881] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\rwHfI4_h.wav" (normalized: "c:\\users\\fd1hvy\\music\\_plqwb\\rwhfi4_h.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15e4 [0083.881] GetFileSizeEx (in: hFile=0x15e4, lpFileSize=0x2b87f840 | out: lpFileSize=0x2b87f840*=92157) returned 1 [0083.881] SetFilePointerEx (in: hFile=0x15e4, liDistanceToMove=0x167f9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.881] ReadFile (in: hFile=0x15e4, lpBuffer=0x2b87f7c4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b87f7c0, lpOverlapped=0x0 | out: lpBuffer=0x2b87f7c4*, lpNumberOfBytesRead=0x2b87f7c0*=0x4, lpOverlapped=0x0) returned 1 [0083.881] SetFilePointerEx (in: hFile=0x15e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.881] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x76678f8 [0084.552] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7667920 [0084.552] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7667a88 [0084.552] NtQuerySystemTime (in: CurrentTime=0x2b87f7a0 | out: CurrentTime=0x2b87f7a0*=132260136417161257) returned 0x0 [0084.552] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0xe317b6fb [0084.552] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0xc5c53dd4 [0084.552] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0xea38d5f8 [0084.552] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0x13e56740 [0084.552] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0x4bd03872 [0084.552] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0x82583fb0 [0084.552] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0xa322d0c7 [0084.552] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0x433e9b77 [0084.552] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0xfcf6c1cd [0084.552] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0xcec226d0 [0084.552] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0x9d019f71 [0084.552] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0x9fa51caa [0084.552] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0x51aac907 [0084.552] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0xee8a8d30 [0084.553] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0x537bb781 [0084.553] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0xc42735f2 [0084.553] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0x60186818 [0084.553] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0xd8e70b3d [0084.553] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0xe35878c0 [0084.553] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0x3ddbc5b3 [0084.553] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0x8945cfa7 [0084.553] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0x45c31e22 [0084.553] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0x96bb4cc1 [0084.553] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0x5d7901b2 [0084.553] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0xd635caaa [0084.553] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0xf494ccd2 [0084.553] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0x23b476b2 [0084.553] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0xdc84e1b2 [0084.553] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0xffff5f23 [0084.553] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0xb43b0f6e [0084.553] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0x928f43d7 [0084.553] RtlRandom (in: Seed=0x2b87f7ac | out: Seed=0x2b87f7ac) returned 0x5d3a25ab [0084.562] SetFilePointerEx (in: hFile=0x15e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.562] ReadFile (in: hFile=0x15e4, lpBuffer=0xdfff0a8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2b87f780, lpOverlapped=0x0 | out: lpBuffer=0xdfff0a8*, lpNumberOfBytesRead=0x2b87f780*=0xc800, lpOverlapped=0x0) returned 1 [0084.562] SetFilePointerEx (in: hFile=0x15e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.562] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8210 [0084.563] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x7575208 [0084.563] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7667ab0 [0084.563] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7667ab0) returned 1 [0084.563] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe00b8b0 [0084.569] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x76678f8 [0084.569] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7667790 [0084.569] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7667790) returned 1 [0084.569] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7575208) returned 1 [0084.569] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8210) returned 1 [0084.569] WriteFile (in: hFile=0x15e4, lpBuffer=0xe00b8b0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2b87f780, lpOverlapped=0x0 | out: lpBuffer=0xe00b8b0*, lpNumberOfBytesWritten=0x2b87f780*=0xc800, lpOverlapped=0x0) returned 1 [0088.914] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe00b8b0) returned 1 [0091.181] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xdfff0a8) returned 1 [0091.181] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x25) returned 0x38a6850 [0091.181] SetFilePointerEx (in: hFile=0x15e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.181] WriteFile (hFile=0x15e4, lpBuffer=0x74b3bc8, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x2b87f800, lpOverlapped=0x0) Thread: id = 1223 os_tid = 0x2048 [0083.881] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\sgP96Lia9.mp3" (normalized: "c:\\users\\fd1hvy\\music\\_plqwb\\sgp96lia9.mp3")) returned 0x20 [0083.882] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\sgP96Lia9.mp3", dwFileAttributes=0x20) returned 1 [0083.882] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\sgP96Lia9.mp3" (normalized: "c:\\users\\fd1hvy\\music\\_plqwb\\sgp96lia9.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15e0 [0083.882] GetFileSizeEx (in: hFile=0x15e0, lpFileSize=0x2b8ffb4c | out: lpFileSize=0x2b8ffb4c*=101641) returned 1 [0083.882] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x18d05, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.882] ReadFile (in: hFile=0x15e0, lpBuffer=0x2b8ffad0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b8ffacc, lpOverlapped=0x0 | out: lpBuffer=0x2b8ffad0*, lpNumberOfBytesRead=0x2b8ffacc*=0x4, lpOverlapped=0x0) returned 1 [0083.882] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.882] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7666990 [0084.540] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7666648 [0084.540] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7666ad0 [0084.540] NtQuerySystemTime (in: CurrentTime=0x2b8ffaac | out: CurrentTime=0x2b8ffaac*=132260136417004513) returned 0x0 [0084.540] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0x311224ed [0084.540] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0x9f40872c [0084.540] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0x3385e9ea [0084.540] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0xd832d652 [0084.540] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0x655b5dbb [0084.540] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0x1ae9a8cb [0084.540] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0xba168ef4 [0084.540] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0x54271732 [0084.540] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0x8bfef16e [0084.540] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0x7984129a [0084.540] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0x4f9fd364 [0084.540] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0x8531fcf2 [0084.540] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0x8efeba00 [0084.541] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0xba817be3 [0084.541] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0x61e89247 [0084.541] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0xb342afd1 [0084.541] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0xde76aa89 [0084.541] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0xbc90ef9e [0084.541] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0xad88ef39 [0084.541] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0x79d10939 [0084.541] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0xf5a0d6e8 [0084.541] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0x9d667cec [0084.541] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0x984d51d8 [0084.541] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0x64f9b047 [0084.541] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0x359adbd6 [0084.541] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0x65d44ce2 [0084.541] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0x916b4de9 [0084.541] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0xe57c4ce7 [0084.541] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0x80930b83 [0084.541] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0x10b53696 [0084.541] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0xb994158a [0084.541] RtlRandom (in: Seed=0x2b8ffab8 | out: Seed=0x2b8ffab8) returned 0x774a3f41 [0084.550] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.550] ReadFile (in: hFile=0x15e0, lpBuffer=0x74e80f8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2b8ffa8c, lpOverlapped=0x0 | out: lpBuffer=0x74e80f8*, lpNumberOfBytesRead=0x2b8ffa8c*=0xc800, lpOverlapped=0x0) returned 1 [0084.550] SetFilePointerEx (in: hFile=0x15e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.550] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8210 [0084.550] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x7575208 [0084.550] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7666aa8 [0084.550] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7666aa8) returned 1 [0084.551] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x74f4900 [0084.552] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x76668c8 [0084.552] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7666788 [0084.552] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7666788) returned 1 [0084.552] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7575208) returned 1 [0084.552] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8210) returned 1 [0084.552] WriteFile (in: hFile=0x15e0, lpBuffer=0x74f4900*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2b8ffa8c, lpOverlapped=0x0 | out: lpBuffer=0x74f4900*, lpNumberOfBytesWritten=0x2b8ffa8c*=0xc800, lpOverlapped=0x0) returned 1 [0088.566] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74f4900) Thread: id = 1224 os_tid = 0x204c [0083.884] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\v6XSRpF077 2LUq8xHtn.m4a" (normalized: "c:\\users\\fd1hvy\\music\\_plqwb\\v6xsrpf077 2luq8xhtn.m4a")) returned 0x20 [0083.884] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\v6XSRpF077 2LUq8xHtn.m4a", dwFileAttributes=0x20) returned 1 [0083.884] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\v6XSRpF077 2LUq8xHtn.m4a" (normalized: "c:\\users\\fd1hvy\\music\\_plqwb\\v6xsrpf077 2luq8xhtn.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15d4 [0083.885] GetFileSizeEx (in: hFile=0x15d4, lpFileSize=0x2b97feb8 | out: lpFileSize=0x2b97feb8*=43415) returned 1 [0083.885] SetFilePointerEx (in: hFile=0x15d4, liDistanceToMove=0xa993, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.885] ReadFile (in: hFile=0x15d4, lpBuffer=0x2b97fe3c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b97fe38, lpOverlapped=0x0 | out: lpBuffer=0x2b97fe3c*, lpNumberOfBytesRead=0x2b97fe38*=0x4, lpOverlapped=0x0) returned 1 [0083.885] SetFilePointerEx (in: hFile=0x15d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.885] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xdf99978 [0084.527] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xdf999a0 [0084.527] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xdf99888 [0084.527] NtQuerySystemTime (in: CurrentTime=0x2b97fe18 | out: CurrentTime=0x2b97fe18*=132260136416848248) returned 0x0 [0084.527] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0x242431b8 [0084.527] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0xc1341642 [0084.527] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0xbe72b550 [0084.527] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0xca5a7c74 [0084.527] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0xa802975a [0084.527] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0xaf632bb3 [0084.527] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0xbf38b233 [0084.527] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0xd11e947b [0084.527] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0x81c35025 [0084.527] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0xd92efa8c [0084.527] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0x391053a9 [0084.527] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0xe8815ba7 [0084.527] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0xfd715b0b [0084.527] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0xb15a904f [0084.527] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0x8e99ee59 [0084.527] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0xa643fa51 [0084.527] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0xd0abb1ad [0084.527] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0x3d4f2e6 [0084.527] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0x881eabce [0084.527] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0x61ab4a9b [0084.527] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0xd4e2f52e [0084.527] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0xbe1a12d6 [0084.527] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0xa1eac30e [0084.527] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0x6b10b603 [0084.527] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0x100ca40d [0084.527] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0xb46d0526 [0084.527] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0xd4f1aae4 [0084.527] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0x58ad5542 [0084.527] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0xc12a45f1 [0084.527] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0x8aeeaa0a [0084.528] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0x817a6f65 [0084.528] RtlRandom (in: Seed=0x2b97fe24 | out: Seed=0x2b97fe24) returned 0x8fda5b9f [0084.538] ReadFile (in: hFile=0x15d4, lpBuffer=0xdfe6098, nNumberOfBytesToRead=0xa997, lpNumberOfBytesRead=0x2b97fe14, lpOverlapped=0x0 | out: lpBuffer=0xdfe6098*, lpNumberOfBytesRead=0x2b97fe14*=0xa997, lpOverlapped=0x0) returned 1 [0084.539] SetFilePointerEx (in: hFile=0x15d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.539] WriteFile (in: hFile=0x15d4, lpBuffer=0xdff28a0*, nNumberOfBytesToWrite=0xa997, lpNumberOfBytesWritten=0x2b97fe10, lpOverlapped=0x0 | out: lpBuffer=0xdff28a0*, lpNumberOfBytesWritten=0x2b97fe10*=0xa997, lpOverlapped=0x0) returned 1 [0088.508] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032720 [0088.508] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032900 [0088.508] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe032900) returned 1 [0088.508] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xdff28a0) Thread: id = 1225 os_tid = 0x2050 [0083.885] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\y7ng-NLkqB2JRPZIWQ.mp3" (normalized: "c:\\users\\fd1hvy\\music\\_plqwb\\y7ng-nlkqb2jrpziwq.mp3")) returned 0x20 [0084.508] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\y7ng-NLkqB2JRPZIWQ.mp3", dwFileAttributes=0x20) returned 1 [0084.508] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\y7ng-NLkqB2JRPZIWQ.mp3" (normalized: "c:\\users\\fd1hvy\\music\\_plqwb\\y7ng-nlkqb2jrpziwq.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfb0 [0084.508] GetFileSizeEx (in: hFile=0xfb0, lpFileSize=0x2b9ffeb8 | out: lpFileSize=0x2b9ffeb8*=52958) returned 1 [0084.508] SetFilePointerEx (in: hFile=0xfb0, liDistanceToMove=0xceda, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.509] ReadFile (in: hFile=0xfb0, lpBuffer=0x2b9ffe3c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b9ffe38, lpOverlapped=0x0 | out: lpBuffer=0x2b9ffe3c*, lpNumberOfBytesRead=0x2b9ffe38*=0x4, lpOverlapped=0x0) returned 1 [0084.509] SetFilePointerEx (in: hFile=0xfb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.509] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xdfb34b8 [0084.509] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xdfb30a8 [0084.509] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xdfb31e8 [0084.509] NtQuerySystemTime (in: CurrentTime=0x2b9ffe18 | out: CurrentTime=0x2b9ffe18*=132260136416692441) returned 0x0 [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0x3e03cde4 [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0x59387d95 [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0x4e95eddc [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0xfe4f9a28 [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0x3e46f1cd [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0x3b596617 [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0xa659334a [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0x808cad11 [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0xfc8597f5 [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0x2c70c9a4 [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0xccb2d727 [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0x3c6c9e13 [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0xe0f85021 [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0x98b8992d [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0x17bcd752 [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0xf446ef71 [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0x917d5bc7 [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0xbbff3879 [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0x7a2fbd2b [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0xa2aab8bc [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0x228a1455 [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0x985ba07c [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0x6f312978 [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0xa1a21a4b [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0x536c72c1 [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0xc46f0dc7 [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0x135f97d0 [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0xe071270b [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0xb3d36115 [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0x8538e31d [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0x732e02f9 [0084.509] RtlRandom (in: Seed=0x2b9ffe24 | out: Seed=0x2b9ffe24) returned 0x2c14516a [0084.519] SetFilePointerEx (in: hFile=0xfb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.519] ReadFile (in: hFile=0xfb0, lpBuffer=0xdfcd088, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2b9ffdf8, lpOverlapped=0x0 | out: lpBuffer=0xdfcd088*, lpNumberOfBytesRead=0x2b9ffdf8*=0xc800, lpOverlapped=0x0) returned 1 [0084.519] SetFilePointerEx (in: hFile=0xfb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.519] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba81c8 [0084.519] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x7575118 [0084.519] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xdfb3558 [0084.519] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xdfb3558) returned 1 [0084.520] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xdfd9890 [0084.526] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xdfb3378 [0084.526] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xdfb3260 [0084.526] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xdfb3260) returned 1 [0084.526] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7575118) returned 1 [0084.526] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba81c8) returned 1 [0084.526] WriteFile (in: hFile=0xfb0, lpBuffer=0xdfd9890*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2b9ffdf8, lpOverlapped=0x0 | out: lpBuffer=0xdfd9890*, lpNumberOfBytesWritten=0x2b9ffdf8*=0xc800, lpOverlapped=0x0) returned 1 [0088.506] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xdfd9890) Thread: id = 1226 os_tid = 0x2054 [0083.886] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\yLuqNTWrEwGtf.wav" (normalized: "c:\\users\\fd1hvy\\music\\_plqwb\\yluqntwrewgtf.wav")) returned 0x20 [0083.886] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\yLuqNTWrEwGtf.wav", dwFileAttributes=0x20) returned 1 [0083.886] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\yLuqNTWrEwGtf.wav" (normalized: "c:\\users\\fd1hvy\\music\\_plqwb\\yluqntwrewgtf.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15c8 [0083.886] GetFileSizeEx (in: hFile=0x15c8, lpFileSize=0x2ba7fef4 | out: lpFileSize=0x2ba7fef4*=16425) returned 1 [0083.886] SetFilePointerEx (in: hFile=0x15c8, liDistanceToMove=0x4025, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.886] ReadFile (in: hFile=0x15c8, lpBuffer=0x2ba7fe78, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ba7fe74, lpOverlapped=0x0 | out: lpBuffer=0x2ba7fe78*, lpNumberOfBytesRead=0x2ba7fe74*=0x4, lpOverlapped=0x0) returned 1 [0083.886] SetFilePointerEx (in: hFile=0x15c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.886] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xdfb32d8 [0084.496] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xdfb3508 [0084.496] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xdfb3328 [0084.496] NtQuerySystemTime (in: CurrentTime=0x2ba7fe54 | out: CurrentTime=0x2ba7fe54*=132260136416536304) returned 0x0 [0084.496] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0xbd2cb66a [0084.496] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0x6cb6c28b [0084.496] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0xc925b20f [0084.496] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0x2ce6bc3b [0084.496] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0x28f65faf [0084.496] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0x80977868 [0084.496] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0x2148be61 [0084.496] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0xc9bbbb93 [0084.496] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0xc543daee [0084.496] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0x783e27e5 [0084.496] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0x46170d2f [0084.496] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0x7bdefc82 [0084.496] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0x47678768 [0084.496] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0x44bc00e8 [0084.496] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0x9176178d [0084.496] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0xf6120486 [0084.496] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0x234464c8 [0084.496] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0x80d87f9 [0084.496] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0xdace8a56 [0084.497] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0xacc13aeb [0084.497] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0x50a7706e [0084.497] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0xdf12bcf1 [0084.497] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0xa85ab522 [0084.497] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0x7cd479bc [0084.497] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0xc959cd59 [0084.497] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0xafed027e [0084.497] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0x7d439a51 [0084.497] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0x61f45438 [0084.497] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0x10514bd8 [0084.497] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0xea5d009a [0084.497] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0x9b185ac8 [0084.497] RtlRandom (in: Seed=0x2ba7fe60 | out: Seed=0x2ba7fe60) returned 0x318fc338 [0084.507] ReadFile (in: hFile=0x15c8, lpBuffer=0xdfb4078, nNumberOfBytesToRead=0x4029, lpNumberOfBytesRead=0x2ba7fe50, lpOverlapped=0x0 | out: lpBuffer=0xdfb4078*, lpNumberOfBytesRead=0x2ba7fe50*=0x4029, lpOverlapped=0x0) returned 1 [0084.508] SetFilePointerEx (in: hFile=0x15c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.508] WriteFile (in: hFile=0x15c8, lpBuffer=0xdfc0880*, nNumberOfBytesToWrite=0x4029, lpNumberOfBytesWritten=0x2ba7fe4c, lpOverlapped=0x0 | out: lpBuffer=0xdfc0880*, lpNumberOfBytesWritten=0x2ba7fe4c*=0x4029, lpOverlapped=0x0) returned 1 [0088.483] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032680 [0088.484] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032900 [0088.484] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe032900) returned 1 [0088.484] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xdfc0880) Thread: id = 1227 os_tid = 0x2058 [0083.887] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\ZqEHyyb-ebHUXQZ4.m4a" (normalized: "c:\\users\\fd1hvy\\music\\_plqwb\\zqehyyb-ebhuxqz4.m4a")) returned 0x20 [0084.483] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\ZqEHyyb-ebHUXQZ4.m4a", dwFileAttributes=0x20) returned 1 [0084.483] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\_PLqwB\\ZqEHyyb-ebHUXQZ4.m4a" (normalized: "c:\\users\\fd1hvy\\music\\_plqwb\\zqehyyb-ebhuxqz4.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfb4 [0084.483] GetFileSizeEx (in: hFile=0xfb4, lpFileSize=0x2baffa1c | out: lpFileSize=0x2baffa1c*=35204) returned 1 [0084.483] SetFilePointerEx (in: hFile=0xfb4, liDistanceToMove=0x8980, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.483] ReadFile (in: hFile=0xfb4, lpBuffer=0x2baff9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2baff99c, lpOverlapped=0x0 | out: lpBuffer=0x2baff9a0*, lpNumberOfBytesRead=0x2baff99c*=0x4, lpOverlapped=0x0) returned 1 [0084.483] SetFilePointerEx (in: hFile=0xfb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.483] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7666298 [0084.483] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7666248 [0084.483] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x76662e8 [0084.483] NtQuerySystemTime (in: CurrentTime=0x2baff97c | out: CurrentTime=0x2baff97c*=132260136416380081) returned 0x0 [0084.483] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0x8d6a295f [0084.483] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0xefc98324 [0084.483] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0x4880b851 [0084.483] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0x2471c407 [0084.483] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0xc81c29b1 [0084.483] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0xfdd8a704 [0084.484] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0x83737a5b [0084.484] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0x2ddc1933 [0084.484] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0x8a7d148e [0084.484] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0x41aa9084 [0084.484] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0x734f58ee [0084.484] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0xd3344efe [0084.484] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0x9c322aec [0084.484] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0x7224772a [0084.484] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0x6ef7626b [0084.484] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0xa9d864b6 [0084.484] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0x2cf1879e [0084.484] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0xdfd1c045 [0084.484] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0x4e74831b [0084.484] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0x2e9c7576 [0084.484] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0xd2b9e186 [0084.484] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0xbb1f9f2f [0084.484] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0xf026376c [0084.484] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0xf4d7abd7 [0084.484] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0x90a969ed [0084.484] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0x79439930 [0084.484] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0xd60ceda1 [0084.484] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0xf23969b9 [0084.484] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0x91102871 [0084.484] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0xc5a7ec1c [0084.484] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0xee95d7f [0084.484] RtlRandom (in: Seed=0x2baff988 | out: Seed=0x2baff988) returned 0x3b803b75 [0084.495] ReadFile (in: hFile=0xfb4, lpBuffer=0xdf9a060, nNumberOfBytesToRead=0x8984, lpNumberOfBytesRead=0x2baff978, lpOverlapped=0x0 | out: lpBuffer=0xdf9a060*, lpNumberOfBytesRead=0x2baff978*=0x8984, lpOverlapped=0x0) returned 1 [0084.496] SetFilePointerEx (in: hFile=0xfb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.496] WriteFile (in: hFile=0xfb4, lpBuffer=0xdfa6868*, nNumberOfBytesToWrite=0x8984, lpNumberOfBytesWritten=0x2baff974, lpOverlapped=0x0 | out: lpBuffer=0xdfa6868*, lpNumberOfBytesWritten=0x2baff974*=0x8984, lpOverlapped=0x0) returned 1 [0088.485] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0326a8 [0088.485] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032900 [0088.485] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe032900) returned 1 [0088.485] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xdfa6868) Thread: id = 1228 os_tid = 0x205c [0083.887] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\siybYIA0\\-n3dCJb.m4a" (normalized: "c:\\users\\fd1hvy\\music\\siybyia0\\-n3dcjb.m4a")) returned 0x20 [0083.887] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\siybYIA0\\-n3dCJb.m4a", dwFileAttributes=0x20) returned 1 [0083.887] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\siybYIA0\\-n3dCJb.m4a" (normalized: "c:\\users\\fd1hvy\\music\\siybyia0\\-n3dcjb.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13fc [0083.888] GetFileSizeEx (in: hFile=0x13fc, lpFileSize=0x2bb7fa80 | out: lpFileSize=0x2bb7fa80*=26895) returned 1 [0083.888] SetFilePointerEx (in: hFile=0x13fc, liDistanceToMove=0x690b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.888] ReadFile (in: hFile=0x13fc, lpBuffer=0x2bb7fa04, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bb7fa00, lpOverlapped=0x0 | out: lpBuffer=0x2bb7fa04*, lpNumberOfBytesRead=0x2bb7fa00*=0x4, lpOverlapped=0x0) returned 1 [0083.888] SetFilePointerEx (in: hFile=0x13fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.888] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x76661a8 [0084.469] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7666360 [0084.469] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7666270 [0084.469] NtQuerySystemTime (in: CurrentTime=0x2bb7f9e0 | out: CurrentTime=0x2bb7f9e0*=132260136416223211) returned 0x0 [0084.469] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0x6d802639 [0084.469] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0x31a98a60 [0084.469] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0xe5e4beb [0084.469] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0xe48a93d9 [0084.469] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0xfdb7684a [0084.469] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0xc256c907 [0084.469] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0x371d3d23 [0084.469] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0xdb532c4f [0084.469] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0x51bf88e8 [0084.469] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0x55824af [0084.469] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0xc96a65b1 [0084.469] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0xb291f5b0 [0084.469] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0x51e40b47 [0084.470] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0x74894dce [0084.470] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0x733c8ff6 [0084.470] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0xb7742e23 [0084.470] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0xeb8e2d73 [0084.470] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0x71f511af [0084.470] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0x7a1798a4 [0084.470] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0xc6792aae [0084.470] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0x8950788c [0084.470] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0xfae119fd [0084.470] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0xca7edcb0 [0084.470] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0xaee8ee0d [0084.470] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0xb14a9259 [0084.470] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0x8e1439bb [0084.470] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0x1222abf [0084.470] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0x21a7f [0084.470] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0xde04ff4f [0084.470] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0xc306820e [0084.470] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0x39187e42 [0084.470] RtlRandom (in: Seed=0x2bb7f9ec | out: Seed=0x2bb7f9ec) returned 0xc54b00b3 [0084.481] ReadFile (in: hFile=0x13fc, lpBuffer=0xdf80048, nNumberOfBytesToRead=0x690f, lpNumberOfBytesRead=0x2bb7f9dc, lpOverlapped=0x0 | out: lpBuffer=0xdf80048*, lpNumberOfBytesRead=0x2bb7f9dc*=0x690f, lpOverlapped=0x0) returned 1 [0084.482] SetFilePointerEx (in: hFile=0x13fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.482] WriteFile (in: hFile=0x13fc, lpBuffer=0xdf8c850*, nNumberOfBytesToWrite=0x690f, lpNumberOfBytesWritten=0x2bb7f9d8, lpOverlapped=0x0 | out: lpBuffer=0xdf8c850*, lpNumberOfBytesWritten=0x2bb7f9d8*=0x690f, lpOverlapped=0x0) returned 1 [0088.462] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032658 [0088.462] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032900 [0088.462] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe032900) returned 1 [0088.462] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xdf8c850) Thread: id = 1229 os_tid = 0x2060 [0083.888] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x6e96458 [0083.888] wcscpy (in: _Dest=0x6e96458, _Source="C:\\Users\\FD1HVy\\Music\\siybYIA0\\BpRZWhTjsHD" | out: _Dest="C:\\Users\\FD1HVy\\Music\\siybYIA0\\BpRZWhTjsHD") returned="C:\\Users\\FD1HVy\\Music\\siybYIA0\\BpRZWhTjsHD" [0083.888] wcscat (in: _Dest=0x6e96458, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\siybYIA0\\BpRZWhTjsHD\\") returned="C:\\Users\\FD1HVy\\Music\\siybYIA0\\BpRZWhTjsHD\\" [0083.888] wcscat (in: _Dest=0x6e96458, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Music\\siybYIA0\\BpRZWhTjsHD\\*") returned="C:\\Users\\FD1HVy\\Music\\siybYIA0\\BpRZWhTjsHD\\*" [0083.888] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a35a8 [0083.888] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\siybYIA0\\BpRZWhTjsHD\\*", lpFindFileData=0x53a35a8 | out: lpFindFileData=0x53a35a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb20197b0, ftCreationTime.dwHighDateTime=0x1d5ca9e, ftLastAccessTime.dwLowDateTime=0x2e87d0d0, ftLastAccessTime.dwHighDateTime=0x1d5d678, ftLastWriteTime.dwLowDateTime=0x2e87d0d0, ftLastWriteTime.dwHighDateTime=0x1d5d678, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7568008 [0088.028] wcscmp (_String1=".", _String2=".") returned 0 [0088.028] FindNextFileW (hFindFile=0x7568008, lpFindFileData=0x53a35a8) Thread: id = 1230 os_tid = 0x2064 [0083.889] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\siybYIA0\\CK9Wpw.wav" (normalized: "c:\\users\\fd1hvy\\music\\siybyia0\\ck9wpw.wav")) returned 0x20 [0083.889] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\siybYIA0\\CK9Wpw.wav", dwFileAttributes=0x20) returned 1 [0083.889] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\siybYIA0\\CK9Wpw.wav" (normalized: "c:\\users\\fd1hvy\\music\\siybyia0\\ck9wpw.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15a0 [0083.889] GetFileSizeEx (in: hFile=0x15a0, lpFileSize=0x2bc7f784 | out: lpFileSize=0x2bc7f784*=93816) returned 1 [0083.889] SetFilePointerEx (in: hFile=0x15a0, liDistanceToMove=0x16e74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.889] ReadFile (in: hFile=0x15a0, lpBuffer=0x2bc7f708, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bc7f704, lpOverlapped=0x0 | out: lpBuffer=0x2bc7f708*, lpNumberOfBytesRead=0x2bc7f704*=0x4, lpOverlapped=0x0) returned 1 [0083.890] SetFilePointerEx (in: hFile=0x15a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.890] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x764be20 [0084.451] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x764bd58 [0084.451] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x764bf10 [0084.451] NtQuerySystemTime (in: CurrentTime=0x2bc7f6e4 | out: CurrentTime=0x2bc7f6e4*=132260136416067643) returned 0x0 [0084.451] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0xf6a9f83d [0084.451] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0x7ed1b08d [0084.451] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0x60867300 [0084.452] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0x9cc7758e [0084.452] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0x13c4a38e [0084.452] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0x4de61f81 [0084.452] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0xad211dd4 [0084.452] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0xf00e0185 [0084.452] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0xdb8c32ae [0084.452] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0xe5a300f1 [0084.452] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0xa1a8712d [0084.452] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0x7a76d564 [0084.452] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0x9d8a1719 [0084.452] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0xca0e6cd6 [0084.452] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0xe9f1e359 [0084.452] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0x8ea2fee7 [0084.452] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0xe27e8fa3 [0084.452] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0xac4a8caa [0084.452] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0x6806920d [0084.452] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0x5232c0c [0084.452] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0x7c3e641c [0084.452] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0x239c6ca4 [0084.452] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0xf8003074 [0084.452] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0x395c4ddc [0084.452] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0x837d67b [0084.452] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0x3c10e8b6 [0084.452] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0x6ee60af8 [0084.452] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0xb07a0335 [0084.452] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0x1a7757a5 [0084.452] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0x5e10d899 [0084.452] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0x52fb3d61 [0084.452] RtlRandom (in: Seed=0x2bc7f6f0 | out: Seed=0x2bc7f6f0) returned 0xde674eff [0084.461] SetFilePointerEx (in: hFile=0x15a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.462] ReadFile (in: hFile=0x15a0, lpBuffer=0x764c5a8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2bc7f6c4, lpOverlapped=0x0 | out: lpBuffer=0x764c5a8*, lpNumberOfBytesRead=0x2bc7f6c4*=0xc800, lpOverlapped=0x0) returned 1 [0084.462] SetFilePointerEx (in: hFile=0x15a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.462] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba80f0 [0084.462] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x75750a0 [0084.462] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x764bf88 [0084.462] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x764bf88) returned 1 [0084.463] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x7658db0 [0084.468] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x764bda8 [0084.468] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x764bc68 [0084.468] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x764bc68) returned 1 [0084.468] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75750a0) returned 1 [0084.468] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba80f0) returned 1 [0084.468] WriteFile (in: hFile=0x15a0, lpBuffer=0x7658db0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2bc7f6c4, lpOverlapped=0x0 | out: lpBuffer=0x7658db0*, lpNumberOfBytesWritten=0x2bc7f6c4*=0xc800, lpOverlapped=0x0) returned 1 [0088.459] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7658db0) Thread: id = 1231 os_tid = 0x2068 [0083.890] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\siybYIA0\\G3vnT-RcV.mp3" (normalized: "c:\\users\\fd1hvy\\music\\siybyia0\\g3vnt-rcv.mp3")) returned 0x20 [0083.890] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\siybYIA0\\G3vnT-RcV.mp3", dwFileAttributes=0x20) returned 1 [0083.890] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\siybYIA0\\G3vnT-RcV.mp3" (normalized: "c:\\users\\fd1hvy\\music\\siybyia0\\g3vnt-rcv.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1408 [0083.890] GetFileSizeEx (in: hFile=0x1408, lpFileSize=0x2bcffc7c | out: lpFileSize=0x2bcffc7c*=5658) returned 1 [0083.890] SetFilePointerEx (in: hFile=0x1408, liDistanceToMove=0x1616, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.891] ReadFile (in: hFile=0x1408, lpBuffer=0x2bcffc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bcffbfc, lpOverlapped=0x0 | out: lpBuffer=0x2bcffc00*, lpNumberOfBytesRead=0x2bcffbfc*=0x4, lpOverlapped=0x0) returned 1 [0083.891] SetFilePointerEx (in: hFile=0x1408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.891] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x75cb030 [0084.440] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x75cb008 [0084.440] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x75cb260 [0084.440] NtQuerySystemTime (in: CurrentTime=0x2bcffbdc | out: CurrentTime=0x2bcffbdc*=132260136415911187) returned 0x0 [0084.440] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0xa2480c78 [0084.440] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0xb148d7f1 [0084.440] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0x732a0912 [0084.440] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0x12a6f720 [0084.440] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0x25bb5b4a [0084.440] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0xf33767e5 [0084.440] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0xabde6df9 [0084.440] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0xe00a7f96 [0084.440] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0xf4545fe [0084.440] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0x5ed1cfec [0084.440] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0x28cdee75 [0084.440] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0x6e54d62d [0084.440] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0xc6c7b2a0 [0084.440] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0xe01879ba [0084.440] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0x69d8a42e [0084.440] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0xf9d9c060 [0084.440] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0xcc195dfb [0084.440] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0x68aae8cd [0084.440] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0x9c1cd207 [0084.440] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0x48c876d6 [0084.440] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0xa1d9f8d2 [0084.440] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0x6d1bb1a0 [0084.440] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0x62426370 [0084.440] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0x9f4e0acf [0084.440] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0x9874b57f [0084.441] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0xe8dccce5 [0084.441] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0x643b6019 [0084.441] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0x84722c64 [0084.441] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0xf7acfc01 [0084.441] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0xaf8219d [0084.441] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0x99f0b638 [0084.441] RtlRandom (in: Seed=0x2bcffbe8 | out: Seed=0x2bcffbe8) returned 0x6b7684f6 [0084.451] ReadFile (in: hFile=0x1408, lpBuffer=0x7632590, nNumberOfBytesToRead=0x161a, lpNumberOfBytesRead=0x2bcffbd8, lpOverlapped=0x0 | out: lpBuffer=0x7632590*, lpNumberOfBytesRead=0x2bcffbd8*=0x161a, lpOverlapped=0x0) returned 1 [0084.451] SetFilePointerEx (in: hFile=0x1408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.451] WriteFile (in: hFile=0x1408, lpBuffer=0x763ed98*, nNumberOfBytesToWrite=0x161a, lpNumberOfBytesWritten=0x2bcffbd4, lpOverlapped=0x0 | out: lpBuffer=0x763ed98*, lpNumberOfBytesWritten=0x2bcffbd4*=0x161a, lpOverlapped=0x0) returned 1 [0088.458] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032630 [0088.458] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032900 [0088.458] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe032900) returned 1 [0088.458] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x763ed98) Thread: id = 1232 os_tid = 0x206c [0083.891] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\siybYIA0\\kPk65KjtvzEdXF.m4a" (normalized: "c:\\users\\fd1hvy\\music\\siybyia0\\kpk65kjtvzedxf.m4a")) returned 0x20 [0084.419] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\siybYIA0\\kPk65KjtvzEdXF.m4a", dwFileAttributes=0x20) returned 1 [0084.419] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\siybYIA0\\kPk65KjtvzEdXF.m4a" (normalized: "c:\\users\\fd1hvy\\music\\siybyia0\\kpk65kjtvzedxf.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfdc [0084.419] GetFileSizeEx (in: hFile=0xfdc, lpFileSize=0x2bd7fe5c | out: lpFileSize=0x2bd7fe5c*=25811) returned 1 [0084.419] SetFilePointerEx (in: hFile=0xfdc, liDistanceToMove=0x64cf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.419] ReadFile (in: hFile=0xfdc, lpBuffer=0x2bd7fde0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bd7fddc, lpOverlapped=0x0 | out: lpBuffer=0x2bd7fde0*, lpNumberOfBytesRead=0x2bd7fddc*=0x4, lpOverlapped=0x0) returned 1 [0084.419] SetFilePointerEx (in: hFile=0xfdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.419] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x75ff870 [0084.419] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x75ff898 [0084.419] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x75ff5c8 [0084.419] NtQuerySystemTime (in: CurrentTime=0x2bd7fdbc | out: CurrentTime=0x2bd7fdbc*=132260136415754938) returned 0x0 [0084.419] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0x18496a2e [0084.419] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0xa7ad11c4 [0084.419] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0x4614b6b0 [0084.419] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0x979819d6 [0084.419] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0x6d2cf225 [0084.419] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0x37901e0f [0084.419] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0x7a36f171 [0084.419] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0x82ed3366 [0084.419] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0xa3f79598 [0084.419] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0x8cb35694 [0084.419] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0xb4ed0d65 [0084.419] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0xa48d07a0 [0084.419] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0xcc38fd66 [0084.419] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0x80848ef1 [0084.420] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0xaac88a58 [0084.420] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0xc10fe515 [0084.420] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0xd821d542 [0084.420] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0xbbeefbf2 [0084.420] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0xfa1d9711 [0084.420] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0x637a1adc [0084.420] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0xa84499cd [0084.420] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0x77fb0f07 [0084.420] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0x96245c02 [0084.420] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0x5aa8af2f [0084.420] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0x8f19a700 [0084.420] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0x657f1b93 [0084.420] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0x51c70b9f [0084.420] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0x233a38f9 [0084.420] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0x75687931 [0084.420] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0x9149463 [0084.420] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0xe0e6cd0c [0084.420] RtlRandom (in: Seed=0x2bd7fdc8 | out: Seed=0x2bd7fdc8) returned 0x794452c8 [0084.438] ReadFile (in: hFile=0xfdc, lpBuffer=0x7619580, nNumberOfBytesToRead=0x64d3, lpNumberOfBytesRead=0x2bd7fdb8, lpOverlapped=0x0 | out: lpBuffer=0x7619580*, lpNumberOfBytesRead=0x2bd7fdb8*=0x64d3, lpOverlapped=0x0) returned 1 [0084.439] SetFilePointerEx (in: hFile=0xfdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.439] WriteFile (in: hFile=0xfdc, lpBuffer=0x7625d88*, nNumberOfBytesToWrite=0x64d3, lpNumberOfBytesWritten=0x2bd7fdb4, lpOverlapped=0x0 | out: lpBuffer=0x7625d88*, lpNumberOfBytesWritten=0x2bd7fdb4*=0x64d3, lpOverlapped=0x0) returned 1 [0088.457] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032608 [0088.457] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032900 [0088.457] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe032900) returned 1 [0088.457] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7625d88) Thread: id = 1233 os_tid = 0x2070 [0083.892] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\siybYIA0\\qzOf3JFfs-J.m4a" (normalized: "c:\\users\\fd1hvy\\music\\siybyia0\\qzof3jffs-j.m4a")) returned 0x20 [0083.892] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\siybYIA0\\qzOf3JFfs-J.m4a", dwFileAttributes=0x20) returned 1 [0083.892] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\siybYIA0\\qzOf3JFfs-J.m4a" (normalized: "c:\\users\\fd1hvy\\music\\siybyia0\\qzof3jffs-j.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1404 [0083.892] GetFileSizeEx (in: hFile=0x1404, lpFileSize=0x2bdffc58 | out: lpFileSize=0x2bdffc58*=33677) returned 1 [0083.892] SetFilePointerEx (in: hFile=0x1404, liDistanceToMove=0x8389, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.892] ReadFile (in: hFile=0x1404, lpBuffer=0x2bdffbdc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bdffbd8, lpOverlapped=0x0 | out: lpBuffer=0x2bdffbdc*, lpNumberOfBytesRead=0x2bdffbd8*=0x4, lpOverlapped=0x0) returned 1 [0083.892] SetFilePointerEx (in: hFile=0x1404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.892] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x75ff7f8 [0084.406] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x75ff848 [0084.406] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x75ff7a8 [0084.406] NtQuerySystemTime (in: CurrentTime=0x2bdffbb8 | out: CurrentTime=0x2bdffbb8*=132260136415598292) returned 0x0 [0084.406] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0x526c069 [0084.406] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0xa092404a [0084.406] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0xb67d6d91 [0084.406] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0x439b606 [0084.406] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0x59aeb4ee [0084.406] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0x77cd776e [0084.406] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0x1dcefe6d [0084.406] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0xacfda7cd [0084.406] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0x49c80327 [0084.406] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0x2690ffee [0084.406] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0xde5c5ee8 [0084.406] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0x21106f97 [0084.406] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0x7f99a04e [0084.406] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0xfc577585 [0084.406] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0xed1c0c31 [0084.406] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0xb0870ec [0084.406] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0x2fb48573 [0084.406] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0xc5be69dc [0084.406] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0x16850d [0084.406] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0x825043e6 [0084.406] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0xe91ef4b [0084.406] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0x71998737 [0084.406] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0x71d8e17a [0084.406] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0x931155b [0084.406] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0x58d06d1e [0084.406] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0xffc391ae [0084.406] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0xb5654a42 [0084.406] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0x82dd1d30 [0084.406] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0x5af52fa6 [0084.406] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0x31dd86fa [0084.406] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0xb1d48e41 [0084.407] RtlRandom (in: Seed=0x2bdffbc4 | out: Seed=0x2bdffbc4) returned 0x260761cb [0084.417] ReadFile (in: hFile=0x1404, lpBuffer=0x7600570, nNumberOfBytesToRead=0x838d, lpNumberOfBytesRead=0x2bdffbb4, lpOverlapped=0x0 | out: lpBuffer=0x7600570*, lpNumberOfBytesRead=0x2bdffbb4*=0x838d, lpOverlapped=0x0) returned 1 [0084.418] SetFilePointerEx (in: hFile=0x1404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.418] WriteFile (in: hFile=0x1404, lpBuffer=0x760cd78*, nNumberOfBytesToWrite=0x838d, lpNumberOfBytesWritten=0x2bdffbb0, lpOverlapped=0x0 | out: lpBuffer=0x760cd78*, lpNumberOfBytesWritten=0x2bdffbb0*=0x838d, lpOverlapped=0x0) returned 1 [0088.447] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032ae0 [0088.447] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032900 [0088.447] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe032900) returned 1 [0088.447] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x760cd78) Thread: id = 1234 os_tid = 0x2074 [0083.893] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\siybYIA0\\u HkfxB.mp3" (normalized: "c:\\users\\fd1hvy\\music\\siybyia0\\u hkfxb.mp3")) returned 0x20 [0083.893] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\siybYIA0\\u HkfxB.mp3", dwFileAttributes=0x20) returned 1 [0083.893] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\siybYIA0\\u HkfxB.mp3" (normalized: "c:\\users\\fd1hvy\\music\\siybyia0\\u hkfxb.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1594 [0083.893] GetFileSizeEx (in: hFile=0x1594, lpFileSize=0x2be7f874 | out: lpFileSize=0x2be7f874*=12071) returned 1 [0083.893] SetFilePointerEx (in: hFile=0x1594, liDistanceToMove=0x2f23, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.893] ReadFile (in: hFile=0x1594, lpBuffer=0x2be7f7f8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2be7f7f4, lpOverlapped=0x0 | out: lpBuffer=0x2be7f7f8*, lpNumberOfBytesRead=0x2be7f7f4*=0x4, lpOverlapped=0x0) returned 1 [0083.893] SetFilePointerEx (in: hFile=0x1594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.893] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x75e6348 [0084.394] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x75e60a0 [0084.394] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x75e6118 [0084.394] NtQuerySystemTime (in: CurrentTime=0x2be7f7d4 | out: CurrentTime=0x2be7f7d4*=132260136415598292) returned 0x0 [0084.394] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0xe84bfb6b [0084.394] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0xe981918c [0084.394] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0x7b72466e [0084.394] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0x1d7c6e27 [0084.394] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0xfa46f6f0 [0084.394] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0x7cf76eb [0084.394] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0xea99e2c1 [0084.394] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0x346fc6ef [0084.394] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0x295f6ec6 [0084.394] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0x6f6862f2 [0084.395] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0x2c967659 [0084.395] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0xa5db16d5 [0084.395] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0x86fcb2e6 [0084.395] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0xa3d31003 [0084.395] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0x64009ad6 [0084.395] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0x95857228 [0084.395] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0x71bf7b04 [0084.395] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0x4ec69559 [0084.395] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0xfb26f2b1 [0084.395] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0x136bf8e6 [0084.395] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0x435a99a7 [0084.395] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0xe3cc4451 [0084.395] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0xdb88dc0a [0084.395] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0x7a8a7457 [0084.395] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0x1d46e6ce [0084.395] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0xe47621ab [0084.395] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0x904a1cbd [0084.395] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0x62d94056 [0084.395] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0x6afcf7e5 [0084.395] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0x63c891ed [0084.395] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0xb8ff1969 [0084.395] RtlRandom (in: Seed=0x2be7f7e0 | out: Seed=0x2be7f7e0) returned 0x658bf064 [0084.405] ReadFile (in: hFile=0x1594, lpBuffer=0x75e6558, nNumberOfBytesToRead=0x2f27, lpNumberOfBytesRead=0x2be7f7d0, lpOverlapped=0x0 | out: lpBuffer=0x75e6558*, lpNumberOfBytesRead=0x2be7f7d0*=0x2f27, lpOverlapped=0x0) returned 1 [0084.405] SetFilePointerEx (in: hFile=0x1594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.406] WriteFile (in: hFile=0x1594, lpBuffer=0x75f2d60*, nNumberOfBytesToWrite=0x2f27, lpNumberOfBytesWritten=0x2be7f7cc, lpOverlapped=0x0 | out: lpBuffer=0x75f2d60*, lpNumberOfBytesWritten=0x2be7f7cc*=0x2f27, lpOverlapped=0x0) returned 1 [0088.422] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0329f0 [0088.422] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032900 [0088.422] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe032900) returned 1 [0088.422] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75f2d60) Thread: id = 1235 os_tid = 0x2078 [0083.894] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\siybYIA0\\xwWMYSyBx.wav" (normalized: "c:\\users\\fd1hvy\\music\\siybyia0\\xwwmysybx.wav")) returned 0x20 [0083.894] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\siybYIA0\\xwWMYSyBx.wav", dwFileAttributes=0x20) returned 1 [0083.894] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\siybYIA0\\xwWMYSyBx.wav" (normalized: "c:\\users\\fd1hvy\\music\\siybyia0\\xwwmysybx.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x140c [0083.894] GetFileSizeEx (in: hFile=0x140c, lpFileSize=0x2beff7f8 | out: lpFileSize=0x2beff7f8*=59288) returned 1 [0083.894] SetFilePointerEx (in: hFile=0x140c, liDistanceToMove=0xe794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.894] ReadFile (in: hFile=0x140c, lpBuffer=0x2beff77c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2beff778, lpOverlapped=0x0 | out: lpBuffer=0x2beff77c*, lpNumberOfBytesRead=0x2beff778*=0x4, lpOverlapped=0x0) returned 1 [0083.894] SetFilePointerEx (in: hFile=0x140c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.894] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x75cbfc0 [0084.376] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x75cc290 [0084.376] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x75cc2e0 [0084.376] NtQuerySystemTime (in: CurrentTime=0x2beff758 | out: CurrentTime=0x2beff758*=132260136415323651) returned 0x0 [0084.376] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0x12cb0e54 [0084.376] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0x6cf2e7dc [0084.376] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0xc4d410c8 [0084.376] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0x2ea82cd0 [0084.376] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0x75e50293 [0084.376] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0xb2d63fcf [0084.376] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0x933bbfb7 [0084.376] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0x2393e304 [0084.376] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0xb747904d [0084.376] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0x2bab02f2 [0084.377] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0x8e3dd46d [0084.377] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0xfaa7a040 [0084.377] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0x7ce3aa6d [0084.377] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0x972eb99 [0084.377] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0x24bf5f66 [0084.377] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0x393f764f [0084.377] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0xbf78efd6 [0084.377] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0x9131f506 [0084.377] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0x119394b [0084.377] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0x924ef1d4 [0084.377] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0x3058ada0 [0084.377] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0x79db1965 [0084.377] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0x348ae23b [0084.377] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0x500f335 [0084.377] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0x9bd2f18f [0084.377] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0x391d03fe [0084.377] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0x6995636b [0084.377] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0x35369ea4 [0084.377] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0xd048784a [0084.377] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0x70f1c060 [0084.377] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0x81e0df2c [0084.377] RtlRandom (in: Seed=0x2beff764 | out: Seed=0x2beff764) returned 0x11fc11ac [0084.387] SetFilePointerEx (in: hFile=0x140c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.387] ReadFile (in: hFile=0x140c, lpBuffer=0x75cc540, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2beff738, lpOverlapped=0x0 | out: lpBuffer=0x75cc540*, lpNumberOfBytesRead=0x2beff738*=0xc800, lpOverlapped=0x0) returned 1 [0084.387] SetFilePointerEx (in: hFile=0x140c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.387] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8888 [0084.387] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x7566798 [0084.387] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x75cc420 [0084.387] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75cc420) returned 1 [0084.388] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x75d8d48 [0084.394] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x75cc240 [0084.394] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x75cc100 [0084.394] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75cc100) returned 1 [0084.394] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7566798) returned 1 [0084.394] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8888) returned 1 [0084.394] WriteFile (in: hFile=0x140c, lpBuffer=0x75d8d48*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2beff738, lpOverlapped=0x0 | out: lpBuffer=0x75d8d48*, lpNumberOfBytesWritten=0x2beff738*=0xc800, lpOverlapped=0x0) returned 1 [0088.424] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75d8d48) Thread: id = 1236 os_tid = 0x207c [0083.896] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x68) returned 0x5468010 [0083.896] wcscpy (in: _Dest=0x5468010, _Source="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk" [0083.896] wcscat (in: _Dest=0x5468010, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\" [0083.896] wcscat (in: _Dest=0x5468010, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\*") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\*" [0083.896] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a3a78 [0083.896] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\*", lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f8fe320, ftCreationTime.dwHighDateTime=0x1d5d399, ftLastAccessTime.dwLowDateTime=0xaee79dd0, ftLastAccessTime.dwHighDateTime=0x1d5cc5c, ftLastWriteTime.dwLowDateTime=0xaee79dd0, ftLastWriteTime.dwHighDateTime=0x1d5cc5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ee00 [0084.369] wcscmp (_String1=".", _String2=".") returned 0 [0084.369] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f8fe320, ftCreationTime.dwHighDateTime=0x1d5d399, ftLastAccessTime.dwLowDateTime=0xaee79dd0, ftLastAccessTime.dwHighDateTime=0x1d5cc5c, ftLastWriteTime.dwLowDateTime=0xaee79dd0, ftLastWriteTime.dwHighDateTime=0x1d5cc5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.369] wcscmp (_String1="..", _String2=".") returned 1 [0084.369] wcscmp (_String1="..", _String2="..") returned 0 [0084.369] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49f4b1e0, ftCreationTime.dwHighDateTime=0x1d5d50a, ftLastAccessTime.dwLowDateTime=0xe1f00b00, ftLastAccessTime.dwHighDateTime=0x1d5d3a4, ftLastWriteTime.dwLowDateTime=0xe1f00b00, ftLastWriteTime.dwHighDateTime=0x1d5d3a4, nFileSizeHigh=0x0, nFileSizeLow=0x2f2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="-Rby7lqvDeb-nM.mkv", cAlternateFileName="-RBY7L~1.MKV")) returned 1 [0084.369] wcscmp (_String1="-Rby7lqvDeb-nM.mkv", _String2=".") returned -1 [0084.369] wcscmp (_String1="-Rby7lqvDeb-nM.mkv", _String2="..") returned -1 [0084.369] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8a) returned 0x549f140 [0084.369] wcscpy (in: _Dest=0x549f140, _Source="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk" [0084.369] wcscat (in: _Dest=0x549f140, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\" [0084.369] wcscat (in: _Dest=0x549f140, _Source="-Rby7lqvDeb-nM.mkv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\-Rby7lqvDeb-nM.mkv") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\-Rby7lqvDeb-nM.mkv" [0084.369] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549f140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd8 [0084.369] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa64f4fd0, ftCreationTime.dwHighDateTime=0x1d5d7d1, ftLastAccessTime.dwLowDateTime=0x23e3bfc0, ftLastAccessTime.dwHighDateTime=0x1d5d143, ftLastWriteTime.dwLowDateTime=0x23e3bfc0, ftLastWriteTime.dwHighDateTime=0x1d5d143, nFileSizeHigh=0x0, nFileSizeLow=0x13733, dwReserved0=0x0, dwReserved1=0x0, cFileName="DyTplOcj_Hb.flv", cAlternateFileName="DYTPLO~1.FLV")) returned 1 [0084.370] wcscmp (_String1="DyTplOcj_Hb.flv", _String2=".") returned 1 [0084.370] wcscmp (_String1="DyTplOcj_Hb.flv", _String2="..") returned 1 [0084.370] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x84) returned 0x549cfc8 [0084.370] wcscpy (in: _Dest=0x549cfc8, _Source="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk" [0084.370] wcscat (in: _Dest=0x549cfc8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\" [0084.370] wcscat (in: _Dest=0x549cfc8, _Source="DyTplOcj_Hb.flv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\DyTplOcj_Hb.flv") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\DyTplOcj_Hb.flv" [0084.370] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549cfc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc88 [0084.370] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dc6930, ftCreationTime.dwHighDateTime=0x1d5d7fa, ftLastAccessTime.dwLowDateTime=0xc398c870, ftLastAccessTime.dwHighDateTime=0x1d5cc44, ftLastWriteTime.dwLowDateTime=0xc398c870, ftLastWriteTime.dwHighDateTime=0x1d5cc44, nFileSizeHigh=0x0, nFileSizeLow=0x17841, dwReserved0=0x0, dwReserved1=0x0, cFileName="gyl0Juvrwt3WAnJzr.flv", cAlternateFileName="GYL0JU~1.FLV")) returned 1 [0084.370] wcscmp (_String1="gyl0Juvrwt3WAnJzr.flv", _String2=".") returned 1 [0084.370] wcscmp (_String1="gyl0Juvrwt3WAnJzr.flv", _String2="..") returned 1 [0084.370] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x90) returned 0x549f860 [0084.370] wcscpy (in: _Dest=0x549f860, _Source="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk" [0084.370] wcscat (in: _Dest=0x549f860, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\" [0084.371] wcscat (in: _Dest=0x549f860, _Source="gyl0Juvrwt3WAnJzr.flv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\gyl0Juvrwt3WAnJzr.flv") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\gyl0Juvrwt3WAnJzr.flv" [0084.371] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549f860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd4 [0084.371] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa482e0, ftCreationTime.dwHighDateTime=0x1d5d6ca, ftLastAccessTime.dwLowDateTime=0xd6e0ccf0, ftLastAccessTime.dwHighDateTime=0x1d5cbba, ftLastWriteTime.dwLowDateTime=0xd6e0ccf0, ftLastWriteTime.dwHighDateTime=0x1d5cbba, nFileSizeHigh=0x0, nFileSizeLow=0x1814, dwReserved0=0x0, dwReserved1=0x0, cFileName="iXqfQB_G9v_u.swf", cAlternateFileName="IXQFQB~1.SWF")) returned 1 [0084.371] wcscmp (_String1="iXqfQB_G9v_u.swf", _String2=".") returned 1 [0084.371] wcscmp (_String1="iXqfQB_G9v_u.swf", _String2="..") returned 1 [0084.371] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x86) returned 0x549d058 [0084.371] wcscpy (in: _Dest=0x549d058, _Source="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk" [0084.371] wcscat (in: _Dest=0x549d058, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\" [0084.371] wcscat (in: _Dest=0x549d058, _Source="iXqfQB_G9v_u.swf" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\iXqfQB_G9v_u.swf") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\iXqfQB_G9v_u.swf" [0084.371] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549d058, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc8 [0084.372] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8292850, ftCreationTime.dwHighDateTime=0x1d5d1f7, ftLastAccessTime.dwLowDateTime=0x73ad1ed0, ftLastAccessTime.dwHighDateTime=0x1d5ccb5, ftLastWriteTime.dwLowDateTime=0x73ad1ed0, ftLastWriteTime.dwHighDateTime=0x1d5ccb5, nFileSizeHigh=0x0, nFileSizeLow=0x9dc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="lXHSP.flv", cAlternateFileName="")) returned 1 [0084.372] wcscmp (_String1="lXHSP.flv", _String2=".") returned 1 [0084.372] wcscmp (_String1="lXHSP.flv", _String2="..") returned 1 [0084.372] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x78) returned 0x38d1620 [0084.372] wcscpy (in: _Dest=0x38d1620, _Source="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk" [0084.372] wcscat (in: _Dest=0x38d1620, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\" [0084.372] wcscat (in: _Dest=0x38d1620, _Source="lXHSP.flv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\lXHSP.flv") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\lXHSP.flv" [0084.372] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d1620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc4 [0084.373] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a06c970, ftCreationTime.dwHighDateTime=0x1d5cf0d, ftLastAccessTime.dwLowDateTime=0x2695ad0, ftLastAccessTime.dwHighDateTime=0x1d5cfef, ftLastWriteTime.dwLowDateTime=0x2695ad0, ftLastWriteTime.dwHighDateTime=0x1d5cfef, nFileSizeHigh=0x0, nFileSizeLow=0x79d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TNhbiIx 01.avi", cAlternateFileName="TNHBII~1.AVI")) returned 1 [0084.373] wcscmp (_String1="TNhbiIx 01.avi", _String2=".") returned 1 [0084.373] wcscmp (_String1="TNhbiIx 01.avi", _String2="..") returned 1 [0084.373] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x82) returned 0x549d448 [0084.373] wcscpy (in: _Dest=0x549d448, _Source="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk" [0084.373] wcscat (in: _Dest=0x549d448, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\" [0084.373] wcscat (in: _Dest=0x549d448, _Source="TNhbiIx 01.avi" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\TNhbiIx 01.avi") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\TNhbiIx 01.avi" [0084.373] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549d448, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc0 [0084.373] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaf23440, ftCreationTime.dwHighDateTime=0x1d5d5e5, ftLastAccessTime.dwLowDateTime=0xc1268d50, ftLastAccessTime.dwHighDateTime=0x1d5ccaf, ftLastWriteTime.dwLowDateTime=0xc1268d50, ftLastWriteTime.dwHighDateTime=0x1d5ccaf, nFileSizeHigh=0x0, nFileSizeLow=0x12169, dwReserved0=0x0, dwReserved1=0x0, cFileName="uwJxsovSXPTKJH0L67.mp4", cAlternateFileName="UWJXSO~1.MP4")) returned 1 [0084.374] wcscmp (_String1="uwJxsovSXPTKJH0L67.mp4", _String2=".") returned 1 [0084.374] wcscmp (_String1="uwJxsovSXPTKJH0L67.mp4", _String2="..") returned 1 [0084.374] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x92) returned 0x55c6398 [0084.374] wcscpy (in: _Dest=0x55c6398, _Source="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk" [0084.374] wcscat (in: _Dest=0x55c6398, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\" [0084.374] wcscat (in: _Dest=0x55c6398, _Source="uwJxsovSXPTKJH0L67.mp4" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\uwJxsovSXPTKJH0L67.mp4") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\uwJxsovSXPTKJH0L67.mp4" [0084.374] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55c6398, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfbc [0084.374] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bed5630, ftCreationTime.dwHighDateTime=0x1d5d6a7, ftLastAccessTime.dwLowDateTime=0xb4dd6d40, ftLastAccessTime.dwHighDateTime=0x1d5d18a, ftLastWriteTime.dwLowDateTime=0xb4dd6d40, ftLastWriteTime.dwHighDateTime=0x1d5d18a, nFileSizeHigh=0x0, nFileSizeLow=0xaa5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="zTp 07Muzep9Gcg6BXy.flv", cAlternateFileName="ZTP07M~1.FLV")) returned 1 [0084.374] wcscmp (_String1="zTp 07Muzep9Gcg6BXy.flv", _String2=".") returned 1 [0084.374] wcscmp (_String1="zTp 07Muzep9Gcg6BXy.flv", _String2="..") returned 1 [0084.374] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x94) returned 0x55c5c18 [0084.374] wcscpy (in: _Dest=0x55c5c18, _Source="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk" [0084.374] wcscat (in: _Dest=0x55c5c18, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\" [0084.374] wcscat (in: _Dest=0x55c5c18, _Source="zTp 07Muzep9Gcg6BXy.flv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\zTp 07Muzep9Gcg6BXy.flv") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\zTp 07Muzep9Gcg6BXy.flv" [0084.374] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55c5c18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfb8 [0084.375] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bed5630, ftCreationTime.dwHighDateTime=0x1d5d6a7, ftLastAccessTime.dwLowDateTime=0xb4dd6d40, ftLastAccessTime.dwHighDateTime=0x1d5d18a, ftLastWriteTime.dwLowDateTime=0xb4dd6d40, ftLastWriteTime.dwHighDateTime=0x1d5d18a, nFileSizeHigh=0x0, nFileSizeLow=0xaa5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="zTp 07Muzep9Gcg6BXy.flv", cAlternateFileName="ZTP07M~1.FLV")) returned 0 [0084.375] FindClose (in: hFindFile=0x389ee00 | out: hFindFile=0x389ee00) returned 1 [0084.375] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a3a78) returned 1 [0084.375] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5468010) returned 1 [0084.375] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54680f0) returned 1 Thread: id = 1237 os_tid = 0x2080 [0083.896] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\j1UAx9SN6m.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\j1uax9sn6m.mp4")) returned 0x20 [0084.350] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\j1UAx9SN6m.mp4", dwFileAttributes=0x20) returned 1 [0084.350] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\j1UAx9SN6m.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\j1uax9sn6m.mp4"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfe0 [0084.350] GetFileSizeEx (in: hFile=0xfe0, lpFileSize=0x2bfff898 | out: lpFileSize=0x2bfff898*=88974) returned 1 [0084.350] SetFilePointerEx (in: hFile=0xfe0, liDistanceToMove=0x15b8a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.350] ReadFile (in: hFile=0xfe0, lpBuffer=0x2bfff81c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bfff818, lpOverlapped=0x0 | out: lpBuffer=0x2bfff81c*, lpNumberOfBytesRead=0x2bfff818*=0x4, lpOverlapped=0x0) returned 1 [0084.350] SetFilePointerEx (in: hFile=0xfe0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.350] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7565ef0 [0084.350] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7565c70 [0084.350] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7565fe0 [0084.350] NtQuerySystemTime (in: CurrentTime=0x2bfff7f8 | out: CurrentTime=0x2bfff7f8*=132260136415129472) returned 0x0 [0084.350] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0xd28d8d03 [0084.350] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0x1c8bfcb4 [0084.350] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0x6a2518a6 [0084.350] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0x350c8ed7 [0084.350] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0x1c79acd9 [0084.350] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0xd5b36444 [0084.350] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0xda5492d0 [0084.350] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0x6d8c4b28 [0084.350] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0xa0384a8a [0084.350] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0x5b98925b [0084.350] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0x1c7b299b [0084.351] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0xf6758096 [0084.351] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0x4ca11b37 [0084.351] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0x2b484ce0 [0084.351] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0xb61b325e [0084.351] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0x764d4649 [0084.351] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0x65d0bb11 [0084.351] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0x3fb3ef8a [0084.351] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0x3ad1d844 [0084.351] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0x94c82a88 [0084.351] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0x1432064d [0084.351] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0xdbb6d43c [0084.351] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0xfeec36c8 [0084.351] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0xb1ee6054 [0084.351] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0x658373fc [0084.351] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0x8752322d [0084.351] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0xd4bdc544 [0084.351] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0x1fd15707 [0084.351] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0x10e214be [0084.351] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0x9d22827f [0084.351] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0x235f19b4 [0084.351] RtlRandom (in: Seed=0x2bfff804 | out: Seed=0x2bfff804) returned 0x92dce708 [0084.360] SetFilePointerEx (in: hFile=0xfe0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.360] ReadFile (in: hFile=0xfe0, lpBuffer=0x75b1520, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2bfff7d8, lpOverlapped=0x0 | out: lpBuffer=0x75b1520*, lpNumberOfBytesRead=0x2bfff7d8*=0xc800, lpOverlapped=0x0) returned 1 [0084.361] SetFilePointerEx (in: hFile=0xfe0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.361] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8888 [0084.361] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x7566798 [0084.361] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7565bd0 [0084.361] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7565bd0) returned 1 [0084.362] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x75bdd28 [0084.368] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7565ef0 [0084.368] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7565dd8 [0084.368] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7565dd8) returned 1 [0084.368] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7566798) returned 1 [0084.368] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8888) returned 1 [0084.368] WriteFile (in: hFile=0xfe0, lpBuffer=0x75bdd28*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2bfff7d8, lpOverlapped=0x0 | out: lpBuffer=0x75bdd28*, lpNumberOfBytesWritten=0x2bfff7d8*=0xc800, lpOverlapped=0x0) returned 1 [0088.401] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75bdd28) Thread: id = 1238 os_tid = 0x2084 [0083.897] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\m3gmDSfSPqv.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\m3gmdsfspqv.mkv")) returned 0x20 [0084.337] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\m3gmDSfSPqv.mkv", dwFileAttributes=0x20) returned 1 [0084.338] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\m3gmDSfSPqv.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\m3gmdsfspqv.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfe8 [0084.338] GetFileSizeEx (in: hFile=0xfe8, lpFileSize=0x2c07fdf8 | out: lpFileSize=0x2c07fdf8*=3910) returned 1 [0084.338] SetFilePointerEx (in: hFile=0xfe8, liDistanceToMove=0xf42, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.338] ReadFile (in: hFile=0xfe8, lpBuffer=0x2c07fd7c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c07fd78, lpOverlapped=0x0 | out: lpBuffer=0x2c07fd7c*, lpNumberOfBytesRead=0x2c07fd78*=0x4, lpOverlapped=0x0) returned 1 [0084.338] SetFilePointerEx (in: hFile=0xfe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.338] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7565e00 [0084.338] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7565d88 [0084.338] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7565c20 [0084.338] NtQuerySystemTime (in: CurrentTime=0x2c07fd58 | out: CurrentTime=0x2c07fd58*=132260136415018689) returned 0x0 [0084.338] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0x87fb246f [0084.338] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0x55d7fe24 [0084.338] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0x66621b50 [0084.338] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0x2d69a631 [0084.338] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0x4f554e8b [0084.338] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0x3acf6a83 [0084.338] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0x86552350 [0084.338] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0x28257aca [0084.338] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0x61838f60 [0084.338] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0xc9058e7a [0084.338] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0x79b772a0 [0084.338] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0xc8a064c1 [0084.338] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0x173533e9 [0084.338] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0xceda7cf6 [0084.338] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0x9f5d0e82 [0084.338] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0xc0e0fc33 [0084.338] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0x2643f99c [0084.338] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0xcdab2305 [0084.338] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0xa38679a8 [0084.338] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0x9899128e [0084.338] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0xb5ec9452 [0084.338] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0x8a0b7380 [0084.338] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0x3afc9ea6 [0084.338] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0x8b927db1 [0084.339] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0x3ce8be8f [0084.339] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0x13005196 [0084.339] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0x5437d64 [0084.339] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0x9f4e3352 [0084.339] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0x99dcf2f [0084.339] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0x1843091 [0084.339] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0x6cfb6db7 [0084.339] RtlRandom (in: Seed=0x2c07fd64 | out: Seed=0x2c07fd64) returned 0xc74fd342 [0084.349] ReadFile (in: hFile=0xfe8, lpBuffer=0x7598510, nNumberOfBytesToRead=0xf46, lpNumberOfBytesRead=0x2c07fd54, lpOverlapped=0x0 | out: lpBuffer=0x7598510*, lpNumberOfBytesRead=0x2c07fd54*=0xf46, lpOverlapped=0x0) returned 1 [0084.349] SetFilePointerEx (in: hFile=0xfe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.349] WriteFile (in: hFile=0xfe8, lpBuffer=0x75a4d18*, nNumberOfBytesToWrite=0xf46, lpNumberOfBytesWritten=0x2c07fd50, lpOverlapped=0x0 | out: lpBuffer=0x75a4d18*, lpNumberOfBytesWritten=0x2c07fd50*=0xf46, lpOverlapped=0x0) returned 1 [0088.259] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032f40 [0088.259] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032900 [0088.259] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe032900) returned 1 [0088.259] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75a4d18) Thread: id = 1239 os_tid = 0x2088 [0083.897] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\MWfD9AasOya.flv" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\mwfd9aasoya.flv")) returned 0x20 [0084.310] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\MWfD9AasOya.flv", dwFileAttributes=0x20) returned 1 [0084.310] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\MWfD9AasOya.flv" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\mwfd9aasoya.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfec [0084.310] GetFileSizeEx (in: hFile=0xfec, lpFileSize=0x2c0ffbd4 | out: lpFileSize=0x2c0ffbd4*=69471) returned 1 [0084.310] SetFilePointerEx (in: hFile=0xfec, liDistanceToMove=0x10f5b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.310] ReadFile (in: hFile=0xfec, lpBuffer=0x2c0ffb58, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c0ffb54, lpOverlapped=0x0 | out: lpBuffer=0x2c0ffb58*, lpNumberOfBytesRead=0x2c0ffb54*=0x4, lpOverlapped=0x0) returned 1 [0084.310] SetFilePointerEx (in: hFile=0xfec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.310] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7565dd8 [0084.310] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7565ba8 [0084.310] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7565f90 [0084.310] NtQuerySystemTime (in: CurrentTime=0x2c0ffb34 | out: CurrentTime=0x2c0ffb34*=132260136414661461) returned 0x0 [0084.310] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0xef719fd0 [0084.310] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0x9c7cfbbf [0084.310] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0x4433b776 [0084.310] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0x4a59489f [0084.310] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0x30bf3ab0 [0084.311] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0x443bbdcf [0084.311] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0x435cbf7c [0084.311] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0x194b0c26 [0084.311] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0x65232ea9 [0084.311] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0xc1880505 [0084.311] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0x30148d59 [0084.311] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0x2f6ec9e1 [0084.311] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0xb6b09fa2 [0084.311] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0x345b1c7e [0084.311] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0xf17f280 [0084.311] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0x8fa4079b [0084.311] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0x3bb83e19 [0084.311] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0x23e3b53c [0084.311] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0x398d97ab [0084.311] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0x8305e1e1 [0084.311] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0x3a647557 [0084.311] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0x1c73428 [0084.311] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0x4b100184 [0084.311] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0xda9ab0f [0084.311] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0xad29c973 [0084.311] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0x8303adec [0084.311] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0x4a7c2a43 [0084.311] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0x17875919 [0084.311] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0x15a64d00 [0084.311] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0x5242d4de [0084.311] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0x63e73dc7 [0084.311] RtlRandom (in: Seed=0x2c0ffb40 | out: Seed=0x2c0ffb40) returned 0x2a78dd9f [0084.320] SetFilePointerEx (in: hFile=0xfec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.320] ReadFile (in: hFile=0xfec, lpBuffer=0x7558940, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2c0ffb14, lpOverlapped=0x0 | out: lpBuffer=0x7558940*, lpNumberOfBytesRead=0x2c0ffb14*=0xc800, lpOverlapped=0x0) returned 1 [0084.321] SetFilePointerEx (in: hFile=0xfec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.321] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8840 [0084.321] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x7566720 [0084.321] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7565bd0 [0084.321] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7565bd0) returned 1 [0084.322] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x758bd08 [0084.337] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7565ec8 [0084.337] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7565d60 [0084.337] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7565d60) returned 1 [0084.337] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7566720) returned 1 [0084.337] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8840) returned 1 [0084.337] WriteFile (in: hFile=0xfec, lpBuffer=0x758bd08*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2c0ffb14, lpOverlapped=0x0 | out: lpBuffer=0x758bd08*, lpNumberOfBytesWritten=0x2c0ffb14*=0xc800, lpOverlapped=0x0) returned 1 [0088.266] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x758bd08) Thread: id = 1240 os_tid = 0x208c [0083.898] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\nMiOK6zeTStn.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\nmiok6zetstn.mkv")) returned 0x20 [0084.297] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\nMiOK6zeTStn.mkv", dwFileAttributes=0x20) returned 1 [0084.297] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\nMiOK6zeTStn.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\nmiok6zetstn.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1570 [0084.297] GetFileSizeEx (in: hFile=0x1570, lpFileSize=0x2c17f750 | out: lpFileSize=0x2c17f750*=79519) returned 1 [0084.297] SetFilePointerEx (in: hFile=0x1570, liDistanceToMove=0x1369b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.297] ReadFile (in: hFile=0x1570, lpBuffer=0x2c17f6d4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c17f6d0, lpOverlapped=0x0 | out: lpBuffer=0x2c17f6d4*, lpNumberOfBytesRead=0x2c17f6d0*=0x4, lpOverlapped=0x0) returned 1 [0084.297] SetFilePointerEx (in: hFile=0x1570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.297] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7565f18 [0084.297] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7565e78 [0084.297] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7565d60 [0084.297] NtQuerySystemTime (in: CurrentTime=0x2c17f6b0 | out: CurrentTime=0x2c17f6b0*=132260136414504499) returned 0x0 [0084.297] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0x97bf9c14 [0084.298] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0xb4cd3a1f [0084.298] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0xc8bf09ad [0084.298] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0x631320d4 [0084.298] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0x2efd0147 [0084.298] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0x4fb74d46 [0084.298] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0x3e36b1d3 [0084.298] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0x3c8826b9 [0084.298] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0xc1191f46 [0084.298] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0xe21e59d0 [0084.298] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0x1c521c64 [0084.298] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0x4c409590 [0084.298] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0x26b77b94 [0084.298] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0xc7858385 [0084.298] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0x14d1499b [0084.298] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0xedc017b9 [0084.298] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0x8cf20089 [0084.298] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0x95631c39 [0084.298] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0x9312f68 [0084.298] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0x49f530a [0084.298] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0xebbef22d [0084.298] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0xe3984e31 [0084.298] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0xf95e0517 [0084.298] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0x723dc3b7 [0084.298] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0x77341317 [0084.298] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0x2de3604e [0084.298] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0x4424e92a [0084.298] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0x84713d5b [0084.298] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0x7ca39e08 [0084.298] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0xfbe849ca [0084.298] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0x1a14caa0 [0084.298] RtlRandom (in: Seed=0x2c17f6bc | out: Seed=0x2c17f6bc) returned 0xa0853c75 [0084.307] SetFilePointerEx (in: hFile=0x1570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.307] ReadFile (in: hFile=0x1570, lpBuffer=0x750d910, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2c17f690, lpOverlapped=0x0 | out: lpBuffer=0x750d910*, lpNumberOfBytesRead=0x2c17f690*=0xc800, lpOverlapped=0x0) returned 1 [0084.308] SetFilePointerEx (in: hFile=0x1570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.308] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8840 [0084.308] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x7566720 [0084.308] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7566058 [0084.308] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7566058) returned 1 [0084.309] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x754c138 [0084.309] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7565ea0 [0084.309] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7565d38 [0084.309] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7565d38) returned 1 [0084.309] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7566720) returned 1 [0084.309] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8840) returned 1 [0084.309] WriteFile (in: hFile=0x1570, lpBuffer=0x754c138*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2c17f690, lpOverlapped=0x0 | out: lpBuffer=0x754c138*, lpNumberOfBytesWritten=0x2c17f690*=0xc800, lpOverlapped=0x0) returned 1 [0088.168] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x754c138) Thread: id = 1241 os_tid = 0x2090 [0083.898] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x7583ec0 [0083.898] wcscpy (in: _Dest=0x7583ec0, _Source="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5" [0083.898] wcscat (in: _Dest=0x7583ec0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\" [0083.898] wcscat (in: _Dest=0x7583ec0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\*") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\*" [0083.898] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a3ce0 [0083.898] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\*", lpFindFileData=0x53a3ce0 | out: lpFindFileData=0x53a3ce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3171ed0, ftCreationTime.dwHighDateTime=0x1d5cfac, ftLastAccessTime.dwLowDateTime=0xe8e7800, ftLastAccessTime.dwHighDateTime=0x1d5c7ba, ftLastWriteTime.dwLowDateTime=0xe8e7800, ftLastWriteTime.dwHighDateTime=0x1d5c7ba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389ee00 [0083.898] wcscmp (_String1=".", _String2=".") returned 0 [0083.898] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53a3ce0 | out: lpFindFileData=0x53a3ce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3171ed0, ftCreationTime.dwHighDateTime=0x1d5cfac, ftLastAccessTime.dwLowDateTime=0xe8e7800, ftLastAccessTime.dwHighDateTime=0x1d5c7ba, ftLastWriteTime.dwLowDateTime=0xe8e7800, ftLastWriteTime.dwHighDateTime=0x1d5c7ba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.898] wcscmp (_String1="..", _String2=".") returned 1 [0083.898] wcscmp (_String1="..", _String2="..") returned 0 [0083.898] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53a3ce0 | out: lpFindFileData=0x53a3ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa094a9c0, ftCreationTime.dwHighDateTime=0x1d5d405, ftLastAccessTime.dwLowDateTime=0x9886de00, ftLastAccessTime.dwHighDateTime=0x1d5c8bc, ftLastWriteTime.dwLowDateTime=0x9886de00, ftLastWriteTime.dwHighDateTime=0x1d5c8bc, nFileSizeHigh=0x0, nFileSizeLow=0xe8ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="22CmeAJJP7RQy3 1.swf", cAlternateFileName="22CMEA~1.SWF")) returned 1 [0083.898] wcscmp (_String1="22CmeAJJP7RQy3 1.swf", _String2=".") returned 1 [0083.898] wcscmp (_String1="22CmeAJJP7RQy3 1.swf", _String2="..") returned 1 [0083.899] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x78) returned 0x38d13a0 [0083.899] wcscpy (in: _Dest=0x38d13a0, _Source="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5" [0083.899] wcscat (in: _Dest=0x38d13a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\" [0083.899] wcscat (in: _Dest=0x38d13a0, _Source="22CmeAJJP7RQy3 1.swf" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\22CmeAJJP7RQy3 1.swf") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\22CmeAJJP7RQy3 1.swf" [0083.899] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d13a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x156c [0083.899] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53a3ce0 | out: lpFindFileData=0x53a3ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91436690, ftCreationTime.dwHighDateTime=0x1d5d56e, ftLastAccessTime.dwLowDateTime=0x1ea86de0, ftLastAccessTime.dwHighDateTime=0x1d5d0cf, ftLastWriteTime.dwLowDateTime=0x1ea86de0, ftLastWriteTime.dwHighDateTime=0x1d5d0cf, nFileSizeHigh=0x0, nFileSizeLow=0x163bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="c5BHDHO-LxzFC.swf", cAlternateFileName="C5BHDH~1.SWF")) returned 1 [0083.899] wcscmp (_String1="c5BHDHO-LxzFC.swf", _String2=".") returned 1 [0083.899] wcscmp (_String1="c5BHDHO-LxzFC.swf", _String2="..") returned 1 [0083.899] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x72) returned 0x38d18a0 [0083.899] wcscpy (in: _Dest=0x38d18a0, _Source="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5" [0083.899] wcscat (in: _Dest=0x38d18a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\" [0083.899] wcscat (in: _Dest=0x38d18a0, _Source="c5BHDHO-LxzFC.swf" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\c5BHDHO-LxzFC.swf") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\c5BHDHO-LxzFC.swf" [0083.899] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d18a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1560 [0083.900] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53a3ce0 | out: lpFindFileData=0x53a3ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce859cb0, ftCreationTime.dwHighDateTime=0x1d5cd23, ftLastAccessTime.dwLowDateTime=0x52d67810, ftLastAccessTime.dwHighDateTime=0x1d5c9ad, ftLastWriteTime.dwLowDateTime=0x52d67810, ftLastWriteTime.dwHighDateTime=0x1d5c9ad, nFileSizeHigh=0x0, nFileSizeLow=0x10793, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ga8Mk5qBDxEWBI3re3g.avi", cAlternateFileName="GA8MK5~1.AVI")) returned 1 [0083.900] wcscmp (_String1="Ga8Mk5qBDxEWBI3re3g.avi", _String2=".") returned 1 [0083.900] wcscmp (_String1="Ga8Mk5qBDxEWBI3re3g.avi", _String2="..") returned 1 [0083.900] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7e) returned 0x39774c8 [0083.900] wcscpy (in: _Dest=0x39774c8, _Source="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5" [0083.900] wcscat (in: _Dest=0x39774c8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\" [0083.900] wcscat (in: _Dest=0x39774c8, _Source="Ga8Mk5qBDxEWBI3re3g.avi" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\Ga8Mk5qBDxEWBI3re3g.avi") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\Ga8Mk5qBDxEWBI3re3g.avi" [0083.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x39774c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1558 [0083.901] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53a3ce0 | out: lpFindFileData=0x53a3ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c78390, ftCreationTime.dwHighDateTime=0x1d5c943, ftLastAccessTime.dwLowDateTime=0x19880d40, ftLastAccessTime.dwHighDateTime=0x1d5ceca, ftLastWriteTime.dwLowDateTime=0x19880d40, ftLastWriteTime.dwHighDateTime=0x1d5ceca, nFileSizeHigh=0x0, nFileSizeLow=0x15492, dwReserved0=0x0, dwReserved1=0x0, cFileName="HdF6X9en2Y.mp4", cAlternateFileName="HDF6X9~1.MP4")) returned 1 [0083.901] wcscmp (_String1="HdF6X9en2Y.mp4", _String2=".") returned 1 [0083.901] wcscmp (_String1="HdF6X9en2Y.mp4", _String2="..") returned 1 [0083.901] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6c) returned 0x7574dd0 [0084.292] wcscpy (in: _Dest=0x7574dd0, _Source="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5" [0084.292] wcscat (in: _Dest=0x7574dd0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\" [0084.292] wcscat (in: _Dest=0x7574dd0, _Source="HdF6X9en2Y.mp4" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\HdF6X9en2Y.mp4") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\HdF6X9en2Y.mp4" [0084.292] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7574dd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x154c [0084.292] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53a3ce0 | out: lpFindFileData=0x53a3ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa06ea520, ftCreationTime.dwHighDateTime=0x1d5d29a, ftLastAccessTime.dwLowDateTime=0x72c49410, ftLastAccessTime.dwHighDateTime=0x1d5cb77, ftLastWriteTime.dwLowDateTime=0x72c49410, ftLastWriteTime.dwHighDateTime=0x1d5cb77, nFileSizeHigh=0x0, nFileSizeLow=0xcf0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mu m_ksI_yimLFCb.swf", cAlternateFileName="MUM_KS~1.SWF")) returned 1 [0084.292] wcscmp (_String1="Mu m_ksI_yimLFCb.swf", _String2=".") returned 1 [0084.292] wcscmp (_String1="Mu m_ksI_yimLFCb.swf", _String2="..") returned 1 [0084.292] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x78) returned 0x38d2520 [0084.293] wcscpy (in: _Dest=0x38d2520, _Source="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5" [0084.293] wcscat (in: _Dest=0x38d2520, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\" [0084.293] wcscat (in: _Dest=0x38d2520, _Source="Mu m_ksI_yimLFCb.swf" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\Mu m_ksI_yimLFCb.swf") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\Mu m_ksI_yimLFCb.swf" [0084.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38d2520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1544 [0084.293] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53a3ce0 | out: lpFindFileData=0x53a3ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1883650, ftCreationTime.dwHighDateTime=0x1d5cd41, ftLastAccessTime.dwLowDateTime=0x52324e70, ftLastAccessTime.dwHighDateTime=0x1d5ce03, ftLastWriteTime.dwLowDateTime=0x52324e70, ftLastWriteTime.dwHighDateTime=0x1d5ce03, nFileSizeHigh=0x0, nFileSizeLow=0x1610a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pLFF75mqBew.avi", cAlternateFileName="PLFF75~1.AVI")) returned 1 [0084.293] wcscmp (_String1="pLFF75mqBew.avi", _String2=".") returned 1 [0084.293] wcscmp (_String1="pLFF75mqBew.avi", _String2="..") returned 1 [0084.293] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6e) returned 0x7574f38 [0084.293] wcscpy (in: _Dest=0x7574f38, _Source="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5" [0084.293] wcscat (in: _Dest=0x7574f38, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\" [0084.293] wcscat (in: _Dest=0x7574f38, _Source="pLFF75mqBew.avi" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\pLFF75mqBew.avi") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\pLFF75mqBew.avi" [0084.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7574f38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xffc [0084.294] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53a3ce0 | out: lpFindFileData=0x53a3ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a4acb40, ftCreationTime.dwHighDateTime=0x1d5d7a8, ftLastAccessTime.dwLowDateTime=0xd8bb0690, ftLastAccessTime.dwHighDateTime=0x1d5d11d, ftLastWriteTime.dwLowDateTime=0xd8bb0690, ftLastWriteTime.dwHighDateTime=0x1d5d11d, nFileSizeHigh=0x0, nFileSizeLow=0xe2c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qpfu9YxU YLv.mkv", cAlternateFileName="QPFU9Y~1.MKV")) returned 1 [0084.294] wcscmp (_String1="Qpfu9YxU YLv.mkv", _String2=".") returned 1 [0084.294] wcscmp (_String1="Qpfu9YxU YLv.mkv", _String2="..") returned 1 [0084.294] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x75757a8 [0084.294] wcscpy (in: _Dest=0x75757a8, _Source="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5" [0084.294] wcscat (in: _Dest=0x75757a8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\" [0084.294] wcscat (in: _Dest=0x75757a8, _Source="Qpfu9YxU YLv.mkv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\Qpfu9YxU YLv.mkv") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\Qpfu9YxU YLv.mkv" [0084.294] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x75757a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xff4 [0084.295] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53a3ce0 | out: lpFindFileData=0x53a3ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafdadba0, ftCreationTime.dwHighDateTime=0x1d5d137, ftLastAccessTime.dwLowDateTime=0xb7ab8080, ftLastAccessTime.dwHighDateTime=0x1d5cd9c, ftLastWriteTime.dwLowDateTime=0xb7ab8080, ftLastWriteTime.dwHighDateTime=0x1d5cd9c, nFileSizeHigh=0x0, nFileSizeLow=0x17ca5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZvrHdgI31lQLP-9mxi.swf", cAlternateFileName="ZVRHDG~1.SWF")) returned 1 [0084.295] wcscmp (_String1="ZvrHdgI31lQLP-9mxi.swf", _String2=".") returned 1 [0084.295] wcscmp (_String1="ZvrHdgI31lQLP-9mxi.swf", _String2="..") returned 1 [0084.295] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7c) returned 0x39772a8 [0084.295] wcscpy (in: _Dest=0x39772a8, _Source="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5" [0084.295] wcscat (in: _Dest=0x39772a8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\" [0084.295] wcscat (in: _Dest=0x39772a8, _Source="ZvrHdgI31lQLP-9mxi.swf" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\ZvrHdgI31lQLP-9mxi.swf") returned="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\ZvrHdgI31lQLP-9mxi.swf" [0084.295] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x39772a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xff0 [0084.296] FindNextFileW (in: hFindFile=0x389ee00, lpFindFileData=0x53a3ce0 | out: lpFindFileData=0x53a3ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafdadba0, ftCreationTime.dwHighDateTime=0x1d5d137, ftLastAccessTime.dwLowDateTime=0xb7ab8080, ftLastAccessTime.dwHighDateTime=0x1d5cd9c, ftLastWriteTime.dwLowDateTime=0xb7ab8080, ftLastWriteTime.dwHighDateTime=0x1d5cd9c, nFileSizeHigh=0x0, nFileSizeLow=0x17ca5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZvrHdgI31lQLP-9mxi.swf", cAlternateFileName="ZVRHDG~1.SWF")) returned 0 [0084.296] FindClose (in: hFindFile=0x389ee00 | out: hFindFile=0x389ee00) returned 1 [0084.296] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a3ce0) returned 1 [0084.296] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7583ec0) returned 1 [0084.296] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757e6b0) returned 1 Thread: id = 1242 os_tid = 0x2094 [0083.901] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\WocACWczdEi.avi" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\wocacwczdei.avi")) returned 0x20 [0084.279] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\WocACWczdEi.avi", dwFileAttributes=0x20) returned 1 [0084.279] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\WocACWczdEi.avi" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\wocacwczdei.avi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1550 [0084.279] GetFileSizeEx (in: hFile=0x1550, lpFileSize=0x2c27fecc | out: lpFileSize=0x2c27fecc*=93306) returned 1 [0084.279] SetFilePointerEx (in: hFile=0x1550, liDistanceToMove=0x16c76, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.279] ReadFile (in: hFile=0x1550, lpBuffer=0x2c27fe50, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c27fe4c, lpOverlapped=0x0 | out: lpBuffer=0x2c27fe50*, lpNumberOfBytesRead=0x2c27fe4c*=0x4, lpOverlapped=0x0) returned 1 [0084.279] SetFilePointerEx (in: hFile=0x1550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.279] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7565e00 [0084.279] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7565f68 [0084.279] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7565ba8 [0084.279] NtQuerySystemTime (in: CurrentTime=0x2c27fe2c | out: CurrentTime=0x2c27fe2c*=132260136414348122) returned 0x0 [0084.279] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0xf4c3b14e [0084.280] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0x5efc6bb3 [0084.280] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0xb9e3e1d7 [0084.280] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0x9904dd1d [0084.280] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0x3d2355f9 [0084.280] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0x55aa1ef5 [0084.280] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0x8a80e99a [0084.280] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0xc6d259c2 [0084.280] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0xd2fa3fb6 [0084.280] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0x250cae97 [0084.280] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0x1fe674b3 [0084.280] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0xccea6f50 [0084.280] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0xf4ce577e [0084.280] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0x2d23a228 [0084.280] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0xda74ee93 [0084.280] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0x1f371224 [0084.280] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0x4041e63d [0084.280] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0xa2809d8d [0084.280] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0xa9d00de9 [0084.280] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0x248d847e [0084.280] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0x91eb56e1 [0084.280] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0x1ca7856b [0084.280] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0x77044c3b [0084.280] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0x80e0c9d7 [0084.280] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0x5c23402 [0084.280] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0xa624346c [0084.280] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0xe8674049 [0084.280] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0x6cbb32d7 [0084.280] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0x53373c1a [0084.280] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0x3feee7fc [0084.280] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0x87718759 [0084.280] RtlRandom (in: Seed=0x2c27fe38 | out: Seed=0x2c27fe38) returned 0xf788eced [0084.289] SetFilePointerEx (in: hFile=0x1550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.289] ReadFile (in: hFile=0x1550, lpBuffer=0x7568160, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2c27fe0c, lpOverlapped=0x0 | out: lpBuffer=0x7568160*, lpNumberOfBytesRead=0x2c27fe0c*=0xc800, lpOverlapped=0x0) returned 1 [0084.290] SetFilePointerEx (in: hFile=0x1550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.290] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba7fd0 [0084.290] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x7566450 [0084.290] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7565ba8 [0084.290] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7565ba8) returned 1 [0084.291] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0x7501108 [0084.291] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7565bf8 [0084.291] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7565bd0 [0084.291] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7565bd0) returned 1 [0084.291] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7566450) returned 1 [0084.291] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba7fd0) returned 1 [0084.291] WriteFile (in: hFile=0x1550, lpBuffer=0x7501108*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2c27fe0c, lpOverlapped=0x0 | out: lpBuffer=0x7501108*, lpNumberOfBytesWritten=0x2c27fe0c*=0xc800, lpOverlapped=0x0) returned 1 [0088.171] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7501108) Thread: id = 1243 os_tid = 0x2098 [0083.902] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base1MedTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\base1medtilethin.scale-100.png")) returned 0x20 [0083.904] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base1MedTileThin.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.905] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base1MedTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\base1medtilethin.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.907] GetLastError () returned 0x5 [0083.907] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base1MedTileThin.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.908] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x546ee88) returned 1 Thread: id = 1244 os_tid = 0x209c [0083.910] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base1SmallTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\base1smalltilethin.scale-100.png")) returned 0x20 [0083.912] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base1SmallTileThin.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.913] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base1SmallTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\base1smalltilethin.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.915] GetLastError () returned 0x5 [0083.915] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base1SmallTileThin.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.916] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55ca328) returned 1 Thread: id = 1245 os_tid = 0x20a0 [0083.916] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base2MedTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\base2medtilethin.scale-100.png")) returned 0x20 [0083.918] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base2MedTileThin.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.919] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base2MedTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\base2medtilethin.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.921] GetLastError () returned 0x5 [0083.921] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base2MedTileThin.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.922] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bc968) returned 1 Thread: id = 1246 os_tid = 0x20a4 [0083.923] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base2SmallTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\base2smalltilethin.scale-100.png")) returned 0x20 [0083.927] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base2SmallTileThin.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.928] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base2SmallTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\base2smalltilethin.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.929] GetLastError () returned 0x5 [0083.929] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base2SmallTileThin.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.931] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55ca450) returned 1 Thread: id = 1247 os_tid = 0x20a8 [0083.931] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseAppList.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\baseapplist.scale-100.png")) returned 0x20 [0083.933] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseAppList.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.934] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseAppList.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\baseapplist.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.935] GetLastError () returned 0x5 [0083.935] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseAppList.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.937] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5baad58) returned 1 Thread: id = 1248 os_tid = 0x20ac [0083.938] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseMedTile.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basemedtile.scale-100.png")) returned 0x20 [0083.941] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseMedTile.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.943] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseMedTile.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basemedtile.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.944] GetLastError () returned 0x5 [0083.944] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseMedTile.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.945] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5baae70) returned 1 Thread: id = 1249 os_tid = 0x20b0 [0083.947] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseMedTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basemedtilethin.scale-100.png")) returned 0x20 [0083.948] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseMedTileThin.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.950] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseMedTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basemedtilethin.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.951] GetLastError () returned 0x5 [0083.951] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseMedTileThin.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.952] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bd058) returned 1 Thread: id = 1250 os_tid = 0x20b4 [0083.953] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseSmallTile.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basesmalltile.scale-100.png")) returned 0x20 [0083.955] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseSmallTile.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.957] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseSmallTile.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basesmalltile.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.958] GetLastError () returned 0x5 [0083.958] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseSmallTile.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.959] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba9318) returned 1 Thread: id = 1251 os_tid = 0x20b8 [0083.960] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseSmallTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basesmalltilethin.scale-100.png")) returned 0x20 [0083.962] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseSmallTileThin.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.964] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseSmallTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basesmalltilethin.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.965] GetLastError () returned 0x5 [0083.965] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseSmallTileThin.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.966] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bd180) returned 1 Thread: id = 1252 os_tid = 0x20bc [0083.968] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail1MedTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basevoicemail1medtilethin.scale-100.png")) returned 0x20 [0083.970] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail1MedTileThin.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.971] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail1MedTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basevoicemail1medtilethin.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.974] GetLastError () returned 0x5 [0083.974] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail1MedTileThin.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.975] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba10e8) returned 1 Thread: id = 1253 os_tid = 0x20c0 [0083.976] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail1SmallTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basevoicemail1smalltilethin.scale-100.png")) returned 0x20 [0084.269] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail1SmallTileThin.scale-100.png", dwFileAttributes=0x20) returned 0 [0084.271] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail1SmallTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basevoicemail1smalltilethin.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.272] GetLastError () returned 0x5 [0084.272] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail1SmallTileThin.scale-100.png", dwFileAttributes=0x20) returned 0 [0084.274] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55ca578) returned 1 Thread: id = 1254 os_tid = 0x20c4 [0083.977] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail2MedTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basevoicemail2medtilethin.scale-100.png")) returned 0x20 [0083.979] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail2MedTileThin.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.980] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail2MedTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basevoicemail2medtilethin.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.981] GetLastError () returned 0x5 [0083.981] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail2MedTileThin.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.983] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba1358) returned 1 Thread: id = 1255 os_tid = 0x20c8 [0083.984] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail2SmallTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basevoicemail2smalltilethin.scale-100.png")) returned 0x20 [0084.263] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail2SmallTileThin.scale-100.png", dwFileAttributes=0x20) returned 0 [0084.264] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail2SmallTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basevoicemail2smalltilethin.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.265] GetLastError () returned 0x5 [0084.265] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail2SmallTileThin.scale-100.png", dwFileAttributes=0x20) returned 0 [0084.267] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55ca6b0) returned 1 Thread: id = 1256 os_tid = 0x20cc [0083.984] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemailMedTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basevoicemailmedtilethin.scale-100.png")) returned 0x20 [0083.986] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemailMedTileThin.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.988] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemailMedTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basevoicemailmedtilethin.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.989] GetLastError () returned 0x5 [0083.989] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemailMedTileThin.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.990] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba1490) returned 1 Thread: id = 1257 os_tid = 0x20d0 [0083.992] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemailSmallTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basevoicemailsmalltilethin.scale-100.png")) returned 0x20 [0084.256] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemailSmallTileThin.scale-100.png", dwFileAttributes=0x20) returned 0 [0084.257] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemailSmallTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basevoicemailsmalltilethin.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.258] GetLastError () returned 0x5 [0084.258] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemailSmallTileThin.scale-100.png", dwFileAttributes=0x20) returned 0 [0084.260] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bd820) returned 1 Thread: id = 1258 os_tid = 0x20d4 [0083.992] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseWideTile.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basewidetile.scale-100.png")) returned 0x20 [0083.994] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseWideTile.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.996] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseWideTile.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basewidetile.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0083.997] GetLastError () returned 0x5 [0083.997] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseWideTile.scale-100.png", dwFileAttributes=0x20) returned 0 [0083.999] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5baa038) returned 1 Thread: id = 1259 os_tid = 0x20d8 [0083.993] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\BadgeLogo.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\badgelogo.scale-150.png")) returned 0x20 [0084.007] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\BadgeLogo.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.009] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\BadgeLogo.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\badgelogo.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.010] GetLastError () returned 0x5 [0084.010] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\BadgeLogo.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.012] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549c0b0) returned 1 Thread: id = 1260 os_tid = 0x20dc [0084.017] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\Logo.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\logo.scale-150.png")) returned 0x20 [0084.019] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\Logo.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.021] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\Logo.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\logo.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.022] GetLastError () returned 0x5 [0084.022] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\Logo.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.023] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7582f78) returned 1 Thread: id = 1261 os_tid = 0x20e0 [0084.024] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\SmallLogo.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\smalllogo.scale-150.png")) returned 0x20 [0084.026] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\SmallLogo.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.028] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\SmallLogo.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\smalllogo.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.029] GetLastError () returned 0x5 [0084.029] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\SmallLogo.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.030] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba90e8) returned 1 Thread: id = 1262 os_tid = 0x20e4 [0084.032] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\Square71x71Logo.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\square71x71logo.scale-150.png")) returned 0x20 [0084.034] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\Square71x71Logo.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.035] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\Square71x71Logo.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\square71x71logo.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.037] GetLastError () returned 0x5 [0084.037] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\Square71x71Logo.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.038] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bd2a8) returned 1 Thread: id = 1263 os_tid = 0x20e8 [0084.039] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.sad.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim1.sad.scale-150.png")) returned 0x20 [0084.041] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.sad.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.043] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.sad.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim1.sad.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.044] GetLastError () returned 0x5 [0084.044] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.sad.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.045] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bd958) returned 1 Thread: id = 1264 os_tid = 0x20ec [0084.046] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.sad.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim1.sad.small.scale-150.png")) returned 0x20 [0084.246] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.sad.small.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.247] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.sad.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim1.sad.small.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.248] GetLastError () returned 0x5 [0084.249] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.sad.small.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.250] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bda80) returned 1 Thread: id = 1265 os_tid = 0x20f0 [0084.047] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim1.scale-150.png")) returned 0x20 [0084.049] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.050] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim1.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.052] GetLastError () returned 0x5 [0084.052] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.053] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bca90) returned 1 Thread: id = 1266 os_tid = 0x20f4 [0084.054] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.smile.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim1.smile.scale-150.png")) returned 0x20 [0084.055] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.smile.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.057] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.smile.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim1.smile.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.058] GetLastError () returned 0x5 [0084.058] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.smile.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.059] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba1d18) returned 1 Thread: id = 1267 os_tid = 0x20f8 [0084.061] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.smile.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim1.smile.small.scale-150.png")) returned 0x20 [0084.239] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.smile.small.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.241] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.smile.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim1.smile.small.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.242] GetLastError () returned 0x5 [0084.242] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.smile.small.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.243] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bdbb8) returned 1 Thread: id = 1268 os_tid = 0x20fc [0084.061] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.surprise.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim1.surprise.scale-150.png")) returned 0x20 [0084.233] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.surprise.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.234] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.surprise.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim1.surprise.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.235] GetLastError () returned 0x5 [0084.235] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.surprise.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.237] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bdcf0) returned 1 Thread: id = 1269 os_tid = 0x2100 [0084.062] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.surprise.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim1.surprise.small.scale-150.png")) returned 0x20 [0084.224] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.surprise.small.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.226] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.surprise.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim1.surprise.small.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.227] GetLastError () returned 0x5 [0084.227] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.surprise.small.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.229] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bde28) returned 1 Thread: id = 1270 os_tid = 0x2104 [0084.065] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.wink.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim1.wink.scale-150.png")) returned 0x20 [0084.068] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.wink.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.069] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.wink.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim1.wink.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.070] GetLastError () returned 0x5 [0084.070] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.wink.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.072] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba1220) returned 1 Thread: id = 1271 os_tid = 0x2108 [0084.073] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.wink.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim1.wink.small.scale-150.png")) returned 0x20 [0084.217] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.wink.small.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.219] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.wink.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim1.wink.small.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.220] GetLastError () returned 0x5 [0084.220] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.wink.small.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.221] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397dff0) returned 1 Thread: id = 1272 os_tid = 0x210c [0084.073] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.sad.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim2.sad.scale-150.png")) returned 0x20 [0084.075] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.sad.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.077] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.sad.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim2.sad.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.078] GetLastError () returned 0x5 [0084.078] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.sad.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.079] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bcce0) returned 1 Thread: id = 1273 os_tid = 0x2110 [0084.081] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.sad.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim2.sad.small.scale-150.png")) returned 0x20 [0084.211] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.sad.small.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.212] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.sad.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim2.sad.small.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.213] GetLastError () returned 0x5 [0084.213] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.sad.small.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.215] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397e128) returned 1 Thread: id = 1274 os_tid = 0x2114 [0084.081] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim2.scale-150.png")) returned 0x20 [0084.084] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.085] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim2.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.086] GetLastError () returned 0x5 [0084.086] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.088] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bc840) returned 1 Thread: id = 1275 os_tid = 0x2118 [0084.089] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.smile.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim2.smile.scale-150.png")) returned 0x20 [0084.091] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.smile.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.092] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.smile.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim2.smile.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.093] GetLastError () returned 0x5 [0084.093] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.smile.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.095] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba1700) returned 1 Thread: id = 1276 os_tid = 0x211c [0084.096] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.smile.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim2.smile.small.scale-150.png")) returned 0x20 [0084.204] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.smile.small.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.206] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.smile.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim2.smile.small.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.207] GetLastError () returned 0x5 [0084.207] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.smile.small.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.208] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397e260) returned 1 Thread: id = 1277 os_tid = 0x2120 [0084.097] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.surprise.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim2.surprise.scale-150.png")) returned 0x20 [0084.198] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.surprise.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.199] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.surprise.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim2.surprise.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.200] GetLastError () returned 0x5 [0084.201] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.surprise.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.202] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397e398) returned 1 Thread: id = 1278 os_tid = 0x2124 [0084.097] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.surprise.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim2.surprise.small.scale-150.png")) returned 0x20 [0084.191] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.surprise.small.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.193] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.surprise.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim2.surprise.small.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.194] GetLastError () returned 0x5 [0084.194] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.surprise.small.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.195] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397e4d0) returned 1 Thread: id = 1279 os_tid = 0x2128 [0084.098] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.wink.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim2.wink.scale-150.png")) returned 0x20 [0084.100] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.wink.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.101] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.wink.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim2.wink.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.102] GetLastError () returned 0x5 [0084.102] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.wink.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.104] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba1838) returned 1 Thread: id = 1280 os_tid = 0x212c [0084.105] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.wink.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim2.wink.small.scale-150.png")) returned 0x20 [0084.184] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.wink.small.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.185] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.wink.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim2.wink.small.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.187] GetLastError () returned 0x5 [0084.187] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.wink.small.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.188] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397e610) returned 1 Thread: id = 1281 os_tid = 0x2130 [0084.105] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.sad.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.sad.scale-150.png")) returned 0x20 [0084.157] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.sad.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.159] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.sad.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.sad.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.160] GetLastError () returned 0x5 [0084.160] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.sad.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.162] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5baa498) returned 1 Thread: id = 1282 os_tid = 0x2134 [0084.107] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.sad.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.sad.small.scale-150.png")) returned 0x20 [0084.155] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.sad.small.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.156] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.sad.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.sad.small.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.156] GetLastError () returned 0x5 [0084.156] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.sad.small.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.156] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bce08) returned 1 Thread: id = 1283 os_tid = 0x2138 [0084.107] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.scale-150.png")) returned 0x20 [0084.152] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.152] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.152] GetLastError () returned 0x5 [0084.152] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.152] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5baac40) returned 1 Thread: id = 1284 os_tid = 0x213c [0084.108] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.smile.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.smile.scale-150.png")) returned 0x20 [0084.140] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.smile.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.154] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.smile.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.smile.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.154] GetLastError () returned 0x5 [0084.154] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.smile.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.154] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bd3d0) returned 1 Thread: id = 1285 os_tid = 0x2140 [0084.109] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.smile.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.smile.small.scale-150.png")) returned 0x20 [0084.140] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.smile.small.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.142] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.smile.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.smile.small.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.153] GetLastError () returned 0x5 [0084.153] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.smile.small.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.153] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bd4f8) returned 1 Thread: id = 1286 os_tid = 0x2144 [0084.109] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.surprise.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.surprise.scale-150.png")) returned 0x20 [0084.139] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.surprise.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.141] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.surprise.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.surprise.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.143] GetLastError () returned 0x5 [0084.143] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.surprise.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.151] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bd620) returned 1 Thread: id = 1287 os_tid = 0x2148 [0084.110] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.surprise.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.surprise.small.scale-150.png")) returned 0x20 [0084.139] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.surprise.small.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.141] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.surprise.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.surprise.small.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.143] GetLastError () returned 0x5 [0084.143] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.surprise.small.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.150] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba15c8) returned 1 Thread: id = 1288 os_tid = 0x214c [0084.112] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.wink.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.wink.scale-150.png")) returned 0x20 [0084.139] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.wink.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.141] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.wink.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.wink.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.143] GetLastError () returned 0x5 [0084.143] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.wink.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.149] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba9778) returned 1 Thread: id = 1289 os_tid = 0x2150 [0084.112] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.wink.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.wink.small.scale-150.png")) returned 0x20 [0084.139] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.wink.small.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.141] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.wink.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.wink.small.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.143] GetLastError () returned 0x5 [0084.143] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.wink.small.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.148] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7584768) returned 1 Thread: id = 1290 os_tid = 0x2154 [0084.113] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\StoreLogo.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\storelogo.scale-150.png")) returned 0x20 [0084.138] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\StoreLogo.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.141] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\StoreLogo.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\storelogo.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.142] GetLastError () returned 0x5 [0084.142] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\StoreLogo.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.147] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5baa5b0) returned 1 Thread: id = 1291 os_tid = 0x2158 [0084.114] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\toast.dualsim1.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\toast.dualsim1.scale-150.png")) returned 0x20 [0084.138] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\toast.dualsim1.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.140] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\toast.dualsim1.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\toast.dualsim1.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.142] GetLastError () returned 0x5 [0084.142] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\toast.dualsim1.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.147] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5baa8f8) returned 1 Thread: id = 1292 os_tid = 0x215c [0084.114] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\toast.dualsim2.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\toast.dualsim2.scale-150.png")) returned 0x20 [0084.138] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\toast.dualsim2.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.140] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\toast.dualsim2.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\toast.dualsim2.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.142] GetLastError () returned 0x5 [0084.142] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\toast.dualsim2.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.146] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba9200) returned 1 Thread: id = 1293 os_tid = 0x2160 [0084.115] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\toast.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\toast.scale-150.png")) returned 0x20 [0084.132] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\toast.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.139] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\toast.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\toast.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.141] GetLastError () returned 0x5 [0084.141] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\toast.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.143] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7582840) returned 1 Thread: id = 1294 os_tid = 0x2164 [0084.116] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\WideLogo.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\widelogo.scale-150.png")) returned 0x20 [0084.138] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\WideLogo.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.140] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\WideLogo.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\widelogo.scale-150.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.142] GetLastError () returned 0x5 [0084.142] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\WideLogo.scale-150.png", dwFileAttributes=0x20) returned 0 [0084.145] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba9bd8) returned 1 Thread: id = 1295 os_tid = 0x2168 [0084.118] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.scale-100.png")) returned 0x20 [0084.654] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-100.png", dwFileAttributes=0x20) returned 0 [0084.654] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0084.654] GetLastError () returned 0x5 [0084.654] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-100.png", dwFileAttributes=0x20) returned 0 [0084.654] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396f2f8) returned 1 Thread: id = 1296 os_tid = 0x216c [0084.120] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.scale-100_contrast-black.png")) returned 0x20 [0088.090] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-100_contrast-black.png", dwFileAttributes=0x20) returned 0 [0088.090] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.scale-100_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0088.091] GetLastError () returned 0x5 [0088.091] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-100_contrast-black.png", dwFileAttributes=0x20) returned 0 [0088.091] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba9430) returned 1 Thread: id = 1297 os_tid = 0x2170 [0084.121] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.scale-100_contrast-white.png")) returned 0x20 [0088.089] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-100_contrast-white.png", dwFileAttributes=0x20) returned 0 [0088.089] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.scale-100_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0088.089] GetLastError () returned 0x5 [0088.089] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-100_contrast-white.png", dwFileAttributes=0x20) returned 0 [0088.089] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba9548) returned 1 Thread: id = 1298 os_tid = 0x2174 [0084.122] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-16.png")) returned 0x20 [0088.061] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16.png", dwFileAttributes=0x20) returned 0 [0088.061] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-16.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0088.062] GetLastError () returned 0x5 [0088.062] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16.png", dwFileAttributes=0x20) returned 0 [0088.062] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x72861d0) returned 1 Thread: id = 1299 os_tid = 0x2178 [0084.122] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-16_altform-unplated.png")) returned 0x20 [0088.064] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0088.064] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-16_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0088.064] GetLastError () returned 0x5 [0088.064] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0088.064] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75843f0) returned 1 Thread: id = 1300 os_tid = 0x217c [0084.123] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-16_altform-unplated_contrast-black.png")) Thread: id = 1301 os_tid = 0x2180 [0084.123] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-16_altform-unplated_contrast-white.png")) Thread: id = 1302 os_tid = 0x2184 [0084.124] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-16_contrast-black.png")) returned 0x20 [0088.084] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_contrast-black.png", dwFileAttributes=0x20) returned 0 [0088.084] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-16_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0088.084] GetLastError () returned 0x5 [0088.084] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_contrast-black.png", dwFileAttributes=0x20) returned 0 [0088.084] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba9660) returned 1 Thread: id = 1303 os_tid = 0x2188 [0084.163] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-16_contrast-white.png")) returned 0x20 [0088.088] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_contrast-white.png", dwFileAttributes=0x20) returned 0 [0088.088] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-16_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0088.088] GetLastError () returned 0x5 [0088.088] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_contrast-white.png", dwFileAttributes=0x20) returned 0 [0088.088] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5baa6c8) returned 1 Thread: id = 1304 os_tid = 0x218c [0084.163] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-20.png")) returned 0x20 [0088.081] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20.png", dwFileAttributes=0x20) returned 0 [0088.081] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-20.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0088.082] GetLastError () returned 0x5 [0088.082] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20.png", dwFileAttributes=0x20) returned 0 [0088.082] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x72862c8) returned 1 Thread: id = 1305 os_tid = 0x2190 [0084.164] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-20_altform-unplated.png")) returned 0x20 [0088.083] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0088.083] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-20_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0088.083] GetLastError () returned 0x5 [0088.083] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0088.083] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7584518) returned 1 Thread: id = 1306 os_tid = 0x2194 [0084.164] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-20_altform-unplated_contrast-black.png")) Thread: id = 1307 os_tid = 0x2198 [0084.165] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-20_altform-unplated_contrast-white.png")) Thread: id = 1308 os_tid = 0x219c [0084.165] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-20_contrast-black.png")) returned 0x20 [0088.080] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_contrast-black.png", dwFileAttributes=0x20) returned 0 [0088.080] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-20_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0088.080] GetLastError () returned 0x5 [0088.080] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_contrast-black.png", dwFileAttributes=0x20) returned 0 [0088.080] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5baab28) returned 1 Thread: id = 1309 os_tid = 0x21a0 [0084.166] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-20_contrast-white.png")) returned 0x20 [0088.079] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_contrast-white.png", dwFileAttributes=0x20) returned 0 [0088.079] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-20_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0088.079] GetLastError () returned 0x5 [0088.079] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_contrast-white.png", dwFileAttributes=0x20) returned 0 [0088.079] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba9890) returned 1 Thread: id = 1310 os_tid = 0x21a4 [0084.166] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-24.png")) returned 0x20 [0088.078] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24.png", dwFileAttributes=0x20) returned 0 [0088.078] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-24.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0088.078] GetLastError () returned 0x5 [0088.078] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24.png", dwFileAttributes=0x20) returned 0 [0088.078] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x72863c0) returned 1 Thread: id = 1311 os_tid = 0x21a8 [0084.167] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-24_altform-unplated.png")) returned 0x20 [0088.076] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0088.077] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-24_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0088.077] GetLastError () returned 0x5 [0088.077] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0088.077] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75842c8) returned 1 Thread: id = 1312 os_tid = 0x21ac [0084.167] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-24_altform-unplated_contrast-black.png")) Thread: id = 1313 os_tid = 0x21b0 [0084.170] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-24_altform-unplated_contrast-white.png")) Thread: id = 1314 os_tid = 0x21b4 [0084.171] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-24_contrast-black.png")) returned 0x20 [0088.075] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_contrast-black.png", dwFileAttributes=0x20) returned 0 [0088.075] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-24_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0088.075] GetLastError () returned 0x5 [0088.075] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_contrast-black.png", dwFileAttributes=0x20) returned 0 [0088.076] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5baa7e0) returned 1 Thread: id = 1315 os_tid = 0x21b8 [0084.171] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-24_contrast-white.png")) returned 0x20 [0088.074] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_contrast-white.png", dwFileAttributes=0x20) returned 0 [0088.074] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-24_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0088.074] GetLastError () returned 0x5 [0088.074] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_contrast-white.png", dwFileAttributes=0x20) returned 0 [0088.074] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5baaa10) returned 1 Thread: id = 1316 os_tid = 0x21bc [0084.172] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-256.png")) returned 0x20 [0088.072] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256.png", dwFileAttributes=0x20) returned 0 [0088.073] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-256.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0088.073] GetLastError () returned 0x5 [0088.073] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256.png", dwFileAttributes=0x20) returned 0 [0088.073] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba25f8) returned 1 Thread: id = 1317 os_tid = 0x21c0 [0084.172] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-256_altform-unplated.png")) returned 0x20 [0088.071] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0088.071] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-256_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0088.071] GetLastError () returned 0x5 [0088.071] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0088.072] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7584890) returned 1 Thread: id = 1318 os_tid = 0x21c4 [0084.173] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-256_altform-unplated_contrast-black.png")) Thread: id = 1319 os_tid = 0x21c8 [0084.173] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-256_altform-unplated_contrast-white.png")) Thread: id = 1320 os_tid = 0x21cc [0084.174] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-256_contrast-black.png")) returned 0x20 [0088.070] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_contrast-black.png", dwFileAttributes=0x20) returned 0 [0088.070] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-256_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0088.070] GetLastError () returned 0x5 [0088.070] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_contrast-black.png", dwFileAttributes=0x20) returned 0 [0088.070] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba99a8) returned 1 Thread: id = 1321 os_tid = 0x21d0 [0084.174] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-256_contrast-white.png")) returned 0x20 [0088.068] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_contrast-white.png", dwFileAttributes=0x20) returned 0 [0088.068] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-256_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0088.069] GetLastError () returned 0x5 [0088.069] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_contrast-white.png", dwFileAttributes=0x20) returned 0 [0088.069] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba9ac0) returned 1 Thread: id = 1322 os_tid = 0x21d4 [0084.175] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-30.png")) returned 0x20 [0088.067] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30.png", dwFileAttributes=0x20) returned 0 [0088.067] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-30.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0088.067] GetLastError () returned 0x5 [0088.067] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30.png", dwFileAttributes=0x20) returned 0 [0088.067] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x72864b8) returned 1 Thread: id = 1323 os_tid = 0x21d8 [0084.175] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-30_altform-unplated.png")) returned 0x20 [0088.066] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0088.066] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-30_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0088.066] GetLastError () returned 0x5 [0088.066] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0088.066] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7585670) returned 1 Thread: id = 1324 os_tid = 0x21dc [0084.176] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-30_altform-unplated_contrast-black.png")) Thread: id = 1325 os_tid = 0x21e0 [0084.176] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-30_altform-unplated_contrast-white.png")) Thread: id = 1326 os_tid = 0x21e4 [0086.064] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6e) returned 0x766e220 [0086.064] wcscpy (in: _Dest=0x766e220, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database" [0086.064] wcscat (in: _Dest=0x766e220, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\" [0086.064] wcscat (in: _Dest=0x766e220, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\*") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\*" [0086.064] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a3a78 [0086.065] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\*", lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cdbf8a7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x8e73b662, ftLastAccessTime.dwHighDateTime=0x1d5d80d, ftLastWriteTime.dwLowDateTime=0x8e73b662, ftLastWriteTime.dwHighDateTime=0x1d5d80d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f000 [0086.065] wcscmp (_String1=".", _String2=".") returned 0 [0086.065] FindNextFileW (in: hFindFile=0x389f000, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cdbf8a7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x8e73b662, ftLastAccessTime.dwHighDateTime=0x1d5d80d, ftLastWriteTime.dwLowDateTime=0x8e73b662, ftLastWriteTime.dwHighDateTime=0x1d5d80d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.065] wcscmp (_String1="..", _String2=".") returned 1 [0086.065] wcscmp (_String1="..", _String2="..") returned 0 [0086.065] FindNextFileW (in: hFindFile=0x389f000, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d1eb87d, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d1eb87d, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x754346b, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDB.chk", cAlternateFileName="")) returned 1 [0086.065] wcscmp (_String1="EDB.chk", _String2=".") returned 1 [0086.065] wcscmp (_String1="EDB.chk", _String2="..") returned 1 [0086.065] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7a) returned 0x3976de0 [0086.065] wcscpy (in: _Dest=0x3976de0, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database" [0086.065] wcscat (in: _Dest=0x3976de0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\" [0086.065] wcscat (in: _Dest=0x3976de0, _Source="EDB.chk" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDB.chk") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDB.chk" [0088.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3976de0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1234 [0088.663] FindNextFileW (in: hFindFile=0x389f000, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cdbf8a7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3cdbf8a7, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x754346b, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDB.log", cAlternateFileName="")) returned 1 [0088.663] wcscmp (_String1="EDB.log", _String2=".") returned 1 [0088.663] wcscmp (_String1="EDB.log", _String2="..") returned 1 [0088.663] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7a) returned 0x39777f8 [0088.663] wcscpy (in: _Dest=0x39777f8, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database" [0088.663] wcscat (in: _Dest=0x39777f8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\" [0088.663] wcscat (in: _Dest=0x39777f8, _Source="EDB.log" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDB.log") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDB.log" [0088.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x39777f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d4 [0088.664] FindNextFileW (in: hFindFile=0x389f000, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cdbf8a7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xcb6e1300, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x8e7618cf, ftLastWriteTime.dwHighDateTime=0x1d5d80d, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDB00006.log", cAlternateFileName="")) returned 1 [0088.664] wcscmp (_String1="EDB00006.log", _String2=".") returned 1 [0088.664] wcscmp (_String1="EDB00006.log", _String2="..") returned 1 [0088.664] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x84) returned 0x549d688 [0088.664] wcscpy (in: _Dest=0x549d688, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database" [0088.664] wcscat (in: _Dest=0x549d688, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\" [0088.664] wcscat (in: _Dest=0x549d688, _Source="EDB00006.log" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDB00006.log") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDB00006.log" [0088.664] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549d688, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d0 [0088.665] FindNextFileW (in: hFindFile=0x389f000, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d1c563b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d1c563b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x3d1c563b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDBres00001.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1 [0088.665] wcscmp (_String1="EDBres00001.jrs", _String2=".") returned 1 [0088.665] wcscmp (_String1="EDBres00001.jrs", _String2="..") returned 1 [0088.665] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8a) returned 0x549f730 [0088.665] wcscpy (in: _Dest=0x549f730, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database" [0088.665] wcscat (in: _Dest=0x549f730, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\" [0088.665] wcscat (in: _Dest=0x549f730, _Source="EDBres00001.jrs" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDBres00001.jrs") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDBres00001.jrs" [0088.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549f730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18cc [0088.665] FindNextFileW (in: hFindFile=0x389f000, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d1eb87d, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d1eb87d, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x3d1eb87d, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDBres00002.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1 [0088.665] wcscmp (_String1="EDBres00002.jrs", _String2=".") returned 1 [0088.666] wcscmp (_String1="EDBres00002.jrs", _String2="..") returned 1 [0088.666] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8a) returned 0x549f270 [0088.666] wcscpy (in: _Dest=0x549f270, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database" [0088.666] wcscat (in: _Dest=0x549f270, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\" [0088.666] wcscat (in: _Dest=0x549f270, _Source="EDBres00002.jrs" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDBres00002.jrs") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDBres00002.jrs" [0088.666] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549f270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1230 [0088.666] FindNextFileW (in: hFindFile=0x389f000, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cdbf8a7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3cffbae0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xe332f20e, ftLastWriteTime.dwHighDateTime=0x1d327e6, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDBtmp.log", cAlternateFileName="")) returned 1 [0088.666] wcscmp (_String1="EDBtmp.log", _String2=".") returned 1 [0088.666] wcscmp (_String1="EDBtmp.log", _String2="..") returned 1 [0088.666] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x80) returned 0x3976d58 [0088.666] wcscpy (in: _Dest=0x3976d58, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database" [0088.666] wcscat (in: _Dest=0x3976d58, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\" [0088.666] wcscat (in: _Dest=0x3976d58, _Source="EDBtmp.log" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDBtmp.log") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDBtmp.log" [0088.666] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3976d58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c8 [0088.667] FindNextFileW (in: hFindFile=0x389f000, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d532a92, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d532a92, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x88a7d0f, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x110000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vedatamodel.edb", cAlternateFileName="VEDATA~1.EDB")) returned 1 [0088.667] wcscmp (_String1="vedatamodel.edb", _String2=".") returned 1 [0088.667] wcscmp (_String1="vedatamodel.edb", _String2="..") returned 1 [0088.667] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8a) returned 0x549eee0 [0088.667] wcscpy (in: _Dest=0x549eee0, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database" [0088.667] wcscat (in: _Dest=0x549eee0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\" [0088.667] wcscat (in: _Dest=0x549eee0, _Source="vedatamodel.edb" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" [0088.667] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549eee0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x127c [0088.668] FindNextFileW (in: hFindFile=0x389f000, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc21df919, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc21df919, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x74d0eea, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vedatamodel.jfm", cAlternateFileName="VEDATA~1.JFM")) returned 1 [0088.668] wcscmp (_String1="vedatamodel.jfm", _String2=".") returned 1 [0088.668] wcscmp (_String1="vedatamodel.jfm", _String2="..") returned 1 [0088.668] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8a) returned 0x549f8f8 [0088.668] wcscpy (in: _Dest=0x549f8f8, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database" [0088.668] wcscat (in: _Dest=0x549f8f8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\" [0088.668] wcscat (in: _Dest=0x549f8f8, _Source="vedatamodel.jfm" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.jfm") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.jfm" [0088.668] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549f8f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b8 [0088.669] FindNextFileW (in: hFindFile=0x389f000, lpFindFileData=0x53a3a78 | out: lpFindFileData=0x53a3a78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc21df919, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc21df919, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x74d0eea, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vedatamodel.jfm", cAlternateFileName="VEDATA~1.JFM")) returned 0 [0088.669] FindClose (in: hFindFile=0x389f000 | out: hFindFile=0x389f000) returned 1 [0088.669] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a3a78) returned 1 [0088.669] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x766e220) returned 1 [0088.669] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496968) returned 1 Thread: id = 1327 os_tid = 0x21e8 [0086.066] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x88) returned 0x549d688 [0086.066] wcscpy (in: _Dest=0x549d688, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers" [0086.066] wcscat (in: _Dest=0x549d688, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\" [0086.066] wcscat (in: _Dest=0x549d688, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\*") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\*" [0086.066] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a3ce0 [0086.066] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\*", lpFindFileData=0x53a3ce0 | out: lpFindFileData=0x53a3ce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x92addfb1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92addfb1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f040 [0086.067] wcscmp (_String1=".", _String2=".") returned 0 [0086.067] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x53a3ce0 | out: lpFindFileData=0x53a3ce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x92addfb1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92addfb1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.067] wcscmp (_String1="..", _String2=".") returned 1 [0086.067] wcscmp (_String1="..", _String2="..") returned 0 [0086.067] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x53a3ce0 | out: lpFindFileData=0x53a3ce0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf98c0dcf, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf98c8304, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf98c8304, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftEdge_bingpagedata", cAlternateFileName="MICROS~4")) returned 1 [0086.067] wcscmp (_String1="MicrosoftEdge_bingpagedata", _String2=".") returned 1 [0086.067] wcscmp (_String1="MicrosoftEdge_bingpagedata", _String2="..") returned 1 [0086.067] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x53f96a0 [0086.067] wcscpy (in: _Dest=0x53f96a0, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers" [0086.067] wcscat (in: _Dest=0x53f96a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\" [0086.067] wcscat (in: _Dest=0x53f96a0, _Source="MicrosoftEdge_bingpagedata" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata" [0088.655] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x53f96a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f14 [0088.655] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x53a3ce0 | out: lpFindFileData=0x53a3ce0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9090a172, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9090a172, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x909a2acc, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftEdge_DNTException", cAlternateFileName="MI18F7~1")) returned 1 [0088.655] wcscmp (_String1="MicrosoftEdge_DNTException", _String2=".") returned 1 [0088.655] wcscmp (_String1="MicrosoftEdge_DNTException", _String2="..") returned 1 [0088.655] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x3975d60 [0088.655] wcscpy (in: _Dest=0x3975d60, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers" [0088.655] wcscat (in: _Dest=0x3975d60, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\" [0088.655] wcscat (in: _Dest=0x3975d60, _Source="MicrosoftEdge_DNTException" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException" [0088.656] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3975d60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19b8 [0088.656] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x53a3ce0 | out: lpFindFileData=0x53a3ce0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x92a91af7, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92a91af7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92a91af7, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftEdge_EmieSiteList", cAlternateFileName="MICFB7~1")) returned 1 [0088.656] wcscmp (_String1="MicrosoftEdge_EmieSiteList", _String2=".") returned 1 [0088.656] wcscmp (_String1="MicrosoftEdge_EmieSiteList", _String2="..") returned 1 [0088.656] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x3975018 [0088.656] wcscpy (in: _Dest=0x3975018, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers" [0088.656] wcscat (in: _Dest=0x3975018, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\" [0088.656] wcscat (in: _Dest=0x3975018, _Source="MicrosoftEdge_EmieSiteList" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieSiteList") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieSiteList" [0088.656] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3975018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19b4 [0088.657] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x53a3ce0 | out: lpFindFileData=0x53a3ce0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x92addfb1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92addfb1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92b04223, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftEdge_EmieUserList", cAlternateFileName="MI15A7~1")) returned 1 [0088.657] wcscmp (_String1="MicrosoftEdge_EmieUserList", _String2=".") returned 1 [0088.657] wcscmp (_String1="MicrosoftEdge_EmieUserList", _String2="..") returned 1 [0088.657] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x3975bd0 [0088.657] wcscpy (in: _Dest=0x3975bd0, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers" [0088.657] wcscat (in: _Dest=0x3975bd0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\" [0088.657] wcscat (in: _Dest=0x3975bd0, _Source="MicrosoftEdge_EmieUserList" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieUserList") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieUserList" [0088.657] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3975bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19ac [0088.658] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x53a3ce0 | out: lpFindFileData=0x53a3ce0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xe0889c9e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe0889c9e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftEdge_iecompat", cAlternateFileName="MICROS~1")) returned 1 [0088.658] wcscmp (_String1="MicrosoftEdge_iecompat", _String2=".") returned 1 [0088.658] wcscmp (_String1="MicrosoftEdge_iecompat", _String2="..") returned 1 [0088.658] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb2) returned 0x5b16490 [0088.658] wcscpy (in: _Dest=0x5b16490, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers" [0088.658] wcscat (in: _Dest=0x5b16490, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\" [0088.658] wcscat (in: _Dest=0x5b16490, _Source="MicrosoftEdge_iecompat" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat" [0088.658] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5b16490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19a4 [0088.659] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x53a3ce0 | out: lpFindFileData=0x53a3ce0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf5b4b18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf5b4b18, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf5b4b18, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftEdge_iecompatua", cAlternateFileName="MICROS~2")) returned 1 [0088.659] wcscmp (_String1="MicrosoftEdge_iecompatua", _String2=".") returned 1 [0088.659] wcscmp (_String1="MicrosoftEdge_iecompatua", _String2="..") returned 1 [0088.659] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb6) returned 0x5b166d0 [0088.659] wcscpy (in: _Dest=0x5b166d0, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers" [0088.659] wcscat (in: _Dest=0x5b166d0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\" [0088.659] wcscat (in: _Dest=0x5b166d0, _Source="MicrosoftEdge_iecompatua" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua" [0088.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5b166d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11e4 [0088.659] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x53a3ce0 | out: lpFindFileData=0x53a3ce0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf58e291f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf58ffddd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf58ffddd, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftEdge_ieflipahead", cAlternateFileName="MICROS~3")) returned 1 [0088.659] wcscmp (_String1="MicrosoftEdge_ieflipahead", _String2=".") returned 1 [0088.659] wcscmp (_String1="MicrosoftEdge_ieflipahead", _String2="..") returned 1 [0088.660] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb8) returned 0x5b16790 [0088.660] wcscpy (in: _Dest=0x5b16790, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers" [0088.660] wcscat (in: _Dest=0x5b16790, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\" [0088.660] wcscat (in: _Dest=0x5b16790, _Source="MicrosoftEdge_ieflipahead" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead" [0088.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5b16790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x199c [0088.660] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x53a3ce0 | out: lpFindFileData=0x53a3ce0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf58e291f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf58ffddd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf58ffddd, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftEdge_ieflipahead", cAlternateFileName="MICROS~3")) returned 0 [0088.660] FindClose (in: hFindFile=0x389f040 | out: hFindFile=0x389f040) returned 1 [0088.661] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a3ce0) returned 1 [0088.661] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549d688) returned 1 [0088.661] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549d7a8) returned 1 Thread: id = 1328 os_tid = 0x21ec [0086.068] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x5468160 [0086.068] wcscpy (in: _Dest=0x5468160, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\User" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\User") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\User" [0086.068] wcscat (in: _Dest=0x5468160, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\User\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\User\\" [0086.068] wcscat (in: _Dest=0x5468160, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\User\\*") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\User\\*" [0086.068] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a4680 [0086.068] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\User\\*", lpFindFileData=0x53a4680 | out: lpFindFileData=0x53a4680*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6771884, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd6771884, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd678d991, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f0c0 [0086.069] wcscmp (_String1=".", _String2=".") returned 0 [0086.069] FindNextFileW (in: hFindFile=0x389f0c0, lpFindFileData=0x53a4680 | out: lpFindFileData=0x53a4680*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6771884, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd6771884, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd678d991, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.069] wcscmp (_String1="..", _String2=".") returned 1 [0086.069] wcscmp (_String1="..", _String2="..") returned 0 [0086.069] FindNextFileW (in: hFindFile=0x389f0c0, lpFindFileData=0x53a4680 | out: lpFindFileData=0x53a4680*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd678d991, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd678d991, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd678d991, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0086.069] wcscmp (_String1="Default", _String2=".") returned 1 [0086.069] wcscmp (_String1="Default", _String2="..") returned 1 [0086.069] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x72) returned 0x38d1d20 [0086.069] wcscpy (in: _Dest=0x38d1d20, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\User" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\User") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\User" [0086.069] wcscat (in: _Dest=0x38d1d20, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\User\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\User\\" [0086.069] wcscat (in: _Dest=0x38d1d20, _Source="Default" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\User\\Default") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\User\\Default" [0088.653] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38d1d20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f6c [0088.654] FindNextFileW (in: hFindFile=0x389f0c0, lpFindFileData=0x53a4680 | out: lpFindFileData=0x53a4680*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd678d991, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd678d991, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd678d991, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 0 [0088.654] FindClose (in: hFindFile=0x389f0c0 | out: hFindFile=0x389f0c0) returned 1 [0088.654] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a4680) returned 1 [0088.654] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5468160) returned 1 [0088.654] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba7d58) returned 1 Thread: id = 1329 os_tid = 0x21f0 [0086.069] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\CDPGlobalSettings.cdp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\connecteddevicesplatform\\cdpglobalsettings.cdp")) returned 0x20 [0086.069] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\CDPGlobalSettings.cdp", dwFileAttributes=0x20) returned 1 [0086.070] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\CDPGlobalSettings.cdp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\connecteddevicesplatform\\cdpglobalsettings.cdp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f18 [0086.070] GetFileSizeEx (in: hFile=0x1f18, lpFileSize=0x2efffab4 | out: lpFileSize=0x2efffab4*=1527) returned 1 [0086.070] SetFilePointerEx (in: hFile=0x1f18, liDistanceToMove=0x5f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.070] ReadFile (in: hFile=0x1f18, lpBuffer=0x2efffa38, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2efffa34, lpOverlapped=0x0 | out: lpBuffer=0x2efffa38*, lpNumberOfBytesRead=0x2efffa34*=0x4, lpOverlapped=0x0) returned 1 [0086.071] SetFilePointerEx (in: hFile=0x1f18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.071] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281660 [0086.071] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281390 [0086.071] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281458 [0086.071] NtQuerySystemTime (in: CurrentTime=0x2efffa14 | out: CurrentTime=0x2efffa14*=132260136432361509) returned 0x0 [0086.071] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0x8fcce9a2 [0086.071] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0x8d0cd00 [0086.071] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0x6cce203e [0086.071] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0x2e553f40 [0086.071] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0x9cbbe611 [0086.071] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0xd1ee5394 [0086.071] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0x99850f20 [0086.071] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0xab8835df [0086.071] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0x96317e35 [0086.071] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0xdfd0a53d [0086.071] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0x387bcb56 [0086.071] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0x2074078b [0086.071] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0xce83e438 [0086.071] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0x87fb7d70 [0086.071] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0x91e9aa9f [0086.071] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0x5762be97 [0086.071] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0xef40f282 [0086.071] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0x373437f9 [0086.072] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0xcfb79676 [0086.072] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0x2dedc2a8 [0086.072] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0x9d169d4d [0086.072] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0x8b86bf64 [0086.072] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0x2fbf4289 [0086.072] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0x49b10060 [0086.072] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0xa5d42337 [0086.072] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0xca12be20 [0086.072] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0xd6111ba2 [0086.072] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0x2879eac2 [0086.072] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0x20ba8aa9 [0086.072] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0x995d3e24 [0086.072] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0xe83949c6 [0086.072] RtlRandom (in: Seed=0x2efffa20 | out: Seed=0x2efffa20) returned 0x512fcb9f Thread: id = 1330 os_tid = 0x21f4 [0086.081] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.advertising\\bootstrap.html")) returned 0x20 [0089.343] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html", dwFileAttributes=0x20) returned 0 [0089.343] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.advertising\\bootstrap.html"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.343] GetLastError () returned 0x5 [0089.343] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html", dwFileAttributes=0x20) returned 0 [0089.343] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54a4100) returned 1 Thread: id = 1331 os_tid = 0x21f8 [0086.083] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.js" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.advertising\\bootstrap.js")) returned 0x20 [0089.346] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.js", dwFileAttributes=0x20) returned 0 [0089.346] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.js" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.advertising\\bootstrap.js"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.346] GetLastError () returned 0x5 [0089.346] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.js", dwFileAttributes=0x20) returned 0 [0089.346] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba29f8) returned 1 Thread: id = 1332 os_tid = 0x21fc [0086.083] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\ormma.js" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.advertising\\ormma.js")) returned 0x20 [0089.349] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\ormma.js", dwFileAttributes=0x20) returned 0 [0089.349] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\ormma.js" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.advertising\\ormma.js"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.349] GetLastError () returned 0x5 [0089.349] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\ormma.js", dwFileAttributes=0x20) returned 0 [0089.349] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x72865b0) returned 1 Thread: id = 1333 os_tid = 0x2200 [0086.084] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat")) returned 0x20 [0086.085] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0086.085] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.086] GetLastError () returned 0x5 [0086.086] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0086.086] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393ebe0) returned 1 Thread: id = 1334 os_tid = 0x2204 [0086.087] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs\\bootstrap.js")) returned 0x20 [0089.345] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js", dwFileAttributes=0x20) returned 0 [0089.348] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs\\bootstrap.js"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.348] GetLastError () returned 0x5 [0089.348] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js", dwFileAttributes=0x20) returned 0 [0089.348] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b20d8) returned 1 Thread: id = 1335 os_tid = 0x2208 [0086.088] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs\\ormma.js")) returned 0x20 [0092.255] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js", dwFileAttributes=0x20) returned 0 [0092.255] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs\\ormma.js"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.256] GetLastError () returned 0x5 [0092.256] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js", dwFileAttributes=0x20) returned 0 [0092.256] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7580a08) returned 1 Thread: id = 1336 os_tid = 0x220c [0086.089] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\default.css" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\default.css")) returned 0x20 [0086.090] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\default.css", dwFileAttributes=0x20) returned 0 [0086.090] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\default.css" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\default.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.090] GetLastError () returned 0x5 [0086.090] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\default.css", dwFileAttributes=0x20) returned 0 [0086.091] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55fd878) returned 1 Thread: id = 1337 os_tid = 0x2210 [0086.091] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x98) returned 0x55c5b78 [0086.092] wcscpy (in: _Dest=0x55c5b78, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" [0086.092] wcscat (in: _Dest=0x55c5b78, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" [0086.092] wcscat (in: _Dest=0x55c5b78, _Source="*" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*" [0086.092] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a48e8 [0086.092] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*", lpFindFileData=0x53a48e8 | out: lpFindFileData=0x53a48e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f300 [0086.092] wcscmp (_String1=".", _String2=".") returned 0 [0086.092] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x53a48e8 | out: lpFindFileData=0x53a48e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.092] wcscmp (_String1="..", _String2=".") returned 1 [0086.092] wcscmp (_String1="..", _String2="..") returned 0 [0086.092] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x53a48e8 | out: lpFindFileData=0x53a48e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe4edf80e, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe4edf80e, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="WORKFL~1.TAR")) returned 1 [0086.092] wcscmp (_String1="Workflow.Targets", _String2=".") returned 1 [0086.092] wcscmp (_String1="Workflow.Targets", _String2="..") returned 1 [0086.092] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb6) returned 0x5b15f50 [0086.092] wcscpy (in: _Dest=0x5b15f50, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" [0086.092] wcscat (in: _Dest=0x5b15f50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" [0086.092] wcscat (in: _Dest=0x5b15f50, _Source="Workflow.Targets" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets" [0088.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5b15f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7dc [0088.651] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x53a48e8 | out: lpFindFileData=0x53a48e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe4edf80e, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe4edf80e, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="WORKFL~2.TAR")) returned 1 [0088.651] wcscmp (_String1="Workflow.VisualBasic.Targets", _String2=".") returned 1 [0088.651] wcscmp (_String1="Workflow.VisualBasic.Targets", _String2="..") returned 1 [0088.651] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x7580858 [0088.651] wcscpy (in: _Dest=0x7580858, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" [0088.651] wcscat (in: _Dest=0x7580858, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" [0088.652] wcscat (in: _Dest=0x7580858, _Source="Workflow.VisualBasic.Targets" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets" [0088.652] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7580858, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x760 [0088.652] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x53a48e8 | out: lpFindFileData=0x53a48e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe4edf80e, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe4edf80e, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="WORKFL~2.TAR")) returned 0 [0088.652] FindClose (in: hFindFile=0x389f300 | out: hFindFile=0x389f300) returned 1 [0088.652] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a48e8) returned 1 [0088.652] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c5b78) returned 1 [0088.652] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54262c8) returned 1 Thread: id = 1338 os_tid = 0x2214 [0086.093] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x98) returned 0x55c5cb8 [0086.093] wcscpy (in: _Dest=0x55c5cb8, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" [0086.093] wcscat (in: _Dest=0x55c5cb8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\" [0086.093] wcscat (in: _Dest=0x55c5cb8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*" [0086.093] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a4b50 [0086.093] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*", lpFindFileData=0x53a4b50 | out: lpFindFileData=0x53a4b50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a165b3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f380 [0086.093] wcscmp (_String1=".", _String2=".") returned 0 [0086.093] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x53a4b50 | out: lpFindFileData=0x53a4b50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a165b3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.094] wcscmp (_String1="..", _String2=".") returned 1 [0086.094] wcscmp (_String1="..", _String2="..") returned 0 [0086.094] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x53a4b50 | out: lpFindFileData=0x53a4b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5733fb2f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x5733fb2f, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd469ff00, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0x1c01, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="")) returned 1 [0086.094] wcscmp (_String1="Workflow.Targets", _String2=".") returned 1 [0086.094] wcscmp (_String1="Workflow.Targets", _String2="..") returned 1 [0086.094] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb6) returned 0x5b160d0 [0086.094] wcscpy (in: _Dest=0x5b160d0, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" [0086.094] wcscat (in: _Dest=0x5b160d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\" [0086.094] wcscat (in: _Dest=0x5b160d0, _Source="Workflow.Targets" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets" [0088.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5b160d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7bc [0088.649] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x53a4b50 | out: lpFindFileData=0x53a4b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5733fb2f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x5733fb2f, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd469ff00, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="")) returned 1 [0088.649] wcscmp (_String1="Workflow.VisualBasic.Targets", _String2=".") returned 1 [0088.649] wcscmp (_String1="Workflow.VisualBasic.Targets", _String2="..") returned 1 [0088.649] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x7580780 [0088.649] wcscpy (in: _Dest=0x7580780, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" [0088.649] wcscat (in: _Dest=0x7580780, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\" [0088.649] wcscat (in: _Dest=0x7580780, _Source="Workflow.VisualBasic.Targets" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets" [0088.649] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7580780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f4 [0088.650] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x53a4b50 | out: lpFindFileData=0x53a4b50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5733fb2f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x5733fb2f, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd469ff00, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="")) returned 0 [0088.650] FindClose (in: hFindFile=0x389f380 | out: hFindFile=0x389f380) returned 1 [0088.650] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a4b50) returned 1 [0088.650] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c5cb8) returned 1 [0088.650] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c6898) returned 1 Thread: id = 1339 os_tid = 0x2218 [0086.094] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat")) returned 0x20 [0089.353] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0089.353] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.353] GetLastError () returned 0x5 [0089.353] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0089.353] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393e9f0) returned 1 Thread: id = 1340 os_tid = 0x221c [0086.095] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\appxmetadata\\codeintegrity.cat")) returned 0x20 [0089.354] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0089.354] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.354] GetLastError () returned 0x5 [0089.354] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0089.354] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389e050) returned 1 Thread: id = 1341 os_tid = 0x2220 [0086.095] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x68) returned 0x5468ef0 [0086.095] wcscpy (in: _Dest=0x5468ef0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat" [0086.095] wcscat (in: _Dest=0x5468ef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\" [0086.095] wcscat (in: _Dest=0x5468ef0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\*" [0086.095] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a4db8 [0086.095] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\*", lpFindFileData=0x53a4db8 | out: lpFindFileData=0x53a4db8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33bf1c6c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33bf1c6c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33bf1c6c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f3c0 [0086.095] wcscmp (_String1=".", _String2=".") returned 0 [0086.095] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x53a4db8 | out: lpFindFileData=0x53a4db8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33bf1c6c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33bf1c6c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33bf1c6c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.095] wcscmp (_String1="..", _String2=".") returned 1 [0086.095] wcscmp (_String1="..", _String2="..") returned 0 [0086.095] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x53a4db8 | out: lpFindFileData=0x53a4db8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33bf1c6c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xbb3faac8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xde8f7271, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveX", cAlternateFileName="")) returned 1 [0086.096] wcscmp (_String1="ActiveX", _String2=".") returned 1 [0086.096] wcscmp (_String1="ActiveX", _String2="..") returned 1 [0086.096] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x74) returned 0x38d1da0 [0086.096] wcscpy (in: _Dest=0x38d1da0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat" [0086.096] wcscat (in: _Dest=0x38d1da0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\" [0086.096] wcscat (in: _Dest=0x38d1da0, _Source="ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0088.647] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38d1da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x78c [0088.647] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x53a4db8 | out: lpFindFileData=0x53a4db8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33bf1c6c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xbb3faac8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xde8f7271, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveX", cAlternateFileName="")) returned 0 [0088.647] FindClose (in: hFindFile=0x389f3c0 | out: hFindFile=0x389f3c0) returned 1 [0088.648] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a4db8) returned 1 [0088.648] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5468ef0) returned 1 [0088.648] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396e4c0) returned 1 Thread: id = 1342 os_tid = 0x2224 [0086.096] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x6e95960 [0086.096] wcscpy (in: _Dest=0x6e95960, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM" [0086.096] wcscat (in: _Dest=0x6e95960, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\" [0086.096] wcscat (in: _Dest=0x6e95960, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\*" [0086.096] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a5020 [0086.096] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\*", lpFindFileData=0x53a5020 | out: lpFindFileData=0x53a5020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33e07dd6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33e07dd6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33e07dd6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f440 [0086.096] wcscmp (_String1=".", _String2=".") returned 0 [0086.096] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x53a5020 | out: lpFindFileData=0x53a5020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33e07dd6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33e07dd6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33e07dd6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.096] wcscmp (_String1="..", _String2=".") returned 1 [0086.097] wcscmp (_String1="..", _String2="..") returned 0 [0086.097] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x53a5020 | out: lpFindFileData=0x53a5020*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x33e07dd6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x31d47305, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x31d47305, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 1 [0086.097] wcscmp (_String1="1.0", _String2=".") returned 1 [0086.097] wcscmp (_String1="1.0", _String2="..") returned 1 [0086.097] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x5468e80 [0086.097] wcscpy (in: _Dest=0x5468e80, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM" [0086.097] wcscat (in: _Dest=0x5468e80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\" [0086.097] wcscat (in: _Dest=0x5468e80, _Source="1.0" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0" [0088.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5468e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x780 [0088.646] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x53a5020 | out: lpFindFileData=0x53a5020*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x33e07dd6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x31d47305, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x31d47305, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 0 [0088.646] FindClose (in: hFindFile=0x389f440 | out: hFindFile=0x389f440) returned 1 [0088.646] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a5020) returned 1 [0088.646] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x6e95960) returned 1 [0088.646] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x6e96250) returned 1 Thread: id = 1343 os_tid = 0x2228 [0086.097] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x68) returned 0x5468f60 [0086.097] wcscpy (in: _Dest=0x5468f60, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0086.097] wcscat (in: _Dest=0x5468f60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0086.097] wcscat (in: _Dest=0x5468f60, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*" [0086.097] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a5288 [0086.097] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*", lpFindFileData=0x53a5288 | out: lpFindFileData=0x53a5288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3420de7a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3420de7a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3420de7a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54459c0 [0086.098] wcscmp (_String1=".", _String2=".") returned 0 [0086.098] FindNextFileW (in: hFindFile=0x54459c0, lpFindFileData=0x53a5288 | out: lpFindFileData=0x53a5288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3420de7a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3420de7a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3420de7a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.098] wcscmp (_String1="..", _String2=".") returned 1 [0086.098] wcscmp (_String1="..", _String2="..") returned 0 [0086.098] FindNextFileW (in: hFindFile=0x54459c0, lpFindFileData=0x53a5288 | out: lpFindFileData=0x53a5288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3420de7a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3420de7a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3420de7a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0086.098] wcscmp (_String1="en_US", _String2=".") returned 1 [0086.098] wcscmp (_String1="en_US", _String2="..") returned 1 [0086.098] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x766de60 [0086.098] wcscpy (in: _Dest=0x766de60, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0086.098] wcscat (in: _Dest=0x766de60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0086.098] wcscat (in: _Dest=0x766de60, _Source="en_US" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US" [0088.644] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x766de60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c8 [0088.644] FindNextFileW (in: hFindFile=0x54459c0, lpFindFileData=0x53a5288 | out: lpFindFileData=0x53a5288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3420de7a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3420de7a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3420de7a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 0 [0088.644] FindClose (in: hFindFile=0x54459c0 | out: hFindFile=0x54459c0) returned 1 [0088.645] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a5288) returned 1 [0088.645] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5468f60) returned 1 [0088.645] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba6fc8) returned 1 Thread: id = 1344 os_tid = 0x222c [0086.099] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x5468e10 [0086.099] wcscpy (in: _Dest=0x5468e10, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader" [0086.099] wcscat (in: _Dest=0x5468e10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\" [0086.099] wcscat (in: _Dest=0x5468e10, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\*" [0086.099] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a54f0 [0086.099] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\*", lpFindFileData=0x53a54f0 | out: lpFindFileData=0x53a54f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ea075c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ea075c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444c80 [0086.099] wcscmp (_String1=".", _String2=".") returned 0 [0086.100] FindNextFileW (in: hFindFile=0x5444c80, lpFindFileData=0x53a54f0 | out: lpFindFileData=0x53a54f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ea075c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ea075c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.100] wcscmp (_String1="..", _String2=".") returned 1 [0086.100] wcscmp (_String1="..", _String2="..") returned 0 [0086.100] FindNextFileW (in: hFindFile=0x5444c80, lpFindFileData=0x53a54f0 | out: lpFindFileData=0x53a54f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ea075c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ea075c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DC", cAlternateFileName="")) returned 1 [0086.100] wcscmp (_String1="DC", _String2=".") returned 1 [0086.100] wcscmp (_String1="DC", _String2="..") returned 1 [0086.100] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x68) returned 0x38b2258 [0086.100] wcscpy (in: _Dest=0x38b2258, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader" [0086.100] wcscat (in: _Dest=0x38b2258, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\" [0086.100] wcscat (in: _Dest=0x38b2258, _Source="DC" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC" [0088.642] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b2258, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x768 [0088.643] FindNextFileW (in: hFindFile=0x5444c80, lpFindFileData=0x53a54f0 | out: lpFindFileData=0x53a54f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ea075c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ea075c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DC", cAlternateFileName="")) returned 0 [0088.643] FindClose (in: hFindFile=0x5444c80 | out: hFindFile=0x5444c80) returned 1 [0088.643] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a54f0) returned 1 [0088.643] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5468e10) returned 1 [0088.643] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba7818) returned 1 Thread: id = 1345 os_tid = 0x2230 [0086.100] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb4) returned 0x5b16850 [0086.100] wcscpy (in: _Dest=0x5b16850, _Source="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages" [0086.100] wcscat (in: _Dest=0x5b16850, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\" [0086.100] wcscat (in: _Dest=0x5b16850, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*" [0086.100] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a2000 [0086.100] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*", lpFindFileData=0x53a2000 | out: lpFindFileData=0x53a2000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444cc0 [0086.102] wcscmp (_String1=".", _String2=".") returned 0 [0086.102] FindNextFileW (in: hFindFile=0x5444cc0, lpFindFileData=0x53a2000 | out: lpFindFileData=0x53a2000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.102] wcscmp (_String1="..", _String2=".") returned 1 [0086.102] wcscmp (_String1="..", _String2="..") returned 0 [0086.102] FindNextFileW (in: hFindFile=0x5444cc0, lpFindFileData=0x53a2000 | out: lpFindFileData=0x53a2000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0086.102] wcscmp (_String1="vcRuntimeAdditional_amd64", _String2=".") returned 1 [0086.102] wcscmp (_String1="vcRuntimeAdditional_amd64", _String2="..") returned 1 [0086.102] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe4) returned 0x54b9468 [0086.102] wcscpy (in: _Dest=0x54b9468, _Source="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages" [0086.102] wcscat (in: _Dest=0x54b9468, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\" [0086.102] wcscat (in: _Dest=0x54b9468, _Source="vcRuntimeAdditional_amd64" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64" [0088.641] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54b9468, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1220 [0088.641] FindNextFileW (in: hFindFile=0x5444cc0, lpFindFileData=0x53a2000 | out: lpFindFileData=0x53a2000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0088.641] FindClose (in: hFindFile=0x5444cc0 | out: hFindFile=0x5444cc0) returned 1 [0088.641] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a2000) returned 1 [0088.641] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5b16850) returned 1 [0088.641] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a2108) returned 1 Thread: id = 1346 os_tid = 0x2234 [0086.103] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6c) returned 0x766e298 [0086.103] wcscpy (in: _Dest=0x766e298, _Source="C:\\Program Files\\Windows Security\\BrowserCore\\en-US" | out: _Dest="C:\\Program Files\\Windows Security\\BrowserCore\\en-US") returned="C:\\Program Files\\Windows Security\\BrowserCore\\en-US" [0086.103] wcscat (in: _Dest=0x766e298, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\") returned="C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\" [0086.103] wcscat (in: _Dest=0x766e298, _Source="*" | out: _Dest="C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\*") returned="C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\*" [0086.103] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a2268 [0086.103] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\*", lpFindFileData=0x53a2268 | out: lpFindFileData=0x53a2268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa92ae2d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444d40 [0086.103] wcscmp (_String1=".", _String2=".") returned 0 [0086.103] FindNextFileW (in: hFindFile=0x5444d40, lpFindFileData=0x53a2268 | out: lpFindFileData=0x53a2268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa92ae2d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.103] wcscmp (_String1="..", _String2=".") returned 1 [0086.103] wcscmp (_String1="..", _String2="..") returned 0 [0086.103] FindNextFileW (in: hFindFile=0x5444d40, lpFindFileData=0x53a2268 | out: lpFindFileData=0x53a2268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d802908, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x76ff649a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x1bb16400, ftLastWriteTime.dwHighDateTime=0x1d29fab, nFileSizeHigh=0x0, nFileSizeLow=0x3a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrowserCore.exe.mui", cAlternateFileName="")) returned 1 [0086.103] wcscmp (_String1="BrowserCore.exe.mui", _String2=".") returned 1 [0086.103] wcscmp (_String1="BrowserCore.exe.mui", _String2="..") returned 1 [0086.103] FindNextFileW (in: hFindFile=0x5444d40, lpFindFileData=0x53a2268 | out: lpFindFileData=0x53a2268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d802908, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x76ff649a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x1bb16400, ftLastWriteTime.dwHighDateTime=0x1d29fab, nFileSizeHigh=0x0, nFileSizeLow=0x3a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrowserCore.exe.mui", cAlternateFileName="")) returned 0 [0086.103] FindClose (in: hFindFile=0x5444d40 | out: hFindFile=0x5444d40) returned 1 [0086.104] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a2268) returned 1 [0086.104] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x766e298) returned 1 [0086.104] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396e610) returned 1 Thread: id = 1347 os_tid = 0x2238 [0086.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Security\\BrowserCore\\manifest.json" (normalized: "c:\\program files\\windows security\\browsercore\\manifest.json")) returned 0x20 [0086.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Security\\BrowserCore\\manifest.json", dwFileAttributes=0x20) returned 0 [0086.105] CreateFileW (lpFileName="C:\\Program Files\\Windows Security\\BrowserCore\\manifest.json" (normalized: "c:\\program files\\windows security\\browsercore\\manifest.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.105] GetLastError () returned 0x5 [0086.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Security\\BrowserCore\\manifest.json", dwFileAttributes=0x20) returned 0 [0086.105] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38d06a0) returned 1 Thread: id = 1348 os_tid = 0x223c [0086.107] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x757e6b0 [0086.107] wcscpy (in: _Dest=0x757e6b0, _Source="C:\\ProgramData\\Microsoft\\AppV\\Setup" | out: _Dest="C:\\ProgramData\\Microsoft\\AppV\\Setup") returned="C:\\ProgramData\\Microsoft\\AppV\\Setup" [0086.107] wcscat (in: _Dest=0x757e6b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\AppV\\Setup\\") returned="C:\\ProgramData\\Microsoft\\AppV\\Setup\\" [0086.107] wcscat (in: _Dest=0x757e6b0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\AppV\\Setup\\*") returned="C:\\ProgramData\\Microsoft\\AppV\\Setup\\*" [0086.107] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a2268 [0086.107] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\AppV\\Setup\\*", lpFindFileData=0x53a2268 | out: lpFindFileData=0x53a2268*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444d40 [0086.107] wcscmp (_String1=".", _String2=".") returned 0 [0086.107] FindNextFileW (in: hFindFile=0x5444d40, lpFindFileData=0x53a2268 | out: lpFindFileData=0x53a2268*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.107] wcscmp (_String1="..", _String2=".") returned 1 [0086.107] wcscmp (_String1="..", _String2="..") returned 0 [0086.107] FindNextFileW (in: hFindFile=0x5444d40, lpFindFileData=0x53a2268 | out: lpFindFileData=0x53a2268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799dd27b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe2889e45, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe2889e45, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1368, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeIntegrator.ps1", cAlternateFileName="")) returned 1 [0086.107] wcscmp (_String1="OfficeIntegrator.ps1", _String2=".") returned 1 [0086.107] wcscmp (_String1="OfficeIntegrator.ps1", _String2="..") returned 1 [0086.107] FindNextFileW (in: hFindFile=0x5444d40, lpFindFileData=0x53a2268 | out: lpFindFileData=0x53a2268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799dd27b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe2889e45, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe2889e45, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1368, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeIntegrator.ps1", cAlternateFileName="")) returned 0 [0086.107] FindClose (in: hFindFile=0x5444d40 | out: hFindFile=0x5444d40) returned 1 [0086.108] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a2268) returned 1 [0086.108] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757e6b0) returned 1 [0086.108] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5532260) returned 1 Thread: id = 1349 os_tid = 0x2240 [0086.109] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\256x256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\256x256.png")) returned 0x20 [0086.111] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\256x256.png", dwFileAttributes=0x20) returned 0 [0086.113] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\256x256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\256x256.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.114] GetLastError () returned 0x5 [0086.114] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\256x256.png", dwFileAttributes=0x20) returned 0 [0086.116] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389df78) returned 1 Thread: id = 1350 os_tid = 0x2244 [0086.117] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0086.119] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.120] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.122] GetLastError () returned 0x5 [0086.122] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.123] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bab520) returned 1 Thread: id = 1351 os_tid = 0x2248 [0086.124] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxClickHandler.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\appxclickhandler.winmd")) returned 0x20 [0086.126] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxClickHandler.winmd", dwFileAttributes=0x20) returned 0 [0086.128] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxClickHandler.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\appxclickhandler.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.129] GetLastError () returned 0x5 [0086.129] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxClickHandler.winmd", dwFileAttributes=0x20) returned 0 [0086.130] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54ba548) returned 1 Thread: id = 1352 os_tid = 0x224c [0086.131] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0086.198] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0086.198] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.198] GetLastError () returned 0x5 [0086.198] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0086.198] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bab600) returned 1 Thread: id = 1353 os_tid = 0x2250 [0086.204] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x3934e28 [0086.204] wcscpy (in: _Dest=0x3934e28, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0086.204] wcscat (in: _Dest=0x3934e28, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0086.204] wcscat (in: _Dest=0x3934e28, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*" [0086.204] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a2c08 [0086.204] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x53a2c08 | out: lpFindFileData=0x53a2c08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c5575af, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab228e06, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9c5575af, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444e40 [0086.205] wcscmp (_String1=".", _String2=".") returned 0 [0086.205] FindNextFileW (in: hFindFile=0x5444e40, lpFindFileData=0x53a2c08 | out: lpFindFileData=0x53a2c08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c5575af, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab228e06, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9c5575af, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.205] wcscmp (_String1="..", _String2=".") returned 1 [0086.205] wcscmp (_String1="..", _String2="..") returned 0 [0086.205] FindNextFileW (in: hFindFile=0x5444e40, lpFindFileData=0x53a2c08 | out: lpFindFileData=0x53a2c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5575af, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9c5575af, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9c5575af, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2abd, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1 [0086.205] wcscmp (_String1="CodeIntegrity.cat", _String2=".") returned 1 [0086.205] wcscmp (_String1="CodeIntegrity.cat", _String2="..") returned 1 [0086.205] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba4af8 [0086.205] wcscpy (in: _Dest=0x5ba4af8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0086.205] wcscat (in: _Dest=0x5ba4af8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0086.205] wcscat (in: _Dest=0x5ba4af8, _Source="CodeIntegrity.cat" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" [0088.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba4af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x734 [0088.598] FindNextFileW (in: hFindFile=0x5444e40, lpFindFileData=0x53a2c08 | out: lpFindFileData=0x53a2c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5575af, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9c5575af, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9c5575af, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2abd, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 0 [0088.598] FindClose (in: hFindFile=0x5444e40 | out: hFindFile=0x5444e40) returned 1 [0088.598] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a2c08) returned 1 [0088.598] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3934e28) returned 1 [0088.598] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75800c0) returned 1 Thread: id = 1354 os_tid = 0x2268 [0086.133] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml" (normalized: "c:\\program files (x86)\\microsoft.net\\redistlist\\assemblylist_4_client.xml")) returned 0x20 [0086.194] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml", dwFileAttributes=0x20) returned 0 [0086.194] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml" (normalized: "c:\\program files (x86)\\microsoft.net\\redistlist\\assemblylist_4_client.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.194] GetLastError () returned 0x5 [0086.194] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml", dwFileAttributes=0x20) returned 0 [0086.194] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5426548) returned 1 Thread: id = 1355 os_tid = 0x2264 [0086.134] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x78) returned 0x38d06a0 [0086.134] wcscpy (in: _Dest=0x38d06a0, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework" [0086.134] wcscat (in: _Dest=0x38d06a0, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\" [0086.134] wcscat (in: _Dest=0x38d06a0, _Source="*" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*" [0086.134] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a2268 [0086.134] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*", lpFindFileData=0x53a2268 | out: lpFindFileData=0x53a2268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe795770f, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79a3b1b, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79a3b1b, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444d40 [0086.135] wcscmp (_String1=".", _String2=".") returned 0 [0086.135] FindNextFileW (in: hFindFile=0x5444d40, lpFindFileData=0x53a2268 | out: lpFindFileData=0x53a2268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe795770f, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79a3b1b, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79a3b1b, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.135] wcscmp (_String1="..", _String2=".") returned 1 [0086.135] wcscmp (_String1="..", _String2="..") returned 0 [0086.135] FindNextFileW (in: hFindFile=0x5444d40, lpFindFileData=0x53a2268 | out: lpFindFileData=0x53a2268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe795770f, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79a3b1b, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79a3b1b, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0086.135] wcscmp (_String1="v3.0", _String2=".") returned 1 [0086.135] wcscmp (_String1="v3.0", _String2="..") returned 1 [0086.135] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7e) returned 0x3976e68 [0086.135] wcscpy (in: _Dest=0x3976e68, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework" [0086.135] wcscat (in: _Dest=0x3976e68, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\" [0086.135] wcscat (in: _Dest=0x3976e68, _Source="v3.0" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0" [0088.637] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3976e68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x75c [0088.638] FindNextFileW (in: hFindFile=0x5444d40, lpFindFileData=0x53a2268 | out: lpFindFileData=0x53a2268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79a3b1b, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79effb3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79effb3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0088.638] wcscmp (_String1="v3.5", _String2=".") returned 1 [0088.638] wcscmp (_String1="v3.5", _String2="..") returned 1 [0088.638] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7e) returned 0x3977770 [0088.638] wcscpy (in: _Dest=0x3977770, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework" [0088.638] wcscat (in: _Dest=0x3977770, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\" [0088.638] wcscat (in: _Dest=0x3977770, _Source="v3.5" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5" [0088.638] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3977770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19bc [0088.639] FindNextFileW (in: hFindFile=0x5444d40, lpFindFileData=0x53a2268 | out: lpFindFileData=0x53a2268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79a3b1b, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79effb3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79effb3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0088.639] FindClose (in: hFindFile=0x5444d40 | out: hFindFile=0x5444d40) returned 1 [0088.639] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a2268) returned 1 [0088.639] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38d06a0) returned 1 [0088.639] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38d0920) returned 1 Thread: id = 1356 os_tid = 0x2260 [0086.135] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\resources.pri")) returned 0x20 [0086.199] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0086.199] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.200] GetLastError () returned 0x5 [0086.200] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0086.200] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757f6a0) returned 1 Thread: id = 1357 os_tid = 0x225c [0086.136] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x5499f20 [0086.136] wcscpy (in: _Dest=0x5499f20, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0086.136] wcscat (in: _Dest=0x5499f20, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0086.136] wcscat (in: _Dest=0x5499f20, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0086.136] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a2738 [0086.136] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x53a2738 | out: lpFindFileData=0x53a2738*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb932fcac, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xfe80d855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe80d855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444dc0 [0086.197] wcscmp (_String1=".", _String2=".") returned 0 [0086.197] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53a2738 | out: lpFindFileData=0x53a2738*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb932fcac, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xfe80d855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe80d855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.197] wcscmp (_String1="..", _String2=".") returned 1 [0086.197] wcscmp (_String1="..", _String2="..") returned 0 [0086.197] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53a2738 | out: lpFindFileData=0x53a2738*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd931350c, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd931350c, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd935f9a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x3eb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources. 20a37ca.pri", cAlternateFileName="RESOUR~1.PRI")) returned 1 [0086.197] wcscmp (_String1="resources. 20a37ca.pri", _String2=".") returned 1 [0086.197] wcscmp (_String1="resources. 20a37ca.pri", _String2="..") returned 1 [0086.197] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x126) returned 0x7587048 [0086.197] wcscpy (in: _Dest=0x7587048, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0086.197] wcscat (in: _Dest=0x7587048, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0086.197] wcscat (in: _Dest=0x7587048, _Source="resources. 20a37ca.pri" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\resources. 20a37ca.pri") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\resources. 20a37ca.pri" [0088.635] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7587048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x758 [0088.635] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53a2738 | out: lpFindFileData=0x53a2738*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd931350c, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd931350c, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd935f9a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x3eb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000-MergedResources-0.pri", cAlternateFileName="")) returned 1 [0088.635] wcscmp (_String1="S-1-5-21-1051304884-625712362-2192934891-1000-MergedResources-0.pri", _String2=".") returned 1 [0088.635] wcscmp (_String1="S-1-5-21-1051304884-625712362-2192934891-1000-MergedResources-0.pri", _String2="..") returned 1 [0088.636] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x180) returned 0xe018ea8 [0088.636] wcscpy (in: _Dest=0xe018ea8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0088.636] wcscat (in: _Dest=0xe018ea8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0088.636] wcscat (in: _Dest=0xe018ea8, _Source="S-1-5-21-1051304884-625712362-2192934891-1000-MergedResources-0.pri" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\S-1-5-21-1051304884-625712362-2192934891-1000-MergedResources-0.pri") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\S-1-5-21-1051304884-625712362-2192934891-1000-MergedResources-0.pri" [0088.636] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0xe018ea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c0 [0088.636] FindNextFileW (in: hFindFile=0x5444dc0, lpFindFileData=0x53a2738 | out: lpFindFileData=0x53a2738*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd931350c, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd931350c, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd935f9a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x3eb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000-MergedResources-0.pri", cAlternateFileName="")) returned 0 [0088.636] FindClose (in: hFindFile=0x5444dc0 | out: hFindFile=0x5444dc0) returned 1 [0088.637] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a2738) returned 1 [0088.637] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5499f20) returned 1 [0088.637] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba20f8) returned 1 Thread: id = 1358 os_tid = 0x2258 [0086.137] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x3971640 [0086.137] wcscpy (in: _Dest=0x3971640, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0086.137] wcscat (in: _Dest=0x3971640, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0086.137] wcscat (in: _Dest=0x3971640, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\*" [0086.137] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a29a0 [0086.137] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdf7b05, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab2732ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d1b15f4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444e00 [0086.202] wcscmp (_String1=".", _String2=".") returned 0 [0086.202] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdf7b05, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab2732ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d1b15f4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.203] wcscmp (_String1="..", _String2=".") returned 1 [0086.203] wcscmp (_String1="..", _String2="..") returned 0 [0086.203] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cdf7b05, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9cdf7b05, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9cdf7b05, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x21a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="256x256.png", cAlternateFileName="")) returned 1 [0086.203] wcscmp (_String1="256x256.png", _String2=".") returned 1 [0086.203] wcscmp (_String1="256x256.png", _String2="..") returned 1 [0086.203] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x54f0868 [0086.203] wcscpy (in: _Dest=0x54f0868, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0086.203] wcscat (in: _Dest=0x54f0868, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0086.203] wcscat (in: _Dest=0x54f0868, _Source="256x256.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\256x256.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\256x256.png" [0088.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54f0868, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x754 [0088.599] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cdf7b05, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9cdf7b05, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9cdf7b05, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.scale-200.png", cAlternateFileName="")) returned 1 [0088.599] wcscmp (_String1="AppPackageAppList.scale-200.png", _String2=".") returned 1 [0088.599] wcscmp (_String1="AppPackageAppList.scale-200.png", _String2="..") returned 1 [0088.599] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x102) returned 0x74b2368 [0088.599] wcscpy (in: _Dest=0x74b2368, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.599] wcscat (in: _Dest=0x74b2368, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.599] wcscat (in: _Dest=0x74b2368, _Source="AppPackageAppList.scale-200.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.scale-200.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.scale-200.png" [0088.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b2368, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1994 [0088.600] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ce1dd5e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9ce1dd5e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9ce1dd5e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.targetsize-16.png", cAlternateFileName="")) returned 1 [0088.600] wcscmp (_String1="AppPackageAppList.targetsize-16.png", _String2=".") returned 1 [0088.600] wcscmp (_String1="AppPackageAppList.targetsize-16.png", _String2="..") returned 1 [0088.600] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0x74b11e8 [0088.600] wcscpy (in: _Dest=0x74b11e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.600] wcscat (in: _Dest=0x74b11e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.600] wcscat (in: _Dest=0x74b11e8, _Source="AppPackageAppList.targetsize-16.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-16.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-16.png" [0088.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b11e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1910 [0088.601] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ce1dd5e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9ce1dd5e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9ce1dd5e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.targetsize-16_altform-unplated.png", cAlternateFileName="")) returned 1 [0088.601] wcscmp (_String1="AppPackageAppList.targetsize-16_altform-unplated.png", _String2=".") returned 1 [0088.601] wcscmp (_String1="AppPackageAppList.targetsize-16_altform-unplated.png", _String2="..") returned 1 [0088.601] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12c) returned 0x7587180 [0088.601] wcscpy (in: _Dest=0x7587180, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.601] wcscat (in: _Dest=0x7587180, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.601] wcscat (in: _Dest=0x7587180, _Source="AppPackageAppList.targetsize-16_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-16_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-16_altform-unplated.png" [0088.601] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7587180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x190c [0088.602] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ce1dd5e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9ce1dd5e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9ce1dd5e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.targetsize-20.png", cAlternateFileName="")) returned 1 [0088.602] wcscmp (_String1="AppPackageAppList.targetsize-20.png", _String2=".") returned 1 [0088.602] wcscmp (_String1="AppPackageAppList.targetsize-20.png", _String2="..") returned 1 [0088.602] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0x74b1418 [0088.602] wcscpy (in: _Dest=0x74b1418, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.602] wcscat (in: _Dest=0x74b1418, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.602] wcscat (in: _Dest=0x74b1418, _Source="AppPackageAppList.targetsize-20.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-20.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-20.png" [0088.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b1418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1908 [0088.602] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ce1dd5e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9ce1dd5e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9ce1dd5e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.targetsize-20_altform-unplated.png", cAlternateFileName="")) returned 1 [0088.602] wcscmp (_String1="AppPackageAppList.targetsize-20_altform-unplated.png", _String2=".") returned 1 [0088.602] wcscmp (_String1="AppPackageAppList.targetsize-20_altform-unplated.png", _String2="..") returned 1 [0088.602] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12c) returned 0x75867c0 [0088.602] wcscpy (in: _Dest=0x75867c0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.602] wcscat (in: _Dest=0x75867c0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.602] wcscat (in: _Dest=0x75867c0, _Source="AppPackageAppList.targetsize-20_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-20_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-20_altform-unplated.png" [0088.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x75867c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1904 [0088.603] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ce1dd5e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9ce1dd5e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9ce1dd5e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.targetsize-24.png", cAlternateFileName="")) returned 1 [0088.603] wcscmp (_String1="AppPackageAppList.targetsize-24.png", _String2=".") returned 1 [0088.603] wcscmp (_String1="AppPackageAppList.targetsize-24.png", _String2="..") returned 1 [0088.603] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0x74b0ea0 [0088.603] wcscpy (in: _Dest=0x74b0ea0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.603] wcscat (in: _Dest=0x74b0ea0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.603] wcscat (in: _Dest=0x74b0ea0, _Source="AppPackageAppList.targetsize-24.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-24.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-24.png" [0088.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b0ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x728 [0088.604] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ce43fbc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9ce43fbc, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9ce43fbc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.targetsize-24_altform-unplated.png", cAlternateFileName="")) returned 1 [0088.604] wcscmp (_String1="AppPackageAppList.targetsize-24_altform-unplated.png", _String2=".") returned 1 [0088.604] wcscmp (_String1="AppPackageAppList.targetsize-24_altform-unplated.png", _String2="..") returned 1 [0088.604] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12c) returned 0x7586dd8 [0088.604] wcscpy (in: _Dest=0x7586dd8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.604] wcscat (in: _Dest=0x7586dd8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.604] wcscat (in: _Dest=0x7586dd8, _Source="AppPackageAppList.targetsize-24_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-24_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-24_altform-unplated.png" [0088.604] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7586dd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x614 [0088.605] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ce43fbc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9ce43fbc, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9ce43fbc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x694, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.targetsize-256.png", cAlternateFileName="")) returned 1 [0088.605] wcscmp (_String1="AppPackageAppList.targetsize-256.png", _String2=".") returned 1 [0088.605] wcscmp (_String1="AppPackageAppList.targetsize-256.png", _String2="..") returned 1 [0088.605] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10c) returned 0x74b1878 [0088.605] wcscpy (in: _Dest=0x74b1878, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.605] wcscat (in: _Dest=0x74b1878, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.605] wcscat (in: _Dest=0x74b1878, _Source="AppPackageAppList.targetsize-256.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-256.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-256.png" [0088.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b1878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ecc [0088.605] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ce43fbc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9ce6a21a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9ce6a21a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x694, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.targetsize-256_altform-unplated.png", cAlternateFileName="")) returned 1 [0088.605] wcscmp (_String1="AppPackageAppList.targetsize-256_altform-unplated.png", _String2=".") returned 1 [0088.606] wcscmp (_String1="AppPackageAppList.targetsize-256_altform-unplated.png", _String2="..") returned 1 [0088.606] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12e) returned 0x7587a08 [0088.606] wcscpy (in: _Dest=0x7587a08, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.606] wcscat (in: _Dest=0x7587a08, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.606] wcscat (in: _Dest=0x7587a08, _Source="AppPackageAppList.targetsize-256_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-256_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-256_altform-unplated.png" [0088.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7587a08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ec0 [0088.606] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ce6a21a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9ce6a21a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9ce6a21a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.targetsize-30.png", cAlternateFileName="")) returned 1 [0088.606] wcscmp (_String1="AppPackageAppList.targetsize-30.png", _String2=".") returned 1 [0088.606] wcscmp (_String1="AppPackageAppList.targetsize-30.png", _String2="..") returned 1 [0088.606] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0x74b1760 [0088.606] wcscpy (in: _Dest=0x74b1760, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.606] wcscat (in: _Dest=0x74b1760, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.606] wcscat (in: _Dest=0x74b1760, _Source="AppPackageAppList.targetsize-30.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-30.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-30.png" [0088.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b1760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc38 [0088.607] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ce6a21a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9ce6a21a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9ce6a21a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.targetsize-30_altform-unplated.png", cAlternateFileName="")) returned 1 [0088.607] wcscmp (_String1="AppPackageAppList.targetsize-30_altform-unplated.png", _String2=".") returned 1 [0088.607] wcscmp (_String1="AppPackageAppList.targetsize-30_altform-unplated.png", _String2="..") returned 1 [0088.607] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12c) returned 0x75872b8 [0088.607] wcscpy (in: _Dest=0x75872b8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.607] wcscat (in: _Dest=0x75872b8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.607] wcscat (in: _Dest=0x75872b8, _Source="AppPackageAppList.targetsize-30_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-30_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-30_altform-unplated.png" [0088.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x75872b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac4 [0088.608] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ce6a21a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9ce6a21a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9ce6a21a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.targetsize-32.png", cAlternateFileName="")) returned 1 [0088.608] wcscmp (_String1="AppPackageAppList.targetsize-32.png", _String2=".") returned 1 [0088.608] wcscmp (_String1="AppPackageAppList.targetsize-32.png", _String2="..") returned 1 [0088.608] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0x74b2480 [0088.608] wcscpy (in: _Dest=0x74b2480, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.608] wcscat (in: _Dest=0x74b2480, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.608] wcscat (in: _Dest=0x74b2480, _Source="AppPackageAppList.targetsize-32.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-32.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-32.png" [0088.609] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b2480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1abc [0088.609] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ce6a21a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9ce6a21a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9ce6a21a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.targetsize-32_altform-unplated.png", cAlternateFileName="")) returned 1 [0088.609] wcscmp (_String1="AppPackageAppList.targetsize-32_altform-unplated.png", _String2=".") returned 1 [0088.609] wcscmp (_String1="AppPackageAppList.targetsize-32_altform-unplated.png", _String2="..") returned 1 [0088.609] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12c) returned 0x7587660 [0088.609] wcscpy (in: _Dest=0x7587660, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.609] wcscat (in: _Dest=0x7587660, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.609] wcscat (in: _Dest=0x7587660, _Source="AppPackageAppList.targetsize-32_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-32_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-32_altform-unplated.png" [0088.609] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7587660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ab8 [0088.610] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ce9047c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9ceb66d1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9ceb66d1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x12e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.targetsize-36.png", cAlternateFileName="")) returned 1 [0088.610] wcscmp (_String1="AppPackageAppList.targetsize-36.png", _String2=".") returned 1 [0088.610] wcscmp (_String1="AppPackageAppList.targetsize-36.png", _String2="..") returned 1 [0088.610] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0x74b0928 [0088.610] wcscpy (in: _Dest=0x74b0928, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.610] wcscat (in: _Dest=0x74b0928, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.610] wcscat (in: _Dest=0x74b0928, _Source="AppPackageAppList.targetsize-36.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-36.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-36.png" [0088.610] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b0928, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ab4 [0088.611] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ceb66d1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9ceb66d1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9ceb66d1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x12e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.targetsize-36_altform-unplated.png", cAlternateFileName="")) returned 1 [0088.611] wcscmp (_String1="AppPackageAppList.targetsize-36_altform-unplated.png", _String2=".") returned 1 [0088.611] wcscmp (_String1="AppPackageAppList.targetsize-36_altform-unplated.png", _String2="..") returned 1 [0088.611] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12c) returned 0x7587b40 [0088.611] wcscpy (in: _Dest=0x7587b40, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.611] wcscat (in: _Dest=0x7587b40, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.611] wcscat (in: _Dest=0x7587b40, _Source="AppPackageAppList.targetsize-36_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-36_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-36_altform-unplated.png" [0088.611] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7587b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ab0 [0088.611] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cedc933, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9cedc933, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9cedc933, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.targetsize-40.png", cAlternateFileName="")) returned 1 [0088.611] wcscmp (_String1="AppPackageAppList.targetsize-40.png", _String2=".") returned 1 [0088.611] wcscmp (_String1="AppPackageAppList.targetsize-40.png", _String2="..") returned 1 [0088.611] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0x74b1990 [0088.611] wcscpy (in: _Dest=0x74b1990, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.612] wcscat (in: _Dest=0x74b1990, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.612] wcscat (in: _Dest=0x74b1990, _Source="AppPackageAppList.targetsize-40.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-40.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-40.png" [0088.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b1990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a48 [0088.612] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cedc933, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9cedc933, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9cedc933, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.targetsize-40_altform-unplated.png", cAlternateFileName="")) returned 1 [0088.612] wcscmp (_String1="AppPackageAppList.targetsize-40_altform-unplated.png", _String2=".") returned 1 [0088.612] wcscmp (_String1="AppPackageAppList.targetsize-40_altform-unplated.png", _String2="..") returned 1 [0088.612] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12c) returned 0x7588020 [0088.612] wcscpy (in: _Dest=0x7588020, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.612] wcscat (in: _Dest=0x7588020, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.612] wcscat (in: _Dest=0x7588020, _Source="AppPackageAppList.targetsize-40_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-40_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-40_altform-unplated.png" [0088.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7588020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a44 [0088.613] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cedc933, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9cedc933, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9cedc933, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.targetsize-48.png", cAlternateFileName="")) returned 1 [0088.613] wcscmp (_String1="AppPackageAppList.targetsize-48.png", _String2=".") returned 1 [0088.613] wcscmp (_String1="AppPackageAppList.targetsize-48.png", _String2="..") returned 1 [0088.613] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0x74b0d88 [0088.613] wcscpy (in: _Dest=0x74b0d88, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.613] wcscat (in: _Dest=0x74b0d88, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.613] wcscat (in: _Dest=0x74b0d88, _Source="AppPackageAppList.targetsize-48.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-48.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-48.png" [0088.613] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b0d88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a3c [0088.614] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cedc933, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9cedc933, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9cedc933, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.targetsize-48_altform-unplated.png", cAlternateFileName="")) returned 1 [0088.614] wcscmp (_String1="AppPackageAppList.targetsize-48_altform-unplated.png", _String2=".") returned 1 [0088.614] wcscmp (_String1="AppPackageAppList.targetsize-48_altform-unplated.png", _String2="..") returned 1 [0088.614] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12c) returned 0x7587798 [0088.614] wcscpy (in: _Dest=0x7587798, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.614] wcscat (in: _Dest=0x7587798, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.614] wcscat (in: _Dest=0x7587798, _Source="AppPackageAppList.targetsize-48_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-48_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-48_altform-unplated.png" [0088.614] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7587798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a38 [0088.614] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cedc933, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9cedc933, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9cedc933, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.targetsize-60.png", cAlternateFileName="")) returned 1 [0088.615] wcscmp (_String1="AppPackageAppList.targetsize-60.png", _String2=".") returned 1 [0088.615] wcscmp (_String1="AppPackageAppList.targetsize-60.png", _String2="..") returned 1 [0088.615] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0x74b0c70 [0088.615] wcscpy (in: _Dest=0x74b0c70, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.615] wcscat (in: _Dest=0x74b0c70, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.615] wcscat (in: _Dest=0x74b0c70, _Source="AppPackageAppList.targetsize-60.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-60.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-60.png" [0088.615] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b0c70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a34 [0088.615] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cf02b88, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9cf02b88, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9cf02b88, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.targetsize-60_altform-unplated.png", cAlternateFileName="")) returned 1 [0088.615] wcscmp (_String1="AppPackageAppList.targetsize-60_altform-unplated.png", _String2=".") returned 1 [0088.615] wcscmp (_String1="AppPackageAppList.targetsize-60_altform-unplated.png", _String2="..") returned 1 [0088.615] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12c) returned 0x75878d0 [0088.615] wcscpy (in: _Dest=0x75878d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.615] wcscat (in: _Dest=0x75878d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.615] wcscat (in: _Dest=0x75878d0, _Source="AppPackageAppList.targetsize-60_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-60_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-60_altform-unplated.png" [0088.615] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x75878d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a2c [0088.616] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cf02b88, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9cf02b88, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9cf02b88, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.targetsize-64.png", cAlternateFileName="")) returned 1 [0088.618] wcscmp (_String1="AppPackageAppList.targetsize-64.png", _String2=".") returned 1 [0088.618] wcscmp (_String1="AppPackageAppList.targetsize-64.png", _String2="..") returned 1 [0088.618] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0x74b2598 [0088.618] wcscpy (in: _Dest=0x74b2598, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.618] wcscat (in: _Dest=0x74b2598, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.618] wcscat (in: _Dest=0x74b2598, _Source="AppPackageAppList.targetsize-64.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-64.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-64.png" [0088.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b2598, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1204 [0088.619] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cf02b88, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9cf02b88, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9cf02b88, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.targetsize-64_altform-unplated.png", cAlternateFileName="")) returned 1 [0088.619] wcscmp (_String1="AppPackageAppList.targetsize-64_altform-unplated.png", _String2=".") returned 1 [0088.619] wcscmp (_String1="AppPackageAppList.targetsize-64_altform-unplated.png", _String2="..") returned 1 [0088.619] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12c) returned 0x7587c78 [0088.619] wcscpy (in: _Dest=0x7587c78, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.619] wcscat (in: _Dest=0x7587c78, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.619] wcscat (in: _Dest=0x7587c78, _Source="AppPackageAppList.targetsize-64_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-64_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-64_altform-unplated.png" [0088.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7587c78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120c [0088.620] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cf02b88, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9cf02b88, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9cf02b88, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.targetsize-72.png", cAlternateFileName="")) returned 1 [0088.620] wcscmp (_String1="AppPackageAppList.targetsize-72.png", _String2=".") returned 1 [0088.620] wcscmp (_String1="AppPackageAppList.targetsize-72.png", _String2="..") returned 1 [0088.620] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0x74b1300 [0088.620] wcscpy (in: _Dest=0x74b1300, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.620] wcscat (in: _Dest=0x74b1300, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.620] wcscat (in: _Dest=0x74b1300, _Source="AppPackageAppList.targetsize-72.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-72.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-72.png" [0088.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b1300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e8 [0088.620] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cf02b88, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9cf02b88, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9cf02b88, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.targetsize-72_altform-unplated.png", cAlternateFileName="")) returned 1 [0088.621] wcscmp (_String1="AppPackageAppList.targetsize-72_altform-unplated.png", _String2=".") returned 1 [0088.621] wcscmp (_String1="AppPackageAppList.targetsize-72_altform-unplated.png", _String2="..") returned 1 [0088.621] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12c) returned 0x75861a8 [0088.621] wcscpy (in: _Dest=0x75861a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.621] wcscat (in: _Dest=0x75861a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.621] wcscat (in: _Dest=0x75861a8, _Source="AppPackageAppList.targetsize-72_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-72_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-72_altform-unplated.png" [0088.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x75861a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c8 [0088.621] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cf02b88, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9cf02b88, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9cf02b88, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.targetsize-80.png", cAlternateFileName="")) returned 1 [0088.621] wcscmp (_String1="AppPackageAppList.targetsize-80.png", _String2=".") returned 1 [0088.621] wcscmp (_String1="AppPackageAppList.targetsize-80.png", _String2="..") returned 1 [0088.621] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0x74b1aa8 [0088.621] wcscpy (in: _Dest=0x74b1aa8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.622] wcscat (in: _Dest=0x74b1aa8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.622] wcscat (in: _Dest=0x74b1aa8, _Source="AppPackageAppList.targetsize-80.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-80.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-80.png" [0088.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b1aa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a20 [0088.622] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cf28ddd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9cf28ddd, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9cf28ddd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.targetsize-80_altform-unplated.png", cAlternateFileName="")) returned 1 [0088.622] wcscmp (_String1="AppPackageAppList.targetsize-80_altform-unplated.png", _String2=".") returned 1 [0088.622] wcscmp (_String1="AppPackageAppList.targetsize-80_altform-unplated.png", _String2="..") returned 1 [0088.622] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12c) returned 0x75862e0 [0088.622] wcscpy (in: _Dest=0x75862e0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.622] wcscat (in: _Dest=0x75862e0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.622] wcscat (in: _Dest=0x75862e0, _Source="AppPackageAppList.targetsize-80_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-80_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-80_altform-unplated.png" [0088.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x75862e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a18 [0088.623] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cf28ddd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9cf28ddd, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9cf28ddd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.targetsize-96.png", cAlternateFileName="")) returned 1 [0088.623] wcscmp (_String1="AppPackageAppList.targetsize-96.png", _String2=".") returned 1 [0088.623] wcscmp (_String1="AppPackageAppList.targetsize-96.png", _String2="..") returned 1 [0088.623] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0x74b1bc0 [0088.623] wcscpy (in: _Dest=0x74b1bc0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.623] wcscat (in: _Dest=0x74b1bc0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.623] wcscat (in: _Dest=0x74b1bc0, _Source="AppPackageAppList.targetsize-96.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-96.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-96.png" [0088.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b1bc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a14 [0088.624] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cf28ddd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9cf28ddd, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9cf28ddd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.targetsize-96_altform-unplated.png", cAlternateFileName="")) returned 1 [0088.624] wcscmp (_String1="AppPackageAppList.targetsize-96_altform-unplated.png", _String2=".") returned 1 [0088.624] wcscmp (_String1="AppPackageAppList.targetsize-96_altform-unplated.png", _String2="..") returned 1 [0088.624] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12c) returned 0x7586a30 [0088.624] wcscpy (in: _Dest=0x7586a30, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.624] wcscat (in: _Dest=0x7586a30, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.624] wcscat (in: _Dest=0x7586a30, _Source="AppPackageAppList.targetsize-96_altform-unplated.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-96_altform-unplated.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-96_altform-unplated.png" [0088.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7586a30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d4 [0088.625] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cf28ddd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9cf28ddd, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9cf28ddd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageBadgeLogo.scale-200.png", cAlternateFileName="")) returned 1 [0088.625] wcscmp (_String1="AppPackageBadgeLogo.scale-200.png", _String2=".") returned 1 [0088.625] wcscmp (_String1="AppPackageBadgeLogo.scale-200.png", _String2="..") returned 1 [0088.625] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x74b0fb8 [0088.625] wcscpy (in: _Dest=0x74b0fb8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.625] wcscat (in: _Dest=0x74b0fb8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.625] wcscat (in: _Dest=0x74b0fb8, _Source="AppPackageBadgeLogo.scale-200.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageBadgeLogo.scale-200.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageBadgeLogo.scale-200.png" [0088.625] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b0fb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a08 [0088.625] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cf28ddd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9cf28ddd, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9cf28ddd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageLargeTile.scale-200.png", cAlternateFileName="")) returned 1 [0088.625] wcscmp (_String1="AppPackageLargeTile.scale-200.png", _String2=".") returned 1 [0088.625] wcscmp (_String1="AppPackageLargeTile.scale-200.png", _String2="..") returned 1 [0088.625] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x74b2138 [0088.625] wcscpy (in: _Dest=0x74b2138, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.626] wcscat (in: _Dest=0x74b2138, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.626] wcscat (in: _Dest=0x74b2138, _Source="AppPackageLargeTile.scale-200.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageLargeTile.scale-200.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageLargeTile.scale-200.png" [0088.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b2138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d8 [0088.626] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cf28ddd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9cf4f03b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9cf4f03b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x459, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageMedTile.scale-200.png", cAlternateFileName="")) returned 1 [0088.626] wcscmp (_String1="AppPackageMedTile.scale-200.png", _String2=".") returned 1 [0088.626] wcscmp (_String1="AppPackageMedTile.scale-200.png", _String2="..") returned 1 [0088.626] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x102) returned 0x74b1cd8 [0088.626] wcscpy (in: _Dest=0x74b1cd8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.626] wcscat (in: _Dest=0x74b1cd8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.626] wcscat (in: _Dest=0x74b1cd8, _Source="AppPackageMedTile.scale-200.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageMedTile.scale-200.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageMedTile.scale-200.png" [0088.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b1cd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19e8 [0088.627] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cf4f03b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9cf4f03b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9cf4f03b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageSmallTile.scale-200.png", cAlternateFileName="")) returned 1 [0088.627] wcscmp (_String1="AppPackageSmallTile.scale-200.png", _String2=".") returned 1 [0088.627] wcscmp (_String1="AppPackageSmallTile.scale-200.png", _String2="..") returned 1 [0088.627] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x74b10d0 [0088.627] wcscpy (in: _Dest=0x74b10d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.627] wcscat (in: _Dest=0x74b10d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.627] wcscat (in: _Dest=0x74b10d0, _Source="AppPackageSmallTile.scale-200.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageSmallTile.scale-200.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageSmallTile.scale-200.png" [0088.627] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b10d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19e0 [0088.628] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cf4f03b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9cf4f03b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9cf4f03b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xcae, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageSplashScreen.scale-200.png", cAlternateFileName="")) returned 1 [0088.628] wcscmp (_String1="AppPackageSplashScreen.scale-200.png", _String2=".") returned 1 [0088.628] wcscmp (_String1="AppPackageSplashScreen.scale-200.png", _String2="..") returned 1 [0088.628] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10c) returned 0x74b26b0 [0088.628] wcscpy (in: _Dest=0x74b26b0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.628] wcscat (in: _Dest=0x74b26b0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.628] wcscat (in: _Dest=0x74b26b0, _Source="AppPackageSplashScreen.scale-200.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageSplashScreen.scale-200.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageSplashScreen.scale-200.png" [0088.628] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b26b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19dc [0088.628] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cf4f03b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9cf4f03b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9cf4f03b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageStoreLogo.scale-200.png", cAlternateFileName="")) returned 1 [0088.629] wcscmp (_String1="AppPackageStoreLogo.scale-200.png", _String2=".") returned 1 [0088.629] wcscmp (_String1="AppPackageStoreLogo.scale-200.png", _String2="..") returned 1 [0088.629] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x74b1530 [0088.629] wcscpy (in: _Dest=0x74b1530, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.629] wcscat (in: _Dest=0x74b1530, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.629] wcscat (in: _Dest=0x74b1530, _Source="AppPackageStoreLogo.scale-200.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageStoreLogo.scale-200.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageStoreLogo.scale-200.png" [0088.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b1530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19d8 [0088.629] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cf75299, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9cf75299, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9cf75299, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageWideTile.scale-200.png", cAlternateFileName="")) returned 1 [0088.629] wcscmp (_String1="AppPackageWideTile.scale-200.png", _String2=".") returned 1 [0088.629] wcscmp (_String1="AppPackageWideTile.scale-200.png", _String2="..") returned 1 [0088.629] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x104) returned 0x74b27c8 [0088.629] wcscpy (in: _Dest=0x74b27c8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.629] wcscat (in: _Dest=0x74b27c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.629] wcscat (in: _Dest=0x74b27c8, _Source="AppPackageWideTile.scale-200.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageWideTile.scale-200.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageWideTile.scale-200.png" [0088.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b27c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19d0 [0088.630] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cf75299, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab3100a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d080313, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-black", cAlternateFileName="CONTRA~1")) returned 1 [0088.630] wcscmp (_String1="contrast-black", _String2=".") returned 1 [0088.630] wcscmp (_String1="contrast-black", _String2="..") returned 1 [0088.630] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54f1090 [0088.630] wcscpy (in: _Dest=0x54f1090, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.630] wcscat (in: _Dest=0x54f1090, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.630] wcscat (in: _Dest=0x54f1090, _Source="contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black" [0088.630] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54f1090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19cc [0088.631] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d080313, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab39d704, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d18b39b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0088.631] wcscmp (_String1="contrast-white", _String2=".") returned 1 [0088.631] wcscmp (_String1="contrast-white", _String2="..") returned 1 [0088.631] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe0) returned 0x54f19a0 [0088.631] wcscpy (in: _Dest=0x54f19a0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.631] wcscat (in: _Dest=0x54f19a0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.631] wcscat (in: _Dest=0x54f19a0, _Source="contrast-white" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white" [0088.631] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54f19a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c8 [0088.632] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d18b39b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab446b84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d1d7849, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileIcons", cAlternateFileName="FILEIC~1")) returned 1 [0088.632] wcscmp (_String1="FileIcons", _String2=".") returned 1 [0088.632] wcscmp (_String1="FileIcons", _String2="..") returned 1 [0088.632] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd6) returned 0x3934488 [0088.632] wcscpy (in: _Dest=0x3934488, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets" [0088.632] wcscat (in: _Dest=0x3934488, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\" [0088.632] wcscat (in: _Dest=0x3934488, _Source="FileIcons" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons" [0088.632] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3934488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c4 [0088.633] FindNextFileW (in: hFindFile=0x5444e00, lpFindFileData=0x53a29a0 | out: lpFindFileData=0x53a29a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d18b39b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab446b84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d1d7849, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileIcons", cAlternateFileName="FILEIC~1")) returned 0 [0088.633] FindClose (in: hFindFile=0x5444e00 | out: hFindFile=0x5444e00) returned 1 [0088.633] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a29a0) returned 1 [0088.634] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3971640) returned 1 [0088.634] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55fdc88) returned 1 Thread: id = 1359 os_tid = 0x2254 [0086.138] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0086.202] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0086.202] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.203] GetLastError () returned 0x5 [0086.203] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0086.203] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5bab6e0) returned 1 Thread: id = 1360 os_tid = 0x226c [0086.205] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml" (normalized: "c:\\program files (x86)\\microsoft.net\\redistlist\\assemblylist_4_extended.xml")) returned 0x20 [0086.206] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml", dwFileAttributes=0x20) returned 0 [0086.206] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml" (normalized: "c:\\program files (x86)\\microsoft.net\\redistlist\\assemblylist_4_extended.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.206] GetLastError () returned 0x5 [0086.206] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml", dwFileAttributes=0x20) returned 0 [0086.206] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c6938) returned 1 Thread: id = 1361 os_tid = 0x2270 [0086.207] GetFileAttributesW (lpFileName="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp" (normalized: "c:\\programdata\\oracle\\java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp")) returned 0x2020 [0086.208] SetFileAttributesW (lpFileName="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp", dwFileAttributes=0x20) returned 1 [0092.258] CreateFileW (lpFileName="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp" (normalized: "c:\\programdata\\oracle\\java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1798 [0092.260] GetFileSizeEx (in: hFile=0x1798, lpFileSize=0x2ffff780 | out: lpFileSize=0x2ffff780*=51) returned 1 [0092.260] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0661d8 [0092.260] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066340 [0092.260] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0664f8 [0092.260] NtQuerySystemTime (in: CurrentTime=0x2ffff6e0 | out: CurrentTime=0x2ffff6e0*=132260136494149736) returned 0x0 [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0xf5fbfe88 [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0x59fe3560 [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0x21cecf46 [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0x361e9ae9 [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0x659dd43f [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0x978b526 [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0x4dc354d9 [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0x17405c36 [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0xd4208772 [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0x41a99d7c [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0x7fcebd89 [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0x760d7a6d [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0xd1f706f7 [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0xf6dc952 [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0xd581fd2a [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0xc229d2b6 [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0xddbcbbd5 [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0x7b2cda3e [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0x45feebf5 [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0x361c1c84 [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0xf6ef1938 [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0x37ee4880 [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0x23ea6a57 [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0x4c16085a [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0xe618b5c2 [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0xb24d267c [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0x7d3f051c [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0xeea2991a [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0xfd3bc7f3 [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0x24dfb271 [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0xf1d5595 [0092.260] RtlRandom (in: Seed=0x2ffff6ec | out: Seed=0x2ffff6ec) returned 0x294f6466 Thread: id = 1362 os_tid = 0x2274 [0086.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 0x20 [0086.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", dwFileAttributes=0x20) returned 1 [0086.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x750 [0086.209] GetFileSizeEx (in: hFile=0x750, lpFileSize=0x3007f758 | out: lpFileSize=0x3007f758*=15984) returned 1 [0086.209] SetFilePointerEx (in: hFile=0x750, liDistanceToMove=0x3e6c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.209] ReadFile (in: hFile=0x750, lpBuffer=0x3007f6dc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3007f6d8, lpOverlapped=0x0 | out: lpBuffer=0x3007f6dc*, lpNumberOfBytesRead=0x3007f6d8*=0x4, lpOverlapped=0x0) returned 1 [0086.211] SetFilePointerEx (in: hFile=0x750, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.213] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281660 [0086.213] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813b8 [0086.213] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281458 [0086.213] NtQuerySystemTime (in: CurrentTime=0x3007f6b8 | out: CurrentTime=0x3007f6b8*=132260136433767825) returned 0x0 [0086.213] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0xf8846a9e [0086.214] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0xdf756212 [0086.214] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0xd9943e05 [0086.214] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0xe603a461 [0086.214] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0xd061d003 [0086.214] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0xd9f852f7 [0086.214] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0x36f406d4 [0086.214] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0x792c1388 [0086.214] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0x778ce55a [0086.214] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0x87ab999f [0086.214] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0x34a442d7 [0086.214] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0x73f35803 [0086.214] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0xfec0e0e7 [0086.214] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0x506252a9 [0086.214] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0x3e08d727 [0086.214] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0xcc088a40 [0086.214] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0x194a4f3b [0086.214] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0x2d887a64 [0086.214] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0xce0ea050 [0086.214] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0x79163413 [0086.214] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0x54511d95 [0086.214] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0x865aedd4 [0086.214] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0xf8f7b8b3 [0086.214] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0x4addc98 [0086.214] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0xc26c5dc7 [0086.214] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0x1ed35ec0 [0086.214] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0x4127221d [0086.214] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0xeaef9eef [0086.214] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0xa370342c [0086.214] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0xe6966783 [0086.214] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0x48a3a4b4 [0086.214] RtlRandom (in: Seed=0x3007f6c4 | out: Seed=0x3007f6c4) returned 0x629b2af0 Thread: id = 1363 os_tid = 0x2278 [0086.224] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files (x86)\\common files\\services\\verisign.bmp")) returned 0x20 [0086.224] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Services\\verisign.bmp", dwFileAttributes=0x20) returned 0 [0086.224] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files (x86)\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.224] GetLastError () returned 0x5 [0086.224] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Services\\verisign.bmp", dwFileAttributes=0x20) returned 0 [0086.224] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38d08a0) returned 1 Thread: id = 1364 os_tid = 0x227c [0086.225] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft OneDrive\\setup\\refcount.ini" (normalized: "c:\\programdata\\microsoft onedrive\\setup\\refcount.ini")) returned 0x2020 [0086.225] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft OneDrive\\setup\\refcount.ini", dwFileAttributes=0x20) returned 1 [0092.271] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft OneDrive\\setup\\refcount.ini" (normalized: "c:\\programdata\\microsoft onedrive\\setup\\refcount.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x179c [0092.271] GetFileSizeEx (in: hFile=0x179c, lpFileSize=0x3017fb74 | out: lpFileSize=0x3017fb74*=0) returned 1 [0092.271] FlushFileBuffers (hFile=0x179c) Thread: id = 1365 os_tid = 0x2280 [0086.226] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb4) returned 0x5b16910 [0086.226] wcscpy (in: _Dest=0x5b16910, _Source="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages" [0086.226] wcscat (in: _Dest=0x5b16910, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\" [0086.226] wcscat (in: _Dest=0x5b16910, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*" [0086.226] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a2e70 [0086.226] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*", lpFindFileData=0x53a2e70 | out: lpFindFileData=0x53a2e70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444e80 [0086.226] wcscmp (_String1=".", _String2=".") returned 0 [0086.226] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x53a2e70 | out: lpFindFileData=0x53a2e70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.226] wcscmp (_String1="..", _String2=".") returned 1 [0086.226] wcscmp (_String1="..", _String2="..") returned 0 [0086.226] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x53a2e70 | out: lpFindFileData=0x53a2e70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0086.226] wcscmp (_String1="vcRuntimeMinimum_x86", _String2=".") returned 1 [0086.227] wcscmp (_String1="vcRuntimeMinimum_x86", _String2="..") returned 1 [0086.227] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x54f0a38 [0086.227] wcscpy (in: _Dest=0x54f0a38, _Source="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages" [0086.227] wcscat (in: _Dest=0x54f0a38, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\" [0086.227] wcscat (in: _Dest=0x54f0a38, _Source="vcRuntimeMinimum_x86" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86" [0088.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54f0a38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ac [0088.596] FindNextFileW (in: hFindFile=0x5444e80, lpFindFileData=0x53a2e70 | out: lpFindFileData=0x53a2e70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0088.596] FindClose (in: hFindFile=0x5444e80 | out: hFindFile=0x5444e80) returned 1 [0088.596] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a2e70) returned 1 [0088.596] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5b16910) returned 1 [0088.596] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a2050) returned 1 Thread: id = 1366 os_tid = 0x2284 [0086.227] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x757e6b0 [0086.227] wcscpy (in: _Dest=0x757e6b0, _Source="C:\\ProgramData\\Microsoft\\Crypto\\DSS" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS" [0086.227] wcscat (in: _Dest=0x757e6b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\" [0086.227] wcscat (in: _Dest=0x757e6b0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*" [0086.227] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53a30d8 [0086.227] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x53a30d8 | out: lpFindFileData=0x53a30d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444ec0 [0086.227] wcscmp (_String1=".", _String2=".") returned 0 [0086.227] FindNextFileW (in: hFindFile=0x5444ec0, lpFindFileData=0x53a30d8 | out: lpFindFileData=0x53a30d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.227] wcscmp (_String1="..", _String2=".") returned 1 [0086.228] wcscmp (_String1="..", _String2="..") returned 0 [0086.228] FindNextFileW (in: hFindFile=0x5444ec0, lpFindFileData=0x53a30d8 | out: lpFindFileData=0x53a30d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0086.228] wcscmp (_String1="MachineKeys", _String2=".") returned 1 [0086.228] wcscmp (_String1="MachineKeys", _String2="..") returned 1 [0086.228] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x6e95c38 [0086.228] wcscpy (in: _Dest=0x6e95c38, _Source="C:\\ProgramData\\Microsoft\\Crypto\\DSS" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS" [0086.228] wcscat (in: _Dest=0x6e95c38, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\" [0086.228] wcscat (in: _Dest=0x6e95c38, _Source="MachineKeys" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys" [0088.594] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x6e95c38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11ec [0088.594] FindNextFileW (in: hFindFile=0x5444ec0, lpFindFileData=0x53a30d8 | out: lpFindFileData=0x53a30d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 0 [0088.594] FindClose (in: hFindFile=0x5444ec0 | out: hFindFile=0x5444ec0) returned 1 [0088.594] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53a30d8) returned 1 [0088.595] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757e6b0) returned 1 [0088.595] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5532170) returned 1 Thread: id = 1367 os_tid = 0x2288 [0086.228] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4e) returned 0x757eef0 [0086.228] wcscpy (in: _Dest=0x757eef0, _Source="C:\\ProgramData\\Microsoft\\Crypto\\Keys" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\Keys") returned="C:\\ProgramData\\Microsoft\\Crypto\\Keys" [0086.228] wcscat (in: _Dest=0x757eef0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\" [0086.228] wcscat (in: _Dest=0x757eef0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*" [0086.228] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5418468 [0086.228] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x5418468 | out: lpFindFileData=0x5418468*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f00 [0086.229] wcscmp (_String1=".", _String2=".") returned 0 [0086.229] FindNextFileW (in: hFindFile=0x5444f00, lpFindFileData=0x5418468 | out: lpFindFileData=0x5418468*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.229] wcscmp (_String1="..", _String2=".") returned 1 [0086.229] wcscmp (_String1="..", _String2="..") returned 0 [0086.229] FindNextFileW (in: hFindFile=0x5444f00, lpFindFileData=0x5418468 | out: lpFindFileData=0x5418468*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.229] FindClose (in: hFindFile=0x5444f00 | out: hFindFile=0x5444f00) returned 1 [0086.230] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5418468) returned 1 [0086.230] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757eef0) returned 1 [0086.230] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757ea20) returned 1 Thread: id = 1368 os_tid = 0x228c [0086.231] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x52) returned 0x7583ec0 [0086.231] wcscpy (in: _Dest=0x7583ec0, _Source="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP") returned="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP" [0086.231] wcscat (in: _Dest=0x7583ec0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\" [0086.231] wcscat (in: _Dest=0x7583ec0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\*" [0086.231] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5418468 [0086.231] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\*", lpFindFileData=0x5418468 | out: lpFindFileData=0x5418468*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5444f00 [0086.231] wcscmp (_String1=".", _String2=".") returned 0 [0086.232] FindNextFileW (in: hFindFile=0x5444f00, lpFindFileData=0x5418468 | out: lpFindFileData=0x5418468*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.232] wcscmp (_String1="..", _String2=".") returned 1 [0086.232] wcscmp (_String1="..", _String2="..") returned 0 [0086.232] FindNextFileW (in: hFindFile=0x5444f00, lpFindFileData=0x5418468 | out: lpFindFileData=0x5418468*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsAIK", cAlternateFileName="WINDOW~1")) returned 1 [0086.232] wcscmp (_String1="WindowsAIK", _String2=".") returned 1 [0086.232] wcscmp (_String1="WindowsAIK", _String2="..") returned 1 [0086.232] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x38b2338 [0086.232] wcscpy (in: _Dest=0x38b2338, _Source="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP") returned="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP" [0086.232] wcscat (in: _Dest=0x38b2338, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\" [0086.232] wcscat (in: _Dest=0x38b2338, _Source="WindowsAIK" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK") returned="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK" [0088.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x38b2338, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x71c [0088.592] FindNextFileW (in: hFindFile=0x5444f00, lpFindFileData=0x5418468 | out: lpFindFileData=0x5418468*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsAIK", cAlternateFileName="WINDOW~1")) returned 0 [0088.592] FindClose (in: hFindFile=0x5444f00 | out: hFindFile=0x5444f00) returned 1 [0088.592] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5418468) returned 1 [0088.592] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7583ec0) returned 1 [0088.592] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757e1e0) returned 1 Thread: id = 1369 os_tid = 0x2290 [0086.232] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4c) returned 0x757ea20 [0086.232] wcscpy (in: _Dest=0x757ea20, _Source="C:\\ProgramData\\Microsoft\\Crypto\\RSA" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA" [0086.232] wcscat (in: _Dest=0x757ea20, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\" [0086.232] wcscat (in: _Dest=0x757ea20, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*" [0086.232] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54186d0 [0086.232] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x54186d0 | out: lpFindFileData=0x54186d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x17c6f037, ftLastAccessTime.dwHighDateTime=0x1d2a02b, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571c10 [0086.233] wcscmp (_String1=".", _String2=".") returned 0 [0086.233] FindNextFileW (in: hFindFile=0xe571c10, lpFindFileData=0x54186d0 | out: lpFindFileData=0x54186d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x17c6f037, ftLastAccessTime.dwHighDateTime=0x1d2a02b, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.233] wcscmp (_String1="..", _String2=".") returned 1 [0086.233] wcscmp (_String1="..", _String2="..") returned 0 [0086.233] FindNextFileW (in: hFindFile=0xe571c10, lpFindFileData=0x54186d0 | out: lpFindFileData=0x54186d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0086.233] wcscmp (_String1="MachineKeys", _String2=".") returned 1 [0086.233] wcscmp (_String1="MachineKeys", _String2="..") returned 1 [0086.233] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x6e959c8 [0086.233] wcscpy (in: _Dest=0x6e959c8, _Source="C:\\ProgramData\\Microsoft\\Crypto\\RSA" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA" [0086.233] wcscat (in: _Dest=0x6e959c8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\" [0086.233] wcscat (in: _Dest=0x6e959c8, _Source="MachineKeys" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys" [0088.589] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x6e959c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x714 [0088.589] FindNextFileW (in: hFindFile=0xe571c10, lpFindFileData=0x54186d0 | out: lpFindFileData=0x54186d0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0088.589] wcscmp (_String1="S-1-5-18", _String2=".") returned 1 [0088.589] wcscmp (_String1="S-1-5-18", _String2="..") returned 1 [0088.589] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0xe53a338 [0088.589] wcscpy (in: _Dest=0xe53a338, _Source="C:\\ProgramData\\Microsoft\\Crypto\\RSA" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA" [0088.589] wcscat (in: _Dest=0xe53a338, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\" [0088.590] wcscat (in: _Dest=0xe53a338, _Source="S-1-5-18" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18" [0088.590] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0xe53a338, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x998 [0088.590] FindNextFileW (in: hFindFile=0xe571c10, lpFindFileData=0x54186d0 | out: lpFindFileData=0x54186d0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 0 [0088.590] FindClose (in: hFindFile=0xe571c10 | out: hFindFile=0xe571c10) returned 1 [0088.590] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54186d0) returned 1 [0088.590] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757ea20) returned 1 [0088.590] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397dcc8) returned 1 Thread: id = 1370 os_tid = 0x2294 [0086.233] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x6e95b68 [0086.233] wcscpy (in: _Dest=0x6e95b68, _Source="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys") returned="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys" [0086.233] wcscat (in: _Dest=0x6e95b68, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\" [0086.233] wcscat (in: _Dest=0x6e95b68, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\*" [0086.233] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5418938 [0086.233] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\*", lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7737cd02, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571750 [0086.235] wcscmp (_String1=".", _String2=".") returned 0 [0086.235] FindNextFileW (in: hFindFile=0xe571750, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7737cd02, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.235] wcscmp (_String1="..", _String2=".") returned 1 [0086.235] wcscmp (_String1="..", _String2="..") returned 0 [0086.235] FindNextFileW (in: hFindFile=0xe571750, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcc464582, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="709228~1")) returned 1 [0086.235] wcscmp (_String1="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", _String2=".") returned 1 [0086.235] wcscmp (_String1="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", _String2="..") returned 1 [0086.235] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x54ba188 [0086.235] wcscpy (in: _Dest=0x54ba188, _Source="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys") returned="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys" [0086.235] wcscat (in: _Dest=0x54ba188, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\" [0086.235] wcscat (in: _Dest=0x54ba188, _Source="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267") returned="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" [0088.586] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54ba188, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x704 [0088.586] FindNextFileW (in: hFindFile=0xe571750, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x1b8875cb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x1b8875cb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x1b8875cb, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="D20D9E~1")) returned 1 [0088.586] wcscmp (_String1="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", _String2=".") returned 1 [0088.586] wcscmp (_String1="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", _String2="..") returned 1 [0088.586] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x54ba368 [0088.586] wcscpy (in: _Dest=0x54ba368, _Source="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys") returned="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys" [0088.586] wcscat (in: _Dest=0x54ba368, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\" [0088.586] wcscat (in: _Dest=0x54ba368, _Source="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71") returned="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" [0088.586] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54ba368, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a8 [0088.587] FindNextFileW (in: hFindFile=0xe571750, lpFindFileData=0x5418938 | out: lpFindFileData=0x5418938*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x1b8875cb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x1b8875cb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x1b8875cb, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="D20D9E~1")) returned 0 [0088.587] FindClose (in: hFindFile=0xe571750 | out: hFindFile=0xe571750) returned 1 [0088.588] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5418938) returned 1 [0088.588] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x6e95b68) returned 1 [0088.588] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75831a0) returned 1 Thread: id = 1371 os_tid = 0x2298 [0086.236] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0086.237] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.238] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.240] GetLastError () returned 0x5 [0086.240] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.241] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b1f18) returned 1 Thread: id = 1372 os_tid = 0x229c [0086.244] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd4) returned 0x3934f08 [0086.244] wcscpy (in: _Dest=0x3934f08, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0086.244] wcscat (in: _Dest=0x3934f08, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\" [0086.244] wcscat (in: _Dest=0x3934f08, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*" [0086.244] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5418ba0 [0086.244] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x5418ba0 | out: lpFindFileData=0x5418ba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdf3689c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa04335f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdf3689c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571790 [0086.245] wcscmp (_String1=".", _String2=".") returned 0 [0086.245] FindNextFileW (in: hFindFile=0xe571790, lpFindFileData=0x5418ba0 | out: lpFindFileData=0x5418ba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdf3689c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa04335f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdf3689c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.245] wcscmp (_String1="..", _String2=".") returned 1 [0086.245] wcscmp (_String1="..", _String2="..") returned 0 [0086.245] FindNextFileW (in: hFindFile=0xe571790, lpFindFileData=0x5418ba0 | out: lpFindFileData=0x5418ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdf3689c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xcdf3689c, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xcdf3689c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x6b98, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 1 [0086.245] wcscmp (_String1="AppxBundleManifest.xml", _String2=".") returned 1 [0086.245] wcscmp (_String1="AppxBundleManifest.xml", _String2="..") returned 1 [0086.245] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfe) returned 0x7582d68 [0086.245] wcscpy (in: _Dest=0x7582d68, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0086.245] wcscat (in: _Dest=0x7582d68, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\" [0086.245] wcscat (in: _Dest=0x7582d68, _Source="AppxBundleManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" [0088.583] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7582d68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x61c [0088.584] FindNextFileW (in: hFindFile=0xe571790, lpFindFileData=0x5418ba0 | out: lpFindFileData=0x5418ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdf3689c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xcdf3689c, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xcdf3689c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x6b98, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 0 [0088.584] FindClose (in: hFindFile=0xe571790 | out: hFindFile=0xe571790) returned 1 [0088.585] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5418ba0) returned 1 [0088.585] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3934f08) returned 1 [0088.585] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757f778) returned 1 Thread: id = 1373 os_tid = 0x22a0 [0086.246] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0086.247] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0086.247] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.247] GetLastError () returned 0x5 [0086.247] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0086.247] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54baf80) returned 1 Thread: id = 1374 os_tid = 0x22a4 [0086.248] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfe) returned 0x7582108 [0086.248] wcscpy (in: _Dest=0x7582108, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" [0086.248] wcscat (in: _Dest=0x7582108, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0086.248] wcscat (in: _Dest=0x7582108, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0086.248] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5418e08 [0086.248] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5e205736, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa043ddd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5e205736, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe5717d0 [0086.249] wcscmp (_String1=".", _String2=".") returned 0 [0086.249] FindNextFileW (in: hFindFile=0xe5717d0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5e205736, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa043ddd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5e205736, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.249] wcscmp (_String1="..", _String2=".") returned 1 [0086.249] wcscmp (_String1="..", _String2="..") returned 0 [0086.249] FindNextFileW (in: hFindFile=0xe5717d0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5e205736, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa043ddd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5e205736, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.249] FindClose (in: hFindFile=0xe5717d0 | out: hFindFile=0xe5717d0) returned 1 [0086.249] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5418e08) returned 1 [0086.249] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7582108) returned 1 [0086.249] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75813a0) returned 1 Thread: id = 1375 os_tid = 0x22a8 [0086.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 0x220 [0086.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml", dwFileAttributes=0x20) returned 1 [0086.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6e8 [0086.251] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x306ffbec | out: lpFileSize=0x306ffbec*=387356) returned 1 [0086.251] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x5e918, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.251] ReadFile (in: hFile=0x6e8, lpBuffer=0x306ffb70, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x306ffb6c, lpOverlapped=0x0 | out: lpBuffer=0x306ffb70*, lpNumberOfBytesRead=0x306ffb6c*=0x4, lpOverlapped=0x0) returned 1 [0086.253] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.253] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813e0 [0086.253] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72817a0 [0086.253] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72817c8 [0086.253] NtQuerySystemTime (in: CurrentTime=0x306ffb4c | out: CurrentTime=0x306ffb4c*=132260136434080268) returned 0x0 [0086.253] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0x96cc2bb9 [0086.253] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0xa1435864 [0086.253] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0xb4a454cd [0086.253] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0x764e17c9 [0086.253] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0x1e36bde7 [0086.253] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0x1e6ead65 [0086.253] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0x9fc2d67c [0086.253] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0x24ec3a31 [0086.253] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0xbac0b02 [0086.253] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0xf1c7494e [0086.253] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0x864d6fa4 [0086.253] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0x2b81b92a [0086.253] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0xe0300fa6 [0086.253] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0x87a3d9b4 [0086.253] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0x4f0a6f73 [0086.253] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0x9d572d27 [0086.253] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0xa032dc74 [0086.253] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0x1fc02640 [0086.253] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0xeab80f9f [0086.253] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0xff771bd6 [0086.253] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0x33bb6309 [0086.253] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0x96adb767 [0086.253] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0x2f3c8f80 [0086.253] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0xd14f6acb [0086.253] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0x3a949825 [0086.253] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0xc7ee18a8 [0086.253] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0x57a1230b [0086.253] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0x8135fef3 [0086.253] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0x1a626082 [0086.253] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0x321a1e1c [0086.254] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0x96a10b1c [0086.254] RtlRandom (in: Seed=0x306ffb58 | out: Seed=0x306ffb58) returned 0x5eb909b0 Thread: id = 1376 os_tid = 0x22ac [0086.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 0x220 [0086.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x20) returned 1 [0086.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6d0 [0086.264] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x3077f774 | out: lpFileSize=0x3077f774*=1533) returned 1 [0086.264] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x5f9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.264] ReadFile (in: hFile=0x6d0, lpBuffer=0x3077f6f8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3077f6f4, lpOverlapped=0x0 | out: lpBuffer=0x3077f6f8*, lpNumberOfBytesRead=0x3077f6f4*=0x4, lpOverlapped=0x0) returned 1 [0086.265] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.265] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813e0 [0086.265] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72817c8 [0086.265] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281340 [0086.265] NtQuerySystemTime (in: CurrentTime=0x3077f6d4 | out: CurrentTime=0x3077f6d4*=132260136434236373) returned 0x0 [0086.265] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0xdc6f56db [0086.265] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0xdd753e39 [0086.265] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0x723caf7d [0086.265] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0xff00c749 [0086.265] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0xecd23005 [0086.265] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0xe1bc68e [0086.265] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0x1d07875d [0086.265] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0x75823b59 [0086.266] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0x8da8df2 [0086.266] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0xf7339e17 [0086.266] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0xfbcd57dd [0086.266] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0x24fb2c92 [0086.266] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0x99837e4a [0086.266] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0xde576d88 [0086.266] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0xadc2195f [0086.266] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0xa8019682 [0086.266] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0x1c96a4a2 [0086.266] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0x6dbf74c6 [0086.266] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0x56782277 [0086.266] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0x299b4d2e [0086.266] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0x21030a8b [0086.266] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0xaa7037f6 [0086.266] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0x129a8bfa [0086.266] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0x95a44a11 [0086.266] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0x6f61732e [0086.266] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0xe7914e48 [0086.266] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0x56dc48c9 [0086.266] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0xf6ffe272 [0086.266] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0xdebf6186 [0086.266] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0x6941c5d9 [0086.266] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0x2d7cd533 [0086.266] RtlRandom (in: Seed=0x3077f6e0 | out: Seed=0x3077f6e0) returned 0xebf91187 Thread: id = 1377 os_tid = 0x22b0 [0086.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 0x220 [0086.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml", dwFileAttributes=0x20) returned 1 [0086.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6d8 [0086.277] GetFileSizeEx (in: hFile=0x6d8, lpFileSize=0x307ffb08 | out: lpFileSize=0x307ffb08*=800867) returned 1 [0086.277] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0xc385f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.277] ReadFile (in: hFile=0x6d8, lpBuffer=0x307ffa8c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x307ffa88, lpOverlapped=0x0 | out: lpBuffer=0x307ffa8c*, lpNumberOfBytesRead=0x307ffa88*=0x4, lpOverlapped=0x0) returned 1 [0086.279] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.279] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813e0 [0086.279] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281340 [0086.279] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281430 [0086.279] NtQuerySystemTime (in: CurrentTime=0x307ffa68 | out: CurrentTime=0x307ffa68*=132260136434392611) returned 0x0 [0086.279] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0x15f6a1db [0086.279] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0xf7627a78 [0086.279] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0x159f357f [0086.279] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0xc9dd8559 [0086.279] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0x9ec6a071 [0086.279] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0xb331eaad [0086.279] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0x6afa7947 [0086.279] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0x5ff1e0e0 [0086.279] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0xab35df35 [0086.279] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0xf3d68010 [0086.279] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0xb0ba60c2 [0086.279] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0xbab700e4 [0086.279] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0xfc37ff1b [0086.280] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0x82805f22 [0086.280] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0xbfad703f [0086.280] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0x166e1059 [0086.280] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0x520d9622 [0086.280] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0x8c1ebfee [0086.280] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0x94bb93c5 [0086.280] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0x5f32446a [0086.280] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0x1c7baeb0 [0086.280] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0x872579aa [0086.280] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0x8b53b666 [0086.280] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0x9ed5ffcf [0086.280] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0x2c0c38f6 [0086.280] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0xfcea71ca [0086.280] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0x81607b33 [0086.280] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0x5e196719 [0086.280] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0xfd910820 [0086.280] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0xe3cab436 [0086.280] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0x45bd435d [0086.280] RtlRandom (in: Seed=0x307ffa74 | out: Seed=0x307ffa74) returned 0x73d460bf Thread: id = 1378 os_tid = 0x22b4 [0086.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 0x220 [0086.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x20) returned 1 [0086.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x540 [0086.290] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3087fc18 | out: lpFileSize=0x3087fc18*=1261) returned 1 [0086.290] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x4e9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.290] ReadFile (in: hFile=0x540, lpBuffer=0x3087fb9c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3087fb98, lpOverlapped=0x0 | out: lpBuffer=0x3087fb9c*, lpNumberOfBytesRead=0x3087fb98*=0x4, lpOverlapped=0x0) returned 1 [0086.291] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.291] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813e0 [0086.291] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281430 [0086.291] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72814a8 [0086.291] NtQuerySystemTime (in: CurrentTime=0x3087fb78 | out: CurrentTime=0x3087fb78*=132260136434548980) returned 0x0 [0086.291] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0x3fbf5a65 [0086.291] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0xc9d9aa01 [0086.292] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0x18a5c660 [0086.292] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0x4830c665 [0086.292] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0xf23c0d06 [0086.292] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0x32a10e5b [0086.292] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0xd2f0594e [0086.292] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0x286007ea [0086.292] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0x3ea24df [0086.292] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0xfc2bd979 [0086.292] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0x60ea1e7d [0086.292] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0x5f151d39 [0086.292] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0x2f0bdc14 [0086.292] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0xafb920a3 [0086.292] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0xeace51c8 [0086.292] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0xfa70297c [0086.292] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0x7e78ac0f [0086.292] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0xb5d06c97 [0086.292] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0x96ad14a [0086.292] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0x1a866d1d [0086.292] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0x5ce46fcd [0086.292] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0x99fde520 [0086.292] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0x919e576a [0086.292] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0x66940aca [0086.292] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0x117c1921 [0086.292] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0x7b3c2f53 [0086.292] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0x56303a30 [0086.292] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0x248fff8b [0086.292] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0x91f2df53 [0086.292] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0x9ecc94c6 [0086.292] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0x93d88fca [0086.292] RtlRandom (in: Seed=0x3087fb84 | out: Seed=0x3087fb84) returned 0x213355b8 Thread: id = 1379 os_tid = 0x22b8 [0086.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 0x220 [0086.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml", dwFileAttributes=0x20) returned 1 [0086.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6ac [0086.303] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x308fff20 | out: lpFileSize=0x308fff20*=496513) returned 1 [0086.303] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x7937d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.303] ReadFile (in: hFile=0x6ac, lpBuffer=0x308ffea4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x308ffea0, lpOverlapped=0x0 | out: lpBuffer=0x308ffea4*, lpNumberOfBytesRead=0x308ffea0*=0x4, lpOverlapped=0x0) returned 1 [0086.305] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.305] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813e0 [0086.305] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72814a8 [0086.305] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281548 [0086.305] NtQuerySystemTime (in: CurrentTime=0x308ffe80 | out: CurrentTime=0x308ffe80*=132260136434705065) returned 0x0 [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0x131908ca [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0x85b3964e [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0x2a8c2a86 [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0x2ccf4f04 [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0x115db777 [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0x132b7501 [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0x824ae78e [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0x4e00abde [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0x8f5c063 [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0x44f33048 [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0x5145f98a [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0xaa5fbfe6 [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0xe6fa17ea [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0xacd4ce71 [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0x7d60ae71 [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0x832ccb76 [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0xe0b96669 [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0x11e7b63a [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0x473a3fb2 [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0x6c11f720 [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0xd0f902fc [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0x566262b [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0x51cb018e [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0x75da3f8e [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0xdaf9d6f4 [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0xc482ce7b [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0xedde8a60 [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0xa229be4b [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0x6616d83f [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0xd7f80a89 [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0x43376fde [0086.305] RtlRandom (in: Seed=0x308ffe8c | out: Seed=0x308ffe8c) returned 0x91832c0 Thread: id = 1380 os_tid = 0x22bc [0086.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 0x220 [0086.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x20) returned 1 [0086.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6a0 [0086.316] GetFileSizeEx (in: hFile=0x6a0, lpFileSize=0x3097fbc8 | out: lpFileSize=0x3097fbc8*=1261) returned 1 [0086.316] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x4e9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.316] ReadFile (in: hFile=0x6a0, lpBuffer=0x3097fb4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3097fb48, lpOverlapped=0x0 | out: lpBuffer=0x3097fb4c*, lpNumberOfBytesRead=0x3097fb48*=0x4, lpOverlapped=0x0) returned 1 [0086.318] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.318] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813e0 [0086.318] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281548 [0086.318] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72815c0 [0086.318] NtQuerySystemTime (in: CurrentTime=0x3097fb28 | out: CurrentTime=0x3097fb28*=132260136434705065) returned 0x0 [0086.318] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0x4b490017 [0086.318] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0xc029f8d6 [0086.318] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0x23de02fb [0086.318] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0xd665148d [0086.318] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0x5de72f86 [0086.318] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0x1f04f17d [0086.318] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0xc0c37c4d [0086.318] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0xbe260898 [0086.318] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0x8cd2b65b [0086.318] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0x294c1558 [0086.318] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0x8be3ca16 [0086.318] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0xae341836 [0086.318] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0xc9038cd8 [0086.318] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0xeebcfe7e [0086.318] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0x57765218 [0086.318] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0xb10eac6c [0086.318] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0xb3b89fd7 [0086.318] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0x5997b902 [0086.318] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0x58eb19de [0086.318] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0xc02099be [0086.318] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0xb237d4b0 [0086.318] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0xb3d05fc7 [0086.318] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0xa240b2d8 [0086.318] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0x6d8aec6b [0086.318] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0x5b6348d6 [0086.318] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0xd05eafe9 [0086.318] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0x1f8d2907 [0086.318] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0xf06121a1 [0086.318] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0x657cd5eb [0086.318] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0x89940e0d [0086.319] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0x6e5d600f [0086.319] RtlRandom (in: Seed=0x3097fb34 | out: Seed=0x3097fb34) returned 0xcc59e1ce Thread: id = 1381 os_tid = 0x22c0 [0086.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 0x220 [0086.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml", dwFileAttributes=0x20) returned 1 [0086.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x688 [0086.330] GetFileSizeEx (in: hFile=0x688, lpFileSize=0x309ff794 | out: lpFileSize=0x309ff794*=253712) returned 1 [0086.330] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x3df0c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.330] ReadFile (in: hFile=0x688, lpBuffer=0x309ff718, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x309ff714, lpOverlapped=0x0 | out: lpBuffer=0x309ff718*, lpNumberOfBytesRead=0x309ff714*=0x4, lpOverlapped=0x0) returned 1 [0086.332] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.332] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813e0 [0086.332] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72815c0 [0086.332] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281638 [0086.332] NtQuerySystemTime (in: CurrentTime=0x309ff6f4 | out: CurrentTime=0x309ff6f4*=132260136434861551) returned 0x0 [0086.332] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0xc423871d [0086.332] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0xf2ed85e5 [0086.332] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0x610dcac7 [0086.332] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0x36346ad9 [0086.332] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0x3b37cbe3 [0086.332] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0xeee85d45 [0086.332] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0xcc101b3c [0086.332] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0xb63f2d05 [0086.332] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0x51858dce [0086.332] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0x646e4995 [0086.332] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0x5fb23459 [0086.332] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0x22e62299 [0086.332] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0x2f981208 [0086.332] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0xd9e480ac [0086.332] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0xa27b437e [0086.333] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0x29b01af0 [0086.333] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0x2e2691f1 [0086.333] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0x5636e68d [0086.333] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0xb815870f [0086.333] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0x71e63d7f [0086.333] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0x804e5ea6 [0086.333] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0x7ec2b19 [0086.333] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0x6ff15086 [0086.333] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0x81b1b196 [0086.333] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0x136ef1c7 [0086.333] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0xd0e7d392 [0086.333] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0x87568069 [0086.333] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0x28e7db43 [0086.333] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0x4e84b3c7 [0086.333] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0x373833d7 [0086.333] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0x4df44128 [0086.333] RtlRandom (in: Seed=0x309ff700 | out: Seed=0x309ff700) returned 0x17a967c5 Thread: id = 1382 os_tid = 0x22c4 [0086.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 0x220 [0086.343] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x20) returned 1 [0086.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x684 [0086.344] GetFileSizeEx (in: hFile=0x684, lpFileSize=0x30a7feb0 | out: lpFileSize=0x30a7feb0*=1261) returned 1 [0086.344] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x4e9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.344] ReadFile (in: hFile=0x684, lpBuffer=0x30a7fe34, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x30a7fe30, lpOverlapped=0x0 | out: lpBuffer=0x30a7fe34*, lpNumberOfBytesRead=0x30a7fe30*=0x4, lpOverlapped=0x0) returned 1 [0086.345] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.345] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813e0 [0086.345] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281638 [0086.345] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72816b0 [0086.345] NtQuerySystemTime (in: CurrentTime=0x30a7fe10 | out: CurrentTime=0x30a7fe10*=132260136435017688) returned 0x0 [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0x5b09c042 [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0x802030cd [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0x48619eb5 [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0x9e949bdf [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0xe88d737f [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0x1725e286 [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0xf0bef881 [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0xf30db368 [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0x6fb79932 [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0xdfa999dc [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0x4635f6e3 [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0x42c8c683 [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0x55917307 [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0xa6d7b68f [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0xf75058ff [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0x73663417 [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0xa1b67f77 [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0x4ebf20ab [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0x87f573d6 [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0x73ae89c8 [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0x540642e0 [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0x3c766127 [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0xe288fe2a [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0xd6199e54 [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0x4353d4d3 [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0x9166053b [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0x32cd299b [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0x7f1088e0 [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0x28b6d544 [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0xf1be80cb [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0x57a9f21f [0086.346] RtlRandom (in: Seed=0x30a7fe1c | out: Seed=0x30a7fe1c) returned 0xfdde6e16 Thread: id = 1383 os_tid = 0x22c8 [0086.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 0x220 [0086.357] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml", dwFileAttributes=0x20) returned 1 [0086.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x680 [0086.357] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x30aff84c | out: lpFileSize=0x30aff84c*=1124942) returned 1 [0086.357] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x112a4a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.357] ReadFile (in: hFile=0x680, lpBuffer=0x30aff7d0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x30aff7cc, lpOverlapped=0x0 | out: lpBuffer=0x30aff7d0*, lpNumberOfBytesRead=0x30aff7cc*=0x4, lpOverlapped=0x0) returned 1 [0086.359] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.359] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813e0 [0086.359] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72816b0 [0086.359] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281c00 [0086.359] NtQuerySystemTime (in: CurrentTime=0x30aff7ac | out: CurrentTime=0x30aff7ac*=132260136435174160) returned 0x0 [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0x34e20799 [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0x3f676002 [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0x9c90781d [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0xb968b82 [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0x3681a34f [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0xe326c4e4 [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0x81ac97ff [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0x74e398c5 [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0xe4084e76 [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0x86b79154 [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0x4e64038a [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0xa03ccba8 [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0xc8365385 [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0x5cf89b1d [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0x44861673 [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0x15b30b11 [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0x3279374d [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0x25f47682 [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0x34476db8 [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0x9ed1267f [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0x568d42a [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0xf78bc13a [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0xed49af55 [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0x33097a66 [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0x39c08b3e [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0x5d7c8289 [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0xca7845f3 [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0x3f4bfc3c [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0xa9c62731 [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0xc15156cf [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0xf4689c4 [0086.359] RtlRandom (in: Seed=0x30aff7b8 | out: Seed=0x30aff7b8) returned 0x9a1c52c1 Thread: id = 1384 os_tid = 0x22cc [0086.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 0x220 [0086.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x20) returned 1 [0086.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x67c [0086.370] GetFileSizeEx (in: hFile=0x67c, lpFileSize=0x30b7f8c8 | out: lpFileSize=0x30b7f8c8*=19451) returned 1 [0086.370] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x4bf7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.370] ReadFile (in: hFile=0x67c, lpBuffer=0x30b7f84c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x30b7f848, lpOverlapped=0x0 | out: lpBuffer=0x30b7f84c*, lpNumberOfBytesRead=0x30b7f848*=0x4, lpOverlapped=0x0) returned 1 [0086.372] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.372] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813e0 [0086.372] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281c28 [0086.372] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281c00 [0086.372] NtQuerySystemTime (in: CurrentTime=0x30b7f828 | out: CurrentTime=0x30b7f828*=132260136435330251) returned 0x0 [0086.372] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0x561be372 [0086.372] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0x2452f384 [0086.372] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0x25e764a8 [0086.372] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0xfad6c67b [0086.372] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0x8eca4908 [0086.372] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0x2f93ce50 [0086.372] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0x4c7645a7 [0086.372] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0x192649af [0086.372] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0x7f744b60 [0086.372] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0x8794078b [0086.372] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0xbbfe63f6 [0086.372] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0x93cd3e1b [0086.372] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0xe30ab0ef [0086.372] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0x56bf02a0 [0086.372] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0x3a5b7cff [0086.372] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0xecba97a6 [0086.373] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0x6656d375 [0086.373] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0xbbae944 [0086.373] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0xb4cb48cc [0086.373] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0xa16fe545 [0086.373] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0x9489757a [0086.373] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0x4f104a29 [0086.373] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0xd5edebf [0086.373] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0xf74a785d [0086.373] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0xab1ffd62 [0086.373] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0xbf03f4fc [0086.373] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0x1be94dea [0086.373] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0x59a6f53d [0086.373] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0x82e7a643 [0086.373] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0xf2c7ad05 [0086.373] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0x3fb99de7 [0086.373] RtlRandom (in: Seed=0x30b7f834 | out: Seed=0x30b7f834) returned 0xbff6372c Thread: id = 1385 os_tid = 0x22d0 [0086.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 0x220 [0086.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml", dwFileAttributes=0x20) returned 1 [0086.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x674 [0086.384] GetFileSizeEx (in: hFile=0x674, lpFileSize=0x30bff798 | out: lpFileSize=0x30bff798*=763363) returned 1 [0086.384] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0xba5df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.384] ReadFile (in: hFile=0x674, lpBuffer=0x30bff71c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x30bff718, lpOverlapped=0x0 | out: lpBuffer=0x30bff71c*, lpNumberOfBytesRead=0x30bff718*=0x4, lpOverlapped=0x0) returned 1 [0086.386] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.386] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813e0 [0086.386] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281c50 [0086.386] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281c00 [0086.386] NtQuerySystemTime (in: CurrentTime=0x30bff6f8 | out: CurrentTime=0x30bff6f8*=132260136435486916) returned 0x0 [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0x68b91564 [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0x756c5ecd [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0x8a18bc71 [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0xef95b253 [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0x1ca2540d [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0x19be9590 [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0x4dbff126 [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0x4e1d592d [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0xb454aab1 [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0x5131e6ab [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0xe054722e [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0x951f6b03 [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0x3d07fad [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0x6e03c47e [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0x7d32f31d [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0xf6752a49 [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0xffe37607 [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0x894b3200 [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0xb359438c [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0x4a59f4c4 [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0x3049b5ac [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0x19b6e5c8 [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0x9f1fe6c6 [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0x26f9771 [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0x250415f0 [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0x85d87ee5 [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0x15b5913e [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0x2c9bf3c4 [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0xddf24882 [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0xde44fa39 [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0x5c16ce67 [0086.386] RtlRandom (in: Seed=0x30bff704 | out: Seed=0x30bff704) returned 0xfed3b8a6 Thread: id = 1386 os_tid = 0x22d4 [0086.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 0x220 [0086.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x20) returned 1 [0086.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x66c [0086.396] GetFileSizeEx (in: hFile=0x66c, lpFileSize=0x30c7f744 | out: lpFileSize=0x30c7f744*=1261) returned 1 [0086.396] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x4e9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.396] ReadFile (in: hFile=0x66c, lpBuffer=0x30c7f6c8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x30c7f6c4, lpOverlapped=0x0 | out: lpBuffer=0x30c7f6c8*, lpNumberOfBytesRead=0x30c7f6c4*=0x4, lpOverlapped=0x0) returned 1 [0086.398] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.398] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813e0 [0086.398] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281c78 [0086.398] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281c00 [0086.398] NtQuerySystemTime (in: CurrentTime=0x30c7f6a4 | out: CurrentTime=0x30c7f6a4*=132260136435642775) returned 0x0 [0086.398] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0xb71a9a48 [0086.398] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0x2fe8cb17 [0086.398] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0x53f2c1ca [0086.398] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0xf229b270 [0086.398] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0x2db7dc04 [0086.398] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0xa4b0d846 [0086.398] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0x17dac776 [0086.398] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0xf4ad5a4a [0086.398] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0x7ab887ed [0086.398] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0x8f1e27b1 [0086.399] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0x84a7b68c [0086.399] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0x1f478a8f [0086.399] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0xe0ca5faa [0086.399] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0x9e326b67 [0086.399] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0xa584b891 [0086.399] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0x3b9877e6 [0086.399] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0xcccf76fe [0086.399] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0x641b769 [0086.399] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0x35de67bd [0086.399] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0x590b5896 [0086.399] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0xf841ebf5 [0086.399] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0x5a2c543b [0086.399] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0xd249defe [0086.399] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0xe2277b69 [0086.399] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0xf7743b1b [0086.399] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0xe1b8d134 [0086.399] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0x6d93b691 [0086.399] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0x49b00684 [0086.399] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0x52db650c [0086.399] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0xd382202d [0086.399] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0x9c554c99 [0086.399] RtlRandom (in: Seed=0x30c7f6b0 | out: Seed=0x30c7f6b0) returned 0xbdd94a40 Thread: id = 1387 os_tid = 0x22d8 [0086.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 0x220 [0086.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x20) returned 1 [0086.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x910 [0086.409] GetFileSizeEx (in: hFile=0x910, lpFileSize=0x30cffb8c | out: lpFileSize=0x30cffb8c*=1261) returned 1 [0086.409] SetFilePointerEx (in: hFile=0x910, liDistanceToMove=0x4e9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.409] ReadFile (in: hFile=0x910, lpBuffer=0x30cffb10, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x30cffb0c, lpOverlapped=0x0 | out: lpBuffer=0x30cffb10*, lpNumberOfBytesRead=0x30cffb0c*=0x4, lpOverlapped=0x0) returned 1 [0086.410] SetFilePointerEx (in: hFile=0x910, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.410] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813e0 [0086.410] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281930 [0086.410] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281c00 [0086.410] NtQuerySystemTime (in: CurrentTime=0x30cffaec | out: CurrentTime=0x30cffaec*=132260136435642775) returned 0x0 [0086.410] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0xae68c075 [0086.410] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0xf26b1930 [0086.410] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0x15531fd5 [0086.410] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0x5491fc4b [0086.411] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0x28a307de [0086.411] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0x12c5f376 [0086.411] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0x830aa947 [0086.411] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0x92f304bf [0086.411] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0xc5845b6b [0086.411] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0x5ee4fd24 [0086.411] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0x9697dbd7 [0086.411] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0xf7c822e2 [0086.411] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0x6b9f2891 [0086.411] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0x42062235 [0086.411] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0xc26f36f5 [0086.411] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0x7395cef5 [0086.411] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0xb9272fcd [0086.411] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0x599f401b [0086.411] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0xf67a2e7b [0086.411] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0x63407dab [0086.411] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0x94b7d3d7 [0086.411] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0x8dceb70 [0086.411] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0x5347e148 [0086.411] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0x6b784a14 [0086.411] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0x1d64f17 [0086.411] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0xed9de1a7 [0086.411] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0xc8780bec [0086.411] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0xa560fc9f [0086.411] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0x912fee9e [0086.411] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0x9640eabf [0086.411] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0x9e1e313e [0086.411] RtlRandom (in: Seed=0x30cffaf8 | out: Seed=0x30cffaf8) returned 0x4f7e5821 Thread: id = 1388 os_tid = 0x22dc [0086.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 0x220 [0086.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml", dwFileAttributes=0x20) returned 1 [0086.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x660 [0086.421] GetFileSizeEx (in: hFile=0x660, lpFileSize=0x30d7f96c | out: lpFileSize=0x30d7f96c*=2147) returned 1 [0086.421] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x85f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.421] ReadFile (in: hFile=0x660, lpBuffer=0x30d7f8f0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x30d7f8ec, lpOverlapped=0x0 | out: lpBuffer=0x30d7f8f0*, lpNumberOfBytesRead=0x30d7f8ec*=0x4, lpOverlapped=0x0) returned 1 [0086.423] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.423] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813e0 [0086.423] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72819a8 [0086.423] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281c00 [0086.423] NtQuerySystemTime (in: CurrentTime=0x30d7f8cc | out: CurrentTime=0x30d7f8cc*=132260136435798999) returned 0x0 [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0x6707ca03 [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0xee05a013 [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0x9d0861a9 [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0x35e6c601 [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0x62b3de2a [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0x4e26929 [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0xca99a43f [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0xa0bc3681 [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0x9999d640 [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0x9e1f2adf [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0xa3ce4835 [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0x9788adad [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0x7da07c17 [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0xc31bce3c [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0xa5a98b8e [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0xbc197791 [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0xd43188c5 [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0x23dd2dd2 [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0x56dc86a6 [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0x5e07ab85 [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0xfd72a82d [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0x4714d5cd [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0xd2a5cd85 [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0xe187c18f [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0x2c1cd20f [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0x8772377a [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0x2378724f [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0x829b7ba2 [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0x2c86625 [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0x7d29efae [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0xf5de4629 [0086.423] RtlRandom (in: Seed=0x30d7f8d8 | out: Seed=0x30d7f8d8) returned 0xe5eba8a8 Thread: id = 1389 os_tid = 0x22e0 [0086.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 0x220 [0086.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml", dwFileAttributes=0x20) returned 1 [0086.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x65c [0086.442] GetFileSizeEx (in: hFile=0x65c, lpFileSize=0x30dff854 | out: lpFileSize=0x30dff854*=2147) returned 1 [0086.442] SetFilePointerEx (in: hFile=0x65c, liDistanceToMove=0x85f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.442] ReadFile (in: hFile=0x65c, lpBuffer=0x30dff7d8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x30dff7d4, lpOverlapped=0x0 | out: lpBuffer=0x30dff7d8*, lpNumberOfBytesRead=0x30dff7d4*=0x4, lpOverlapped=0x0) returned 1 [0086.444] SetFilePointerEx (in: hFile=0x65c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.444] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813e0 [0086.444] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281a20 [0086.444] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281c00 [0086.444] NtQuerySystemTime (in: CurrentTime=0x30dff7b4 | out: CurrentTime=0x30dff7b4*=132260136435955281) returned 0x0 [0086.444] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0xc7db010b [0086.444] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0x61aba2de [0086.444] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0x8899fed1 [0086.444] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0x676a772e [0086.444] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0xef43af01 [0086.444] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0xd48885eb [0086.444] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0x6937ebb5 [0086.444] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0x75c0a409 [0086.444] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0xcfc25a3e [0086.444] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0x2899b68c [0086.444] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0xa7c16be9 [0086.444] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0xd358e4fa [0086.444] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0x5182ae4d [0086.444] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0x156f4bc6 [0086.444] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0xa7c7b945 [0086.444] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0x2c27cb4b [0086.444] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0x472eea79 [0086.444] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0xce823ec4 [0086.444] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0x71bdfda1 [0086.444] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0xe3346c30 [0086.444] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0xc7586f17 [0086.445] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0x30253d59 [0086.445] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0x9da1d4b5 [0086.445] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0xbeed8077 [0086.445] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0x2e4c474 [0086.445] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0x7dafcca4 [0086.445] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0x7d0295eb [0086.445] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0x9feb3d14 [0086.445] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0xefc3736e [0086.445] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0x29776551 [0086.445] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0x2cacb51f [0086.445] RtlRandom (in: Seed=0x30dff7c0 | out: Seed=0x30dff7c0) returned 0x8180f2df Thread: id = 1390 os_tid = 0x22e4 [0086.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 0x220 [0086.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml", dwFileAttributes=0x20) returned 1 [0086.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x658 [0086.455] GetFileSizeEx (in: hFile=0x658, lpFileSize=0x30e7f88c | out: lpFileSize=0x30e7f88c*=215883) returned 1 [0086.455] SetFilePointerEx (in: hFile=0x658, liDistanceToMove=0x34b47, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.455] ReadFile (in: hFile=0x658, lpBuffer=0x30e7f810, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x30e7f80c, lpOverlapped=0x0 | out: lpBuffer=0x30e7f810*, lpNumberOfBytesRead=0x30e7f80c*=0x4, lpOverlapped=0x0) returned 1 [0086.456] SetFilePointerEx (in: hFile=0x658, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.456] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813e0 [0086.457] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281a98 [0086.457] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281c00 [0086.457] NtQuerySystemTime (in: CurrentTime=0x30e7f7ec | out: CurrentTime=0x30e7f7ec*=132260136436111343) returned 0x0 [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0xd2f0aca8 [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0xc5f195a2 [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0x1448a310 [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0xe5fe24db [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0x2fb4de58 [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0x7ecb2056 [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0xfca20de7 [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0x53e2f8b0 [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0xe4d391da [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0x29d9aa0 [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0xca2ca34b [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0xa1723d34 [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0xa070e1c3 [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0xbbcd7246 [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0x738584d6 [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0x66be857d [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0x25224afd [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0xf8dbe961 [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0x61dcfe17 [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0xe30e554e [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0x9708df4 [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0xa4d4dad [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0x63933765 [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0xd029f20c [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0x16d69277 [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0x8e9ee12a [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0xc353bf1b [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0xa32175bd [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0x1c885953 [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0x80df7a94 [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0x67694316 [0086.457] RtlRandom (in: Seed=0x30e7f7f8 | out: Seed=0x30e7f7f8) returned 0x107336f1 Thread: id = 1391 os_tid = 0x22e8 [0086.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 0x220 [0086.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x20) returned 1 [0086.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x654 [0086.468] GetFileSizeEx (in: hFile=0x654, lpFileSize=0x30effe8c | out: lpFileSize=0x30effe8c*=1261) returned 1 [0086.468] SetFilePointerEx (in: hFile=0x654, liDistanceToMove=0x4e9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.468] ReadFile (in: hFile=0x654, lpBuffer=0x30effe10, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x30effe0c, lpOverlapped=0x0 | out: lpBuffer=0x30effe10*, lpNumberOfBytesRead=0x30effe0c*=0x4, lpOverlapped=0x0) returned 1 [0086.470] SetFilePointerEx (in: hFile=0x654, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.470] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813e0 [0086.470] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281b10 [0086.470] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281c00 [0086.470] NtQuerySystemTime (in: CurrentTime=0x30effdec | out: CurrentTime=0x30effdec*=132260136436268206) returned 0x0 [0086.470] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0x2c5b73c0 [0086.470] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0xf91c8568 [0086.470] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0x190cfc10 [0086.470] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0xe824edbe [0086.470] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0xd4904c50 [0086.470] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0xcbfef5f4 [0086.470] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0x32cef35b [0086.470] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0xbe36a842 [0086.470] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0x1e463cb1 [0086.470] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0xabf9f936 [0086.470] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0x7a657663 [0086.470] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0x2f45f78c [0086.470] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0x468b91c2 [0086.470] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0x79ee5178 [0086.470] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0xf6de8608 [0086.470] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0x1cab1e7a [0086.470] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0xdc9fdee9 [0086.470] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0x4c6e7a60 [0086.470] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0x80df7b6b [0086.470] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0xefbd86d6 [0086.470] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0x725617c4 [0086.470] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0x23881c34 [0086.470] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0xdf305327 [0086.470] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0x180d9832 [0086.471] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0xdf7ae911 [0086.471] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0xfabd19c1 [0086.471] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0x67658558 [0086.471] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0x4e9e9a4 [0086.471] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0x2593aa34 [0086.471] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0xf848bedc [0086.471] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0x2fe95571 [0086.471] RtlRandom (in: Seed=0x30effdf8 | out: Seed=0x30effdf8) returned 0x2f98e023 Thread: id = 1392 os_tid = 0x22ec [0086.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 0x220 [0086.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x20) returned 1 [0086.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x650 [0086.481] GetFileSizeEx (in: hFile=0x650, lpFileSize=0x30f7fcac | out: lpFileSize=0x30f7fcac*=1261) returned 1 [0086.482] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x4e9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.482] ReadFile (in: hFile=0x650, lpBuffer=0x30f7fc30, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x30f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0x30f7fc30*, lpNumberOfBytesRead=0x30f7fc2c*=0x4, lpOverlapped=0x0) returned 1 [0086.483] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.483] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813e0 [0086.483] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281b88 [0086.483] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281c00 [0086.483] NtQuerySystemTime (in: CurrentTime=0x30f7fc0c | out: CurrentTime=0x30f7fc0c*=132260136436424036) returned 0x0 [0086.483] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0x7b7f683c [0086.483] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0x59a5af3c [0086.483] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0x33e08046 [0086.483] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0x264dcfc2 [0086.483] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0x5716439b [0086.483] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0x3d0c8336 [0086.484] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0xea615094 [0086.484] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0x822c4e5b [0086.484] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0x3edf10ea [0086.484] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0xd5a0ed4 [0086.484] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0x20dce068 [0086.484] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0xf4bb8448 [0086.484] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0x1774019e [0086.484] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0xf3045799 [0086.484] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0xad7e2ce8 [0086.484] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0xba8a322b [0086.484] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0x1df9b3 [0086.484] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0x23b23d3 [0086.484] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0xb50e7f5f [0086.484] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0xcbaca758 [0086.484] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0x3da4d03f [0086.484] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0x1a955fc4 [0086.484] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0xa52cc9b9 [0086.484] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0x82f7ea52 [0086.484] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0xa1df318d [0086.484] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0x49ba1cc7 [0086.484] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0x62118634 [0086.484] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0xa434d0e5 [0086.484] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0x797c8941 [0086.484] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0xa9ae60ca [0086.484] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0x45f8f2f4 [0086.484] RtlRandom (in: Seed=0x30f7fc18 | out: Seed=0x30f7fc18) returned 0xade0d567 Thread: id = 1393 os_tid = 0x22f0 [0086.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 0x220 [0086.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml", dwFileAttributes=0x20) returned 1 [0086.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x64c [0086.494] GetFileSizeEx (in: hFile=0x64c, lpFileSize=0x30fff83c | out: lpFileSize=0x30fff83c*=343329) returned 1 [0086.494] SetFilePointerEx (in: hFile=0x64c, liDistanceToMove=0x53d1d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.494] ReadFile (in: hFile=0x64c, lpBuffer=0x30fff7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x30fff7bc, lpOverlapped=0x0 | out: lpBuffer=0x30fff7c0*, lpNumberOfBytesRead=0x30fff7bc*=0x4, lpOverlapped=0x0) returned 1 [0086.496] SetFilePointerEx (in: hFile=0x64c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.496] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813e0 [0086.496] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281c00 [0086.496] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282100 [0086.496] NtQuerySystemTime (in: CurrentTime=0x30fff79c | out: CurrentTime=0x30fff79c*=132260136436580680) returned 0x0 [0086.496] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0x64687385 [0086.496] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0x81e86bc2 [0086.496] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0xa2ea7dd5 [0086.496] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0x9438cae7 [0086.496] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0xbbcd8126 [0086.496] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0x1911b5fa [0086.496] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0x72131e11 [0086.496] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0x87b57f07 [0086.496] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0x6a21abac [0086.496] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0x99fcfaaf [0086.496] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0xef1c8b7e [0086.496] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0x671d379a [0086.496] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0xceb089f7 [0086.496] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0x100653d6 [0086.496] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0xc5a2dd0a [0086.496] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0x521ec1ee [0086.497] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0xfbbe088a [0086.497] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0x2e8024cc [0086.497] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0xc678462 [0086.497] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0x37b4e3ef [0086.497] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0xfdddffd3 [0086.497] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0x24f20bf2 [0086.497] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0x93599279 [0086.497] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0xfeb0856b [0086.497] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0x1287d5ee [0086.497] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0x3e5051d9 [0086.497] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0x5b8ee114 [0086.497] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0xef792ecc [0086.497] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0xfc014158 [0086.497] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0x24cdc159 [0086.497] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0x39b4ba14 [0086.497] RtlRandom (in: Seed=0x30fff7a8 | out: Seed=0x30fff7a8) returned 0x794f2fd2 Thread: id = 1394 os_tid = 0x22f4 [0086.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 0x220 [0086.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x20) returned 1 [0086.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x648 [0086.508] GetFileSizeEx (in: hFile=0x648, lpFileSize=0x3107f7ac | out: lpFileSize=0x3107f7ac*=14913) returned 1 [0086.508] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x3a3d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.508] ReadFile (in: hFile=0x648, lpBuffer=0x3107f730, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3107f72c, lpOverlapped=0x0 | out: lpBuffer=0x3107f730*, lpNumberOfBytesRead=0x3107f72c*=0x4, lpOverlapped=0x0) returned 1 [0086.509] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.509] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813e0 [0086.509] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282128 [0086.509] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282100 [0086.509] NtQuerySystemTime (in: CurrentTime=0x3107f70c | out: CurrentTime=0x3107f70c*=132260136436736467) returned 0x0 [0086.509] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0xf945fd74 [0086.509] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0xccbe38c9 [0086.509] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0x630c3ef9 [0086.509] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0xc4da447e [0086.509] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0x1d7ec007 [0086.510] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0xa778188c [0086.510] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0x8057128b [0086.510] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0x78ace99f [0086.510] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0x5ba9e76c [0086.510] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0x766181a1 [0086.510] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0xb664bd63 [0086.510] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0x330d367e [0086.510] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0x7a58d399 [0086.510] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0xda1cef42 [0086.510] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0x514082ee [0086.510] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0x595cf54c [0086.510] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0x4731d531 [0086.510] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0x38038cb [0086.510] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0x4085bc12 [0086.510] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0xbcbe23e [0086.510] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0xce9b9c99 [0086.510] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0xd09d50d6 [0086.510] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0x1a5a9aff [0086.510] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0x86f67c3c [0086.510] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0xc242f0a [0086.510] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0xd9524e65 [0086.510] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0x3b201ab5 [0086.510] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0x6cc8dc24 [0086.510] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0xf6d14aa2 [0086.510] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0x74080e7f [0086.510] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0x9ff6f4e4 [0086.510] RtlRandom (in: Seed=0x3107f718 | out: Seed=0x3107f718) returned 0x65409e9b Thread: id = 1395 os_tid = 0x22f8 [0086.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 0x220 [0086.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml", dwFileAttributes=0x20) returned 1 [0086.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x640 [0086.520] GetFileSizeEx (in: hFile=0x640, lpFileSize=0x310ff9f4 | out: lpFileSize=0x310ff9f4*=357349) returned 1 [0086.520] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x573e1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.520] ReadFile (in: hFile=0x640, lpBuffer=0x310ff978, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x310ff974, lpOverlapped=0x0 | out: lpBuffer=0x310ff978*, lpNumberOfBytesRead=0x310ff974*=0x4, lpOverlapped=0x0) returned 1 [0086.522] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.522] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813e0 [0086.522] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282150 [0086.522] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282100 [0086.522] NtQuerySystemTime (in: CurrentTime=0x310ff954 | out: CurrentTime=0x310ff954*=132260136436736467) returned 0x0 [0086.522] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0x6a7a6ccf [0086.522] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0x692c2565 [0086.522] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0xcc68d75 [0086.522] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0x735391d4 [0086.522] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0xa0a0f034 [0086.522] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0x39f46898 [0086.522] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0xa74c7915 [0086.522] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0xb1152d92 [0086.522] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0x3afd9b43 [0086.522] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0xa77ae536 [0086.523] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0x6ac2d8f0 [0086.523] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0xf1d6bfd9 [0086.523] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0x4ef58f95 [0086.523] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0x7a243d98 [0086.523] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0xe8c0f34e [0086.523] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0x369d624a [0086.523] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0x56339cf4 [0086.523] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0x1cca015f [0086.523] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0x38cfd08f [0086.523] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0x13254106 [0086.523] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0x86d0efa6 [0086.524] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0x1c34e37a [0086.524] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0x9a6e1cde [0086.524] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0x55f45926 [0086.524] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0xbcbc90de [0086.524] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0xab811868 [0086.524] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0x7724df9f [0086.524] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0xf8f157db [0086.524] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0x33e4a15b [0086.524] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0xa218bc75 [0086.524] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0x450812fb [0086.524] RtlRandom (in: Seed=0x310ff960 | out: Seed=0x310ff960) returned 0x24d0762b Thread: id = 1396 os_tid = 0x22fc [0086.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 0x220 [0086.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x20) returned 1 [0086.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x638 [0086.534] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x3117fa48 | out: lpFileSize=0x3117fa48*=1261) returned 1 [0086.534] SetFilePointerEx (in: hFile=0x638, liDistanceToMove=0x4e9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.534] ReadFile (in: hFile=0x638, lpBuffer=0x3117f9cc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3117f9c8, lpOverlapped=0x0 | out: lpBuffer=0x3117f9cc*, lpNumberOfBytesRead=0x3117f9c8*=0x4, lpOverlapped=0x0) returned 1 [0086.536] SetFilePointerEx (in: hFile=0x638, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.536] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813e0 [0086.536] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282178 [0086.536] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282100 [0086.536] NtQuerySystemTime (in: CurrentTime=0x3117f9a8 | out: CurrentTime=0x3117f9a8*=132260136436892721) returned 0x0 [0086.536] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0xe2470d30 [0086.536] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0x99bbe2ca [0086.536] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0x25e20904 [0086.536] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0x4f63d3b8 [0086.536] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0x41fd0d8b [0086.536] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0x9f4f3981 [0086.536] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0x8e6d57ea [0086.536] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0xbca6029f [0086.536] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0x736454eb [0086.536] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0x95eead7d [0086.536] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0x60b2fce8 [0086.536] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0x366e1801 [0086.536] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0x395c5856 [0086.536] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0x53548b27 [0086.536] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0x42483f48 [0086.536] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0x23e5b00a [0086.536] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0xfd19b521 [0086.536] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0xf81fc9cf [0086.536] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0x28ed6c51 [0086.536] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0xd94821de [0086.536] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0x79abbd76 [0086.536] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0xabbc8254 [0086.536] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0xd688f389 [0086.536] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0x7c1e97eb [0086.536] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0x99eb57dd [0086.536] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0x99c0c003 [0086.536] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0xb0349a14 [0086.536] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0x15bd22b8 [0086.536] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0x7318d45e [0086.536] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0x9924690c [0086.536] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0xe4a66ab7 [0086.537] RtlRandom (in: Seed=0x3117f9b4 | out: Seed=0x3117f9b4) returned 0x8c69ac7b Thread: id = 1397 os_tid = 0x2300 [0086.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0086.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml", dwFileAttributes=0x20) returned 1 [0086.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x634 [0086.547] GetFileSizeEx (in: hFile=0x634, lpFileSize=0x311ffe84 | out: lpFileSize=0x311ffe84*=65002) returned 1 [0086.547] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0xfde6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.547] ReadFile (in: hFile=0x634, lpBuffer=0x311ffe08, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x311ffe04, lpOverlapped=0x0 | out: lpBuffer=0x311ffe08*, lpNumberOfBytesRead=0x311ffe04*=0x4, lpOverlapped=0x0) returned 1 [0086.583] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.583] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813e0 [0086.583] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281de0 [0086.583] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282100 [0086.583] NtQuerySystemTime (in: CurrentTime=0x311ffde4 | out: CurrentTime=0x311ffde4*=132260136437361532) returned 0x0 [0086.583] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0xc2eaf050 [0086.583] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0xa6c4ff18 [0086.583] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0xdcb6a39f [0086.583] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0xc2e32f6e [0086.583] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0x7c8e1d18 [0086.583] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0x310ea728 [0086.583] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0xe741bd4b [0086.583] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0x8f79ccc7 [0086.583] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0xf985c101 [0086.583] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0x875d5651 [0086.583] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0x9470b777 [0086.583] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0x2d298654 [0086.583] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0x8e1dd8b5 [0086.583] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0xba7ae0af [0086.583] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0x9092d02 [0086.583] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0x1b7ac7cc [0086.583] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0xb900b3cd [0086.583] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0x4b3d140f [0086.583] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0xffede06e [0086.583] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0xff010988 [0086.583] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0x44d65bb0 [0086.583] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0xc7b83e43 [0086.584] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0xd94bd946 [0086.584] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0x8c7e1bb [0086.584] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0x8ba215f5 [0086.584] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0x33d5667a [0086.584] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0x4c9191a1 [0086.584] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0x477ccc4d [0086.584] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0x56a5ca57 [0086.584] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0x20e351f5 [0086.584] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0xe843653a [0086.584] RtlRandom (in: Seed=0x311ffdf0 | out: Seed=0x311ffdf0) returned 0x1393127c Thread: id = 1398 os_tid = 0x2304 [0086.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0086.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x20) returned 1 [0086.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x630 [0086.549] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x3127fa04 | out: lpFileSize=0x3127fa04*=1261) returned 1 [0086.549] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x4e9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.549] ReadFile (in: hFile=0x630, lpBuffer=0x3127f988, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3127f984, lpOverlapped=0x0 | out: lpBuffer=0x3127f988*, lpNumberOfBytesRead=0x3127f984*=0x4, lpOverlapped=0x0) returned 1 [0086.613] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.613] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813e0 [0086.613] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281f48 [0086.613] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282100 [0086.613] NtQuerySystemTime (in: CurrentTime=0x3127f964 | out: CurrentTime=0x3127f964*=132260136437674018) returned 0x0 [0086.613] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0x1b36baed [0086.613] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0x78f1a129 [0086.613] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0x80fc3120 [0086.613] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0x8c13e8ba [0086.613] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0x51ee5b3b [0086.613] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0x3384f016 [0086.613] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0xd1c99eca [0086.613] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0xf3232ac0 [0086.613] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0xe7bbfbe0 [0086.613] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0xcf2f7da4 [0086.613] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0xf666ec79 [0086.613] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0xe7986464 [0086.613] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0xd21bd220 [0086.613] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0xa324aba6 [0086.613] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0x41140b7b [0086.613] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0x28287242 [0086.613] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0x2c629780 [0086.614] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0x44fb72cf [0086.614] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0x62b417e3 [0086.614] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0xb9b754b9 [0086.614] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0x530186b8 [0086.614] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0x97d30852 [0086.614] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0xf2c3c12b [0086.614] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0x20dbb719 [0086.614] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0x4d13dae [0086.614] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0x78749489 [0086.614] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0xf2642373 [0086.614] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0x352cbf03 [0086.614] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0x84715fa6 [0086.614] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0xe8c82f2f [0086.614] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0x4e226e3f [0086.614] RtlRandom (in: Seed=0x3127f970 | out: Seed=0x3127f970) returned 0xe188aa57 Thread: id = 1399 os_tid = 0x2308 [0086.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 0x220 [0086.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml", dwFileAttributes=0x20) returned 1 [0086.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x62c [0086.551] GetFileSizeEx (in: hFile=0x62c, lpFileSize=0x312ffe40 | out: lpFileSize=0x312ffe40*=1261) returned 1 [0086.551] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x4e9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.551] ReadFile (in: hFile=0x62c, lpBuffer=0x312ffdc4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x312ffdc0, lpOverlapped=0x0 | out: lpBuffer=0x312ffdc4*, lpNumberOfBytesRead=0x312ffdc0*=0x4, lpOverlapped=0x0) returned 1 [0086.603] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.603] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813e0 [0086.603] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281ed0 [0086.603] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282100 [0086.603] NtQuerySystemTime (in: CurrentTime=0x312ffda0 | out: CurrentTime=0x312ffda0*=132260136437674018) returned 0x0 [0086.603] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0x487064f [0086.604] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0xcc880f67 [0086.604] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0xac29563d [0086.604] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0x980deca0 [0086.604] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0xb11d2556 [0086.604] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0xdc1a42a6 [0086.604] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0x59872a87 [0086.604] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0xad6c7138 [0086.604] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0xcde6ccba [0086.604] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0xea49bd0d [0086.604] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0xf484c323 [0086.604] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0x6053359f [0086.604] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0xcfa127c1 [0086.604] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0x6508d62f [0086.604] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0x8faa3517 [0086.604] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0xc7a4eb3a [0086.604] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0x8bf87c68 [0086.604] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0xc19ce742 [0086.604] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0xe03ddf63 [0086.604] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0xe456e646 [0086.604] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0xd225749f [0086.604] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0xfba45ada [0086.604] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0xc6fde313 [0086.604] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0x283a7382 [0086.604] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0xbcb75fe9 [0086.604] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0x91ab7a14 [0086.604] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0xcfd4ed23 [0086.604] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0xbe3a66a2 [0086.604] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0x1995f4a [0086.604] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0x9ba28b92 [0086.604] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0x93ef7660 [0086.604] RtlRandom (in: Seed=0x312ffdac | out: Seed=0x312ffdac) returned 0x3874a1f2 Thread: id = 1400 os_tid = 0x230c [0086.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 0x220 [0086.553] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml", dwFileAttributes=0x20) returned 1 [0086.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x628 [0086.553] GetFileSizeEx (in: hFile=0x628, lpFileSize=0x3137fed0 | out: lpFileSize=0x3137fed0*=9216) returned 1 [0086.553] SetFilePointerEx (in: hFile=0x628, liDistanceToMove=0x23fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.553] ReadFile (in: hFile=0x628, lpBuffer=0x3137fe54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3137fe50, lpOverlapped=0x0 | out: lpBuffer=0x3137fe54*, lpNumberOfBytesRead=0x3137fe50*=0x4, lpOverlapped=0x0) returned 1 [0086.593] SetFilePointerEx (in: hFile=0x628, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.594] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813e0 [0086.594] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281e58 [0086.594] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282100 [0086.594] NtQuerySystemTime (in: CurrentTime=0x3137fe30 | out: CurrentTime=0x3137fe30*=132260136437517736) returned 0x0 [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0xdb52d573 [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0x9af3b57c [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0xb7817563 [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0x64680061 [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0xae2f792a [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0x3bbc8518 [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0x351b1287 [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0x3a67bd93 [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0x55eb135f [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0x26d3f65d [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0xe7ed11bb [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0x9e4b7e08 [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0x8c06ee1c [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0x3322b97c [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0x5cbbcca3 [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0xec3744db [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0x90351a31 [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0x4236c5f3 [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0xa67a9a60 [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0x99fbf311 [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0x2dcff3a4 [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0x21bfe2d [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0x22b6449e [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0xb49fab3 [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0xfaaa23a7 [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0xeb4773b8 [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0xe94489d6 [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0x2b8d6682 [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0xe8bafd6e [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0xfee79779 [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0x1bc64a54 [0086.594] RtlRandom (in: Seed=0x3137fe3c | out: Seed=0x3137fe3c) returned 0x385724d3 Thread: id = 1401 os_tid = 0x2310 [0086.554] GetFileAttributesW (lpFileName="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\programdata\\oracle\\java\\installcache_x64\\baseimagefam8")) returned 0x2020 [0086.555] SetFileAttributesW (lpFileName="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\baseimagefam8", dwFileAttributes=0x20) returned 1 [0092.272] CreateFileW (lpFileName="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\programdata\\oracle\\java\\installcache_x64\\baseimagefam8"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17ac [0092.272] GetFileSizeEx (in: hFile=0x17ac, lpFileSize=0x313ffdb8 | out: lpFileSize=0x313ffdb8*=82551925) returned 1 [0092.272] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0x4eba471, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.272] ReadFile (in: hFile=0x17ac, lpBuffer=0x313ffd3c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x313ffd38, lpOverlapped=0x0 | out: lpBuffer=0x313ffd3c*, lpNumberOfBytesRead=0x313ffd38*=0x4, lpOverlapped=0x0) returned 1 [0092.275] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.275] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0661d8 [0092.275] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066368 [0092.275] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0664f8 [0092.275] NtQuerySystemTime (in: CurrentTime=0x313ffd18 | out: CurrentTime=0x313ffd18*=132260136494416722) returned 0x0 [0092.275] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0x5e102762 [0092.275] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0xa96c7825 [0092.275] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0x83e4aaed [0092.275] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0xe9f2995c [0092.275] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0x727668c4 [0092.275] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0x6d194896 [0092.275] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0x93d2c395 [0092.275] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0x291619a [0092.276] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0x2b97c6ea [0092.276] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0xd3d0bcef [0092.276] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0xa6e59648 [0092.276] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0x3e4a39a4 [0092.276] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0x56b29655 [0092.276] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0x5157321c [0092.276] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0xf26f9618 [0092.276] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0xe08578e5 [0092.276] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0x147cba3b [0092.276] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0xcf07914e [0092.276] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0x9b9cbab [0092.276] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0xa4463ccf [0092.276] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0xfafdaeb6 [0092.276] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0xe268130e [0092.276] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0x493d4412 [0092.276] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0xd5880726 [0092.276] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0xca52e2f0 [0092.276] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0x64fc3ce7 [0092.276] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0x96d7edac [0092.276] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0xaf6d35bc [0092.276] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0x2b999230 [0092.276] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0x67ba078b [0092.276] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0xb2120f8f [0092.276] RtlRandom (in: Seed=0x313ffd24 | out: Seed=0x313ffd24) returned 0xa1ab28ab Thread: id = 1402 os_tid = 0x2314 [0086.555] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0086.629] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.629] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.629] GetLastError () returned 0x5 [0086.629] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.629] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396f6b8) returned 1 Thread: id = 1403 os_tid = 0x2318 [0086.556] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0086.625] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0086.626] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.626] GetLastError () returned 0x5 [0086.626] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0086.626] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b8ce8) returned 1 Thread: id = 1404 os_tid = 0x231c [0086.556] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0086.626] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0089.362] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.958] GetLastError () returned 0x5 [0091.958] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0091.958] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b8838) returned 1 Thread: id = 1405 os_tid = 0x2320 [0086.557] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x3934fe8 [0086.557] wcscpy (in: _Dest=0x3934fe8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" [0086.557] wcscat (in: _Dest=0x3934fe8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\" [0086.557] wcscat (in: _Dest=0x3934fe8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\*" [0086.557] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5418e08 [0086.557] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fe54df6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab549f27, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fed1b77, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54452c0 [0089.401] wcscmp (_String1=".", _String2=".") returned 0 [0089.401] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fe54df6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab549f27, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fed1b77, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.401] wcscmp (_String1="..", _String2=".") returned 1 [0089.402] wcscmp (_String1="..", _String2="..") returned 0 [0089.402] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe7b04f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fe7b04f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fe7b04f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x341, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.scale-200.png", cAlternateFileName="")) returned 1 [0089.402] wcscmp (_String1="GetStartedAppList.scale-200.png", _String2=".") returned 1 [0089.402] wcscmp (_String1="GetStartedAppList.scale-200.png", _String2="..") returned 1 [0089.402] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x7588840 [0089.402] wcscpy (in: _Dest=0x7588840, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" [0089.402] wcscat (in: _Dest=0x7588840, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\" [0089.402] wcscat (in: _Dest=0x7588840, _Source="GetStartedAppList.scale-200.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-200.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-200.png" [0089.402] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7588840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x740 [0089.402] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe7b04f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fe7b04f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fe7b04f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x341, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.scale-200_contrast-black.png", cAlternateFileName="")) returned 1 [0089.402] wcscmp (_String1="GetStartedAppList.scale-200_contrast-black.png", _String2=".") returned 1 [0089.402] wcscmp (_String1="GetStartedAppList.scale-200_contrast-black.png", _String2="..") returned 1 [0089.402] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12c) returned 0x74e0c20 [0089.402] wcscpy (in: _Dest=0x74e0c20, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" [0089.403] wcscat (in: _Dest=0x74e0c20, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\" [0089.403] wcscat (in: _Dest=0x74e0c20, _Source="GetStartedAppList.scale-200_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-200_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-200_contrast-black.png" [0089.403] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e0c20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x570 [0089.403] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe7b04f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fe7b04f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fe7b04f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x38b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.scale-200_contrast-white.png", cAlternateFileName="")) returned 1 [0089.403] wcscmp (_String1="GetStartedAppList.scale-200_contrast-white.png", _String2=".") returned 1 [0089.403] wcscmp (_String1="GetStartedAppList.scale-200_contrast-white.png", _String2="..") returned 1 [0089.403] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12c) returned 0x74dfff0 [0089.403] wcscpy (in: _Dest=0x74dfff0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" [0089.403] wcscat (in: _Dest=0x74dfff0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\" [0089.403] wcscat (in: _Dest=0x74dfff0, _Source="GetStartedAppList.scale-200_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-200_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-200_contrast-white.png" [0089.403] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74dfff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fb8 [0089.404] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe7b04f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fe7b04f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fe7b04f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1338, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedLargeTile.scale-200.png", cAlternateFileName="")) returned 1 [0089.404] wcscmp (_String1="GetStartedLargeTile.scale-200.png", _String2=".") returned 1 [0089.404] wcscmp (_String1="GetStartedLargeTile.scale-200.png", _String2="..") returned 1 [0089.404] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x75842c8 [0089.404] wcscpy (in: _Dest=0x75842c8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" [0089.404] wcscat (in: _Dest=0x75842c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\" [0089.404] wcscat (in: _Dest=0x75842c8, _Source="GetStartedLargeTile.scale-200.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-200.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-200.png" [0089.404] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x75842c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ac [0089.405] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe7b04f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fe7b04f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fe7b04f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1338, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedLargeTile.scale-200_contrast-black.png", cAlternateFileName="")) returned 1 [0089.405] wcscmp (_String1="GetStartedLargeTile.scale-200_contrast-black.png", _String2=".") returned 1 [0089.405] wcscmp (_String1="GetStartedLargeTile.scale-200_contrast-black.png", _String2="..") returned 1 [0089.405] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x130) returned 0x74e0128 [0089.405] wcscpy (in: _Dest=0x74e0128, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" [0089.405] wcscat (in: _Dest=0x74e0128, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\" [0089.405] wcscat (in: _Dest=0x74e0128, _Source="GetStartedLargeTile.scale-200_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-200_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-200_contrast-black.png" [0089.405] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e0128, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1680 [0089.406] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe7b04f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fe7b04f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fe7b04f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1553, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedLargeTile.scale-200_contrast-white.png", cAlternateFileName="")) returned 1 [0089.406] wcscmp (_String1="GetStartedLargeTile.scale-200_contrast-white.png", _String2=".") returned 1 [0089.406] wcscmp (_String1="GetStartedLargeTile.scale-200_contrast-white.png", _String2="..") returned 1 [0089.406] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x130) returned 0x74e0398 [0089.406] wcscpy (in: _Dest=0x74e0398, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" [0089.406] wcscat (in: _Dest=0x74e0398, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\" [0089.406] wcscat (in: _Dest=0x74e0398, _Source="GetStartedLargeTile.scale-200_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-200_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-200_contrast-white.png" [0089.406] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e0398, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x167c [0089.407] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe7b04f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fe7b04f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fe7b04f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x6f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedMedTile.scale-200.png", cAlternateFileName="")) returned 1 [0089.407] wcscmp (_String1="GetStartedMedTile.scale-200.png", _String2=".") returned 1 [0089.407] wcscmp (_String1="GetStartedMedTile.scale-200.png", _String2="..") returned 1 [0089.407] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x7589448 [0089.407] wcscpy (in: _Dest=0x7589448, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" [0089.407] wcscat (in: _Dest=0x7589448, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\" [0089.407] wcscat (in: _Dest=0x7589448, _Source="GetStartedMedTile.scale-200.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-200.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-200.png" [0089.407] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7589448, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13d0 [0089.408] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe7b04f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fe7b04f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fe7b04f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x6f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedMedTile.scale-200_contrast-black.png", cAlternateFileName="")) returned 1 [0089.408] wcscmp (_String1="GetStartedMedTile.scale-200_contrast-black.png", _String2=".") returned 1 [0089.408] wcscmp (_String1="GetStartedMedTile.scale-200_contrast-black.png", _String2="..") returned 1 [0089.408] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12c) returned 0x74e0740 [0089.408] wcscpy (in: _Dest=0x74e0740, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" [0089.408] wcscat (in: _Dest=0x74e0740, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\" [0089.408] wcscat (in: _Dest=0x74e0740, _Source="GetStartedMedTile.scale-200_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-200_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-200_contrast-black.png" [0089.408] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e0740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1678 [0089.408] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fea12a9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fea6684, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fea6684, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x801, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedMedTile.scale-200_contrast-white.png", cAlternateFileName="")) returned 1 [0089.408] wcscmp (_String1="GetStartedMedTile.scale-200_contrast-white.png", _String2=".") returned 1 [0089.408] wcscmp (_String1="GetStartedMedTile.scale-200_contrast-white.png", _String2="..") returned 1 [0089.408] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12c) returned 0x74e0e90 [0089.408] wcscpy (in: _Dest=0x74e0e90, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" [0089.408] wcscat (in: _Dest=0x74e0e90, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\" [0089.409] wcscat (in: _Dest=0x74e0e90, _Source="GetStartedMedTile.scale-200_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-200_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-200_contrast-white.png" [0089.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e0e90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1674 [0089.409] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fea80f8, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7feaa819, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7feaa819, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x48f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedSmallTile.scale-200.png", cAlternateFileName="")) returned 1 [0089.409] wcscmp (_String1="GetStartedSmallTile.scale-200.png", _String2=".") returned 1 [0089.409] wcscmp (_String1="GetStartedSmallTile.scale-200.png", _String2="..") returned 1 [0089.409] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x54bd620 [0089.409] wcscpy (in: _Dest=0x54bd620, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" [0089.409] wcscat (in: _Dest=0x54bd620, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\" [0089.409] wcscat (in: _Dest=0x54bd620, _Source="GetStartedSmallTile.scale-200.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-200.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-200.png" [0089.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bd620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1670 [0089.410] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7feab8fd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7feab8fd, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7feab8fd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x48f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedSmallTile.scale-200_contrast-black.png", cAlternateFileName="")) returned 1 [0089.410] wcscmp (_String1="GetStartedSmallTile.scale-200_contrast-black.png", _String2=".") returned 1 [0089.410] wcscmp (_String1="GetStartedSmallTile.scale-200_contrast-black.png", _String2="..") returned 1 [0089.410] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x130) returned 0x74e0608 [0089.410] wcscpy (in: _Dest=0x74e0608, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" [0089.410] wcscat (in: _Dest=0x74e0608, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\" [0089.410] wcscat (in: _Dest=0x74e0608, _Source="GetStartedSmallTile.scale-200_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-200_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-200_contrast-black.png" [0089.410] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e0608, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x166c [0089.411] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7feab8fd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7feab8fd, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7feab8fd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedSmallTile.scale-200_contrast-white.png", cAlternateFileName="")) returned 1 [0089.411] wcscmp (_String1="GetStartedSmallTile.scale-200_contrast-white.png", _String2=".") returned 1 [0089.411] wcscmp (_String1="GetStartedSmallTile.scale-200_contrast-white.png", _String2="..") returned 1 [0089.411] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x130) returned 0x74e09b0 [0089.411] wcscpy (in: _Dest=0x74e09b0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" [0089.411] wcscat (in: _Dest=0x74e09b0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\" [0089.411] wcscat (in: _Dest=0x74e09b0, _Source="GetStartedSmallTile.scale-200_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-200_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-200_contrast-white.png" [0089.411] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e09b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1668 [0089.412] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7feab8fd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7feab8fd, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7feab8fd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1a2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedSplash.scale-200.png", cAlternateFileName="")) returned 1 [0089.412] wcscmp (_String1="GetStartedSplash.scale-200.png", _String2=".") returned 1 [0089.412] wcscmp (_String1="GetStartedSplash.scale-200.png", _String2="..") returned 1 [0089.412] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10c) returned 0x7589d08 [0089.412] wcscpy (in: _Dest=0x7589d08, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" [0089.412] wcscat (in: _Dest=0x7589d08, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\" [0089.412] wcscat (in: _Dest=0x7589d08, _Source="GetStartedSplash.scale-200.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-200.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-200.png" [0089.412] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7589d08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13d4 [0089.412] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7feab8fd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7feab8fd, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7feab8fd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1a2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedSplash.scale-200_contrast-black.png", cAlternateFileName="")) returned 1 [0089.412] wcscmp (_String1="GetStartedSplash.scale-200_contrast-black.png", _String2=".") returned 1 [0089.412] wcscmp (_String1="GetStartedSplash.scale-200_contrast-black.png", _String2="..") returned 1 [0089.412] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12a) returned 0x74df288 [0089.412] wcscpy (in: _Dest=0x74df288, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" [0089.413] wcscat (in: _Dest=0x74df288, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\" [0089.413] wcscat (in: _Dest=0x74df288, _Source="GetStartedSplash.scale-200_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-200_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-200_contrast-black.png" [0089.413] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74df288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1664 [0089.413] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7feab8fd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fed1b77, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fed1b77, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x54ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedSplash.scale-200_contrast-white.png", cAlternateFileName="")) returned 1 [0089.413] wcscmp (_String1="GetStartedSplash.scale-200_contrast-white.png", _String2=".") returned 1 [0089.413] wcscmp (_String1="GetStartedSplash.scale-200_contrast-white.png", _String2="..") returned 1 [0089.413] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12a) returned 0x74df3c0 [0089.413] wcscpy (in: _Dest=0x74df3c0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" [0089.413] wcscat (in: _Dest=0x74df3c0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\" [0089.413] wcscat (in: _Dest=0x74df3c0, _Source="GetStartedSplash.scale-200_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-200_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-200_contrast-white.png" [0089.413] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74df3c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1660 [0089.414] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fed1b77, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fed1b77, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fed1b77, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x8e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedWideTile.scale-200.png", cAlternateFileName="")) returned 1 [0089.414] wcscmp (_String1="GetStartedWideTile.scale-200.png", _String2=".") returned 1 [0089.414] wcscmp (_String1="GetStartedWideTile.scale-200.png", _String2="..") returned 1 [0089.414] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x110) returned 0x7589f38 [0089.414] wcscpy (in: _Dest=0x7589f38, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" [0089.414] wcscat (in: _Dest=0x7589f38, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\" [0089.414] wcscat (in: _Dest=0x7589f38, _Source="GetStartedWideTile.scale-200.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-200.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-200.png" [0089.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7589f38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13d8 [0089.415] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fed1b77, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fed1b77, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fed1b77, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x8e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedWideTile.scale-200_contrast-black.png", cAlternateFileName="")) returned 1 [0089.415] wcscmp (_String1="GetStartedWideTile.scale-200_contrast-black.png", _String2=".") returned 1 [0089.415] wcscmp (_String1="GetStartedWideTile.scale-200_contrast-black.png", _String2="..") returned 1 [0089.415] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12e) returned 0x7587528 [0089.415] wcscpy (in: _Dest=0x7587528, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" [0089.415] wcscat (in: _Dest=0x7587528, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\" [0089.415] wcscat (in: _Dest=0x7587528, _Source="GetStartedWideTile.scale-200_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-200_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-200_contrast-black.png" [0089.415] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7587528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1658 [0089.416] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fed1b77, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fed1b77, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fed1b77, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xa34, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedWideTile.scale-200_contrast-white.png", cAlternateFileName="")) returned 1 [0089.416] wcscmp (_String1="GetStartedWideTile.scale-200_contrast-white.png", _String2=".") returned 1 [0089.416] wcscmp (_String1="GetStartedWideTile.scale-200_contrast-white.png", _String2="..") returned 1 [0089.416] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12e) returned 0x5baa350 [0089.416] wcscpy (in: _Dest=0x5baa350, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" [0089.416] wcscat (in: _Dest=0x5baa350, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\" [0089.416] wcscat (in: _Dest=0x5baa350, _Source="GetStartedWideTile.scale-200_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-200_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-200_contrast-white.png" [0089.416] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5baa350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x164c [0089.417] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x5418e08 | out: lpFindFileData=0x5418e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fed1b77, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fed1b77, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fed1b77, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xa34, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedWideTile.scale-200_contrast-white.png", cAlternateFileName="")) returned 0 [0089.417] FindClose (in: hFindFile=0x54452c0 | out: hFindFile=0x54452c0) returned 1 [0089.418] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5418e08) returned 1 [0089.418] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3934fe8) returned 1 [0089.418] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7580ae0) returned 1 Thread: id = 1406 os_tid = 0x2324 [0086.557] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0086.559] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.561] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.563] GetLastError () returned 0x5 [0086.563] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.565] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389e2d8) returned 1 Thread: id = 1407 os_tid = 0x2328 [0086.567] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x3971a50 [0086.567] wcscpy (in: _Dest=0x3971a50, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0086.567] wcscat (in: _Dest=0x3971a50, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\" [0086.567] wcscat (in: _Dest=0x3971a50, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*" [0086.567] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5419070 [0086.567] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x5419070 | out: lpFindFileData=0x5419070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x287b925a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab841b4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x287b925a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe5717d0 [0086.568] wcscmp (_String1=".", _String2=".") returned 0 [0086.568] FindNextFileW (in: hFindFile=0xe5717d0, lpFindFileData=0x5419070 | out: lpFindFileData=0x5419070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x287b925a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab841b4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x287b925a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.568] wcscmp (_String1="..", _String2=".") returned 1 [0086.568] wcscmp (_String1="..", _String2="..") returned 0 [0086.568] FindNextFileW (in: hFindFile=0xe5717d0, lpFindFileData=0x5419070 | out: lpFindFileData=0x5419070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x287b925a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x287df4b3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x287df4b3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4246, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 1 [0086.568] wcscmp (_String1="AppxBundleManifest.xml", _String2=".") returned 1 [0086.568] wcscmp (_String1="AppxBundleManifest.xml", _String2="..") returned 1 [0086.568] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba5bf8 [0086.568] wcscpy (in: _Dest=0x5ba5bf8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0086.568] wcscat (in: _Dest=0x5ba5bf8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\" [0086.568] wcscat (in: _Dest=0x5ba5bf8, _Source="AppxBundleManifest.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" [0088.581] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba5bf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x618 [0088.582] FindNextFileW (in: hFindFile=0xe5717d0, lpFindFileData=0x5419070 | out: lpFindFileData=0x5419070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x287b925a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x287df4b3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x287df4b3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4246, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 0 [0088.582] FindClose (in: hFindFile=0xe5717d0 | out: hFindFile=0xe5717d0) returned 1 [0088.583] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5419070) returned 1 [0088.583] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3971a50) returned 1 [0088.583] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55fc9d8) returned 1 Thread: id = 1408 os_tid = 0x232c [0086.569] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0086.569] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0086.569] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.569] GetLastError () returned 0x5 [0086.569] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0086.569] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7580bb8) returned 1 Thread: id = 1409 os_tid = 0x2330 [0086.570] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba57f8 [0086.570] wcscpy (in: _Dest=0x5ba57f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" [0086.570] wcscat (in: _Dest=0x5ba57f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0086.571] wcscat (in: _Dest=0x5ba57f8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0086.571] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54192d8 [0086.571] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x54192d8 | out: lpFindFileData=0x54192d8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbd8a0611, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbd8a0611, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8a0611, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571810 [0086.571] wcscmp (_String1=".", _String2=".") returned 0 [0086.571] FindNextFileW (in: hFindFile=0xe571810, lpFindFileData=0x54192d8 | out: lpFindFileData=0x54192d8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbd8a0611, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbd8a0611, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8a0611, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.571] wcscmp (_String1="..", _String2=".") returned 1 [0086.571] wcscmp (_String1="..", _String2="..") returned 0 [0086.571] FindNextFileW (in: hFindFile=0xe571810, lpFindFileData=0x54192d8 | out: lpFindFileData=0x54192d8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbd8a0611, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbd8a0611, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8a0611, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.572] FindClose (in: hFindFile=0xe571810 | out: hFindFile=0xe571810) returned 1 [0086.572] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54192d8) returned 1 [0086.572] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba57f8) returned 1 [0086.572] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x72866a8) returned 1 Thread: id = 1410 os_tid = 0x2334 [0086.573] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb6) returned 0x5b169d0 [0086.573] wcscpy (in: _Dest=0x5b169d0, _Source="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" [0086.573] wcscat (in: _Dest=0x5b169d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\" [0086.573] wcscat (in: _Dest=0x5b169d0, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*" [0086.573] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54192d8 [0086.573] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*", lpFindFileData=0x54192d8 | out: lpFindFileData=0x54192d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571810 [0086.573] wcscmp (_String1=".", _String2=".") returned 0 [0086.573] FindNextFileW (in: hFindFile=0xe571810, lpFindFileData=0x54192d8 | out: lpFindFileData=0x54192d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.573] wcscmp (_String1="..", _String2=".") returned 1 [0086.573] wcscmp (_String1="..", _String2="..") returned 0 [0086.573] FindNextFileW (in: hFindFile=0xe571810, lpFindFileData=0x54192d8 | out: lpFindFileData=0x54192d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0086.573] wcscmp (_String1="vcRuntimeAdditional_x86", _String2=".") returned 1 [0086.573] wcscmp (_String1="vcRuntimeAdditional_x86", _String2="..") returned 1 [0086.573] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe2) returned 0x54ba278 [0086.573] wcscpy (in: _Dest=0x54ba278, _Source="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" [0086.573] wcscat (in: _Dest=0x54ba278, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\" [0086.573] wcscat (in: _Dest=0x54ba278, _Source="vcRuntimeAdditional_x86" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86" [0088.579] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54ba278, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11e8 [0088.580] FindNextFileW (in: hFindFile=0xe571810, lpFindFileData=0x54192d8 | out: lpFindFileData=0x54192d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0088.580] FindClose (in: hFindFile=0xe571810 | out: hFindFile=0xe571810) returned 1 [0088.580] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54192d8) returned 1 [0088.580] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5b169d0) returned 1 [0088.580] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3905fe0) returned 1 Thread: id = 1411 os_tid = 0x2338 [0086.574] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0x38fd270 [0086.574] wcscpy (in: _Dest=0x38fd270, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Device" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device" [0086.574] wcscat (in: _Dest=0x38fd270, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\" [0086.574] wcscat (in: _Dest=0x38fd270, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*" [0086.574] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5419540 [0086.574] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x5419540 | out: lpFindFileData=0x5419540*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571850 [0086.575] wcscmp (_String1=".", _String2=".") returned 0 [0086.575] FindNextFileW (in: hFindFile=0xe571850, lpFindFileData=0x5419540 | out: lpFindFileData=0x5419540*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.575] wcscmp (_String1="..", _String2=".") returned 1 [0086.575] wcscmp (_String1="..", _String2="..") returned 0 [0086.575] FindNextFileW (in: hFindFile=0xe571850, lpFindFileData=0x5419540 | out: lpFindFileData=0x5419540*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{113527a4-45d4-4b6f-b567-97838f1b04b0}", cAlternateFileName="{11352~1")) returned 1 [0086.575] wcscmp (_String1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", _String2=".") returned 1 [0086.575] wcscmp (_String1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", _String2="..") returned 1 [0086.575] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa8) returned 0x388fa90 [0086.575] wcscpy (in: _Dest=0x388fa90, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Device" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device" [0086.575] wcscat (in: _Dest=0x388fa90, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\" [0086.575] wcscat (in: _Dest=0x388fa90, _Source="{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0088.576] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x388fa90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f64 [0088.576] FindNextFileW (in: hFindFile=0xe571850, lpFindFileData=0x5419540 | out: lpFindFileData=0x5419540*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 1 [0088.576] wcscmp (_String1="{8702d817-5aad-4674-9ef3-4d3decd87120}", _String2=".") returned 1 [0088.576] wcscmp (_String1="{8702d817-5aad-4674-9ef3-4d3decd87120}", _String2="..") returned 1 [0088.576] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa8) returned 0x388f300 [0088.576] wcscpy (in: _Dest=0x388f300, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Device" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device" [0088.576] wcscat (in: _Dest=0x388f300, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\" [0088.576] wcscat (in: _Dest=0x388f300, _Source="{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" [0088.576] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x388f300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f48 [0088.577] FindNextFileW (in: hFindFile=0xe571850, lpFindFileData=0x5419540 | out: lpFindFileData=0x5419540*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 0 [0088.577] FindClose (in: hFindFile=0xe571850 | out: hFindFile=0xe571850) returned 1 [0088.578] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5419540) returned 1 [0088.578] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38fd270) returned 1 [0088.578] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542ba70) returned 1 Thread: id = 1412 os_tid = 0x233c [0086.575] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0x38fc640 [0086.575] wcscpy (in: _Dest=0x38fc640, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Task" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task" [0086.575] wcscat (in: _Dest=0x38fc640, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\" [0086.575] wcscat (in: _Dest=0x38fc640, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*" [0086.575] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x54197a8 [0086.575] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0x54197a8 | out: lpFindFileData=0x54197a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571890 [0086.576] wcscmp (_String1=".", _String2=".") returned 0 [0086.576] FindNextFileW (hFindFile=0xe571890, lpFindFileData=0x54197a8) Thread: id = 1413 os_tid = 0x2340 [0086.576] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0086.637] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.637] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.637] GetLastError () returned 0x5 [0086.637] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.637] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55fd2c8) returned 1 Thread: id = 1414 os_tid = 0x2344 [0086.578] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0086.628] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0086.630] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.630] GetLastError () returned 0x5 [0086.630] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0086.630] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55fcaa8) returned 1 Thread: id = 1415 os_tid = 0x2348 [0086.579] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x53f9ce0 [0086.579] wcscpy (in: _Dest=0x53f9ce0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0086.579] wcscat (in: _Dest=0x53f9ce0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0086.579] wcscat (in: _Dest=0x53f9ce0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*" [0086.579] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5419a10 [0086.579] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x5419a10 | out: lpFindFileData=0x5419a10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2891078c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab9bb295, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2891078c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571910 [0086.638] wcscmp (_String1=".", _String2=".") returned 0 [0086.638] FindNextFileW (hFindFile=0xe571910, lpFindFileData=0x5419a10) Thread: id = 1416 os_tid = 0x234c [0086.580] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0086.635] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0086.635] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.636] GetLastError () returned 0x5 [0086.636] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0086.636] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55fda18) returned 1 Thread: id = 1417 os_tid = 0x2350 [0086.580] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb4) returned 0x5b16a90 [0086.580] wcscpy (in: _Dest=0x5b16a90, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets" [0086.580] wcscat (in: _Dest=0x5b16a90, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\" [0086.580] wcscat (in: _Dest=0x5b16a90, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\*" [0086.580] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5419c78 [0086.580] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x5419c78 | out: lpFindFileData=0x5419c78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2895cc43, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabb21004, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28bc9f4c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe5718d0 [0086.634] wcscmp (_String1=".", _String2=".") returned 0 [0086.634] FindNextFileW (hFindFile=0xe5718d0, lpFindFileData=0x5419c78) Thread: id = 1418 os_tid = 0x2354 [0086.581] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\BuildInfo.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\buildinfo.xml")) returned 0x20 [0086.631] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\BuildInfo.xml", dwFileAttributes=0x20) returned 0 [0086.631] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\BuildInfo.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\buildinfo.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.631] GetLastError () returned 0x5 [0086.631] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\BuildInfo.xml", dwFileAttributes=0x20) returned 0 [0086.632] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3975d60) returned 1 Thread: id = 1419 os_tid = 0x2358 [0086.581] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.Apps.Messaging.Base.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\microsoft.apps.messaging.base.winmd")) returned 0x20 [0086.634] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.Apps.Messaging.Base.winmd", dwFileAttributes=0x20) returned 0 [0086.634] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.Apps.Messaging.Base.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\microsoft.apps.messaging.base.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.634] GetLastError () returned 0x5 [0086.634] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.Apps.Messaging.Base.winmd", dwFileAttributes=0x20) returned 0 [0086.634] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x72867a0) returned 1 Thread: id = 1420 os_tid = 0x235c [0086.581] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.Apps.Messaging.External.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\microsoft.apps.messaging.external.winmd")) returned 0x20 [0086.639] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.Apps.Messaging.External.winmd", dwFileAttributes=0x20) returned 0 [0086.639] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.Apps.Messaging.External.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\microsoft.apps.messaging.external.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.639] GetLastError () returned 0x5 [0086.639] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.Apps.Messaging.External.winmd", dwFileAttributes=0x20) returned 0 [0086.639] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba2af8) returned 1 Thread: id = 1421 os_tid = 0x2360 [0086.642] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.Apps.Messaging.Internal.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\microsoft.apps.messaging.internal.winmd")) returned 0x20 [0086.642] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.Apps.Messaging.Internal.winmd", dwFileAttributes=0x20) returned 0 [0086.643] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.Apps.Messaging.Internal.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\microsoft.apps.messaging.internal.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.643] GetLastError () returned 0x5 [0086.643] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.Apps.Messaging.Internal.winmd", dwFileAttributes=0x20) returned 0 [0086.643] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba21f8) returned 1 Thread: id = 1422 os_tid = 0x2364 [0086.645] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.Graphics.Canvas.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\microsoft.graphics.canvas.winmd")) returned 0x20 [0086.645] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.Graphics.Canvas.winmd", dwFileAttributes=0x20) returned 0 [0086.645] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.Graphics.Canvas.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\microsoft.graphics.canvas.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.645] GetLastError () returned 0x5 [0086.645] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.Graphics.Canvas.winmd", dwFileAttributes=0x20) returned 0 [0086.645] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b8dd8) returned 1 Thread: id = 1423 os_tid = 0x2368 [0086.646] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.People.AutoSuggest.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\microsoft.people.autosuggest.winmd")) returned 0x20 [0086.646] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.People.AutoSuggest.winmd", dwFileAttributes=0x20) returned 0 [0086.646] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.People.AutoSuggest.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\microsoft.people.autosuggest.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.647] GetLastError () returned 0x5 [0086.647] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.People.AutoSuggest.winmd", dwFileAttributes=0x20) returned 0 [0086.647] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b8ec8) returned 1 Thread: id = 1424 os_tid = 0x236c [0086.648] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.People.Controls.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\microsoft.people.controls.winmd")) returned 0x20 [0086.649] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.People.Controls.winmd", dwFileAttributes=0x20) returned 0 [0086.649] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.People.Controls.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\microsoft.people.controls.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.649] GetLastError () returned 0x5 [0086.649] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.People.Controls.winmd", dwFileAttributes=0x20) returned 0 [0086.650] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b8fb8) returned 1 Thread: id = 1425 os_tid = 0x2370 [0086.651] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.People.Relevance.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\microsoft.people.relevance.winmd")) returned 0x20 [0086.651] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.People.Relevance.winmd", dwFileAttributes=0x20) returned 0 [0086.651] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.People.Relevance.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\microsoft.people.relevance.winmd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.652] GetLastError () returned 0x5 [0086.652] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Microsoft.People.Relevance.winmd", dwFileAttributes=0x20) returned 0 [0086.652] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b9378) returned 1 Thread: id = 1426 os_tid = 0x2374 [0086.653] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xea) returned 0x7285cf8 [0086.653] wcscpy (in: _Dest=0x7285cf8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" [0086.653] wcscat (in: _Dest=0x7285cf8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0086.653] wcscat (in: _Dest=0x7285cf8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0086.653] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5419ee0 [0086.653] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x5419ee0 | out: lpFindFileData=0x5419ee0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbd8a0611, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xfbac0b62, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfbac0b62, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571950 [0086.653] wcscmp (_String1=".", _String2=".") returned 0 [0086.653] FindNextFileW (hFindFile=0xe571950, lpFindFileData=0x5419ee0) Thread: id = 1427 os_tid = 0x2378 [0086.654] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\resources.pri")) returned 0x20 [0086.654] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0086.654] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.654] GetLastError () returned 0x5 [0086.654] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\resources.pri", dwFileAttributes=0x20) returned 0 [0086.654] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39762d8) returned 1 Thread: id = 1428 os_tid = 0x237c [0086.655] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0086.656] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.656] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.656] GetLastError () returned 0x5 [0086.656] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.656] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55fd1f8) returned 1 Thread: id = 1429 os_tid = 0x2380 [0086.657] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0086.658] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0086.658] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.658] GetLastError () returned 0x5 [0086.658] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0086.658] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55fcb78) returned 1 Thread: id = 1430 os_tid = 0x2384 [0086.659] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53fa0c8 [0086.659] wcscpy (in: _Dest=0x53fa0c8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0086.659] wcscat (in: _Dest=0x53fa0c8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0086.659] wcscat (in: _Dest=0x53fa0c8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*" [0086.659] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x541a148 [0086.659] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x541a148 | out: lpFindFileData=0x541a148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d0fdc78, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa936cde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d0fdc78, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571990 [0086.660] wcscmp (_String1=".", _String2=".") returned 0 [0086.660] FindNextFileW (hFindFile=0xe571990, lpFindFileData=0x541a148) Thread: id = 1431 os_tid = 0x2388 [0086.661] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0086.661] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0086.661] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.661] GetLastError () returned 0x5 [0086.661] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0086.661] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55fdae8) returned 1 Thread: id = 1432 os_tid = 0x238c [0086.662] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb2) returned 0x5b16e50 [0086.662] wcscpy (in: _Dest=0x5b16e50, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets" [0086.662] wcscat (in: _Dest=0x5b16e50, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\" [0086.662] wcscat (in: _Dest=0x5b16e50, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\*" [0086.662] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x541a3b0 [0086.662] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x541a3b0 | out: lpFindFileData=0x541a3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d1bc83f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa937267, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2db7c876, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe5719d0 [0086.663] wcscmp (_String1=".", _String2=".") returned 0 [0086.663] FindNextFileW (hFindFile=0xe5719d0, lpFindFileData=0x541a3b0) Thread: id = 1433 os_tid = 0x2390 [0086.663] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x53fa190 [0086.663] wcscpy (in: _Dest=0x53fa190, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Configuration" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Configuration") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Configuration" [0086.663] wcscat (in: _Dest=0x53fa190, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Configuration\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Configuration\\" [0086.663] wcscat (in: _Dest=0x53fa190, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Configuration\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Configuration\\*" [0086.663] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x541a618 [0086.663] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Configuration\\*", lpFindFileData=0x541a618 | out: lpFindFileData=0x541a618*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dbabacb, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad79c2f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dbabacb, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571a10 [0086.664] wcscmp (_String1=".", _String2=".") returned 0 [0086.664] FindNextFileW (hFindFile=0xe571a10, lpFindFileData=0x541a618) Thread: id = 1434 os_tid = 0x2394 [0086.664] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb2) returned 0x5b16f10 [0086.664] wcscpy (in: _Dest=0x5b16f10, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Images" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Images") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Images" [0086.665] wcscat (in: _Dest=0x5b16f10, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Images\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Images\\" [0086.665] wcscat (in: _Dest=0x5b16f10, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Images\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Images\\*" [0086.665] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5416c58 [0086.665] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Images\\*", lpFindFileData=0x5416c58 | out: lpFindFileData=0x5416c58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dbabacb, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7a6fb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dbabacb, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571a50 [0086.665] wcscmp (_String1=".", _String2=".") returned 0 [0086.665] FindNextFileW (hFindFile=0xe571a50, lpFindFileData=0x5416c58) Thread: id = 1435 os_tid = 0x2398 [0086.665] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0) returned 0x7580270 [0086.665] wcscpy (in: _Dest=0x7580270, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising" [0086.665] wcscat (in: _Dest=0x7580270, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\" [0086.665] wcscat (in: _Dest=0x7580270, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\*" [0086.665] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5416ec0 [0086.665] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\*", lpFindFileData=0x5416ec0 | out: lpFindFileData=0x5416ec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd03022, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7ad84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd2927f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571a90 [0086.666] wcscmp (_String1=".", _String2=".") returned 0 [0086.666] FindNextFileW (hFindFile=0xe571a90, lpFindFileData=0x5416ec0) Thread: id = 1436 os_tid = 0x239c [0086.666] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) Thread: id = 1437 os_tid = 0x23a0 [0086.667] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) Thread: id = 1438 os_tid = 0x23a4 [0086.667] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0086.669] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.670] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.672] GetLastError () returned 0x5 [0086.672] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.673] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389e200) returned 1 Thread: id = 1439 os_tid = 0x23a8 [0086.674] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x3970ef0 [0086.674] wcscpy (in: _Dest=0x3970ef0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0086.674] wcscat (in: _Dest=0x3970ef0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\" [0086.674] wcscat (in: _Dest=0x3970ef0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*" [0086.674] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5417128 [0086.674] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x5417128 | out: lpFindFileData=0x5417128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c254236, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa53e492, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c254236, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571ad0 [0086.675] wcscmp (_String1=".", _String2=".") returned 0 [0086.675] FindNextFileW (hFindFile=0xe571ad0, lpFindFileData=0x5417128) Thread: id = 1440 os_tid = 0x23ac [0086.676] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0086.676] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0086.676] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.677] GetLastError () returned 0x5 [0086.677] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0086.677] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757f190) returned 1 Thread: id = 1441 os_tid = 0x23b0 [0086.678] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x7285df0 [0086.678] wcscpy (in: _Dest=0x7285df0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" [0086.678] wcscat (in: _Dest=0x7285df0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0086.678] wcscat (in: _Dest=0x7285df0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0086.678] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5417390 [0086.678] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x5417390 | out: lpFindFileData=0x5417390*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x608513a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa53f14b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608513a6, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571b10 [0086.678] wcscmp (_String1=".", _String2=".") returned 0 [0086.678] FindNextFileW (hFindFile=0xe571b10, lpFindFileData=0x5417390) Thread: id = 1442 os_tid = 0x23b4 [0086.678] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0086.747] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.747] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.747] GetLastError () returned 0x5 [0086.747] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.747] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55fe238) returned 1 Thread: id = 1443 os_tid = 0x23b8 [0086.748] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x3970fc0 [0086.748] wcscpy (in: _Dest=0x3970fc0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0086.749] wcscat (in: _Dest=0x3970fc0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\" [0086.749] wcscat (in: _Dest=0x3970fc0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*" [0086.749] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5417d30 [0086.749] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x5417d30 | out: lpFindFileData=0x5417d30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70454cf5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa293d66, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70454cf5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571b50 [0086.749] wcscmp (_String1=".", _String2=".") returned 0 [0086.749] FindNextFileW (hFindFile=0xe571b50, lpFindFileData=0x5417d30) Thread: id = 1444 os_tid = 0x23bc [0086.752] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0086.752] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0086.752] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.752] GetLastError () returned 0x5 [0086.752] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0086.752] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55fcd18) returned 1 Thread: id = 1445 os_tid = 0x23c0 [0086.753] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0086.755] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.756] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.758] GetLastError () returned 0x5 [0086.758] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.759] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39744e0) returned 1 Thread: id = 1446 os_tid = 0x23c4 [0086.760] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x3971090 [0086.761] wcscpy (in: _Dest=0x3971090, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0086.761] wcscat (in: _Dest=0x3971090, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\" [0086.761] wcscat (in: _Dest=0x3971090, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*" [0086.761] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5417f98 [0086.761] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x5417f98 | out: lpFindFileData=0x5417f98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2cdd5a7d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa935760, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2cdd5a7d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571b90 [0086.762] wcscmp (_String1=".", _String2=".") returned 0 [0086.762] FindNextFileW (hFindFile=0xe571b90, lpFindFileData=0x5417f98) Thread: id = 1447 os_tid = 0x23c8 [0086.762] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0086.762] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0086.762] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.762] GetLastError () returned 0x5 [0086.762] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0086.762] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757fa00) returned 1 Thread: id = 1448 os_tid = 0x23cc [0086.763] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba21f8 [0086.764] wcscpy (in: _Dest=0x5ba21f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" [0086.764] wcscat (in: _Dest=0x5ba21f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\" [0086.764] wcscat (in: _Dest=0x5ba21f8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" [0086.764] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x5418200 [0086.764] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x5418200 | out: lpFindFileData=0x5418200*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb7a270e5, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571bd0 [0086.765] wcscmp (_String1=".", _String2=".") returned 0 [0086.765] FindNextFileW (hFindFile=0xe571bd0, lpFindFileData=0x5418200) Thread: id = 1449 os_tid = 0x23d0 [0086.765] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0086.766] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.766] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.766] GetLastError () returned 0x5 [0086.766] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.766] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3974408) returned 1 Thread: id = 1450 os_tid = 0x23d4 [0086.767] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcc) returned 0x75804f8 [0086.767] wcscpy (in: _Dest=0x75804f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0086.767] wcscat (in: _Dest=0x75804f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\" [0086.767] wcscat (in: _Dest=0x75804f8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*" [0086.767] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f4790 [0086.767] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x53f4790 | out: lpFindFileData=0x53f4790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68a98ed8, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaaebe349, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x68a98ed8, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571c50 [0086.767] wcscmp (_String1=".", _String2=".") returned 0 [0086.767] FindNextFileW (hFindFile=0xe571c50, lpFindFileData=0x53f4790) Thread: id = 1451 os_tid = 0x23d8 [0086.768] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0086.768] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.768] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.768] GetLastError () returned 0x5 [0086.768] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.768] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f7e30) returned 1 Thread: id = 1452 os_tid = 0x23dc [0086.770] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x3971160 [0086.770] wcscpy (in: _Dest=0x3971160, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0086.770] wcscat (in: _Dest=0x3971160, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\" [0086.770] wcscat (in: _Dest=0x3971160, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*" [0086.770] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f49f8 [0086.770] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x53f49f8 | out: lpFindFileData=0x53f49f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed19195, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab5eb5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7ed19195, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571c90 [0086.770] wcscmp (_String1=".", _String2=".") returned 0 [0086.770] FindNextFileW (hFindFile=0xe571c90, lpFindFileData=0x53f49f8) Thread: id = 1453 os_tid = 0x23e0 [0086.770] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0086.773] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0086.773] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.773] GetLastError () returned 0x5 [0086.773] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0086.773] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55fceb8) returned 1 Thread: id = 1454 os_tid = 0x23e4 [0086.774] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0086.775] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.775] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.775] GetLastError () returned 0x5 [0086.775] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.775] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f19a0) returned 1 Thread: id = 1455 os_tid = 0x23e8 [0086.776] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0086.776] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.776] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.776] GetLastError () returned 0x5 [0086.776] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.777] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3974690) returned 1 Thread: id = 1456 os_tid = 0x23ec [0086.778] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc8) returned 0x3971230 [0086.778] wcscpy (in: _Dest=0x3971230, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" [0086.778] wcscat (in: _Dest=0x3971230, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\" [0086.778] wcscat (in: _Dest=0x3971230, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*" [0086.778] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f4ec8 [0086.778] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x53f4ec8 | out: lpFindFileData=0x53f4ec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x773fa578, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa096b21, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x773fa578, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571cd0 [0086.778] wcscmp (_String1=".", _String2=".") returned 0 [0086.778] FindNextFileW (hFindFile=0xe571cd0, lpFindFileData=0x53f4ec8) Thread: id = 1457 os_tid = 0x23f0 [0086.779] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0086.779] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0086.780] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.780] GetLastError () returned 0x5 [0086.780] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0086.780] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757f268) returned 1 Thread: id = 1458 os_tid = 0x23f4 [0086.781] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0086.781] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.781] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.781] GetLastError () returned 0x5 [0086.781] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.781] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f1518) returned 1 Thread: id = 1459 os_tid = 0x23f8 [0086.782] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb4) returned 0x5b16fd0 [0086.782] wcscpy (in: _Dest=0x5b16fd0, _Source="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" [0086.783] wcscat (in: _Dest=0x5b16fd0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\" [0086.783] wcscat (in: _Dest=0x5b16fd0, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*" [0086.783] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f5130 [0086.783] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*", lpFindFileData=0x53f5130 | out: lpFindFileData=0x53f5130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571d10 [0086.783] wcscmp (_String1=".", _String2=".") returned 0 [0086.783] FindNextFileW (hFindFile=0xe571d10, lpFindFileData=0x53f5130) Thread: id = 1460 os_tid = 0x23fc [0086.783] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x68) returned 0x38b24f8 [0086.783] wcscpy (in: _Dest=0x38b24f8, _Source="C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader" | out: _Dest="C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader" [0086.783] wcscat (in: _Dest=0x38b24f8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader\\" [0086.783] wcscat (in: _Dest=0x38b24f8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader\\*") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader\\*" [0086.783] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f5398 [0086.783] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader\\*", lpFindFileData=0x53f5398 | out: lpFindFileData=0x53f5398*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571d50 [0086.784] wcscmp (_String1=".", _String2=".") returned 0 [0086.784] FindNextFileW (hFindFile=0xe571d50, lpFindFileData=0x53f5398) Thread: id = 1461 os_tid = 0x2404 [0086.784] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x72) returned 0x38d08a0 [0086.784] wcscpy (in: _Dest=0x38d08a0, _Source="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios" | out: _Dest="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios" [0086.784] wcscat (in: _Dest=0x38d08a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\" [0086.784] wcscat (in: _Dest=0x38d08a0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\*") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\*" [0086.784] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f5600 [0086.784] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\*", lpFindFileData=0x53f5600 | out: lpFindFileData=0x53f5600*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d9a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a88b65e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe5715d0 [0086.784] wcscmp (_String1=".", _String2=".") returned 0 [0086.784] FindNextFileW (hFindFile=0xe5715d0, lpFindFileData=0x53f5600) Thread: id = 1462 os_tid = 0x2408 [0086.785] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb4) returned 0x5b15890 [0086.785] wcscpy (in: _Dest=0x5b15890, _Source="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages" [0086.785] wcscat (in: _Dest=0x5b15890, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\" [0086.785] wcscat (in: _Dest=0x5b15890, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*" [0086.785] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f5868 [0086.785] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*", lpFindFileData=0x53f5868 | out: lpFindFileData=0x53f5868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571610 [0086.785] wcscmp (_String1=".", _String2=".") returned 0 [0086.785] FindNextFileW (hFindFile=0xe571610, lpFindFileData=0x53f5868) Thread: id = 1463 os_tid = 0x240c [0086.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 0x20 [0086.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM", dwFileAttributes=0x20) returned 1 [0086.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x5b8 [0086.787] GetFileSizeEx (in: hFile=0x5b8, lpFileSize=0x334ff86c | out: lpFileSize=0x334ff86c*=174528) returned 1 [0086.787] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x2a9bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.787] ReadFile (in: hFile=0x5b8, lpBuffer=0x334ff7f0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x334ff7ec, lpOverlapped=0x0 | out: lpBuffer=0x334ff7f0*, lpNumberOfBytesRead=0x334ff7ec*=0x4, lpOverlapped=0x0) returned 1 [0086.788] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.788] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813e0 [0086.788] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7281fc0 [0086.788] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282100 [0086.788] NtQuerySystemTime (in: CurrentTime=0x334ff7cc | out: CurrentTime=0x334ff7cc*=132260136439392706) returned 0x0 [0086.788] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0xea242d47 [0086.788] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0x249a8c34 [0086.789] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0xfa371b5f [0086.789] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0x5849bd11 [0086.789] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0x193cf2ab [0086.789] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0x2c8c8068 [0086.789] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0x32222217 [0086.789] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0x17f4ae4e [0086.789] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0xcda2b92d [0086.789] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0xf819f5 [0086.789] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0xe4a507b8 [0086.789] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0xfd2a8a3c [0086.789] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0x79028839 [0086.789] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0x17f6570d [0086.789] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0xe06bd68 [0086.789] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0x15d55325 [0086.789] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0xe47634c6 [0086.789] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0xbd328cc [0086.789] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0x343e3180 [0086.789] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0x9fe5a0aa [0086.789] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0xb8db56ec [0086.789] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0xc56ad849 [0086.789] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0xaaa99075 [0086.789] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0xf37c7e12 [0086.789] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0xcd23f2d3 [0086.789] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0xbd1107bd [0086.789] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0x47e785db [0086.789] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0x805dc03d [0086.790] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0x34be1bcb [0086.790] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0xe638cac7 [0086.790] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0x435214bb [0086.790] RtlRandom (in: Seed=0x334ff7d8 | out: Seed=0x334ff7d8) returned 0x36886e8 Thread: id = 1464 os_tid = 0x2410 [0086.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 0x20 [0086.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS", dwFileAttributes=0x20) returned 1 [0086.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x5b4 [0086.799] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x3357fbdc | out: lpFileSize=0x3357fbdc*=94467) returned 1 [0086.799] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x170ff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.799] ReadFile (in: hFile=0x5b4, lpBuffer=0x3357fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3357fb5c, lpOverlapped=0x0 | out: lpBuffer=0x3357fb60*, lpNumberOfBytesRead=0x3357fb5c*=0x4, lpOverlapped=0x0) returned 1 [0086.807] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.807] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813e0 [0086.807] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282038 [0086.807] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282100 [0086.807] NtQuerySystemTime (in: CurrentTime=0x3357fb3c | out: CurrentTime=0x3357fb3c*=132260136439705434) returned 0x0 [0086.807] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0xbf48a4e1 [0086.807] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0x5377849b [0086.807] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0x2f4ffd10 [0086.807] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0xc7033e57 [0086.807] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0xc4b37c4e [0086.807] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0xcf1b7194 [0086.807] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0x44edfa20 [0086.808] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0x32d725f1 [0086.808] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0xacd5c63a [0086.808] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0x27ec6171 [0086.808] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0x96cb6b3a [0086.808] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0x83302872 [0086.808] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0xf0b0b0b9 [0086.808] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0x218cfae [0086.808] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0x8d19ae55 [0086.808] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0xdba5be40 [0086.808] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0xff33381e [0086.808] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0xac529fec [0086.808] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0x9bda89b0 [0086.808] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0xa8352af2 [0086.808] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0x7363da9 [0086.808] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0x42099743 [0086.808] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0xbb45e4e7 [0086.808] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0x406323d7 [0086.808] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0xc811f404 [0086.808] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0x10d88a50 [0086.808] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0xe2efde63 [0086.808] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0xe85b7795 [0086.808] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0x87d3ac09 [0086.808] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0xf4d60ec6 [0086.808] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0x2689ade3 [0086.808] RtlRandom (in: Seed=0x3357fb48 | out: Seed=0x3357fb48) returned 0x7b465a3e Thread: id = 1465 os_tid = 0x2414 [0086.801] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6e) returned 0x766e658 [0086.801] wcscpy (in: _Dest=0x766e658, _Source="C:\\Program Files (x86)\\Common Files\\Java\\Java Update" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update" [0086.801] wcscat (in: _Dest=0x766e658, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" [0086.801] wcscat (in: _Dest=0x766e658, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\*") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\*" [0086.801] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f5ad0 [0086.801] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\*", lpFindFileData=0x53f5ad0 | out: lpFindFileData=0x53f5ad0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xb2fe5e18, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xbb68653c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb300c058, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571650 [0086.801] wcscmp (_String1=".", _String2=".") returned 0 [0086.801] FindNextFileW (hFindFile=0xe571650, lpFindFileData=0x53f5ad0) Thread: id = 1466 os_tid = 0x2418 [0086.801] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x38b26b8 [0086.801] wcscpy (in: _Dest=0x38b26b8, _Source="C:\\Program Files (x86)\\Google\\Update2\\1.3.33.5" | out: _Dest="C:\\Program Files (x86)\\Google\\Update2\\1.3.33.5") returned="C:\\Program Files (x86)\\Google\\Update2\\1.3.33.5" [0086.801] wcscat (in: _Dest=0x38b26b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Update2\\1.3.33.5\\") returned="C:\\Program Files (x86)\\Google\\Update2\\1.3.33.5\\" [0086.802] wcscat (in: _Dest=0x38b26b8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\Update2\\1.3.33.5\\*") returned="C:\\Program Files (x86)\\Google\\Update2\\1.3.33.5\\*" [0086.802] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f5d38 [0086.802] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Update2\\1.3.33.5\\*", lpFindFileData=0x53f5d38 | out: lpFindFileData=0x53f5d38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc631f07, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc7d58e1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc7d58e1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe570f50 [0086.818] wcscmp (_String1=".", _String2=".") returned 0 [0086.818] FindNextFileW (hFindFile=0xe570f50, lpFindFileData=0x53f5d38) Thread: id = 1467 os_tid = 0x241c [0086.803] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x38b1fb8 [0086.803] wcscpy (in: _Dest=0x38b1fb8, _Source="C:\\Program Files (x86)\\Google\\Update2\\Download" | out: _Dest="C:\\Program Files (x86)\\Google\\Update2\\Download") returned="C:\\Program Files (x86)\\Google\\Update2\\Download" [0086.803] wcscat (in: _Dest=0x38b1fb8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Update2\\Download\\") returned="C:\\Program Files (x86)\\Google\\Update2\\Download\\" [0086.803] wcscat (in: _Dest=0x38b1fb8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\Update2\\Download\\*") returned="C:\\Program Files (x86)\\Google\\Update2\\Download\\*" [0086.803] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f5fa0 [0086.803] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Update2\\Download\\*", lpFindFileData=0x53f5fa0 | out: lpFindFileData=0x53f5fa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcda0384e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcda0384e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xdfd42df1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571690 [0086.804] wcscmp (_String1=".", _String2=".") returned 0 [0086.804] FindNextFileW (hFindFile=0xe571690, lpFindFileData=0x53f5fa0) Thread: id = 1468 os_tid = 0x2420 [0086.805] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x38fd5b0 [0086.805] wcscpy (in: _Dest=0x38fd5b0, _Source="C:\\Program Files (x86)\\Google\\Update2\\Install" | out: _Dest="C:\\Program Files (x86)\\Google\\Update2\\Install") returned="C:\\Program Files (x86)\\Google\\Update2\\Install" [0086.805] wcscat (in: _Dest=0x38fd5b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Update2\\Install\\") returned="C:\\Program Files (x86)\\Google\\Update2\\Install\\" [0086.805] wcscat (in: _Dest=0x38fd5b0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\Update2\\Install\\*") returned="C:\\Program Files (x86)\\Google\\Update2\\Install\\*" [0086.805] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f6470 [0086.805] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Update2\\Install\\*", lpFindFileData=0x53f6470 | out: lpFindFileData=0x53f6470*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcda0384e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe0122b4c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe0122b4c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe5716d0 [0086.805] wcscmp (_String1=".", _String2=".") returned 0 [0086.805] FindNextFileW (hFindFile=0xe5716d0, lpFindFileData=0x53f6470) Thread: id = 1469 os_tid = 0x2424 [0086.805] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53fa258 [0086.805] wcscpy (in: _Dest=0x53fa258, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe" [0086.806] wcscat (in: _Dest=0x53fa258, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe\\" [0086.806] wcscat (in: _Dest=0x53fa258, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe\\*" [0086.806] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f6940 [0086.806] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x53f6940 | out: lpFindFileData=0x53f6940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1096e68, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae30dca7, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xae30dca7, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571710 [0086.817] wcscmp (_String1=".", _String2=".") returned 0 [0086.817] FindNextFileW (hFindFile=0xe571710, lpFindFileData=0x53f6940) Thread: id = 1470 os_tid = 0x2428 [0086.818] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53fa320 [0086.818] wcscpy (in: _Dest=0x53fa320, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe" [0086.818] wcscat (in: _Dest=0x53fa320, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe\\" [0086.818] wcscat (in: _Dest=0x53fa320, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe\\*" [0086.818] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f2f80 [0086.818] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x53f2f80 | out: lpFindFileData=0x53f2f80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11c813b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad7e0bf4, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xad7e0bf4, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe570f90 [0086.820] wcscmp (_String1=".", _String2=".") returned 0 [0086.820] FindNextFileW (hFindFile=0xe570f90, lpFindFileData=0x53f2f80) Thread: id = 1471 os_tid = 0x242c [0086.820] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53fa3e8 [0086.820] wcscpy (in: _Dest=0x53fa3e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe" [0086.821] wcscat (in: _Dest=0x53fa3e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe\\" [0086.821] wcscat (in: _Dest=0x53fa3e8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe\\*" [0086.821] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f31e8 [0086.821] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x53f31e8 | out: lpFindFileData=0x53f31e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f6d5e4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad0dfe61, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xad0dfe61, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe570fd0 [0086.822] wcscmp (_String1=".", _String2=".") returned 0 [0086.822] FindNextFileW (hFindFile=0xe570fd0, lpFindFileData=0x53f31e8) Thread: id = 1472 os_tid = 0x2430 [0086.822] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53f9060 [0086.822] wcscpy (in: _Dest=0x53f9060, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe" [0086.822] wcscat (in: _Dest=0x53f9060, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe\\" [0086.822] wcscat (in: _Dest=0x53f9060, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe\\*" [0086.823] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f36b8 [0086.823] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x53f36b8 | out: lpFindFileData=0x53f36b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33fb9a9b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaca2b3ac, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xaca2b3ac, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571010 [0086.824] wcscmp (_String1=".", _String2=".") returned 0 [0086.824] FindNextFileW (hFindFile=0xe571010, lpFindFileData=0x53f36b8) Thread: id = 1473 os_tid = 0x2434 [0086.824] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53f92b8 [0086.824] wcscpy (in: _Dest=0x53f92b8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe" [0086.824] wcscat (in: _Dest=0x53f92b8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\" [0086.825] wcscat (in: _Dest=0x53f92b8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\*" [0086.825] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f3920 [0086.825] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x53f3920 | out: lpFindFileData=0x53f3920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b404f13, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xaee25a0f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c25330e, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571050 [0086.826] wcscmp (_String1=".", _String2=".") returned 0 [0086.826] FindNextFileW (hFindFile=0xe571050, lpFindFileData=0x53f3920) Thread: id = 1474 os_tid = 0x2438 [0086.826] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53f9380 [0086.826] wcscpy (in: _Dest=0x53f9380, _Source="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe" [0086.826] wcscat (in: _Dest=0x53f9380, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\" [0086.827] wcscat (in: _Dest=0x53f9380, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\*" [0086.827] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f3b88 [0086.827] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x53f3b88 | out: lpFindFileData=0x53f3b88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ac94c, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xaef00b37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1dc41199, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571090 [0086.828] wcscmp (_String1=".", _String2=".") returned 0 [0086.828] FindNextFileW (hFindFile=0xe571090, lpFindFileData=0x53f3b88) Thread: id = 1475 os_tid = 0x243c [0086.828] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb6) returned 0x5b15950 [0086.828] wcscpy (in: _Dest=0x5b15950, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe" [0086.828] wcscat (in: _Dest=0x5b15950, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\" [0086.829] wcscat (in: _Dest=0x5b15950, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\*" [0086.829] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f3df0 [0086.829] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x53f3df0 | out: lpFindFileData=0x53f3df0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59460ee7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xd1ed095d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd1ed095d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe5710d0 [0086.829] wcscmp (_String1=".", _String2=".") returned 0 [0086.829] FindNextFileW (hFindFile=0xe5710d0, lpFindFileData=0x53f3df0) Thread: id = 1476 os_tid = 0x2440 [0086.830] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x53f7d60 [0086.830] wcscpy (in: _Dest=0x53f7d60, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe" [0086.830] wcscat (in: _Dest=0x53f7d60, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe\\" [0086.830] wcscat (in: _Dest=0x53f7d60, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe\\*" [0086.830] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f4058 [0086.830] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x53f4058 | out: lpFindFileData=0x53f4058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58fa379e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xd1eaa713, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd1eaa713, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571110 [0086.832] wcscmp (_String1=".", _String2=".") returned 0 [0086.832] FindNextFileW (hFindFile=0xe571110, lpFindFileData=0x53f4058) Thread: id = 1477 os_tid = 0x2444 [0086.832] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x55c80b0 [0086.832] wcscpy (in: _Dest=0x55c80b0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe" [0086.832] wcscat (in: _Dest=0x55c80b0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\" [0086.832] wcscat (in: _Dest=0x55c80b0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\*" [0086.832] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f42c0 [0086.832] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x53f42c0 | out: lpFindFileData=0x53f42c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa599a57e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaf561945, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6e6321cd, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571150 [0086.832] wcscmp (_String1=".", _String2=".") returned 0 [0086.832] FindNextFileW (hFindFile=0xe571150, lpFindFileData=0x53f42c0) Thread: id = 1478 os_tid = 0x2448 [0086.833] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53f9448 [0086.833] wcscpy (in: _Dest=0x53f9448, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe" [0086.833] wcscat (in: _Dest=0x53f9448, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe\\" [0086.833] wcscat (in: _Dest=0x53f9448, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe\\*" [0086.833] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53f4528 [0086.833] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x53f4528 | out: lpFindFileData=0x53f4528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa57d3c26, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xafabb342, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6e60bed5, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe5712d0 [0086.843] wcscmp (_String1=".", _String2=".") returned 0 [0086.843] FindNextFileW (hFindFile=0xe5712d0, lpFindFileData=0x53f4528) Thread: id = 1479 os_tid = 0x244c [0086.834] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x75805d0 [0086.834] wcscpy (in: _Dest=0x75805d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe" [0086.834] wcscat (in: _Dest=0x75805d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0086.834] wcscat (in: _Dest=0x75805d0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe\\*" [0086.834] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b3358 [0086.834] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe\\*", lpFindFileData=0x53b3358 | out: lpFindFileData=0x53b3358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ef508f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xd45db281, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd45db281, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571190 [0086.835] wcscmp (_String1=".", _String2=".") returned 0 [0086.835] FindNextFileW (hFindFile=0xe571190, lpFindFileData=0x53b3358) Thread: id = 1480 os_tid = 0x2450 [0086.835] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb2) returned 0x5b15e90 [0086.835] wcscpy (in: _Dest=0x5b15e90, _Source="C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe" [0086.835] wcscat (in: _Dest=0x5b15e90, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe\\" [0086.835] wcscat (in: _Dest=0x5b15e90, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe\\*" [0086.835] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b35c0 [0086.835] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x53b35c0 | out: lpFindFileData=0x53b35c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f76a4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xd45db281, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd45db281, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571290 [0086.843] wcscmp (_String1=".", _String2=".") returned 0 [0086.843] FindNextFileW (hFindFile=0xe571290, lpFindFileData=0x53b35c0) Thread: id = 1481 os_tid = 0x2454 [0086.838] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa8) returned 0x388f1a0 [0086.838] wcscpy (in: _Dest=0x388f1a0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe" [0086.838] wcscat (in: _Dest=0x388f1a0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\" [0086.838] wcscat (in: _Dest=0x388f1a0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\*" [0086.838] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b3828 [0086.838] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x53b3828 | out: lpFindFileData=0x53b3828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16dc6f6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xd45db281, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd45db281, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571250 [0086.843] wcscmp (_String1=".", _String2=".") returned 0 [0086.843] FindNextFileW (hFindFile=0xe571250, lpFindFileData=0x53b3828) Thread: id = 1482 os_tid = 0x2458 [0086.839] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x53f7e30 [0086.839] wcscpy (in: _Dest=0x53f7e30, _Source="C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe" [0086.839] wcscat (in: _Dest=0x53f7e30, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe\\" [0086.839] wcscat (in: _Dest=0x53f7e30, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe\\*" [0086.839] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b3a90 [0086.839] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe\\*", lpFindFileData=0x53b3a90 | out: lpFindFileData=0x53b3a90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x255053c0, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xd61ded48, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd61ded48, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe5711d0 [0086.840] wcscmp (_String1=".", _String2=".") returned 0 [0086.840] FindNextFileW (hFindFile=0xe5711d0, lpFindFileData=0x53b3a90) Thread: id = 1483 os_tid = 0x245c [0086.841] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa0) returned 0x54a26e8 [0086.841] wcscpy (in: _Dest=0x54a26e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe" [0086.841] wcscat (in: _Dest=0x54a26e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\" [0086.841] wcscat (in: _Dest=0x54a26e8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\*" [0086.841] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b3cf8 [0086.841] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x53b3cf8 | out: lpFindFileData=0x53b3cf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2499f315, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xd61ded48, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd61ded48, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571210 [0086.843] wcscmp (_String1=".", _String2=".") returned 0 [0086.843] FindNextFileW (hFindFile=0xe571210, lpFindFileData=0x53b3cf8) Thread: id = 1484 os_tid = 0x2460 [0086.844] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb0) returned 0x55c82d8 [0086.844] wcscpy (in: _Dest=0x55c82d8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.People_2017.222.1920.0_neutral_~_8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.People_2017.222.1920.0_neutral_~_8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.People_2017.222.1920.0_neutral_~_8wekyb3d8bbwe" [0086.844] wcscat (in: _Dest=0x55c82d8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.People_2017.222.1920.0_neutral_~_8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.People_2017.222.1920.0_neutral_~_8wekyb3d8bbwe\\" [0086.844] wcscat (in: _Dest=0x55c82d8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.People_2017.222.1920.0_neutral_~_8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.People_2017.222.1920.0_neutral_~_8wekyb3d8bbwe\\*" [0086.844] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b3f60 [0086.844] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.People_2017.222.1920.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x53b3f60 | out: lpFindFileData=0x53b3f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x248ba4f4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xd61ded48, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd61ded48, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571310 [0086.846] wcscmp (_String1=".", _String2=".") returned 0 [0086.846] FindNextFileW (hFindFile=0xe571310, lpFindFileData=0x53b3f60) Thread: id = 1485 os_tid = 0x2464 [0086.846] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x53f7f00 [0086.846] wcscpy (in: _Dest=0x53f7f00, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe" [0086.846] wcscat (in: _Dest=0x53f7f00, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\" [0086.847] wcscat (in: _Dest=0x53f7f00, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\*" [0086.847] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b4430 [0086.847] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x53b4430 | out: lpFindFileData=0x53b4430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x367c081d, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xaff5073a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37eb3642, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571350 [0086.850] wcscmp (_String1=".", _String2=".") returned 0 [0086.850] FindNextFileW (hFindFile=0xe571350, lpFindFileData=0x53b4430) Thread: id = 1486 os_tid = 0x2468 [0086.850] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x53f7fd0 [0086.850] wcscpy (in: _Dest=0x53f7fd0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe") returned="C:\\Program Files\\WindowsApps\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe" [0086.850] wcscat (in: _Dest=0x53f7fd0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\" [0086.850] wcscat (in: _Dest=0x53f7fd0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\*" [0086.850] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b4698 [0086.850] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x53b4698 | out: lpFindFileData=0x53b4698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3979638c, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xb00f9315, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a630d34, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571390 [0086.852] wcscmp (_String1=".", _String2=".") returned 0 [0086.852] FindNextFileW (hFindFile=0xe571390, lpFindFileData=0x53b4698) Thread: id = 1487 os_tid = 0x246c [0086.855] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x82) returned 0x549d718 [0086.855] wcscpy (in: _Dest=0x549d718, _Source="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation" [0086.855] wcscat (in: _Dest=0x549d718, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\" [0086.855] wcscat (in: _Dest=0x549d718, _Source="*" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*" [0086.855] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b4900 [0086.855] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*", lpFindFileData=0x53b4900 | out: lpFindFileData=0x53b4900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79312f8, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79312f8, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe5713d0 [0086.855] wcscmp (_String1=".", _String2=".") returned 0 [0086.855] FindNextFileW (hFindFile=0xe5713d0, lpFindFileData=0x53b4900) Thread: id = 1488 os_tid = 0x2470 [0086.855] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x84) returned 0x549d838 [0086.855] wcscpy (in: _Dest=0x549d838, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework" [0086.855] wcscat (in: _Dest=0x549d838, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\" [0086.855] wcscat (in: _Dest=0x549d838, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\*") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\*" [0086.855] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b4b68 [0086.855] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\*", lpFindFileData=0x53b4b68 | out: lpFindFileData=0x53b4b68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a165b3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a8888e, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a8888e, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571410 [0086.856] wcscmp (_String1=".", _String2=".") returned 0 [0086.856] FindNextFileW (hFindFile=0xe571410, lpFindFileData=0x53b4b68) Thread: id = 1489 os_tid = 0x2474 [0086.856] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x54) returned 0x7583f20 [0086.856] wcscpy (in: _Dest=0x7583f20, _Source="C:\\Users\\Default.migrated\\AppData\\Local" | out: _Dest="C:\\Users\\Default.migrated\\AppData\\Local") returned="C:\\Users\\Default.migrated\\AppData\\Local" [0086.856] wcscat (in: _Dest=0x7583f20, _Source="\\" | out: _Dest="C:\\Users\\Default.migrated\\AppData\\Local\\") returned="C:\\Users\\Default.migrated\\AppData\\Local\\" [0086.856] wcscat (in: _Dest=0x7583f20, _Source="*" | out: _Dest="C:\\Users\\Default.migrated\\AppData\\Local\\*") returned="C:\\Users\\Default.migrated\\AppData\\Local\\*" [0086.856] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b4dd0 [0086.856] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\Local\\*", lpFindFileData=0x53b4dd0 | out: lpFindFileData=0x53b4dd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571450 [0086.857] wcscmp (_String1=".", _String2=".") returned 0 [0086.857] FindNextFileW (hFindFile=0xe571450, lpFindFileData=0x53b4dd0) Thread: id = 1490 os_tid = 0x2478 [0086.857] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0086.857] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.857] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.857] GetLastError () returned 0x5 [0086.857] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.858] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b8af8) Thread: id = 1491 os_tid = 0x247c [0086.858] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0086.859] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0086.859] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.859] GetLastError () returned 0x5 [0086.859] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0086.859] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75816b8) returned 1 Thread: id = 1492 os_tid = 0x2480 [0086.860] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0086.860] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0086.860] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.860] GetLastError () returned 0x5 [0086.861] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0086.861] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75814a8) returned 1 Thread: id = 1493 os_tid = 0x2484 [0086.862] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0086.862] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.862] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.862] GetLastError () returned 0x5 [0086.862] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", dwFileAttributes=0x20) returned 0 [0086.862] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3970c80) returned 1 Thread: id = 1494 os_tid = 0x2488 [0086.863] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0086.864] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0086.864] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.864] GetLastError () returned 0x5 [0086.864] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", dwFileAttributes=0x20) returned 0 [0086.864] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55fd468) returned 1 Thread: id = 1495 os_tid = 0x248c [0086.865] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x53f9510 [0086.865] wcscpy (in: _Dest=0x53f9510, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\AppxMetadata" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\AppxMetadata" [0086.865] wcscat (in: _Dest=0x53f9510, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\AppxMetadata\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\AppxMetadata\\" [0086.865] wcscat (in: _Dest=0x53f9510, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*" [0086.865] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b5038 [0086.865] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x53b5038 | out: lpFindFileData=0x53b5038*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1801155, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadeaa4f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa18273b3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571490 [0086.865] wcscmp (_String1=".", _String2=".") returned 0 [0086.865] FindNextFileW (hFindFile=0xe571490, lpFindFileData=0x53b5038) Thread: id = 1496 os_tid = 0x2490 [0086.866] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0086.867] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0086.867] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.867] GetLastError () returned 0x5 [0086.867] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", dwFileAttributes=0x20) returned 0 [0086.867] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55fe648) returned 1 Thread: id = 1497 os_tid = 0x2494 [0086.868] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb4) returned 0x5b16190 [0086.868] wcscpy (in: _Dest=0x5b16190, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\Assets" [0086.868] wcscat (in: _Dest=0x5b16190, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\Assets\\" [0086.868] wcscat (in: _Dest=0x5b16190, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\Assets\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\Assets\\*" [0086.868] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b52a0 [0086.868] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x53b52a0 | out: lpFindFileData=0x53b52a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa18273b3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadeab676, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2f98f1f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe5714d0 [0086.869] wcscmp (_String1=".", _String2=".") returned 0 [0086.869] FindNextFileW (hFindFile=0xe5714d0, lpFindFileData=0x53b52a0) Thread: id = 1498 os_tid = 0x2498 [0086.869] GetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\CampaignCatalog.json" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigncatalog.json")) returned 0x20 [0086.869] SetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\CampaignCatalog.json", dwFileAttributes=0x20) returned 1 [0086.870] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\CampaignCatalog.json" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigncatalog.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x560 [0086.870] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x3467fc74 | out: lpFileSize=0x3467fc74*=38) returned 1 [0086.870] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813e0 [0086.870] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72820b0 [0086.870] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282100 [0086.870] NtQuerySystemTime (in: CurrentTime=0x3467fbd4 | out: CurrentTime=0x3467fbd4*=132260136440330014) returned 0x0 [0086.870] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0x44685f41 [0086.870] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0xa717a93f [0086.870] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0x7fb3d211 [0086.870] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0x809ef8b3 [0086.870] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0xf19969f3 [0086.870] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0x12ef7d2c [0086.870] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0x42862ed0 [0086.870] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0xdc726d14 [0086.870] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0xbe93e0b8 [0086.870] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0x957a4011 [0086.870] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0xa1f14d72 [0086.870] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0x88f8dc9c [0086.870] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0xf7abba00 [0086.870] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0x1446dd68 [0086.870] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0x6e86d385 [0086.870] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0x24d0fb92 [0086.870] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0x50474d7 [0086.870] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0xaac55a4b [0086.870] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0x289a5bd2 [0086.870] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0x1ddc40cf [0086.870] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0x92233b4 [0086.870] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0x803a54a1 [0086.870] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0xd6d1b995 [0086.870] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0x4ce93fb2 [0086.870] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0x800d479a [0086.870] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0xda41678d [0086.870] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0x8ff78064 [0086.870] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0xe536be7b [0086.870] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0xfa2a8121 [0086.870] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0x48b97936 [0086.870] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0x97433032 [0086.871] RtlRandom (in: Seed=0x3467fbe0 | out: Seed=0x3467fbe0) returned 0x517b58fc Thread: id = 1499 os_tid = 0x249c [0086.880] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x396e610 [0086.880] wcscpy (in: _Dest=0x396e610, _Source="C:\\Program Files\\UNP\\CampaignManager\\Campaigns" | out: _Dest="C:\\Program Files\\UNP\\CampaignManager\\Campaigns") returned="C:\\Program Files\\UNP\\CampaignManager\\Campaigns" [0086.880] wcscat (in: _Dest=0x396e610, _Source="\\" | out: _Dest="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\") returned="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\" [0086.880] wcscat (in: _Dest=0x396e610, _Source="*" | out: _Dest="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\*") returned="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\*" [0086.880] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b5508 [0086.880] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\*", lpFindFileData=0x53b5508 | out: lpFindFileData=0x53b5508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa74805fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571510 [0086.880] wcscmp (_String1=".", _String2=".") returned 0 [0086.880] FindNextFileW (hFindFile=0xe571510, lpFindFileData=0x53b5508) Thread: id = 1500 os_tid = 0x24a0 [0086.880] GetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.001.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.001.etl")) returned 0x2000 [0086.881] SetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.001.etl", dwFileAttributes=0x20) returned 1 [0086.881] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.001.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.001.etl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0086.881] GetLastError () returned 0x20 [0086.881] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8) returned 0x38a3d90 [0086.881] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0086.881] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a3d90) returned 1 [0086.881] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8) returned 0x38a3df0 [0086.881] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x80) returned 0x39776e8 [0086.881] wcscpy (in: _Dest=0x39776e8, _Source="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.001.etl" | out: _Dest="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.001.etl") returned="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.001.etl" [0086.881] SetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.001.etl", dwFileAttributes=0x2000) returned 1 [0086.882] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54097a8) returned 1 Thread: id = 1501 os_tid = 0x24a4 [0086.883] GetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.002.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.002.etl")) returned 0x2020 [0086.883] SetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.002.etl", dwFileAttributes=0x20) returned 1 [0092.707] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.002.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.002.etl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x994 [0092.707] GetFileSizeEx (in: hFile=0x994, lpFileSize=0x347ffca0 | out: lpFileSize=0x347ffca0*=131072) returned 1 [0092.707] SetFilePointerEx (in: hFile=0x994, liDistanceToMove=0x1fffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.707] ReadFile (in: hFile=0x994, lpBuffer=0x347ffc24, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x347ffc20, lpOverlapped=0x0 | out: lpBuffer=0x347ffc24*, lpNumberOfBytesRead=0x347ffc20*=0x4, lpOverlapped=0x0) returned 1 [0092.708] SetFilePointerEx (in: hFile=0x994, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.708] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0661d8 [0092.708] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066890 [0092.708] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0669f8 [0092.708] NtQuerySystemTime (in: CurrentTime=0x347ffc00 | out: CurrentTime=0x347ffc00*=132260136498619488) returned 0x0 [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0x4d68797f [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0xbaab6213 [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0x82a19225 [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0xe0d452a2 [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0xd943a589 [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0xa30a70bf [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0x74bedfb4 [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0x94692df7 [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0x206432cb [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0xe0987b0 [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0xb68f5dd2 [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0xc3737629 [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0x871ff076 [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0x80f3da3f [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0x799a7849 [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0xfa51fde9 [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0xeab5b9a7 [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0xacc99a8c [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0xbe222bd4 [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0xe6a9b45e [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0x737af30d [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0xaba34878 [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0xf1f5aaa5 [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0x7912e713 [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0x4e841d7f [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0x38230108 [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0xea8abd29 [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0x238ac4c2 [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0x1a501da4 [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0xe2a5950f [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0xb6898cf [0092.709] RtlRandom (in: Seed=0x347ffc0c | out: Seed=0x347ffc0c) returned 0x28d494dc Thread: id = 1502 os_tid = 0x24a8 [0086.884] GetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.003.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.003.etl")) returned 0x2020 [0086.884] SetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.003.etl", dwFileAttributes=0x20) returned 1 [0092.683] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.003.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.003.etl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x159c [0092.694] GetFileSizeEx (in: hFile=0x159c, lpFileSize=0x3487fa20 | out: lpFileSize=0x3487fa20*=131072) returned 1 [0092.694] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x1fffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.694] ReadFile (in: hFile=0x159c, lpBuffer=0x3487f9a4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3487f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3487f9a4*, lpNumberOfBytesRead=0x3487f9a0*=0x4, lpOverlapped=0x0) returned 1 [0092.697] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.697] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0661d8 [0092.697] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066868 [0092.697] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0669f8 [0092.697] NtQuerySystemTime (in: CurrentTime=0x3487f980 | out: CurrentTime=0x3487f980*=132260136498619488) returned 0x0 [0092.697] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0x8972a93 [0092.697] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0xcf7bb276 [0092.697] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0xc130f821 [0092.697] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0xa6ca80ac [0092.697] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0x81b3ac55 [0092.697] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0x3df18bee [0092.697] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0xf799f822 [0092.697] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0x9fffe6d1 [0092.697] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0x734fb772 [0092.697] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0x54240ddb [0092.697] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0xdf12fe0 [0092.697] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0x8a964848 [0092.697] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0x3acdc1c5 [0092.697] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0xf85d70b3 [0092.697] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0x950f9d8c [0092.697] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0x30339c0f [0092.697] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0x2f697e1a [0092.697] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0xaa81e1cf [0092.697] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0x45c3aacb [0092.697] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0xcb8c38df [0092.697] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0xfc81c012 [0092.697] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0xa988727b [0092.697] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0x2b8cf1fe [0092.698] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0xbbc19d3d [0092.698] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0x513bcfe3 [0092.698] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0xdf552ce2 [0092.698] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0x6cccf75 [0092.698] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0xde695c52 [0092.698] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0x5d4f1408 [0092.698] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0xc5112e7b [0092.698] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0x993528eb [0092.698] RtlRandom (in: Seed=0x3487f98c | out: Seed=0x3487f98c) returned 0x9fa37acb Thread: id = 1503 os_tid = 0x24ac [0086.885] GetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.004.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.004.etl")) returned 0x2020 [0086.885] SetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.004.etl", dwFileAttributes=0x20) returned 1 [0092.672] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.004.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.004.etl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1590 [0092.682] GetFileSizeEx (in: hFile=0x1590, lpFileSize=0x348ffc04 | out: lpFileSize=0x348ffc04*=131072) returned 1 [0092.682] SetFilePointerEx (in: hFile=0x1590, liDistanceToMove=0x1fffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.682] ReadFile (in: hFile=0x1590, lpBuffer=0x348ffb88, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x348ffb84, lpOverlapped=0x0 | out: lpBuffer=0x348ffb88*, lpNumberOfBytesRead=0x348ffb84*=0x4, lpOverlapped=0x0) returned 1 [0092.684] SetFilePointerEx (in: hFile=0x1590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.684] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0661d8 [0092.684] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066840 [0092.684] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0669f8 [0092.684] NtQuerySystemTime (in: CurrentTime=0x348ffb64 | out: CurrentTime=0x348ffb64*=132260136498464314) returned 0x0 [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0x2ae5fd88 [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0x522fc1f9 [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0x33f89e89 [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0xa7be236a [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0x8c596fa4 [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0x1c2a24a7 [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0xbf4695b2 [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0x6dd52b92 [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0xd08f00f7 [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0x6be1e4a9 [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0x6ccb61f6 [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0xfd17ebb0 [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0x84bfc96b [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0xb1ddbb65 [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0xb9ec8204 [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0x3eaa8dce [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0xd7e5f970 [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0x633a1723 [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0x9402437a [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0x43822d84 [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0x22126ea2 [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0xc9c7ff17 [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0x8bf32f4f [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0xf8b18d26 [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0xb6f1707f [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0x5442ae1e [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0x853198a3 [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0x7d913a83 [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0x4df463f3 [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0xa435de57 [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0x2aa3ed92 [0092.684] RtlRandom (in: Seed=0x348ffb70 | out: Seed=0x348ffb70) returned 0x66d4ec8a Thread: id = 1504 os_tid = 0x24b0 [0086.885] GetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.005.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.005.etl")) returned 0x2020 [0086.885] SetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.005.etl", dwFileAttributes=0x20) returned 1 [0092.660] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.005.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.005.etl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x418 [0092.660] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x3497fd7c | out: lpFileSize=0x3497fd7c*=131072) returned 1 [0092.660] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x1fffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.660] ReadFile (in: hFile=0x418, lpBuffer=0x3497fd00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3497fcfc, lpOverlapped=0x0 | out: lpBuffer=0x3497fd00*, lpNumberOfBytesRead=0x3497fcfc*=0x4, lpOverlapped=0x0) returned 1 [0092.672] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.672] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0661d8 [0092.672] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0662f0 [0092.672] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0669f8 [0092.672] NtQuerySystemTime (in: CurrentTime=0x3497fcdc | out: CurrentTime=0x3497fcdc*=132260136498307263) returned 0x0 [0092.672] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0x1ce68b9c [0092.672] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0x531a3878 [0092.672] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0x2b813b79 [0092.672] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0x4d2c1f21 [0092.672] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0x636ddb06 [0092.672] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0x404fe8f5 [0092.672] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0x1248c8b1 [0092.672] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0xa5fedada [0092.672] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0xae92aea8 [0092.672] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0x9166c4a9 [0092.673] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0xa20e388 [0092.673] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0xaa835e34 [0092.673] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0x5ccda6d6 [0092.673] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0xade22144 [0092.673] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0x96c13cc2 [0092.673] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0x5edefcbc [0092.673] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0xc7f819dd [0092.673] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0x57893cab [0092.673] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0xd4f418e2 [0092.673] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0xd72400d0 [0092.673] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0x8c638ee0 [0092.673] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0xccea0234 [0092.673] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0x3a23889f [0092.673] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0x5f2df8da [0092.673] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0x1edaaaeb [0092.673] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0xf32cd4f0 [0092.673] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0x380dfa9e [0092.673] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0xfab49fe [0092.673] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0x971351be [0092.673] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0x876e76ad [0092.673] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0xde094be5 [0092.673] RtlRandom (in: Seed=0x3497fce8 | out: Seed=0x3497fce8) returned 0x3f2b1e76 Thread: id = 1505 os_tid = 0x24b4 [0086.886] GetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.006.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.006.etl")) returned 0x2020 [0086.886] SetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.006.etl", dwFileAttributes=0x20) returned 1 [0092.658] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.006.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.006.etl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x209c [0092.659] GetFileSizeEx (in: hFile=0x209c, lpFileSize=0x349ff740 | out: lpFileSize=0x349ff740*=131072) returned 1 [0092.659] SetFilePointerEx (in: hFile=0x209c, liDistanceToMove=0x1fffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.659] ReadFile (in: hFile=0x209c, lpBuffer=0x349ff6c4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x349ff6c0, lpOverlapped=0x0 | out: lpBuffer=0x349ff6c4*, lpNumberOfBytesRead=0x349ff6c0*=0x4, lpOverlapped=0x0) returned 1 [0092.661] SetFilePointerEx (in: hFile=0x209c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.661] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0661d8 [0092.661] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066278 [0092.661] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0662f0 [0092.661] NtQuerySystemTime (in: CurrentTime=0x349ff6a0 | out: CurrentTime=0x349ff6a0*=132260136498150831) returned 0x0 [0092.661] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0x1abb88ef [0092.661] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0xb46fc0a [0092.661] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0x91831de3 [0092.661] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0xe15b901b [0092.661] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0x44efe2c1 [0092.661] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0xdaebce10 [0092.661] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0x444cf36c [0092.661] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0x76ed41c4 [0092.661] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0xd160e17c [0092.661] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0x39d55ebf [0092.661] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0xc1853d01 [0092.661] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0x337f8cfe [0092.661] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0x954f5c83 [0092.661] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0xbcfb0c0f [0092.661] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0xc1458fa8 [0092.661] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0xa0c1097 [0092.661] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0x7b409593 [0092.661] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0x75f0f608 [0092.661] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0x68dbd44c [0092.662] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0xae74cf4c [0092.662] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0x2e2d9fae [0092.662] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0x692513e1 [0092.662] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0x7711881c [0092.662] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0xddee09cc [0092.662] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0x4aeb7ca7 [0092.662] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0x3cb1c057 [0092.662] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0x8a0168ae [0092.662] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0xf036115c [0092.662] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0xa4e43719 [0092.662] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0x691b4196 [0092.662] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0x2da5528 [0092.662] RtlRandom (in: Seed=0x349ff6ac | out: Seed=0x349ff6ac) returned 0x60752c09 Thread: id = 1506 os_tid = 0x24b8 [0086.887] GetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.007.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.007.etl")) returned 0x2020 [0086.887] SetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.007.etl", dwFileAttributes=0x20) returned 1 [0092.636] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.007.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.007.etl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x98c [0092.647] GetFileSizeEx (in: hFile=0x98c, lpFileSize=0x34a7fbd4 | out: lpFileSize=0x34a7fbd4*=131072) returned 1 [0092.647] SetFilePointerEx (in: hFile=0x98c, liDistanceToMove=0x1fffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.647] ReadFile (in: hFile=0x98c, lpBuffer=0x34a7fb58, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x34a7fb54, lpOverlapped=0x0 | out: lpBuffer=0x34a7fb58*, lpNumberOfBytesRead=0x34a7fb54*=0x4, lpOverlapped=0x0) returned 1 [0092.648] SetFilePointerEx (in: hFile=0x98c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.648] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0661d8 [0092.648] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066200 [0092.648] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066278 [0092.648] NtQuerySystemTime (in: CurrentTime=0x34a7fb34 | out: CurrentTime=0x34a7fb34*=132260136497994721) returned 0x0 [0092.648] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0xf53710f9 [0092.648] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0x4bd40d74 [0092.648] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0x6c557ad [0092.648] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0x1487cd57 [0092.648] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0x6f40f878 [0092.648] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0x70efa3f9 [0092.648] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0x950bcd78 [0092.648] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0xf191713b [0092.648] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0x9fe362a8 [0092.648] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0x9f6789c5 [0092.648] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0x6a40a81f [0092.648] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0x3f07df24 [0092.648] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0x24282faf [0092.649] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0xe857efc2 [0092.649] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0xa75f8463 [0092.649] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0x89fe0a68 [0092.649] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0xeca3452 [0092.649] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0xb8b539ac [0092.649] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0x85340af3 [0092.649] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0x858fdb1 [0092.649] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0xfc081d67 [0092.649] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0x6301bfb2 [0092.649] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0x9ff3d5c0 [0092.649] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0xbe01ab79 [0092.649] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0xc4bcce40 [0092.649] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0xb9b904e7 [0092.649] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0x22c0afa6 [0092.649] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0x8190a887 [0092.649] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0x37a6e33e [0092.649] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0x153e876e [0092.649] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0xcc38dffa [0092.649] RtlRandom (in: Seed=0x34a7fb40 | out: Seed=0x34a7fb40) returned 0x12134c3e Thread: id = 1507 os_tid = 0x24bc [0086.887] GetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.008.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.008.etl")) returned 0x2020 [0086.888] SetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.008.etl", dwFileAttributes=0x20) returned 1 [0092.623] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.008.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.008.etl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17b4 [0092.634] GetFileSizeEx (in: hFile=0x17b4, lpFileSize=0x34aff7e4 | out: lpFileSize=0x34aff7e4*=131072) returned 1 [0092.635] SetFilePointerEx (in: hFile=0x17b4, liDistanceToMove=0x1fffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.635] ReadFile (in: hFile=0x17b4, lpBuffer=0x34aff768, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x34aff764, lpOverlapped=0x0 | out: lpBuffer=0x34aff768*, lpNumberOfBytesRead=0x34aff764*=0x4, lpOverlapped=0x0) returned 1 [0092.637] SetFilePointerEx (in: hFile=0x17b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.637] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0661d8 [0092.637] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0664f8 [0092.637] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066200 [0092.637] NtQuerySystemTime (in: CurrentTime=0x34aff744 | out: CurrentTime=0x34aff744*=132260136497994721) returned 0x0 [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0xaca2a83f [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0x31ae8ae7 [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0x99baa52b [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0x3af080bf [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0xf0895b01 [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0xf4ef584a [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0x40f4ce96 [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0x7d81ad4a [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0x77edf05d [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0xa64a5813 [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0xe62f1ec0 [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0xfb71099d [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0x620ce54a [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0xf0aff19f [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0x5a4119f3 [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0x7b3c1d88 [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0x3daa8867 [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0x89a8d7b3 [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0x3a6ca77b [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0x5112bc04 [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0xc528a5b2 [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0x884261 [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0xc76c776c [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0x906b3f78 [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0x437052a3 [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0x9d42eab3 [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0xbe058e95 [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0x8c5784d9 [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0xce7ba82a [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0xae9b11aa [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0x6670ae46 [0092.637] RtlRandom (in: Seed=0x34aff750 | out: Seed=0x34aff750) returned 0xff03d486 Thread: id = 1508 os_tid = 0x24c0 [0086.888] GetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.009.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.009.etl")) returned 0x2020 [0086.888] SetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.009.etl", dwFileAttributes=0x20) returned 1 [0092.611] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.009.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.009.etl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x9b4 [0092.622] GetFileSizeEx (in: hFile=0x9b4, lpFileSize=0x34b7fe20 | out: lpFileSize=0x34b7fe20*=131072) returned 1 [0092.622] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0x1fffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.622] ReadFile (in: hFile=0x9b4, lpBuffer=0x34b7fda4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x34b7fda0, lpOverlapped=0x0 | out: lpBuffer=0x34b7fda4*, lpNumberOfBytesRead=0x34b7fda0*=0x4, lpOverlapped=0x0) returned 1 [0092.624] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.624] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0661d8 [0092.624] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066430 [0092.624] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0664f8 [0092.624] NtQuerySystemTime (in: CurrentTime=0x34b7fd80 | out: CurrentTime=0x34b7fd80*=132260136497838932) returned 0x0 [0092.624] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0x48f8d7b [0092.624] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0x67b3c4b0 [0092.624] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0x553dab01 [0092.624] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0xe2428a9 [0092.624] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0x7d1ec1d9 [0092.624] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0x9dc6e357 [0092.624] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0x3f44179b [0092.624] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0xfd7580dd [0092.624] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0xec68ce61 [0092.624] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0x10ec5a2d [0092.624] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0x4ad6f676 [0092.624] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0x6930ff85 [0092.624] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0x32e0f17b [0092.624] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0x1c2950bb [0092.624] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0x8c2197f4 [0092.624] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0x2589cb4a [0092.624] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0x301a3096 [0092.624] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0x18b163a3 [0092.624] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0x96ca9dbc [0092.624] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0x78429676 [0092.624] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0x3487450 [0092.624] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0x3566d395 [0092.624] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0x9b5895a3 [0092.624] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0x9553cd41 [0092.624] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0x9f27a636 [0092.624] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0x5c61c91b [0092.624] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0x2c1c0e7 [0092.624] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0xf35e8964 [0092.625] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0xf05cac7a [0092.625] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0x16ec93b1 [0092.625] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0x186cc61a [0092.625] RtlRandom (in: Seed=0x34b7fd8c | out: Seed=0x34b7fd8c) returned 0x611d70c2 Thread: id = 1509 os_tid = 0x24c4 [0086.889] GetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.010.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.010.etl")) returned 0x2020 [0086.889] SetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.010.etl", dwFileAttributes=0x20) returned 1 [0092.599] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.010.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.010.etl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15b4 [0092.610] GetFileSizeEx (in: hFile=0x15b4, lpFileSize=0x34bffec8 | out: lpFileSize=0x34bffec8*=131072) returned 1 [0092.610] SetFilePointerEx (in: hFile=0x15b4, liDistanceToMove=0x1fffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.610] ReadFile (in: hFile=0x15b4, lpBuffer=0x34bffe4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x34bffe48, lpOverlapped=0x0 | out: lpBuffer=0x34bffe4c*, lpNumberOfBytesRead=0x34bffe48*=0x4, lpOverlapped=0x0) returned 1 [0092.611] SetFilePointerEx (in: hFile=0x15b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.611] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0661d8 [0092.611] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066408 [0092.611] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0664f8 [0092.612] NtQuerySystemTime (in: CurrentTime=0x34bffe28 | out: CurrentTime=0x34bffe28*=132260136497682661) returned 0x0 [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0x81e8e4a5 [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0x38dcd522 [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0xffe1283a [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0x4889afad [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0x92fc0918 [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0x61d2f474 [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0x3ad92a95 [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0x8652e5d1 [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0x741e86f4 [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0x7de1312d [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0x7d9b9152 [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0x7b13e4b7 [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0xe972b379 [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0xf9d1e86 [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0xb8f8824b [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0xde1b38c [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0x4c4c18e4 [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0x8eda0a7d [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0x9977beac [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0xd95cf01 [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0x7cc8a07c [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0x6d44f2af [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0xe306302c [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0x6df0004b [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0xb94018e3 [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0x8c15856b [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0xce054e3d [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0x4a21f8b6 [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0xb8f45404 [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0x88bbc3d8 [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0xb391a7fd [0092.612] RtlRandom (in: Seed=0x34bffe34 | out: Seed=0x34bffe34) returned 0xad03ce53 Thread: id = 1510 os_tid = 0x24c8 [0086.890] GetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.021.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.021.etl")) returned 0x2020 [0086.890] SetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.021.etl", dwFileAttributes=0x20) returned 1 [0092.588] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.021.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.021.etl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15b0 [0092.598] GetFileSizeEx (in: hFile=0x15b0, lpFileSize=0x34c7f86c | out: lpFileSize=0x34c7f86c*=131072) returned 1 [0092.598] SetFilePointerEx (in: hFile=0x15b0, liDistanceToMove=0x1fffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.598] ReadFile (in: hFile=0x15b0, lpBuffer=0x34c7f7f0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x34c7f7ec, lpOverlapped=0x0 | out: lpBuffer=0x34c7f7f0*, lpNumberOfBytesRead=0x34c7f7ec*=0x4, lpOverlapped=0x0) returned 1 [0092.599] SetFilePointerEx (in: hFile=0x15b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.599] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0661d8 [0092.600] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0663e0 [0092.600] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0664f8 [0092.600] NtQuerySystemTime (in: CurrentTime=0x34c7f7cc | out: CurrentTime=0x34c7f7cc*=132260136497525996) returned 0x0 [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0x4e946898 [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0x502ef92e [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0x213280ac [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0x1fcfbb3b [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0xcb26666e [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0x4dbf2204 [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0x4f9384aa [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0x836257f4 [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0xfbb09845 [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0xdfa526d2 [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0x5fbd9581 [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0x8f93bd78 [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0xa92fb7f3 [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0x92bd975a [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0xcc90203d [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0x5a583acc [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0x842e56df [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0x7265c3fa [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0x5b67ca4 [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0xeb970b6b [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0x44bfe131 [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0x7db7f64b [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0xdb2b368 [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0x2ef33e26 [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0x5ff97c4c [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0xe3e02bd7 [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0x5ff49ab0 [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0xf0e9a463 [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0xccffe2d1 [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0xa1e8cdab [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0xf02a7467 [0092.600] RtlRandom (in: Seed=0x34c7f7d8 | out: Seed=0x34c7f7d8) returned 0xe230afdf Thread: id = 1511 os_tid = 0x24cc [0086.890] GetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.022.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.022.etl")) returned 0x2020 [0086.891] SetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.022.etl", dwFileAttributes=0x20) returned 1 [0092.576] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.022.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.022.etl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x9b0 [0092.586] GetFileSizeEx (in: hFile=0x9b0, lpFileSize=0x34cff9a4 | out: lpFileSize=0x34cff9a4*=131072) returned 1 [0092.586] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0x1fffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.586] ReadFile (in: hFile=0x9b0, lpBuffer=0x34cff928, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x34cff924, lpOverlapped=0x0 | out: lpBuffer=0x34cff928*, lpNumberOfBytesRead=0x34cff924*=0x4, lpOverlapped=0x0) returned 1 [0092.588] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.588] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0661d8 [0092.588] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0663b8 [0092.588] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0664f8 [0092.588] NtQuerySystemTime (in: CurrentTime=0x34cff904 | out: CurrentTime=0x34cff904*=132260136497525996) returned 0x0 [0092.588] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0xe2a832ab [0092.588] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0x412881a1 [0092.588] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0xb060714b [0092.588] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0x406330e9 [0092.588] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0x28184323 [0092.588] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0x81279f95 [0092.588] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0xc8c48b72 [0092.588] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0x1df68927 [0092.588] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0x7d22eacc [0092.588] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0x15b7da09 [0092.588] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0x300d2d72 [0092.588] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0x5169808e [0092.588] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0xfd6a33f3 [0092.588] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0x6e1b5c82 [0092.588] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0xb96b4c3f [0092.588] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0xb851f6f4 [0092.588] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0x6880bc83 [0092.588] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0x348ab8ef [0092.589] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0x4d21c5e8 [0092.589] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0x72404f1b [0092.589] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0x1a5e7ae7 [0092.589] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0x2276d1f3 [0092.589] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0xe6d6514b [0092.589] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0x24f05cd [0092.589] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0x199e86d8 [0092.589] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0x5bbd416f [0092.589] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0x188afed3 [0092.589] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0xd4e7b121 [0092.589] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0x504e7703 [0092.589] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0x8923f6c4 [0092.589] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0x24c94c8a [0092.589] RtlRandom (in: Seed=0x34cff910 | out: Seed=0x34cff910) returned 0xf833f927 Thread: id = 1512 os_tid = 0x24d0 [0086.891] GetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.029.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.029.etl")) returned 0x2020 [0086.891] SetFileAttributesW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.029.etl", dwFileAttributes=0x20) returned 1 [0092.574] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.029.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.029.etl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17b0 [0092.575] GetFileSizeEx (in: hFile=0x17b0, lpFileSize=0x34d7f824 | out: lpFileSize=0x34d7f824*=262144) returned 1 [0092.575] SetFilePointerEx (in: hFile=0x17b0, liDistanceToMove=0x3fffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.575] ReadFile (in: hFile=0x17b0, lpBuffer=0x34d7f7a8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x34d7f7a4, lpOverlapped=0x0 | out: lpBuffer=0x34d7f7a8*, lpNumberOfBytesRead=0x34d7f7a4*=0x4, lpOverlapped=0x0) returned 1 [0092.576] SetFilePointerEx (in: hFile=0x17b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.576] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0661d8 [0092.576] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066390 [0092.576] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0664f8 [0092.576] NtQuerySystemTime (in: CurrentTime=0x34d7f784 | out: CurrentTime=0x34d7f784*=132260136497369533) returned 0x0 [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0xc422eb8d [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0xda5a1eaa [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0x3be1cf68 [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0x71ed633a [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0xc658c6cb [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0xaddde8e8 [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0xa6764f [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0xc1467787 [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0x72accb89 [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0x25b26ce6 [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0xc9b3464 [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0xb1d02e07 [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0xb1bf0f1 [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0x7430f3f9 [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0x6b6d035a [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0xa2e09490 [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0x329b28a3 [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0xa0222042 [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0x15116ca3 [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0xff05d815 [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0xeeec640 [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0xf8e85ff5 [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0xefcd4ea5 [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0x840d0098 [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0xa90bd7f1 [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0x30e5a42e [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0xa5904664 [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0xea58765e [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0x42b5fea8 [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0xd23561c7 [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0x2d9a130f [0092.577] RtlRandom (in: Seed=0x34d7f790 | out: Seed=0x34d7f790) returned 0xe8abb1e1 Thread: id = 1513 os_tid = 0x24d4 [0086.892] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x60) returned 0x541ab30 [0086.892] wcscpy (in: _Dest=0x541ab30, _Source="C:\\Program Files\\Microsoft Office\\root\\client" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\client") returned="C:\\Program Files\\Microsoft Office\\root\\client" [0086.892] wcscat (in: _Dest=0x541ab30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\client\\") returned="C:\\Program Files\\Microsoft Office\\root\\client\\" [0086.892] wcscat (in: _Dest=0x541ab30, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\client\\*") returned="C:\\Program Files\\Microsoft Office\\root\\client\\*" [0086.892] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b1b48 [0086.892] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\*", lpFindFileData=0x53b1b48 | out: lpFindFileData=0x53b1b48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86813dc4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2ca2e08, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2ca2e08, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571550 [0086.894] wcscmp (_String1=".", _String2=".") returned 0 [0086.894] FindNextFileW (hFindFile=0xe571550, lpFindFileData=0x53b1b48) Thread: id = 1514 os_tid = 0x24d8 [0086.894] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x62) returned 0x396e530 [0086.894] wcscpy (in: _Dest=0x396e530, _Source="C:\\Program Files\\Microsoft Office\\root\\CLIPART" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\CLIPART") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART" [0086.894] wcscat (in: _Dest=0x396e530, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\" [0086.894] wcscat (in: _Dest=0x396e530, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\*") returned="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\*" [0086.894] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b1db0 [0086.894] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\*", lpFindFileData=0x53b1db0 | out: lpFindFileData=0x53b1db0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe571590 [0086.895] wcscmp (_String1=".", _String2=".") returned 0 [0086.895] FindNextFileW (hFindFile=0xe571590, lpFindFileData=0x53b1db0) Thread: id = 1515 os_tid = 0x24dc [0086.896] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x78) returned 0x38d2120 [0086.896] wcscpy (in: _Dest=0x38d2120, _Source="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16" [0086.896] wcscat (in: _Dest=0x38d2120, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\" [0086.896] wcscat (in: _Dest=0x38d2120, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\*") returned="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\*" [0086.896] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b2280 [0086.896] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\*", lpFindFileData=0x53b2280 | out: lpFindFileData=0x53b2280*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe570dd0 [0086.898] wcscmp (_String1=".", _String2=".") returned 0 [0086.898] FindNextFileW (hFindFile=0xe570dd0, lpFindFileData=0x53b2280) Thread: id = 1516 os_tid = 0x24e0 [0086.899] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) returned 0x396d960 [0086.899] wcscpy (in: _Dest=0x396d960, _Source="C:\\Program Files\\Microsoft Office\\root\\Flattener" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\Flattener") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener" [0086.899] wcscat (in: _Dest=0x396d960, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\Flattener\\") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\" [0086.899] wcscat (in: _Dest=0x396d960, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\Flattener\\*") returned="C:\\Program Files\\Microsoft Office\\root\\Flattener\\*" [0086.899] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b2750 [0086.899] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\*", lpFindFileData=0x53b2750 | out: lpFindFileData=0x53b2750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114f5747, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114f5747, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe570e10 [0086.903] wcscmp (_String1=".", _String2=".") returned 0 [0086.903] FindNextFileW (hFindFile=0xe570e10, lpFindFileData=0x53b2750) Thread: id = 1517 os_tid = 0x24e4 [0086.904] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0xe53a060 [0086.904] wcscpy (in: _Dest=0xe53a060, _Source="C:\\Program Files\\Microsoft Office\\root\\fre" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\fre") returned="C:\\Program Files\\Microsoft Office\\root\\fre" [0086.904] wcscat (in: _Dest=0xe53a060, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\fre\\") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\" [0086.904] wcscat (in: _Dest=0xe53a060, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\fre\\*") returned="C:\\Program Files\\Microsoft Office\\root\\fre\\*" [0086.904] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b29b8 [0086.904] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\*", lpFindFileData=0x53b29b8 | out: lpFindFileData=0x53b29b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe570e50 [0086.906] wcscmp (_String1=".", _String2=".") returned 0 [0086.906] FindNextFileW (hFindFile=0xe570e50, lpFindFileData=0x53b29b8) Thread: id = 1518 os_tid = 0x24e8 [0086.906] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6a) returned 0x766e748 [0086.906] wcscpy (in: _Dest=0x766e748, _Source="C:\\Program Files\\Microsoft Office\\root\\Integration" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\Integration") returned="C:\\Program Files\\Microsoft Office\\root\\Integration" [0086.907] wcscat (in: _Dest=0x766e748, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\Integration\\") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\" [0086.907] wcscat (in: _Dest=0x766e748, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\Integration\\*") returned="C:\\Program Files\\Microsoft Office\\root\\Integration\\*" [0086.907] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b2c20 [0086.907] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\*", lpFindFileData=0x53b2c20 | out: lpFindFileData=0x53b2c20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd1f5fb21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b2abe77, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2abe77, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe570e90 [0086.909] wcscmp (_String1=".", _String2=".") returned 0 [0086.909] FindNextFileW (hFindFile=0xe570e90, lpFindFileData=0x53b2c20) Thread: id = 1519 os_tid = 0x24ec [0086.909] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x68) returned 0x396d9d0 [0086.909] wcscpy (in: _Dest=0x396d9d0, _Source="C:\\Program Files\\Microsoft Office\\root\\Licenses16" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\Licenses16") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16" [0086.909] wcscat (in: _Dest=0x396d9d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\" [0086.909] wcscat (in: _Dest=0x396d9d0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\*") returned="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\*" [0086.909] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53b2e88 [0086.909] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\*", lpFindFileData=0x53b2e88 | out: lpFindFileData=0x53b2e88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2687c83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee308135, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe570ed0 [0086.913] wcscmp (_String1=".", _String2=".") returned 0 [0086.913] FindNextFileW (hFindFile=0xe570ed0, lpFindFileData=0x53b2e88) Thread: id = 1520 os_tid = 0x24f0 [0086.911] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0xe53a470 [0086.911] wcscpy (in: _Dest=0xe53a470, _Source="C:\\Program Files\\Microsoft Office\\root\\loc" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\loc") returned="C:\\Program Files\\Microsoft Office\\root\\loc" [0086.911] wcscat (in: _Dest=0xe53a470, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\loc\\") returned="C:\\Program Files\\Microsoft Office\\root\\loc\\" [0086.912] wcscat (in: _Dest=0xe53a470, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\loc\\*") returned="C:\\Program Files\\Microsoft Office\\root\\loc\\*" [0086.912] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53cfe88 [0086.912] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\loc\\*", lpFindFileData=0x53cfe88 | out: lpFindFileData=0x53cfe88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee45f66d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x983c2c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xe570f10 [0086.913] wcscmp (_String1=".", _String2=".") returned 0 [0086.913] FindNextFileW (hFindFile=0xe570f10, lpFindFileData=0x53cfe88) Thread: id = 1521 os_tid = 0x24f4 [0086.914] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0xe53a4d8 [0086.914] wcscpy (in: _Dest=0xe53a4d8, _Source="C:\\Program Files\\Microsoft Office\\root\\mcxml" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\mcxml") returned="C:\\Program Files\\Microsoft Office\\root\\mcxml" [0086.914] wcscat (in: _Dest=0xe53a4d8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\mcxml\\") returned="C:\\Program Files\\Microsoft Office\\root\\mcxml\\" [0086.914] wcscat (in: _Dest=0xe53a4d8, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\mcxml\\*") returned="C:\\Program Files\\Microsoft Office\\root\\mcxml\\*" [0086.914] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d00f0 [0086.914] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\*", lpFindFileData=0x53d00f0 | out: lpFindFileData=0x53d00f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x75672c8 [0086.915] wcscmp (_String1=".", _String2=".") returned 0 [0086.915] FindNextFileW (hFindFile=0x75672c8, lpFindFileData=0x53d00f0) Thread: id = 1522 os_tid = 0x24f8 [0086.916] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x396db20 [0086.916] wcscpy (in: _Dest=0x396db20, _Source="C:\\Program Files\\Microsoft Office\\root\\Office16" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\Office16") returned="C:\\Program Files\\Microsoft Office\\root\\Office16" [0086.916] wcscat (in: _Dest=0x396db20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\Office16\\") returned="C:\\Program Files\\Microsoft Office\\root\\Office16\\" [0086.916] wcscat (in: _Dest=0x396db20, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\Office16\\*") returned="C:\\Program Files\\Microsoft Office\\root\\Office16\\*" [0086.916] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d0358 [0086.916] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\*", lpFindFileData=0x53d0358 | out: lpFindFileData=0x53d0358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7567808 [0086.916] wcscmp (_String1=".", _String2=".") returned 0 [0086.916] FindNextFileW (hFindFile=0x7567808, lpFindFileData=0x53d0358) Thread: id = 1523 os_tid = 0x24fc [0086.916] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5c) returned 0xe53a540 [0086.916] wcscpy (in: _Dest=0xe53a540, _Source="C:\\Program Files\\Microsoft Office\\root\\rsod" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\rsod") returned="C:\\Program Files\\Microsoft Office\\root\\rsod" [0086.916] wcscat (in: _Dest=0xe53a540, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\rsod\\") returned="C:\\Program Files\\Microsoft Office\\root\\rsod\\" [0086.916] wcscat (in: _Dest=0xe53a540, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\rsod\\*") returned="C:\\Program Files\\Microsoft Office\\root\\rsod\\*" [0086.916] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d05c0 [0086.916] FindFirstFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\*", lpFindFileData=0x53d05c0) Thread: id = 1524 os_tid = 0x2500 [0086.917] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x68) Thread: id = 1525 os_tid = 0x2504 [0086.917] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) Thread: id = 1526 os_tid = 0x2508 [0086.918] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5a) returned 0xe53a5a8 [0086.918] wcscpy (in: _Dest=0xe53a5a8, _Source="C:\\Program Files\\Microsoft Office\\root\\VFS" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\VFS") returned="C:\\Program Files\\Microsoft Office\\root\\VFS" [0086.918] wcscat (in: _Dest=0xe53a5a8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\VFS\\") returned="C:\\Program Files\\Microsoft Office\\root\\VFS\\" [0086.918] wcscat (in: _Dest=0xe53a5a8, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\root\\VFS\\*") returned="C:\\Program Files\\Microsoft Office\\root\\VFS\\*" [0086.918] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d0828 [0086.918] FindFirstFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\*", lpFindFileData=0x53d0828) Thread: id = 1527 os_tid = 0x250c [0086.918] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6a) returned 0x766e7c0 [0086.918] wcscpy (in: _Dest=0x766e7c0, _Source="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl") returned="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl" [0086.918] wcscat (in: _Dest=0x766e7c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\") returned="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\" [0086.918] wcscat (in: _Dest=0x766e7c0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\*") returned="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\*" [0086.918] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d0cf8 [0086.918] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\*", lpFindFileData=0x53d0cf8 | out: lpFindFileData=0x53d0cf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdec183d6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xdec183d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdec183d6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7567848 [0086.918] wcscmp (_String1=".", _String2=".") returned 0 [0086.918] FindNextFileW (hFindFile=0x7567848, lpFindFileData=0x53d0cf8) Thread: id = 1528 os_tid = 0x2510 [0086.919] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x766e838 [0086.919] wcscpy (in: _Dest=0x766e838, _Source="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader" [0086.919] wcscat (in: _Dest=0x766e838, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\" [0086.919] wcscat (in: _Dest=0x766e838, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\*") returned="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\*" [0086.919] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d0f60 [0086.919] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\*", lpFindFileData=0x53d0f60 | out: lpFindFileData=0x53d0f60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2d82cf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2d82cf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7567888 [0086.919] wcscmp (_String1=".", _String2=".") returned 0 [0086.919] FindNextFileW (hFindFile=0x7567888, lpFindFileData=0x53d0f60) Thread: id = 1529 os_tid = 0x2514 [0086.919] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\ReadMe.htm" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\readme.htm")) returned 0x20 [0086.920] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\ReadMe.htm", dwFileAttributes=0x20) returned 1 [0086.920] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\ReadMe.htm" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\readme.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2128 [0086.920] GetFileSizeEx (in: hFile=0x2128, lpFileSize=0x355ffb10 | out: lpFileSize=0x355ffb10*=16633) returned 1 [0086.920] SetFilePointerEx (in: hFile=0x2128, liDistanceToMove=0x40f5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.920] ReadFile (in: hFile=0x2128, lpBuffer=0x355ffa94, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x355ffa90, lpOverlapped=0x0 | out: lpBuffer=0x355ffa94*, lpNumberOfBytesRead=0x355ffa90*=0x4, lpOverlapped=0x0) returned 1 [0086.922] SetFilePointerEx (in: hFile=0x2128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813e0 [0086.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282100 [0086.922] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282218 [0086.922] NtQuerySystemTime (in: CurrentTime=0x355ffa70 | out: CurrentTime=0x355ffa70*=132260136440798917) returned 0x0 [0086.922] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0x2b488ff2 [0086.922] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0x4d09f6a0 [0086.922] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0x6f8baf32 [0086.922] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0xa03d39d0 [0086.922] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0xca043ec2 [0086.922] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0x807dca9e [0086.922] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0x7c3fc96f [0086.922] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0x674c4ca9 [0086.922] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0xe00c6efc [0086.922] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0x656333b2 [0086.922] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0xbbe775fe [0086.922] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0x9393eb26 [0086.922] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0x5b4e0ced [0086.922] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0xeb0e29f [0086.922] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0x3381f547 [0086.922] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0xce0d2df3 [0086.922] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0x5f0b12be [0086.922] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0xe7c2fcc0 [0086.922] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0x254f61ec [0086.922] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0x9e98c3a8 [0086.922] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0xb6ecb0a2 [0086.922] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0xefcc5124 [0086.922] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0x8c87a30a [0086.922] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0x5490a9be [0086.922] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0xe14bd364 [0086.922] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0x3f20b249 [0086.922] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0xec949460 [0086.923] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0x6fef7ce [0086.923] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0x8a7ff5a8 [0086.923] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0x5a84fb6c [0086.923] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0x2c26d602 [0086.923] RtlRandom (in: Seed=0x355ffa7c | out: Seed=0x355ffa7c) returned 0x7251d409 Thread: id = 1530 os_tid = 0x2518 [0086.934] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x74) returned 0x38d2320 [0086.934] wcscpy (in: _Dest=0x38d2320, _Source="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource") returned="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource" [0086.934] wcscat (in: _Dest=0x38d2320, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\") returned="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\" [0086.934] wcscat (in: _Dest=0x38d2320, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\*") returned="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\*" [0086.934] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d11c8 [0086.934] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\*", lpFindFileData=0x53d11c8 | out: lpFindFileData=0x53d11c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x389535d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389535d8, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x75678c8 [0086.934] wcscmp (_String1=".", _String2=".") returned 0 [0086.934] FindNextFileW (hFindFile=0x75678c8, lpFindFileData=0x53d11c8) Thread: id = 1531 os_tid = 0x251c [0086.934] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7a) returned 0x3977220 [0086.934] wcscpy (in: _Dest=0x3977220, _Source="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files") returned="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files" [0086.934] wcscat (in: _Dest=0x3977220, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\") returned="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\" [0086.934] wcscat (in: _Dest=0x3977220, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\*") returned="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\*" [0086.934] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d1430 [0086.934] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\*", lpFindFileData=0x53d1430 | out: lpFindFileData=0x53d1430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cd6ac1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cd6ac1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cd6ac1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7567908 [0086.935] wcscmp (_String1=".", _String2=".") returned 0 [0086.935] FindNextFileW (hFindFile=0x7567908, lpFindFileData=0x53d1430) Thread: id = 1532 os_tid = 0x2520 [0086.936] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x66) Thread: id = 1533 os_tid = 0x2524 [0086.936] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x48) returned 0x5eec038 [0086.936] wcscpy (in: _Dest=0x5eec038, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0086.936] wcscat (in: _Dest=0x5eec038, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0086.936] wcscat (in: _Dest=0x5eec038, _Source="*" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\*") returned="C:\\Users\\All Users\\USOShared\\Logs\\*" [0086.936] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d1698 [0086.936] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\*", lpFindFileData=0x53d1698 | out: lpFindFileData=0x53d1698*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa872976f, ftLastAccessTime.dwHighDateTime=0x1d5e1e4, ftLastWriteTime.dwLowDateTime=0xa872976f, ftLastWriteTime.dwHighDateTime=0x1d5e1e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7567948 [0086.936] wcscmp (_String1=".", _String2=".") returned 0 [0086.936] FindNextFileW (hFindFile=0x7567948, lpFindFileData=0x53d1698) Thread: id = 1534 os_tid = 0x2528 [0086.937] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x58) returned 0x7583f80 [0086.937] wcscpy (in: _Dest=0x7583f80, _Source="C:\\Users\\All Users\\USOPrivate\\UpdateStore" | out: _Dest="C:\\Users\\All Users\\USOPrivate\\UpdateStore") returned="C:\\Users\\All Users\\USOPrivate\\UpdateStore" [0086.937] wcscat (in: _Dest=0x7583f80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\") returned="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\" [0086.937] wcscat (in: _Dest=0x7583f80, _Source="*" | out: _Dest="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\*") returned="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\*" [0086.937] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53d1b68 [0086.937] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\*", lpFindFileData=0x53d1b68 | out: lpFindFileData=0x53d1b68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xac22596e, ftLastAccessTime.dwHighDateTime=0x1d5e1e4, ftLastWriteTime.dwLowDateTime=0xac22596e, ftLastWriteTime.dwHighDateTime=0x1d5e1e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7567188 [0086.937] wcscmp (_String1=".", _String2=".") returned 0 [0086.937] FindNextFileW (hFindFile=0x7567188, lpFindFileData=0x53d1b68) Thread: id = 1535 os_tid = 0x252c [0086.938] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm")) returned 0x20 [0086.938] SetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm", dwFileAttributes=0x20) returned 1 [0086.938] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x213c [0086.938] GetFileSizeEx (in: hFile=0x213c, lpFileSize=0x358ffd48 | out: lpFileSize=0x358ffd48*=750) returned 1 [0086.938] SetFilePointerEx (in: hFile=0x213c, liDistanceToMove=0x2ea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.938] ReadFile (in: hFile=0x213c, lpBuffer=0x358ffccc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x358ffcc8, lpOverlapped=0x0 | out: lpBuffer=0x358ffccc*, lpNumberOfBytesRead=0x358ffcc8*=0x4, lpOverlapped=0x0) returned 1 [0086.940] SetFilePointerEx (in: hFile=0x213c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.940] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x72813e0 [0086.940] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282290 [0086.940] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0x7282218 [0086.940] NtQuerySystemTime (in: CurrentTime=0x358ffca8 | out: CurrentTime=0x358ffca8*=132260136440955316) returned 0x0 [0086.940] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0x6b9d8da8 [0086.940] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0x99f6087a [0086.940] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0x3c806052 [0086.940] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0x47923398 [0086.940] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0x7e2f6f0 [0086.940] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0x5771ac55 [0086.940] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0x5bc158e2 [0086.940] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0x498c1110 [0086.940] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0x31356b7d [0086.940] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0xf7205c8 [0086.940] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0x6157c9d5 [0086.940] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0xc8abeb0a [0086.940] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0xe37be7b [0086.940] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0x77bd81a4 [0086.940] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0x39a51a76 [0086.940] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0x68b8a052 [0086.940] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0x1d790f6e [0086.940] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0x284adf46 [0086.940] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0xab8eac91 [0086.940] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0xbc838bd5 [0086.940] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0xed54d224 [0086.940] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0x94cffcdf [0086.940] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0xe3a87143 [0086.940] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0xc048d5d6 [0086.940] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0x75243ad9 [0086.941] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0xd77596 [0086.941] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0xfda5f82c [0086.941] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0xfc38e5d4 [0086.941] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0xb8c20bad [0086.941] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0xb96f1db0 [0086.941] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0xf265a6e1 [0086.941] RtlRandom (in: Seed=0x358ffcb4 | out: Seed=0x358ffcb4) returned 0x55980db3 Thread: id = 1536 os_tid = 0x2530 [0086.950] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm")) returned 0x20 [0086.951] SetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm", dwFileAttributes=0x20) returned 1 [0086.951] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2140 [0086.951] GetFileSizeEx (in: hFile=0x2140, lpFileSize=0x3597fe18 | out: lpFileSize=0x3597fe18*=638) returned 1 [0086.951] SetFilePointerEx (in: hFile=0x2140, liDistanceToMove=0x27a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.951] ReadFile (in: hFile=0x2140, lpBuffer=0x3597fd9c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3597fd98, lpOverlapped=0x0 | out: lpBuffer=0x3597fd9c*, lpNumberOfBytesRead=0x3597fd98*=0x4, lpOverlapped=0x0) returned 1 [0086.952] SetFilePointerEx (in: hFile=0x2140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.952] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032f40 [0086.952] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032e50 [0086.952] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032bd0 [0086.952] NtQuerySystemTime (in: CurrentTime=0x3597fd78 | out: CurrentTime=0x3597fd78*=132260136441111577) returned 0x0 [0086.952] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0xfda8cbce [0086.952] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0x55e08ac5 [0086.952] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0x393a3b63 [0086.952] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0x3b136900 [0086.952] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0xf5bfd67a [0086.952] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0xeb85f420 [0086.953] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0x7a4cf374 [0086.953] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0xd858de5d [0086.953] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0xe502767d [0086.953] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0x8f539ab [0086.953] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0xc1ef469d [0086.953] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0x3557beef [0086.953] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0xc2b7f27a [0086.953] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0xa8ed06ee [0086.953] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0x83ea5d58 [0086.953] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0xbb2b4ad5 [0086.953] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0xe3337685 [0086.953] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0x56dcebb0 [0086.953] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0x8ccc375b [0086.953] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0xb26d4985 [0086.953] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0x6ea693cd [0086.953] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0x283ea07b [0086.953] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0xd741f857 [0086.953] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0x39a323ff [0086.953] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0x3cab3eac [0086.953] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0x5856ee29 [0086.953] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0xfbadb2c7 [0086.953] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0xad42404f [0086.953] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0x6e575bc5 [0086.953] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0xaadb122e [0086.953] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0xe987f0f4 [0086.953] RtlRandom (in: Seed=0x3597fd84 | out: Seed=0x3597fd84) returned 0x20c299bc Thread: id = 1537 os_tid = 0x2534 [0086.962] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm")) returned 0x20 [0086.963] SetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm", dwFileAttributes=0x20) returned 1 [0086.963] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2144 [0086.963] GetFileSizeEx (in: hFile=0x2144, lpFileSize=0x359ffefc | out: lpFileSize=0x359ffefc*=750) returned 1 [0086.963] SetFilePointerEx (in: hFile=0x2144, liDistanceToMove=0x2ea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.964] ReadFile (in: hFile=0x2144, lpBuffer=0x359ffe80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x359ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x359ffe80*, lpNumberOfBytesRead=0x359ffe7c*=0x4, lpOverlapped=0x0) returned 1 [0086.965] SetFilePointerEx (in: hFile=0x2144, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.965] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032f40 [0086.965] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032e78 [0086.965] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032bd0 [0086.965] NtQuerySystemTime (in: CurrentTime=0x359ffe5c | out: CurrentTime=0x359ffe5c*=132260136441267759) returned 0x0 [0086.965] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0xd01ef76 [0086.965] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0x95141782 [0086.965] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0xa2f6d335 [0086.965] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0xe2c4620b [0086.965] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0x9d9c26c7 [0086.965] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0xeca8959f [0086.965] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0x532349dc [0086.965] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0xd118bbe [0086.965] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0xc024b52c [0086.965] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0xca30e92f [0086.965] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0x3b5c80c [0086.965] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0xa10e60f5 [0086.965] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0xa19dd32c [0086.965] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0xd58cdf07 [0086.965] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0x68552c56 [0086.965] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0x94b211df [0086.965] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0x5ac24f11 [0086.965] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0x3b386ccd [0086.965] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0x6e655056 [0086.966] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0x8ffd4250 [0086.966] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0xb36038ee [0086.966] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0x61d10887 [0086.966] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0xfcdd81d0 [0086.966] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0x814b462 [0086.966] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0xa9a46333 [0086.966] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0xd2c403b0 [0086.966] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0x5618cd39 [0086.966] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0x38069a66 [0086.966] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0x8e2b4e67 [0086.966] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0x75e87fea [0086.966] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0x45971fcf [0086.966] RtlRandom (in: Seed=0x359ffe68 | out: Seed=0x359ffe68) returned 0x61a3af77 Thread: id = 1538 os_tid = 0x2538 [0086.975] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb6) returned 0x5b16250 [0086.975] wcscpy (in: _Dest=0x5b16250, _Source="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages" [0086.975] wcscat (in: _Dest=0x5b16250, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\" [0086.975] wcscat (in: _Dest=0x5b16250, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*" [0086.975] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53cdf40 [0086.975] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*", lpFindFileData=0x53cdf40 | out: lpFindFileData=0x53cdf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x75671c8 [0086.975] wcscmp (_String1=".", _String2=".") returned 0 [0086.975] FindNextFileW (hFindFile=0x75671c8, lpFindFileData=0x53cdf40) Thread: id = 1539 os_tid = 0x253c [0086.976] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm")) returned 0x20 [0086.976] SetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm", dwFileAttributes=0x20) returned 1 [0086.976] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x214c [0086.976] GetFileSizeEx (in: hFile=0x214c, lpFileSize=0x35affb58 | out: lpFileSize=0x35affb58*=626) returned 1 [0086.977] SetFilePointerEx (in: hFile=0x214c, liDistanceToMove=0x26e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.977] ReadFile (in: hFile=0x214c, lpBuffer=0x35affadc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x35affad8, lpOverlapped=0x0 | out: lpBuffer=0x35affadc*, lpNumberOfBytesRead=0x35affad8*=0x4, lpOverlapped=0x0) returned 1 [0086.977] SetFilePointerEx (in: hFile=0x214c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.977] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032f40 [0086.977] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032ea0 [0086.977] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032bd0 [0086.978] NtQuerySystemTime (in: CurrentTime=0x35affab8 | out: CurrentTime=0x35affab8*=132260136441424695) returned 0x0 [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0x282efb99 [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0xf9d03a34 [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0xef40481c [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0x66b7d7bb [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0xd81d5ff9 [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0xb8582741 [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0x81ebd0dc [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0x279bbfcc [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0xac8217fa [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0xa3804441 [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0x17fa3bec [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0xb4df9671 [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0xa4cce4a2 [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0x4fd2cf68 [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0xc0e7bba9 [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0xa9ef2cbd [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0x8756683c [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0x9a9c3940 [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0xea661f9b [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0xfe2ab256 [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0xd1fdb879 [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0xf700f74e [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0xb3c69c5a [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0x844ac2ba [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0x186747a8 [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0x2dfd25c9 [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0x95a3a8be [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0x45d6c553 [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0x66566e81 [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0x13f7531c [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0xecc8432c [0086.978] RtlRandom (in: Seed=0x35affac4 | out: Seed=0x35affac4) returned 0x42f57da4 Thread: id = 1540 os_tid = 0x2540 [0086.987] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x42) returned 0x3941098 [0086.988] wcscpy (in: _Dest=0x3941098, _Source="C:\\Users\\All Users\\Oracle\\Java" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java") returned="C:\\Users\\All Users\\Oracle\\Java" [0086.988] wcscat (in: _Dest=0x3941098, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\") returned="C:\\Users\\All Users\\Oracle\\Java\\" [0086.988] wcscat (in: _Dest=0x3941098, _Source="*" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\*") returned="C:\\Users\\All Users\\Oracle\\Java\\*" [0086.988] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53ce1a8 [0086.988] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\*", lpFindFileData=0x53ce1a8 | out: lpFindFileData=0x53ce1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7567208 [0086.988] wcscmp (_String1=".", _String2=".") returned 0 [0086.988] FindNextFileW (hFindFile=0x7567208, lpFindFileData=0x53ce1a8) Thread: id = 1541 os_tid = 0x2544 Thread: id = 1542 os_tid = 0x2548 Thread: id = 1543 os_tid = 0x254c Thread: id = 1544 os_tid = 0x2550 Thread: id = 1545 os_tid = 0x2554 Thread: id = 1546 os_tid = 0x2558 Thread: id = 1547 os_tid = 0x255c Thread: id = 1548 os_tid = 0x2560 Thread: id = 1549 os_tid = 0x2564 Thread: id = 1550 os_tid = 0x2568 Thread: id = 1551 os_tid = 0x256c Thread: id = 1552 os_tid = 0x2570 Thread: id = 1553 os_tid = 0x2574 Thread: id = 1554 os_tid = 0x2578 Thread: id = 1555 os_tid = 0x257c Thread: id = 1556 os_tid = 0x2580 Thread: id = 1557 os_tid = 0x2584 Thread: id = 1558 os_tid = 0x2588 Thread: id = 1559 os_tid = 0x258c Thread: id = 1560 os_tid = 0x2590 Thread: id = 1561 os_tid = 0x2594 Thread: id = 1562 os_tid = 0x2598 Thread: id = 1563 os_tid = 0x259c Thread: id = 1564 os_tid = 0x25a0 Thread: id = 1565 os_tid = 0x25a4 Thread: id = 1566 os_tid = 0x25a8 Thread: id = 1567 os_tid = 0x25ac Thread: id = 1568 os_tid = 0x25b0 Thread: id = 1569 os_tid = 0x25b4 Thread: id = 1570 os_tid = 0x25b8 Thread: id = 1571 os_tid = 0x25bc Thread: id = 1572 os_tid = 0x25c0 Thread: id = 1573 os_tid = 0x25c4 Thread: id = 1574 os_tid = 0x25c8 Thread: id = 1575 os_tid = 0x25cc Thread: id = 1576 os_tid = 0x25d0 Thread: id = 1577 os_tid = 0x25d4 Thread: id = 1578 os_tid = 0x25d8 Thread: id = 1579 os_tid = 0x25dc Thread: id = 1580 os_tid = 0x25e0 Thread: id = 1581 os_tid = 0x25e4 Thread: id = 1582 os_tid = 0x25e8 Thread: id = 1583 os_tid = 0x25ec Thread: id = 1584 os_tid = 0x25f0 Thread: id = 1585 os_tid = 0x25f4 Thread: id = 1586 os_tid = 0x25f8 Thread: id = 1587 os_tid = 0x25fc Thread: id = 1588 os_tid = 0x2600 Thread: id = 1589 os_tid = 0x2604 Thread: id = 1590 os_tid = 0x2608 Thread: id = 1591 os_tid = 0x260c Thread: id = 1592 os_tid = 0x2610 Thread: id = 1593 os_tid = 0x2614 Thread: id = 1594 os_tid = 0x2618 Thread: id = 1595 os_tid = 0x261c Thread: id = 1596 os_tid = 0x2620 Thread: id = 1597 os_tid = 0x2624 Thread: id = 1598 os_tid = 0x2628 Thread: id = 1599 os_tid = 0x262c Thread: id = 1600 os_tid = 0x2630 Thread: id = 1601 os_tid = 0x2650 Thread: id = 1602 os_tid = 0x2654 Thread: id = 1603 os_tid = 0x2658 Thread: id = 1604 os_tid = 0x265c Thread: id = 1605 os_tid = 0x2660 Thread: id = 1606 os_tid = 0x2664 Thread: id = 1607 os_tid = 0x2668 Thread: id = 1608 os_tid = 0x266c Thread: id = 1609 os_tid = 0x2670 Thread: id = 1610 os_tid = 0x2674 Thread: id = 1611 os_tid = 0x2678 Thread: id = 1612 os_tid = 0x267c Thread: id = 1613 os_tid = 0x2680 Thread: id = 1614 os_tid = 0x2684 Thread: id = 1615 os_tid = 0x2688 Thread: id = 1616 os_tid = 0x268c Thread: id = 1617 os_tid = 0x2690 Thread: id = 1618 os_tid = 0x2694 Thread: id = 1619 os_tid = 0x2698 Thread: id = 1620 os_tid = 0x269c Thread: id = 1621 os_tid = 0x26a0 Thread: id = 1622 os_tid = 0x26a4 Thread: id = 1623 os_tid = 0x26a8 Thread: id = 1624 os_tid = 0x26ac Thread: id = 1625 os_tid = 0x26b0 Thread: id = 1626 os_tid = 0x26b4 Thread: id = 1627 os_tid = 0x26b8 Thread: id = 1628 os_tid = 0x26bc Thread: id = 1629 os_tid = 0x26c0 Thread: id = 1630 os_tid = 0x26c4 Thread: id = 1631 os_tid = 0x26c8 Thread: id = 1632 os_tid = 0x26cc Thread: id = 1633 os_tid = 0x26d0 Thread: id = 1634 os_tid = 0x26d4 Thread: id = 1635 os_tid = 0x26d8 Thread: id = 1636 os_tid = 0x26dc Thread: id = 1637 os_tid = 0x26e0 Thread: id = 1638 os_tid = 0x26e4 Thread: id = 1639 os_tid = 0x26e8 Thread: id = 1640 os_tid = 0x26ec Thread: id = 1641 os_tid = 0x26f0 Thread: id = 1642 os_tid = 0x26f4 Thread: id = 1643 os_tid = 0x26f8 Thread: id = 1644 os_tid = 0x26fc Thread: id = 1645 os_tid = 0x2700 Thread: id = 1646 os_tid = 0x2704 Thread: id = 1647 os_tid = 0x2708 Thread: id = 1648 os_tid = 0x270c Thread: id = 1649 os_tid = 0x2710 Thread: id = 1650 os_tid = 0x2714 Thread: id = 1651 os_tid = 0x2718 Thread: id = 1652 os_tid = 0x271c Thread: id = 1653 os_tid = 0x2720 Thread: id = 1654 os_tid = 0x2724 Thread: id = 1655 os_tid = 0x2728 Thread: id = 1656 os_tid = 0x272c Thread: id = 1657 os_tid = 0x2730 Thread: id = 1658 os_tid = 0x2734 Thread: id = 1659 os_tid = 0x2738 Thread: id = 1660 os_tid = 0x273c Thread: id = 1661 os_tid = 0x2740 Thread: id = 1662 os_tid = 0x2744 Thread: id = 1663 os_tid = 0x2748 Thread: id = 1664 os_tid = 0x274c Thread: id = 1665 os_tid = 0x2750 Thread: id = 1666 os_tid = 0x2754 Thread: id = 1667 os_tid = 0x2758 Thread: id = 1668 os_tid = 0x275c Thread: id = 1669 os_tid = 0x2760 Thread: id = 1670 os_tid = 0x2764 Thread: id = 1671 os_tid = 0x2768 Thread: id = 1672 os_tid = 0x276c Thread: id = 1673 os_tid = 0x2770 Thread: id = 1674 os_tid = 0x2774 Thread: id = 1675 os_tid = 0x2778 Thread: id = 1676 os_tid = 0x277c Thread: id = 1677 os_tid = 0x2780 Thread: id = 1678 os_tid = 0x2784 Thread: id = 1679 os_tid = 0x2788 Thread: id = 1680 os_tid = 0x278c Thread: id = 1681 os_tid = 0x2790 Thread: id = 1682 os_tid = 0x2794 Thread: id = 1683 os_tid = 0x2798 Thread: id = 1684 os_tid = 0x279c Thread: id = 1685 os_tid = 0x27a0 Thread: id = 1686 os_tid = 0x27a4 Thread: id = 1687 os_tid = 0x27a8 Thread: id = 1688 os_tid = 0x27ac Thread: id = 1689 os_tid = 0x27b0 Thread: id = 1690 os_tid = 0x27b4 Thread: id = 1691 os_tid = 0x27b8 Thread: id = 1692 os_tid = 0x27bc Thread: id = 1700 os_tid = 0x27dc [0087.593] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\default.js" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\default.js")) returned 0x20 [0087.594] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\default.js", dwFileAttributes=0x20) returned 0 [0087.594] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\default.js" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\default.js"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.594] GetLastError () returned 0x5 [0087.594] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\default.js", dwFileAttributes=0x20) returned 0 [0087.594] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55fe308) returned 1 Thread: id = 1701 os_tid = 0x27e0 [0087.593] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat")) returned 0x20 [0087.596] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0087.596] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.596] GetLastError () returned 0x5 [0087.596] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0087.596] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba2ef8) returned 1 Thread: id = 1702 os_tid = 0x27e4 [0087.597] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\Attributions.html" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\attributions.html")) returned 0x20 [0089.605] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\Attributions.html", dwFileAttributes=0x20) returned 0 [0089.605] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\Attributions.html" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\attributions.html"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.605] GetLastError () returned 0x5 [0089.605] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\Attributions.html", dwFileAttributes=0x20) returned 0 [0089.605] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fa708) returned 1 Thread: id = 1730 os_tid = 0x2854 [0087.677] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat")) returned 0x20 [0087.679] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0087.738] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.739] GetLastError () returned 0x5 [0087.740] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0087.741] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba46f8) returned 1 Thread: id = 1731 os_tid = 0x2858 [0087.743] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat")) returned 0x20 [0087.744] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0087.746] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.747] GetLastError () returned 0x5 [0087.747] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0087.748] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba47f8) returned 1 Thread: id = 1732 os_tid = 0x285c [0087.751] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat")) returned 0x20 [0087.752] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0087.754] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.755] GetLastError () returned 0x5 [0087.755] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0087.756] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba48f8) returned 1 Thread: id = 1733 os_tid = 0x2860 [0087.760] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat")) returned 0x20 [0087.762] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0087.763] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.net.native.runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.765] GetLastError () returned 0x5 [0087.765] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0087.766] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba49f8) returned 1 Thread: id = 1734 os_tid = 0x2864 [0087.767] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml")) returned 0x20 [0087.770] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml", dwFileAttributes=0x20) returned 0 [0087.771] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.776] GetLastError () returned 0x5 [0087.776] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml", dwFileAttributes=0x20) returned 0 [0087.777] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75849b8) returned 1 Thread: id = 1735 os_tid = 0x2868 [0087.778] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat")) returned 0x20 [0087.779] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0087.779] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.780] GetLastError () returned 0x5 [0087.780] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0087.780] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54505a8) returned 1 Thread: id = 1736 os_tid = 0x286c [0087.781] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\LockScreenLogo.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\assets\\lockscreenlogo.scale-200.png")) returned 0x20 [0087.783] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\LockScreenLogo.scale-200.png", dwFileAttributes=0x20) returned 0 [0087.785] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\LockScreenLogo.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\assets\\lockscreenlogo.scale-200.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.786] GetLastError () returned 0x5 [0087.786] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\LockScreenLogo.scale-200.png", dwFileAttributes=0x20) returned 0 [0087.787] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7582738) returned 1 Thread: id = 1737 os_tid = 0x2870 [0087.788] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x7582108 [0087.788] wcscpy (in: _Dest=0x7582108, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.StickyNotes.Views\\Images" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.StickyNotes.Views\\Images") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.StickyNotes.Views\\Images" [0087.791] wcscat (in: _Dest=0x7582108, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.StickyNotes.Views\\Images\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.StickyNotes.Views\\Images\\" [0087.791] wcscat (in: _Dest=0x7582108, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.StickyNotes.Views\\Images\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.StickyNotes.Views\\Images\\*" [0087.791] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53ce410 [0087.791] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.StickyNotes.Views\\Images\\*", lpFindFileData=0x53ce410 | out: lpFindFileData=0x53ce410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a8a9a20, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaddfa4dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a8a9a20, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7567fc8 [0087.792] wcscmp (_String1=".", _String2=".") returned 0 [0087.792] FindNextFileW (hFindFile=0x7567fc8, lpFindFileData=0x53ce410) Thread: id = 1738 os_tid = 0x2874 [0087.792] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\resources.44828b84.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\resources.44828b84.pri")) returned 0x2020 [0087.793] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\resources.44828b84.pri", dwFileAttributes=0x20) returned 0 [0087.793] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\resources.44828b84.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\resources.44828b84.pri"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.793] GetLastError () returned 0x5 [0087.793] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\resources.44828b84.pri", dwFileAttributes=0x2020) returned 0 [0087.793] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75867c0) returned 1 Thread: id = 1739 os_tid = 0x2878 [0087.794] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Resources\\DemoModeInk.dat" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\resources\\demomodeink.dat")) returned 0x20 [0087.795] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Resources\\DemoModeInk.dat", dwFileAttributes=0x20) returned 0 [0087.795] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Resources\\DemoModeInk.dat" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\resources\\demomodeink.dat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.795] GetLastError () returned 0x5 [0087.795] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Resources\\DemoModeInk.dat", dwFileAttributes=0x20) returned 0 [0087.795] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b9198) returned 1 Thread: id = 1740 os_tid = 0x287c [0087.796] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\_resources\\0.rsrc")) returned 0x20 [0087.797] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc", dwFileAttributes=0x20) returned 0 [0087.797] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\_resources\\0.rsrc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.797] GetLastError () returned 0x5 [0087.797] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc", dwFileAttributes=0x20) returned 0 [0087.797] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3934488) returned 1 Thread: id = 1741 os_tid = 0x2880 [0087.798] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\1.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\_resources\\1.rsrc")) returned 0x20 [0087.799] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\1.rsrc", dwFileAttributes=0x20) returned 0 [0087.799] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\1.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\_resources\\1.rsrc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.799] GetLastError () returned 0x5 [0087.799] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\1.rsrc", dwFileAttributes=0x20) returned 0 [0087.799] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39348e8) returned 1 Thread: id = 1742 os_tid = 0x2884 [0087.800] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\2.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\_resources\\2.rsrc")) returned 0x20 [0087.800] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\2.rsrc", dwFileAttributes=0x20) returned 0 [0087.800] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\2.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\_resources\\2.rsrc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.801] GetLastError () returned 0x5 [0087.801] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\2.rsrc", dwFileAttributes=0x20) returned 0 [0087.801] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39349c8) returned 1 Thread: id = 1743 os_tid = 0x2888 [0087.802] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\3.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\_resources\\3.rsrc")) returned 0x20 [0087.802] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\3.rsrc", dwFileAttributes=0x20) returned 0 [0087.802] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\3.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\_resources\\3.rsrc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.802] GetLastError () returned 0x5 [0087.802] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\3.rsrc", dwFileAttributes=0x20) returned 0 [0087.802] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3934aa8) returned 1 Thread: id = 1744 os_tid = 0x288c [0087.803] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\_resources\\index.txt")) returned 0x20 [0087.805] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt", dwFileAttributes=0x20) returned 0 [0087.805] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\_resources\\index.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0087.805] GetLastError () returned 0x5 [0087.805] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt", dwFileAttributes=0x20) returned 0 [0087.805] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f0210) returned 1 Thread: id = 1745 os_tid = 0x2890 [0087.807] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\22CmeAJJP7RQy3 1.swf" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\oh5\\22cmeajjp7rqy3 1.swf")) returned 0x20 [0087.807] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\22CmeAJJP7RQy3 1.swf", dwFileAttributes=0x20) returned 1 [0087.807] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\22CmeAJJP7RQy3 1.swf" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\oh5\\22cmeajjp7rqy3 1.swf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21b4 [0087.807] GetFileSizeEx (in: hFile=0x21b4, lpFileSize=0x3c1ff89c | out: lpFileSize=0x3c1ff89c*=59626) returned 1 [0087.807] SetFilePointerEx (in: hFile=0x21b4, liDistanceToMove=0xe8e6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.807] ReadFile (in: hFile=0x21b4, lpBuffer=0x3c1ff820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c1ff81c, lpOverlapped=0x0 | out: lpBuffer=0x3c1ff820*, lpNumberOfBytesRead=0x3c1ff81c*=0x4, lpOverlapped=0x0) returned 1 [0087.807] SetFilePointerEx (in: hFile=0x21b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.807] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032f40 [0087.807] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032ec8 [0087.808] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032bd0 [0087.808] NtQuerySystemTime (in: CurrentTime=0x3c1ff7fc | out: CurrentTime=0x3c1ff7fc*=132260136449705270) returned 0x0 [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0x18cc0d55 [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0x6462a10c [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0xceaed313 [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0xa784f032 [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0x794bc794 [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0xa2dbe395 [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0x4b763aca [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0x2361e365 [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0x5c376a1f [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0x501ac55f [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0x869d05a3 [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0x40848fd9 [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0xd18edb79 [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0x8e1e9598 [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0x902f4445 [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0x6688d188 [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0x357266f2 [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0x8767f008 [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0x9cc41382 [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0xea58f18 [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0x9e552597 [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0x303c5ed1 [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0xbece0ccb [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0xbe71b055 [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0xe7c1f598 [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0xf715005a [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0x24f6ccc7 [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0x392ce729 [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0x208384df [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0x89c2b491 [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0xfb3438c5 [0087.808] RtlRandom (in: Seed=0x3c1ff808 | out: Seed=0x3c1ff808) returned 0xb00d9a94 Thread: id = 1746 os_tid = 0x2894 [0087.817] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\c5BHDHO-LxzFC.swf" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\oh5\\c5bhdho-lxzfc.swf")) returned 0x20 [0087.818] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\c5BHDHO-LxzFC.swf", dwFileAttributes=0x20) returned 1 [0087.818] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\c5BHDHO-LxzFC.swf" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\oh5\\c5bhdho-lxzfc.swf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21b8 [0087.818] GetFileSizeEx (in: hFile=0x21b8, lpFileSize=0x3c27f850 | out: lpFileSize=0x3c27f850*=91068) returned 1 [0087.818] SetFilePointerEx (in: hFile=0x21b8, liDistanceToMove=0x163b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.818] ReadFile (in: hFile=0x21b8, lpBuffer=0x3c27f7d4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c27f7d0, lpOverlapped=0x0 | out: lpBuffer=0x3c27f7d4*, lpNumberOfBytesRead=0x3c27f7d0*=0x4, lpOverlapped=0x0) returned 1 [0087.818] SetFilePointerEx (in: hFile=0x21b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.818] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032f40 [0087.818] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032ef0 [0087.818] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032bd0 [0087.818] NtQuerySystemTime (in: CurrentTime=0x3c27f7b0 | out: CurrentTime=0x3c27f7b0*=132260136449705270) returned 0x0 [0087.818] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0x43c9d309 [0087.818] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0x2dd7786d [0087.818] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0x4ffda756 [0087.818] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0x57a3e53a [0087.818] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0x58918d27 [0087.818] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0xff18f00d [0087.818] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0x8f1e148e [0087.818] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0x77b810c3 [0087.818] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0x3f93b5d0 [0087.818] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0x33bc4908 [0087.819] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0xe530a10c [0087.819] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0xc8ed5b34 [0087.819] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0x7874206c [0087.819] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0xd8b518bb [0087.819] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0x9dc0fffc [0087.819] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0xd00248bf [0087.819] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0x8a0d82fc [0087.819] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0xebe02679 [0087.819] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0xded1aa5 [0087.819] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0x5035347a [0087.819] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0xa095ea14 [0087.819] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0x8136b981 [0087.819] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0xf004af17 [0087.819] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0x618e17f9 [0087.819] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0xba030113 [0087.819] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0xd7ade5dc [0087.819] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0xfcb49b60 [0087.819] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0x8c8439e8 [0087.819] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0x869c10b7 [0087.819] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0xa8e7107a [0087.819] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0x1184a9f8 [0087.819] RtlRandom (in: Seed=0x3c27f7bc | out: Seed=0x3c27f7bc) returned 0xa1903494 Thread: id = 1747 os_tid = 0x2898 [0087.831] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\Ga8Mk5qBDxEWBI3re3g.avi" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\oh5\\ga8mk5qbdxewbi3re3g.avi")) returned 0x20 [0087.831] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\Ga8Mk5qBDxEWBI3re3g.avi", dwFileAttributes=0x20) returned 1 [0087.832] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\Ga8Mk5qBDxEWBI3re3g.avi" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\oh5\\ga8mk5qbdxewbi3re3g.avi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21bc [0087.832] GetFileSizeEx (in: hFile=0x21bc, lpFileSize=0x3c2ffedc | out: lpFileSize=0x3c2ffedc*=67475) returned 1 [0087.832] SetFilePointerEx (in: hFile=0x21bc, liDistanceToMove=0x1078f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.832] ReadFile (in: hFile=0x21bc, lpBuffer=0x3c2ffe60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c2ffe5c, lpOverlapped=0x0 | out: lpBuffer=0x3c2ffe60*, lpNumberOfBytesRead=0x3c2ffe5c*=0x4, lpOverlapped=0x0) returned 1 [0087.832] SetFilePointerEx (in: hFile=0x21bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.832] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032f40 [0087.832] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032b30 [0087.832] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032bd0 [0087.832] NtQuerySystemTime (in: CurrentTime=0x3c2ffe3c | out: CurrentTime=0x3c2ffe3c*=132260136449862006) returned 0x0 [0087.832] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0x9cb7a427 [0087.832] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0xdcf49eb9 [0087.832] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0xec218031 [0087.832] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0x577fff81 [0087.832] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0xfdafe85e [0087.832] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0xa76c2754 [0087.832] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0x530c9b91 [0087.832] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0xbe65b254 [0087.832] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0x9906fcdf [0087.832] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0x76fb973d [0087.832] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0xb7e53dc7 [0087.832] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0x6ce2fa89 [0087.832] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0x31658b09 [0087.832] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0xee5b602d [0087.832] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0xfd18cd32 [0087.832] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0xff060cf3 [0087.832] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0xc461c961 [0087.832] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0x8ceeef4d [0087.832] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0x87b519ec [0087.832] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0xd261da3d [0087.832] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0xba57e7b6 [0087.832] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0xb43efa2f [0087.833] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0xd4e305f5 [0087.833] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0xf8cf3ae8 [0087.833] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0x15ebbdd0 [0087.833] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0xccead633 [0087.833] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0xb9c37f6e [0087.833] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0x486ebe2c [0087.833] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0x6187719 [0087.833] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0x9f2a7caf [0087.833] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0x82c693ae [0087.833] RtlRandom (in: Seed=0x3c2ffe48 | out: Seed=0x3c2ffe48) returned 0x9ba5b97e Thread: id = 1748 os_tid = 0x289c [0087.845] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\HdF6X9en2Y.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\oh5\\hdf6x9en2y.mp4")) returned 0x20 [0087.845] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\HdF6X9en2Y.mp4", dwFileAttributes=0x20) returned 1 [0087.846] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\HdF6X9en2Y.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\oh5\\hdf6x9en2y.mp4"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21c0 [0087.846] GetFileSizeEx (in: hFile=0x21c0, lpFileSize=0x3c37fbc0 | out: lpFileSize=0x3c37fbc0*=87186) returned 1 [0087.846] SetFilePointerEx (in: hFile=0x21c0, liDistanceToMove=0x1548e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.846] ReadFile (in: hFile=0x21c0, lpBuffer=0x3c37fb44, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c37fb40, lpOverlapped=0x0 | out: lpBuffer=0x3c37fb44*, lpNumberOfBytesRead=0x3c37fb40*=0x4, lpOverlapped=0x0) returned 1 [0087.846] SetFilePointerEx (in: hFile=0x21c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.846] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032f40 [0087.846] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032bd0 [0087.846] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032bf8 [0087.846] NtQuerySystemTime (in: CurrentTime=0x3c37fb20 | out: CurrentTime=0x3c37fb20*=132260136450018455) returned 0x0 [0087.846] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0xcd7ccdc1 [0087.846] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0xe2fa6d9a [0087.846] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0xf8dc69e8 [0087.846] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0x7259d6b [0087.846] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0x65d0ea8a [0087.846] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0xd9644e05 [0087.846] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0x3030330d [0087.846] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0x72d3a621 [0087.846] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0x42ca8aba [0087.846] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0x98a8d306 [0087.846] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0x48180379 [0087.846] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0xce02cc9d [0087.846] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0x57633bcb [0087.846] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0x977b35ec [0087.846] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0x99cdf1bd [0087.847] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0xc293841f [0087.847] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0xa399facc [0087.847] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0xfbaac695 [0087.847] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0xa53ae23e [0087.847] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0x41943cab [0087.847] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0xc5628fb7 [0087.847] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0xce523c0b [0087.847] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0x5d9232c0 [0087.847] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0x7339f232 [0087.847] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0xe3e9799 [0087.847] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0xe81e191c [0087.847] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0xa6eed96 [0087.847] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0x616e0ae3 [0087.847] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0x63d3ed23 [0087.847] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0x91c308b5 [0087.847] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0xf153f768 [0087.847] RtlRandom (in: Seed=0x3c37fb2c | out: Seed=0x3c37fb2c) returned 0x1ed20b9b Thread: id = 1749 os_tid = 0x28a0 [0087.856] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\Mu m_ksI_yimLFCb.swf" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\oh5\\mu m_ksi_yimlfcb.swf")) returned 0x20 [0087.857] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\Mu m_ksI_yimLFCb.swf", dwFileAttributes=0x20) returned 1 [0087.857] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\Mu m_ksI_yimLFCb.swf" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\oh5\\mu m_ksi_yimlfcb.swf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21c4 [0087.857] GetFileSizeEx (in: hFile=0x21c4, lpFileSize=0x3c3ffc1c | out: lpFileSize=0x3c3ffc1c*=53006) returned 1 [0087.857] SetFilePointerEx (in: hFile=0x21c4, liDistanceToMove=0xcf0a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.857] ReadFile (in: hFile=0x21c4, lpBuffer=0x3c3ffba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c3ffb9c, lpOverlapped=0x0 | out: lpBuffer=0x3c3ffba0*, lpNumberOfBytesRead=0x3c3ffb9c*=0x4, lpOverlapped=0x0) returned 1 [0087.857] SetFilePointerEx (in: hFile=0x21c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.857] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032f40 [0087.857] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032bf8 [0087.857] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032cc0 [0087.857] NtQuerySystemTime (in: CurrentTime=0x3c3ffb7c | out: CurrentTime=0x3c3ffb7c*=132260136450174651) returned 0x0 [0087.857] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0xb3bbba91 [0087.857] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0x9ea1050f [0087.857] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0x1a3c0a63 [0087.857] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0x2d89a9f3 [0087.857] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0x419bb35f [0087.857] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0xf2071716 [0087.857] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0x8217283 [0087.857] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0xa525950f [0087.857] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0x484a75f4 [0087.858] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0xab3b7e68 [0087.858] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0x922fa00c [0087.858] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0x4f8774bc [0087.858] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0x6199f308 [0087.858] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0x7004ef5f [0087.858] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0x306b02 [0087.858] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0xc1a5d11e [0087.858] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0x69023dcc [0087.858] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0x24a2e776 [0087.858] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0xb4b56760 [0087.858] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0xa3a02281 [0087.858] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0xac80f87b [0087.858] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0x6b3c52d5 [0087.858] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0xf9febc05 [0087.858] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0x3e1262a6 [0087.858] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0x3eed521b [0087.858] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0x468c53d3 [0087.858] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0xdec4b99a [0087.858] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0x7a55e4f3 [0087.858] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0x5e6e6ef [0087.858] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0x6cb96af8 [0087.858] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0x899e8189 [0087.858] RtlRandom (in: Seed=0x3c3ffb88 | out: Seed=0x3c3ffb88) returned 0x21dd945d Thread: id = 1750 os_tid = 0x28a4 [0087.870] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\pLFF75mqBew.avi" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\oh5\\plff75mqbew.avi")) returned 0x20 [0087.870] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\pLFF75mqBew.avi", dwFileAttributes=0x20) returned 1 [0087.871] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\pLFF75mqBew.avi" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\oh5\\plff75mqbew.avi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21c8 [0087.871] GetFileSizeEx (in: hFile=0x21c8, lpFileSize=0x3c47fc20 | out: lpFileSize=0x3c47fc20*=90378) returned 1 [0087.871] SetFilePointerEx (in: hFile=0x21c8, liDistanceToMove=0x16106, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.871] ReadFile (in: hFile=0x21c8, lpBuffer=0x3c47fba4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c47fba0, lpOverlapped=0x0 | out: lpBuffer=0x3c47fba4*, lpNumberOfBytesRead=0x3c47fba0*=0x4, lpOverlapped=0x0) returned 1 [0087.871] SetFilePointerEx (in: hFile=0x21c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.871] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032f40 [0087.871] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032cc0 [0087.871] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe033008 [0087.871] NtQuerySystemTime (in: CurrentTime=0x3c47fb80 | out: CurrentTime=0x3c47fb80*=132260136450330744) returned 0x0 [0087.871] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0x98991292 [0087.871] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0x69eb51df [0087.871] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0x858f968e [0087.871] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0x332d2959 [0087.871] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0x8413c063 [0087.871] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0x8d1d14db [0087.871] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0x8a6ef7fa [0087.871] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0x974234c3 [0087.871] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0xf4039d61 [0087.871] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0x6072a7d0 [0087.871] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0x1674d329 [0087.871] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0x304ba5fc [0087.871] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0x9fd407b [0087.871] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0x7b47afa9 [0087.871] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0xadfec5fe [0087.871] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0x70780c47 [0087.871] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0x4c8f2abd [0087.871] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0x28a492d [0087.872] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0x4544a725 [0087.872] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0x8aabf982 [0087.872] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0x60dcdc1f [0087.872] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0x2cf8f74e [0087.872] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0x365ca5e2 [0087.872] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0x6815d882 [0087.872] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0xa8efe8da [0087.872] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0x3ad0c4ba [0087.872] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0x71909af7 [0087.872] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0x917b3943 [0087.872] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0xbe60afee [0087.872] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0x5012a2e4 [0087.872] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0xd5f6141a [0087.872] RtlRandom (in: Seed=0x3c47fb8c | out: Seed=0x3c47fb8c) returned 0x6e752b4f Thread: id = 1751 os_tid = 0x28a8 [0087.881] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\Qpfu9YxU YLv.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\oh5\\qpfu9yxu ylv.mkv")) returned 0x20 [0087.881] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\Qpfu9YxU YLv.mkv", dwFileAttributes=0x20) returned 1 [0087.881] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\Qpfu9YxU YLv.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\oh5\\qpfu9yxu ylv.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21cc [0087.881] GetFileSizeEx (in: hFile=0x21cc, lpFileSize=0x3c4ffa04 | out: lpFileSize=0x3c4ffa04*=58057) returned 1 [0087.881] SetFilePointerEx (in: hFile=0x21cc, liDistanceToMove=0xe2c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.881] ReadFile (in: hFile=0x21cc, lpBuffer=0x3c4ff988, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c4ff984, lpOverlapped=0x0 | out: lpBuffer=0x3c4ff988*, lpNumberOfBytesRead=0x3c4ff984*=0x4, lpOverlapped=0x0) returned 1 [0087.881] SetFilePointerEx (in: hFile=0x21cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.882] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032f40 [0087.882] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe033080 [0087.882] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe033008 [0087.882] NtQuerySystemTime (in: CurrentTime=0x3c4ff964 | out: CurrentTime=0x3c4ff964*=132260136450330744) returned 0x0 [0087.882] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0x5f79e770 [0087.882] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0x36f4d27e [0087.882] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0x9d0117d7 [0087.882] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0x7e16f841 [0087.882] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0x1d3a2cf4 [0087.882] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0xaf7f2746 [0087.882] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0x3f47ccb6 [0087.882] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0x8bf8c65c [0087.882] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0xb30e91a7 [0087.882] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0xa62a335c [0087.882] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0xa5bc509c [0087.882] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0xdda89267 [0087.882] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0x62d3f9ce [0087.882] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0xa46f5094 [0087.882] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0xfa56f760 [0087.882] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0xd3a83996 [0087.882] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0xd33bf5bf [0087.882] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0x3c57f855 [0087.882] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0x317bdec8 [0087.882] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0x4670e719 [0087.882] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0xcf01821f [0087.882] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0x5733ab6d [0087.882] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0xe0477873 [0087.882] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0x894ad3f5 [0087.882] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0x45cb53ee [0087.882] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0x5c739615 [0087.882] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0xee201b8e [0087.885] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0x1c85777e [0087.885] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0xb064b463 [0087.885] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0xc1c4e420 [0087.885] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0x91fbb183 [0087.885] RtlRandom (in: Seed=0x3c4ff970 | out: Seed=0x3c4ff970) returned 0x7f643c59 Thread: id = 1752 os_tid = 0x28ac [0087.894] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\ZvrHdgI31lQLP-9mxi.swf" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\oh5\\zvrhdgi31lqlp-9mxi.swf")) returned 0x20 [0087.894] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\ZvrHdgI31lQLP-9mxi.swf", dwFileAttributes=0x20) returned 1 [0087.894] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\Oh5\\ZvrHdgI31lQLP-9mxi.swf" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\oh5\\zvrhdgi31lqlp-9mxi.swf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21d0 [0087.895] GetFileSizeEx (in: hFile=0x21d0, lpFileSize=0x3c57fb18 | out: lpFileSize=0x3c57fb18*=97445) returned 1 [0087.895] SetFilePointerEx (in: hFile=0x21d0, liDistanceToMove=0x17ca1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.895] ReadFile (in: hFile=0x21d0, lpBuffer=0x3c57fa9c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c57fa98, lpOverlapped=0x0 | out: lpBuffer=0x3c57fa9c*, lpNumberOfBytesRead=0x3c57fa98*=0x4, lpOverlapped=0x0) returned 1 [0087.895] SetFilePointerEx (in: hFile=0x21d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.895] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032f40 [0087.895] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe033008 [0087.895] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0321d0 [0087.895] NtQuerySystemTime (in: CurrentTime=0x3c57fa78 | out: CurrentTime=0x3c57fa78*=132260136450487002) returned 0x0 [0087.895] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0x8ef5d186 [0087.895] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0x919c64f [0087.895] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0x2d2aaaf7 [0087.895] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0x1ee8a0af [0087.895] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0x9357b216 [0087.895] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0x6ea00cef [0087.895] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0xd757e826 [0087.895] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0x4bc4d2f4 [0087.895] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0x68eab428 [0087.895] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0x8b44701e [0087.895] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0x257bf36e [0087.895] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0xe7a1e11f [0087.895] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0xd4b6d4c1 [0087.895] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0x8db19031 [0087.895] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0xae11288 [0087.895] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0x5e5f158d [0087.895] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0x37c896e8 [0087.895] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0xac0fc91d [0087.895] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0xd37d3bfb [0087.895] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0x997a6704 [0087.895] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0x46ff0de1 [0087.895] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0xb9d05dda [0087.895] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0x65da4c2a [0087.895] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0x599f5b49 [0087.895] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0xdff9887a [0087.895] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0xe88fcc90 [0087.895] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0x2c5d65e [0087.895] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0x33b20e6c [0087.895] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0x995ac272 [0087.895] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0xde10be43 [0087.896] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0x7f517692 [0087.896] RtlRandom (in: Seed=0x3c57fa84 | out: Seed=0x3c57fa84) returned 0x78432e43 Thread: id = 1753 os_tid = 0x28b0 [0087.919] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\-Rby7lqvDeb-nM.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\bxovoayqyls8jk\\-rby7lqvdeb-nm.mkv")) returned 0x20 [0087.920] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\-Rby7lqvDeb-nM.mkv", dwFileAttributes=0x20) returned 1 [0087.920] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\-Rby7lqvDeb-nM.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\bxovoayqyls8jk\\-rby7lqvdeb-nm.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21d4 [0087.920] GetFileSizeEx (in: hFile=0x21d4, lpFileSize=0x3c5ff814 | out: lpFileSize=0x3c5ff814*=12075) returned 1 [0087.920] SetFilePointerEx (in: hFile=0x21d4, liDistanceToMove=0x2f27, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.920] ReadFile (in: hFile=0x21d4, lpBuffer=0x3c5ff798, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c5ff794, lpOverlapped=0x0 | out: lpBuffer=0x3c5ff798*, lpNumberOfBytesRead=0x3c5ff794*=0x4, lpOverlapped=0x0) returned 1 [0087.920] SetFilePointerEx (in: hFile=0x21d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.920] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032f40 [0087.920] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032428 [0087.920] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0321d0 [0087.920] NtQuerySystemTime (in: CurrentTime=0x3c5ff774 | out: CurrentTime=0x3c5ff774*=132260136450799588) returned 0x0 [0087.920] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0x7bba64c8 [0087.920] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0xe518e38c [0087.920] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0x9d408d5a [0087.920] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0x4aca16cd [0087.920] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0x51edb3b5 [0087.920] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0xfa32a761 [0087.920] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0xdee6dcdf [0087.920] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0x7ed6529d [0087.921] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0x29d4709c [0087.921] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0x9dd28f15 [0087.921] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0x1a974c7b [0087.921] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0x2c242c04 [0087.921] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0xdb93386d [0087.921] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0x336bd67e [0087.921] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0xfbcd809f [0087.921] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0x7fd7191b [0087.921] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0xbab8f3ae [0087.921] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0x6cff0cfb [0087.921] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0xd7e5b539 [0087.921] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0x16673c4a [0087.921] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0xc419f564 [0087.921] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0x56cd5646 [0087.921] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0x965c55f9 [0087.921] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0xe512b48d [0087.921] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0x253b3ae6 [0087.921] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0x6a7c2346 [0087.921] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0x892eb1f6 [0087.921] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0x30ac85bd [0087.921] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0x5b16d35d [0087.921] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0x5529493f [0087.921] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0x5319a240 [0087.921] RtlRandom (in: Seed=0x3c5ff780 | out: Seed=0x3c5ff780) returned 0x2d4c8942 Thread: id = 1754 os_tid = 0x28b4 [0087.937] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\DyTplOcj_Hb.flv" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\bxovoayqyls8jk\\dytplocj_hb.flv")) returned 0x20 [0087.937] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\DyTplOcj_Hb.flv", dwFileAttributes=0x20) returned 1 [0087.937] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\DyTplOcj_Hb.flv" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\bxovoayqyls8jk\\dytplocj_hb.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21d8 [0087.938] GetFileSizeEx (in: hFile=0x21d8, lpFileSize=0x3c67fa14 | out: lpFileSize=0x3c67fa14*=79667) returned 1 [0087.938] SetFilePointerEx (in: hFile=0x21d8, liDistanceToMove=0x1372f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.938] ReadFile (in: hFile=0x21d8, lpBuffer=0x3c67f998, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c67f994, lpOverlapped=0x0 | out: lpBuffer=0x3c67f998*, lpNumberOfBytesRead=0x3c67f994*=0x4, lpOverlapped=0x0) returned 1 [0087.938] SetFilePointerEx (in: hFile=0x21d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.938] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032f40 [0087.938] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032450 [0087.938] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0321d0 [0087.938] NtQuerySystemTime (in: CurrentTime=0x3c67f974 | out: CurrentTime=0x3c67f974*=132260136451042397) returned 0x0 [0087.938] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0xef72aba7 [0087.938] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0x52025594 [0087.938] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0x327b3967 [0087.938] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0xb7fb19f4 [0087.938] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0xb61ba81b [0087.938] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0xc49e0512 [0087.938] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0x98c34795 [0087.938] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0x3849b189 [0087.938] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0xfc8ed108 [0087.938] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0xe58b388f [0087.938] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0x4e417950 [0087.938] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0xe161d46 [0087.938] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0xa2a0e659 [0087.938] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0x528d65f [0087.938] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0x6258b18c [0087.938] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0xd32ad21e [0087.938] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0xacad05c [0087.939] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0xa1009f62 [0087.939] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0x924cd04e [0087.939] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0xa28ff382 [0087.939] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0xac3301bd [0087.939] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0x7ab82402 [0087.939] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0xf33c1b88 [0087.939] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0xb3a7d261 [0087.939] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0xa021f07e [0087.939] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0xfa94e426 [0087.939] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0x16f50015 [0087.939] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0x78a71e18 [0087.939] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0xfc915f6 [0087.939] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0xe328bff2 [0087.939] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0x87beb425 [0087.939] RtlRandom (in: Seed=0x3c67f980 | out: Seed=0x3c67f980) returned 0xb09aaf73 Thread: id = 1755 os_tid = 0x28b8 [0087.950] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\gyl0Juvrwt3WAnJzr.flv" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\bxovoayqyls8jk\\gyl0juvrwt3wanjzr.flv")) returned 0x20 [0087.950] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\gyl0Juvrwt3WAnJzr.flv", dwFileAttributes=0x20) returned 1 [0087.951] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\gyl0Juvrwt3WAnJzr.flv" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\bxovoayqyls8jk\\gyl0juvrwt3wanjzr.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21dc [0087.951] GetFileSizeEx (in: hFile=0x21dc, lpFileSize=0x3c6ffdcc | out: lpFileSize=0x3c6ffdcc*=96321) returned 1 [0087.951] SetFilePointerEx (in: hFile=0x21dc, liDistanceToMove=0x1783d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.951] ReadFile (in: hFile=0x21dc, lpBuffer=0x3c6ffd50, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c6ffd4c, lpOverlapped=0x0 | out: lpBuffer=0x3c6ffd50*, lpNumberOfBytesRead=0x3c6ffd4c*=0x4, lpOverlapped=0x0) returned 1 [0087.951] SetFilePointerEx (in: hFile=0x21dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.951] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032f40 [0087.951] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032478 [0087.951] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0321d0 [0087.951] NtQuerySystemTime (in: CurrentTime=0x3c6ffd2c | out: CurrentTime=0x3c6ffd2c*=132260136451172693) returned 0x0 [0087.951] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0x4c71485b [0087.951] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0x543c948b [0087.951] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0x463739d [0087.951] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0x71e0f3fa [0087.951] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0x7e143ea3 [0087.951] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0xe5254398 [0087.951] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0xdb1ee1b2 [0087.951] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0x78783314 [0087.951] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0xe87ccb30 [0087.951] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0xeb834742 [0087.951] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0x8324f999 [0087.952] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0x87edf889 [0087.952] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0x1e1bd556 [0087.952] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0xee776b55 [0087.952] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0x9299e3e6 [0087.952] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0xfada5423 [0087.952] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0xf90eabcc [0087.952] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0xcae6db74 [0087.952] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0x7e8bf70e [0087.952] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0xa5ba42b4 [0087.952] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0xc58a839c [0087.952] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0x3fd28f1 [0087.952] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0x1d29c01f [0087.952] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0xab363c5d [0087.952] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0xf53dc8a2 [0087.952] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0xe76556c3 [0087.952] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0x632c5f10 [0087.952] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0xab89b970 [0087.952] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0xec8b0a14 [0087.952] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0x177a4b2e [0087.952] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0xa6bb75f8 [0087.952] RtlRandom (in: Seed=0x3c6ffd38 | out: Seed=0x3c6ffd38) returned 0x75a55f03 Thread: id = 1756 os_tid = 0x28bc [0087.967] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\iXqfQB_G9v_u.swf" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\bxovoayqyls8jk\\ixqfqb_g9v_u.swf")) returned 0x20 [0087.967] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\iXqfQB_G9v_u.swf", dwFileAttributes=0x20) returned 1 [0087.967] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\iXqfQB_G9v_u.swf" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\bxovoayqyls8jk\\ixqfqb_g9v_u.swf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21e0 [0087.967] GetFileSizeEx (in: hFile=0x21e0, lpFileSize=0x3c77f88c | out: lpFileSize=0x3c77f88c*=6164) returned 1 [0087.967] SetFilePointerEx (in: hFile=0x21e0, liDistanceToMove=0x1810, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.967] ReadFile (in: hFile=0x21e0, lpBuffer=0x3c77f810, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c77f80c, lpOverlapped=0x0 | out: lpBuffer=0x3c77f810*, lpNumberOfBytesRead=0x3c77f80c*=0x4, lpOverlapped=0x0) returned 1 [0087.967] SetFilePointerEx (in: hFile=0x21e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.967] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032f40 [0087.967] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0324a0 [0087.967] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0321d0 [0087.968] NtQuerySystemTime (in: CurrentTime=0x3c77f7ec | out: CurrentTime=0x3c77f7ec*=132260136451335587) returned 0x0 [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0x15a0d46 [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0x47ef13bb [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0xbb570bab [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0xdea51c6b [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0x339a3fe7 [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0x5ea1ba6c [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0xbf46b5bc [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0x3f4bc3d9 [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0xbb354994 [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0xcb0f255d [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0xbf994f35 [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0x378b833c [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0x4bc298c4 [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0x71edccf9 [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0x2bd188e8 [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0xeb68d009 [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0x4431f5a6 [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0xaa4f1857 [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0x61de84f8 [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0xbb784433 [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0xdc1793bf [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0x2be1ad5a [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0x70562858 [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0xf3d7ba4a [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0x658bb27f [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0xfe94b24b [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0xc2b8df0b [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0xd88c7620 [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0x1d0088bf [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0x10dde1cd [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0x61d5609d [0087.968] RtlRandom (in: Seed=0x3c77f7f8 | out: Seed=0x3c77f7f8) returned 0xf100868d Thread: id = 1757 os_tid = 0x28c0 [0087.979] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\lXHSP.flv" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\bxovoayqyls8jk\\lxhsp.flv")) returned 0x20 [0087.979] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\lXHSP.flv", dwFileAttributes=0x20) returned 1 [0087.979] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\lXHSP.flv" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\bxovoayqyls8jk\\lxhsp.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21e4 [0087.979] GetFileSizeEx (in: hFile=0x21e4, lpFileSize=0x3c7ffbd0 | out: lpFileSize=0x3c7ffbd0*=40385) returned 1 [0087.979] SetFilePointerEx (in: hFile=0x21e4, liDistanceToMove=0x9dbd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.979] ReadFile (in: hFile=0x21e4, lpBuffer=0x3c7ffb54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c7ffb50, lpOverlapped=0x0 | out: lpBuffer=0x3c7ffb54*, lpNumberOfBytesRead=0x3c7ffb50*=0x4, lpOverlapped=0x0) returned 1 [0087.979] SetFilePointerEx (in: hFile=0x21e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.979] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032f40 [0087.979] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0324c8 [0087.979] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0321d0 [0087.979] NtQuerySystemTime (in: CurrentTime=0x3c7ffb30 | out: CurrentTime=0x3c7ffb30*=132260136451420591) returned 0x0 [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0x63ea1fd1 [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0x9c0832f8 [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0x8dd94977 [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0xed8bf0d6 [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0xe863b1f [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0x30d03863 [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0x328592be [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0x3c84a5a5 [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0x4c8e6f1f [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0x67fb76ae [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0x480aa3d8 [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0x791dcaea [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0x55e7792d [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0xd5318402 [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0xd46e7688 [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0xbe086b0f [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0xcf535646 [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0x4eb1db8f [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0x6c592639 [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0xdf2743b9 [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0x9a0f5e7a [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0xa7ed4133 [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0xe2863861 [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0xfcc470bd [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0x5b94e45e [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0x4b030d18 [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0x5c2ff759 [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0xa7ca15c2 [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0xbe54c288 [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0x29a4bf39 [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0x1aa3097 [0087.980] RtlRandom (in: Seed=0x3c7ffb3c | out: Seed=0x3c7ffb3c) returned 0x6ae13f9b Thread: id = 1758 os_tid = 0x28c4 [0087.989] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\TNhbiIx 01.avi" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\bxovoayqyls8jk\\tnhbiix 01.avi")) returned 0x20 [0087.989] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\TNhbiIx 01.avi", dwFileAttributes=0x20) returned 1 [0087.990] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\TNhbiIx 01.avi" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\bxovoayqyls8jk\\tnhbiix 01.avi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21e8 [0087.990] GetFileSizeEx (in: hFile=0x21e8, lpFileSize=0x3c87ff24 | out: lpFileSize=0x3c87ff24*=31190) returned 1 [0087.990] SetFilePointerEx (in: hFile=0x21e8, liDistanceToMove=0x79d2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.990] ReadFile (in: hFile=0x21e8, lpBuffer=0x3c87fea8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c87fea4, lpOverlapped=0x0 | out: lpBuffer=0x3c87fea8*, lpNumberOfBytesRead=0x3c87fea4*=0x4, lpOverlapped=0x0) returned 1 [0087.990] SetFilePointerEx (in: hFile=0x21e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.990] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032f40 [0087.990] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032108 [0087.990] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0321d0 [0087.990] NtQuerySystemTime (in: CurrentTime=0x3c87fe84 | out: CurrentTime=0x3c87fe84*=132260136451420591) returned 0x0 [0087.990] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0x64792e98 [0087.990] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0x85a3a571 [0087.990] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0x237a3f5 [0087.990] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0xba360b26 [0087.990] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0xc95e2221 [0087.990] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0x1bfb795 [0087.990] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0xe96fe8d2 [0087.990] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0x45fcb59d [0087.990] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0xb372719a [0087.990] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0xbb07e964 [0087.990] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0x27ebb [0087.990] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0xcf0ca546 [0087.990] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0x124bdb3a [0087.990] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0xe5914117 [0087.990] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0x9efe6806 [0087.990] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0x17e45d10 [0087.990] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0x5a9d2e19 [0087.990] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0x8174a1b3 [0087.990] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0xbbb1e18a [0087.990] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0xf50503d2 [0087.990] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0x79c4dc69 [0087.991] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0x23904ee6 [0087.991] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0x56997d67 [0087.991] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0x6aaac142 [0087.991] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0xc5dcd5e2 [0087.991] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0x423b43a0 [0087.991] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0xbcae9dc9 [0087.991] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0xe60fd84c [0087.991] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0x7a34afef [0087.991] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0xdbf29de1 [0087.991] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0x92afa0a7 [0087.991] RtlRandom (in: Seed=0x3c87fe90 | out: Seed=0x3c87fe90) returned 0xe1a094a8 Thread: id = 1759 os_tid = 0x28c8 [0088.004] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\uwJxsovSXPTKJH0L67.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\bxovoayqyls8jk\\uwjxsovsxptkjh0l67.mp4")) returned 0x20 [0088.004] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\uwJxsovSXPTKJH0L67.mp4", dwFileAttributes=0x20) returned 1 [0088.004] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\uwJxsovSXPTKJH0L67.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\bxovoayqyls8jk\\uwjxsovsxptkjh0l67.mp4"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21ec [0088.004] GetFileSizeEx (in: hFile=0x21ec, lpFileSize=0x3c8ff988 | out: lpFileSize=0x3c8ff988*=74089) returned 1 [0088.004] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0x12165, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.004] ReadFile (in: hFile=0x21ec, lpBuffer=0x3c8ff90c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c8ff908, lpOverlapped=0x0 | out: lpBuffer=0x3c8ff90c*, lpNumberOfBytesRead=0x3c8ff908*=0x4, lpOverlapped=0x0) returned 1 [0088.004] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.004] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032f40 [0088.004] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032180 [0088.004] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0321d0 [0088.004] NtQuerySystemTime (in: CurrentTime=0x3c8ff8e8 | out: CurrentTime=0x3c8ff8e8*=132260136451577961) returned 0x0 [0088.004] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0x53e16e8 [0088.004] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0xd83cb595 [0088.004] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0x3abb18fe [0088.004] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0x9d0bd658 [0088.004] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0x9bc02df5 [0088.004] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0xbe96ef52 [0088.005] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0xa4f708f9 [0088.005] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0x6fa1a09a [0088.005] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0x5996c901 [0088.005] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0xf65fbfd4 [0088.005] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0x48dfe105 [0088.005] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0xb99778d6 [0088.005] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0x97663d92 [0088.005] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0x95af0624 [0088.005] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0xe21fab27 [0088.005] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0xcb204154 [0088.005] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0xbd7d9092 [0088.005] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0x9513b6cf [0088.005] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0x4874aaca [0088.005] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0xc67fc2ad [0088.005] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0xda4277cf [0088.005] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0x5b65359f [0088.005] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0x7301b767 [0088.005] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0xa1393a0a [0088.005] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0xf094e22a [0088.005] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0x62a72b82 [0088.005] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0x58ee1d62 [0088.005] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0x87833f58 [0088.005] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0xf9415d04 [0088.005] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0xdd172711 [0088.005] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0xe3b61bbb [0088.005] RtlRandom (in: Seed=0x3c8ff8f4 | out: Seed=0x3c8ff8f4) returned 0x1bb33a16 Thread: id = 1760 os_tid = 0x28cc [0088.015] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\zTp 07Muzep9Gcg6BXy.flv" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\bxovoayqyls8jk\\ztp 07muzep9gcg6bxy.flv")) returned 0x20 [0088.015] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\zTp 07Muzep9Gcg6BXy.flv", dwFileAttributes=0x20) returned 1 [0088.015] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\IgPHumGpOyi\\bxovOAyqYLs8jk\\zTp 07Muzep9Gcg6BXy.flv" (normalized: "c:\\users\\fd1hvy\\videos\\igphumgpoyi\\bxovoayqyls8jk\\ztp 07muzep9gcg6bxy.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x21f0 [0088.015] GetFileSizeEx (in: hFile=0x21f0, lpFileSize=0x3c97fcfc | out: lpFileSize=0x3c97fcfc*=43610) returned 1 [0088.015] SetFilePointerEx (in: hFile=0x21f0, liDistanceToMove=0xaa56, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.015] ReadFile (in: hFile=0x21f0, lpBuffer=0x3c97fc80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c97fc7c, lpOverlapped=0x0 | out: lpBuffer=0x3c97fc80*, lpNumberOfBytesRead=0x3c97fc7c*=0x4, lpOverlapped=0x0) returned 1 [0088.015] SetFilePointerEx (in: hFile=0x21f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.015] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032f40 [0088.015] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0321d0 [0088.015] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe032220 [0088.015] NtQuerySystemTime (in: CurrentTime=0x3c97fc5c | out: CurrentTime=0x3c97fc5c*=132260136451734155) returned 0x0 [0088.015] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0xc36ed305 [0088.015] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0x3395fb8a [0088.015] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0x9e631950 [0088.015] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0x2eb52cc8 [0088.015] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0xf00ec9be [0088.015] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0xb1d95691 [0088.015] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0xa32edefd [0088.015] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0xbc90bca1 [0088.015] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0x4182e1a8 [0088.016] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0x9423753 [0088.016] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0x26036a5b [0088.016] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0xa37d2f31 [0088.016] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0x7b32823d [0088.016] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0x77ff0a58 [0088.016] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0xac8e21b6 [0088.016] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0xe9097a2a [0088.016] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0x3655a36c [0088.016] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0x31e1d30c [0088.016] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0xebb0a9f8 [0088.016] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0x5dfe20a6 [0088.016] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0xb56c6e35 [0088.016] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0x8497ab9f [0088.016] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0x6732b8d4 [0088.016] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0x89128e2c [0088.016] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0x2ee19964 [0088.016] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0x7056b018 [0088.016] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0x62c41d3 [0088.016] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0xe0ce722 [0088.016] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0x6e91006f [0088.016] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0x88805b39 [0088.016] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0x869ab8c8 [0088.016] RtlRandom (in: Seed=0x3c97fc68 | out: Seed=0x3c97fc68) returned 0x6a8cc62 Thread: id = 1761 os_tid = 0x28d0 [0088.092] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\GetSMDL2.ttf" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\resources\\getsmdl2.ttf")) returned 0x20 [0088.093] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\GetSMDL2.ttf", dwFileAttributes=0x20) returned 0 [0088.093] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\GetSMDL2.ttf" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\resources\\getsmdl2.ttf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0088.093] GetLastError () returned 0x5 [0088.093] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\GetSMDL2.ttf", dwFileAttributes=0x20) returned 0 [0088.094] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39706d0) returned 1 Thread: id = 1762 os_tid = 0x28d4 [0088.095] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x53f80a0 [0088.095] wcscpy (in: _Dest=0x53f80a0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage" [0088.095] wcscat (in: _Dest=0x53f80a0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\" [0088.095] wcscat (in: _Dest=0x53f80a0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\*" [0088.095] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53ce678 [0088.095] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\*", lpFindFileData=0x53ce678 | out: lpFindFileData=0x53ce678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fa750b2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab78e843, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fac1569, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7568048 [0088.097] wcscmp (_String1=".", _String2=".") returned 0 [0088.097] FindNextFileW (hFindFile=0x7568048, lpFindFileData=0x53ce678) Thread: id = 1763 os_tid = 0x28d8 [0088.097] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_resources\\0.rsrc")) returned 0x20 [0088.097] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc", dwFileAttributes=0x20) returned 0 [0088.097] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_resources\\0.rsrc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0088.097] GetLastError () returned 0x5 [0088.097] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc", dwFileAttributes=0x20) returned 0 [0088.097] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fa4b0) returned 1 Thread: id = 1764 os_tid = 0x28dc [0088.099] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_resources\\index.txt")) returned 0x20 [0088.099] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt", dwFileAttributes=0x20) returned 0 [0088.100] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_resources\\index.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0088.100] GetLastError () returned 0x5 [0088.100] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt", dwFileAttributes=0x20) returned 0 [0088.100] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39707a0) returned 1 Thread: id = 1765 os_tid = 0x28e0 [0088.104] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x39762d8 [0088.104] wcscpy (in: _Dest=0x39762d8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop" [0088.104] wcscat (in: _Dest=0x39762d8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\" [0088.105] wcscat (in: _Dest=0x39762d8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\*" [0088.105] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x53ce8e0 [0088.105] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\*", lpFindFileData=0x53ce8e0 | out: lpFindFileData=0x53ce8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f8f31a9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c1a05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f919407, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7568088 [0088.106] wcscmp (_String1=".", _String2=".") returned 0 [0088.106] FindNextFileW (hFindFile=0x7568088, lpFindFileData=0x53ce8e0) Thread: id = 1860 os_tid = 0x2a5c [0089.938] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\premium_background_icon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\assets\\premium_background_icon.png")) returned 0x20 [0089.939] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\premium_background_icon.png", dwFileAttributes=0x20) returned 0 [0089.940] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\premium_background_icon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\assets\\premium_background_icon.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.940] GetLastError () returned 0x5 [0089.940] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\premium_background_icon.png", dwFileAttributes=0x20) returned 0 [0089.940] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74d6078) returned 1 Thread: id = 1861 os_tid = 0x2a6c [0089.941] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x74dc1a8 [0089.941] wcscpy (in: _Dest=0x74dc1a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\Default" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\Default") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\Default" [0089.941] wcscat (in: _Dest=0x74dc1a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\Default\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\Default\\" [0089.941] wcscat (in: _Dest=0x74dc1a8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\Default\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\Default\\*" [0089.941] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x39375d8 [0089.941] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\Default\\*", lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3499a434, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac371336, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3499a434, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54452c0 [0089.941] wcscmp (_String1=".", _String2=".") returned 0 [0089.941] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3499a434, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac371336, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3499a434, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.942] wcscmp (_String1="..", _String2=".") returned 1 [0089.942] wcscmp (_String1="..", _String2="..") returned 0 [0089.942] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3499a434, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x349c067b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x349c067b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xb66f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCasualGames.zip", cAlternateFileName="")) returned 1 [0089.942] wcscmp (_String1="MSCasualGames.zip", _String2=".") returned 1 [0089.942] wcscmp (_String1="MSCasualGames.zip", _String2="..") returned 1 [0089.942] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x126) returned 0x5ba94b0 [0089.942] wcscpy (in: _Dest=0x5ba94b0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\Default" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\Default") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\Default" [0089.942] wcscat (in: _Dest=0x5ba94b0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\Default\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\Default\\" [0089.942] wcscat (in: _Dest=0x5ba94b0, _Source="MSCasualGames.zip" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\Default\\MSCasualGames.zip") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\Default\\MSCasualGames.zip" [0089.942] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba94b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15fc [0089.942] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3499a434, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x349c067b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x349c067b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xb66f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCasualGames.zip", cAlternateFileName="")) returned 0 [0089.942] FindClose (in: hFindFile=0x54452c0 | out: hFindFile=0x54452c0) returned 1 [0089.943] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39375d8) returned 1 [0089.943] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74dc1a8) returned 1 [0089.943] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74d85f8) returned 1 Thread: id = 1862 os_tid = 0x2a70 [0089.944] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe6) returned 0x54b9cd8 [0089.944] wcscpy (in: _Dest=0x54b9cd8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs" [0089.944] wcscat (in: _Dest=0x54b9cd8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\" [0089.944] wcscat (in: _Dest=0x54b9cd8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\*" [0089.944] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x39375d8 [0089.944] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\*", lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa741b52, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e840 [0092.886] wcscmp (_String1=".", _String2=".") returned 0 [0092.886] FindNextFileW (in: hFindFile=0x389e840, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa741b52, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.886] wcscmp (_String1="..", _String2=".") returned 1 [0092.886] wcscmp (_String1="..", _String2="..") returned 0 [0092.886] FindNextFileW (in: hFindFile=0x389e840, lpFindFileData=0x39375d8 | out: lpFindFileData=0x39375d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa742614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Font", cAlternateFileName="")) returned 1 [0092.886] wcscmp (_String1="Font", _String2=".") returned 1 [0092.886] wcscmp (_String1="Font", _String2="..") returned 1 [0092.886] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x7332cf0 [0092.886] wcscpy (in: _Dest=0x7332cf0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs" [0092.886] wcscat (in: _Dest=0x7332cf0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\" [0092.886] wcscat (in: _Dest=0x7332cf0, _Source="Font" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font" Thread: id = 1863 os_tid = 0x2a74 [0089.944] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x54f1348 [0089.944] wcscpy (in: _Dest=0x54f1348, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes" [0089.944] wcscat (in: _Dest=0x54f1348, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\" [0089.945] wcscat (in: _Dest=0x54f1348, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\*" [0089.945] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3937840 [0089.945] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\*", lpFindFileData=0x3937840 | out: lpFindFileData=0x3937840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c490576, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c51ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c490576, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e800 [0092.882] wcscmp (_String1=".", _String2=".") returned 0 [0092.882] FindNextFileW (in: hFindFile=0x389e800, lpFindFileData=0x3937840 | out: lpFindFileData=0x3937840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c490576, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c51ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c490576, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.882] wcscmp (_String1="..", _String2=".") returned 1 [0092.882] wcscmp (_String1="..", _String2="..") returned 0 [0092.882] FindNextFileW (in: hFindFile=0x389e800, lpFindFileData=0x3937840 | out: lpFindFileData=0x3937840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c490576, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c490576, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c490576, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Generic.xbf", cAlternateFileName="")) returned 1 [0092.882] wcscmp (_String1="Generic.xbf", _String2=".") returned 1 [0092.882] wcscmp (_String1="Generic.xbf", _String2="..") returned 1 [0092.882] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x7332bf8 [0092.882] wcscpy (in: _Dest=0x7332bf8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes" [0092.882] wcscat (in: _Dest=0x7332bf8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\" [0092.882] wcscat (in: _Dest=0x7332bf8, _Source="Generic.xbf" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\Generic.xbf") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\Generic.xbf" Thread: id = 1864 os_tid = 0x2a78 [0089.945] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xac) returned 0x55c8fc8 [0089.945] wcscpy (in: _Dest=0x55c8fc8, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0089.945] wcscat (in: _Dest=0x55c8fc8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0089.945] wcscat (in: _Dest=0x55c8fc8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*" [0089.945] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3937d10 [0089.945] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54452c0 [0089.947] wcscmp (_String1=".", _String2=".") returned 0 [0089.947] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.947] wcscmp (_String1="..", _String2=".") returned 1 [0089.947] wcscmp (_String1="..", _String2="..") returned 0 [0089.947] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0089.947] wcscmp (_String1="background.png", _String2=".") returned 1 [0089.947] wcscmp (_String1="background.png", _String2="..") returned 1 [0089.947] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x53f7540 [0089.947] wcscpy (in: _Dest=0x53f7540, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0089.947] wcscat (in: _Dest=0x53f7540, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0089.947] wcscat (in: _Dest=0x53f7540, _Source="background.png" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" [0089.947] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53f7540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15ec [0089.948] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1 [0089.948] wcscmp (_String1="behavior.xml", _String2=".") returned 1 [0089.948] wcscmp (_String1="behavior.xml", _String2="..") returned 1 [0089.948] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x53f84b0 [0089.948] wcscpy (in: _Dest=0x53f84b0, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0089.948] wcscat (in: _Dest=0x53f84b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0089.948] wcscat (in: _Dest=0x53f84b0, _Source="behavior.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" [0089.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53f84b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13f8 [0089.949] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="device.png", cAlternateFileName="")) returned 1 [0089.949] wcscmp (_String1="device.png", _String2=".") returned 1 [0089.949] wcscmp (_String1="device.png", _String2="..") returned 1 [0089.949] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53f9768 [0089.949] wcscpy (in: _Dest=0x53f9768, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0089.949] wcscat (in: _Dest=0x53f9768, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0089.949] wcscat (in: _Dest=0x53f9768, _Source="device.png" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" [0089.949] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53f9768, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15dc [0089.950] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="overlay.png", cAlternateFileName="")) returned 1 [0089.950] wcscmp (_String1="overlay.png", _String2=".") returned 1 [0089.950] wcscmp (_String1="overlay.png", _String2="..") returned 1 [0089.950] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc0) returned 0x53f9a88 [0089.950] wcscpy (in: _Dest=0x53f9a88, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0089.950] wcscat (in: _Dest=0x53f9a88, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0089.950] wcscat (in: _Dest=0x53f9a88, _Source="overlay.png" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" [0089.950] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53f9a88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15d8 [0089.950] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 1 [0089.950] wcscmp (_String1="superbar.png", _String2=".") returned 1 [0089.950] wcscmp (_String1="superbar.png", _String2="..") returned 1 [0089.950] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x53f7880 [0089.950] wcscpy (in: _Dest=0x53f7880, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0089.950] wcscat (in: _Dest=0x53f7880, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0089.950] wcscat (in: _Dest=0x53f7880, _Source="superbar.png" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" [0089.950] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53f7880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15d0 [0089.951] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 0 [0089.951] FindClose (in: hFindFile=0x54452c0 | out: hFindFile=0x54452c0) returned 1 [0089.952] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3937d10) returned 1 [0089.952] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c8fc8) returned 1 [0089.952] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388fa90) returned 1 Thread: id = 1865 os_tid = 0x2a7c [0089.953] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xac) returned 0x55c8fc8 [0089.953] wcscpy (in: _Dest=0x55c8fc8, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" [0089.953] wcscat (in: _Dest=0x55c8fc8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\" [0089.953] wcscat (in: _Dest=0x55c8fc8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*" [0089.953] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3937d10 [0089.953] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54452c0 [0089.954] wcscmp (_String1=".", _String2=".") returned 0 [0089.954] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.954] wcscmp (_String1="..", _String2=".") returned 1 [0089.954] wcscmp (_String1="..", _String2="..") returned 0 [0089.954] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0089.954] wcscmp (_String1="background.png", _String2=".") returned 1 [0089.954] wcscmp (_String1="background.png", _String2="..") returned 1 [0089.954] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc6) returned 0x53f7610 [0089.954] wcscpy (in: _Dest=0x53f7610, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" [0089.954] wcscat (in: _Dest=0x53f7610, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\" [0089.954] wcscat (in: _Dest=0x53f7610, _Source="background.png" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" [0089.954] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53f7610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15cc [0089.955] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1 [0089.955] wcscmp (_String1="behavior.xml", _String2=".") returned 1 [0089.955] wcscmp (_String1="behavior.xml", _String2="..") returned 1 [0089.955] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc2) returned 0x53f8580 [0089.955] wcscpy (in: _Dest=0x53f8580, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" [0089.955] wcscat (in: _Dest=0x53f8580, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\" [0089.955] wcscat (in: _Dest=0x53f8580, _Source="behavior.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" [0089.955] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53f8580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c4 [0089.955] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png", cAlternateFileName="")) returned 1 [0089.955] wcscmp (_String1="watermark.png", _String2=".") returned 1 [0089.955] wcscmp (_String1="watermark.png", _String2="..") returned 1 [0089.955] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4) returned 0x53f76e0 [0089.955] wcscpy (in: _Dest=0x53f76e0, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" [0089.955] wcscat (in: _Dest=0x53f76e0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\" [0089.955] wcscat (in: _Dest=0x53f76e0, _Source="watermark.png" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" [0089.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x53f76e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15bc [0089.956] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png", cAlternateFileName="")) returned 0 [0089.956] FindClose (in: hFindFile=0x54452c0 | out: hFindFile=0x54452c0) returned 1 [0089.956] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3937d10) returned 1 [0089.956] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x55c8fc8) returned 1 [0089.956] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388f300) returned 1 Thread: id = 1866 os_tid = 0x2a80 [0089.957] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe6) returned 0x54b9eb8 [0089.958] wcscpy (in: _Dest=0x54b9eb8, _Source="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86" [0089.958] wcscat (in: _Dest=0x54b9eb8, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\" [0089.958] wcscat (in: _Dest=0x54b9eb8, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*" [0089.958] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3937d10 [0089.958] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54452c0 [0089.958] wcscmp (_String1=".", _String2=".") returned 0 [0089.958] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.958] wcscmp (_String1="..", _String2=".") returned 1 [0089.958] wcscmp (_String1="..", _String2="..") returned 0 [0089.958] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e42500, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe1e42500, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xe1e42500, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x4f699e, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0089.958] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0089.958] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0089.958] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce7900, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xcce7900, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xcce7900, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0089.958] wcscmp (_String1="vc_runtimeAdditional_x86.msi", _String2=".") returned 1 [0089.958] wcscmp (_String1="vc_runtimeAdditional_x86.msi", _String2="..") returned 1 [0089.958] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce7900, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xcce7900, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xcce7900, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0089.958] FindClose (in: hFindFile=0x54452c0 | out: hFindFile=0x54452c0) returned 1 [0089.958] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3937d10) returned 1 [0089.958] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b9eb8) returned 1 [0089.958] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54ba278) returned 1 Thread: id = 1867 os_tid = 0x2a84 [0089.959] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml")) returned 0x20 [0089.961] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml", dwFileAttributes=0x20) returned 0 [0089.962] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.964] GetLastError () returned 0x5 [0089.964] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml", dwFileAttributes=0x20) returned 0 [0089.965] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba5bf8) returned 1 Thread: id = 1868 os_tid = 0x2a88 [0089.966] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml")) returned 0x20 [0089.969] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml", dwFileAttributes=0x20) returned 0 [0089.971] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.972] GetLastError () returned 0x5 [0089.972] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml", dwFileAttributes=0x20) returned 0 [0089.973] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7582d68) returned 1 Thread: id = 1869 os_tid = 0x2a8c [0089.975] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\programdata\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0x24 [0089.976] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", dwFileAttributes=0x20) Thread: id = 1870 os_tid = 0x2a90 [0089.979] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\programdata\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0x24 [0089.979] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", dwFileAttributes=0x20) Thread: id = 1871 os_tid = 0x2a94 [0089.979] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x5468b70 [0089.979] wcscpy (in: _Dest=0x5468b70, _Source="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys" [0089.979] wcscat (in: _Dest=0x5468b70, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\" [0089.979] wcscat (in: _Dest=0x5468b70, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*" [0089.979] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3937d10 [0089.979] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54452c0 [0089.980] wcscmp (_String1=".", _String2=".") returned 0 [0089.980] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.980] wcscmp (_String1="..", _String2=".") returned 1 [0089.980] wcscmp (_String1="..", _String2="..") returned 0 [0089.980] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcb806263, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb806263, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcbbe5f7c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x8b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="F686AA~1")) returned 1 [0089.981] wcscmp (_String1="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", _String2=".") returned 1 [0089.981] wcscmp (_String1="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", _String2="..") returned 1 [0089.981] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xec) returned 0x54501c8 [0089.981] wcscpy (in: _Dest=0x54501c8, _Source="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys" [0089.981] wcscat (in: _Dest=0x54501c8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\" [0089.981] wcscat (in: _Dest=0x54501c8, _Source="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" [0089.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54501c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1598 [0089.981] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcb806263, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb806263, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcbbe5f7c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x8b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="F686AA~1")) returned 0 [0089.981] FindClose (in: hFindFile=0x54452c0 | out: hFindFile=0x54452c0) returned 1 [0089.982] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3937d10) returned 1 [0089.982] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5468b70) returned 1 [0089.982] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x6e959c8) returned 1 Thread: id = 1872 os_tid = 0x2a98 [0089.983] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5e) returned 0xe53a610 [0089.983] wcscpy (in: _Dest=0xe53a610, _Source="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18" [0089.983] wcscat (in: _Dest=0xe53a610, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" [0089.983] wcscat (in: _Dest=0xe53a610, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*" [0089.983] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3937d10 [0089.983] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54452c0 [0089.983] wcscmp (_String1=".", _String2=".") returned 0 [0089.983] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.983] wcscmp (_String1="..", _String2=".") returned 1 [0089.983] wcscmp (_String1="..", _String2="..") returned 0 [0089.983] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="4ECCD1~1")) returned 1 [0089.984] wcscmp (_String1="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", _String2=".") returned 1 [0089.984] wcscmp (_String1="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", _String2="..") returned 1 [0089.984] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe6) returned 0x54b9198 [0089.984] wcscpy (in: _Dest=0x54b9198, _Source="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18" [0089.984] wcscat (in: _Dest=0x54b9198, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" [0089.984] wcscat (in: _Dest=0x54b9198, _Source="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" [0089.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54b9198, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1568 [0089.984] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="4ECCD1~1")) returned 0 [0089.984] FindClose (in: hFindFile=0x54452c0 | out: hFindFile=0x54452c0) returned 1 [0089.985] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3937d10) returned 1 [0089.985] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe53a610) returned 1 [0089.985] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe53a338) returned 1 Thread: id = 1873 os_tid = 0x2a9c [0089.986] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x68) returned 0x5468b70 [0089.986] wcscpy (in: _Dest=0x5468b70, _Source="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK") returned="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK" [0089.986] wcscat (in: _Dest=0x5468b70, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\" [0089.986] wcscat (in: _Dest=0x5468b70, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\*" [0089.986] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3937d10 [0089.986] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\*", lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54452c0 [0089.986] wcscmp (_String1=".", _String2=".") returned 0 [0089.986] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.986] wcscmp (_String1="..", _String2=".") returned 1 [0089.986] wcscmp (_String1="..", _String2="..") returned 0 [0089.986] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.986] FindClose (in: hFindFile=0x54452c0 | out: hFindFile=0x54452c0) returned 1 [0089.986] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3937d10) returned 1 [0089.986] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5468b70) returned 1 [0089.987] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b2338) returned 1 Thread: id = 1874 os_tid = 0x2aa0 [0089.988] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x64) returned 0x5468b70 [0089.988] wcscpy (in: _Dest=0x5468b70, _Source="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys" [0089.988] wcscat (in: _Dest=0x5468b70, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\" [0089.988] wcscat (in: _Dest=0x5468b70, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*" [0089.988] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3937d10 [0089.988] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54452c0 [0089.989] wcscmp (_String1=".", _String2=".") returned 0 [0089.989] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.989] wcscmp (_String1="..", _String2=".") returned 1 [0089.989] wcscmp (_String1="..", _String2="..") returned 0 [0089.989] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.989] FindClose (in: hFindFile=0x54452c0 | out: hFindFile=0x54452c0) returned 1 [0089.989] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3937d10) returned 1 [0089.989] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5468b70) returned 1 [0089.989] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x6e95c38) returned 1 Thread: id = 1875 os_tid = 0x2aa4 [0089.990] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xde) returned 0x54f1430 [0089.990] wcscpy (in: _Dest=0x54f1430, _Source="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86" [0089.990] wcscat (in: _Dest=0x54f1430, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\" [0089.990] wcscat (in: _Dest=0x54f1430, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*" [0089.990] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3937d10 [0089.990] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54452c0 [0089.990] wcscmp (_String1=".", _String2=".") returned 0 [0089.990] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.990] wcscmp (_String1="..", _String2=".") returned 1 [0089.990] wcscmp (_String1="..", _String2="..") returned 0 [0089.990] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0xf36be, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0089.990] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0089.990] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0089.991] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0089.991] wcscmp (_String1="vc_runtimeMinimum_x86.msi", _String2=".") returned 1 [0089.991] wcscmp (_String1="vc_runtimeMinimum_x86.msi", _String2="..") returned 1 [0089.991] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0089.991] FindClose (in: hFindFile=0x54452c0 | out: hFindFile=0x54452c0) returned 1 [0089.991] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3937d10) returned 1 [0089.991] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f1430) returned 1 [0089.991] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f0a38) returned 1 Thread: id = 1876 os_tid = 0x2aa8 [0089.992] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat")) returned 0x20 [0089.994] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0089.994] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0089.994] GetLastError () returned 0x5 [0089.994] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0089.994] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba4af8) returned 1 Thread: id = 1877 os_tid = 0x2aac [0089.995] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\256x256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\256x256.png")) returned 0x20 [0089.998] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\256x256.png", dwFileAttributes=0x20) returned 0 [0090.000] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\256x256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\256x256.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.001] GetLastError () returned 0x5 [0090.001] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\256x256.png", dwFileAttributes=0x20) returned 0 [0090.003] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f0868) returned 1 Thread: id = 1878 os_tid = 0x2ab0 [0090.004] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.scale-200.png")) returned 0x20 [0090.007] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.scale-200.png", dwFileAttributes=0x20) returned 0 [0090.008] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.scale-200.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.009] GetLastError () returned 0x5 [0090.009] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.scale-200.png", dwFileAttributes=0x20) returned 0 [0090.011] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b2368) returned 1 Thread: id = 1879 os_tid = 0x2ab4 [0090.012] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-16.png")) returned 0x20 [0090.019] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-16.png", dwFileAttributes=0x20) returned 0 [0090.020] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-16.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.022] GetLastError () returned 0x5 [0090.022] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-16.png", dwFileAttributes=0x20) returned 0 [0090.023] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b11e8) returned 1 Thread: id = 1880 os_tid = 0x2ab8 [0090.024] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-16_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-16_altform-unplated.png")) returned 0x20 [0090.026] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-16_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0090.027] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-16_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-16_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.029] GetLastError () returned 0x5 [0090.029] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-16_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0090.030] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7587180) returned 1 Thread: id = 1881 os_tid = 0x2abc [0090.031] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-20.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-20.png")) returned 0x20 [0090.033] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-20.png", dwFileAttributes=0x20) returned 0 [0090.035] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-20.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-20.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.037] GetLastError () returned 0x5 [0090.037] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-20.png", dwFileAttributes=0x20) returned 0 [0090.038] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b1418) returned 1 Thread: id = 1882 os_tid = 0x2ac0 [0090.039] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-20_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-20_altform-unplated.png")) returned 0x20 [0090.041] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-20_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0090.043] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-20_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-20_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.044] GetLastError () returned 0x5 [0090.044] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-20_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0090.045] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75867c0) returned 1 Thread: id = 1883 os_tid = 0x2ac4 [0090.046] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-24.png")) returned 0x20 [0090.049] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-24.png", dwFileAttributes=0x20) returned 0 [0090.052] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-24.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.053] GetLastError () returned 0x5 [0090.053] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-24.png", dwFileAttributes=0x20) returned 0 [0090.055] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b0ea0) returned 1 Thread: id = 1884 os_tid = 0x2ac8 [0090.056] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-24_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-24_altform-unplated.png")) returned 0x20 [0090.057] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-24_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0090.059] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-24_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-24_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.060] GetLastError () returned 0x5 [0090.060] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-24_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0090.062] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7586dd8) returned 1 Thread: id = 1885 os_tid = 0x2acc [0090.063] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-256.png")) returned 0x20 [0090.065] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-256.png", dwFileAttributes=0x20) returned 0 [0090.068] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-256.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.069] GetLastError () returned 0x5 [0090.069] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-256.png", dwFileAttributes=0x20) returned 0 [0090.071] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b1878) returned 1 Thread: id = 1886 os_tid = 0x2ad0 [0090.072] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-256_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-256_altform-unplated.png")) returned 0x20 [0090.073] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-256_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0090.075] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-256_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-256_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.076] GetLastError () returned 0x5 [0090.076] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-256_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0090.078] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7587a08) returned 1 Thread: id = 1887 os_tid = 0x2ad4 [0090.079] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-30.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-30.png")) returned 0x20 [0090.081] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-30.png", dwFileAttributes=0x20) returned 0 [0090.084] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-30.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-30.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.085] GetLastError () returned 0x5 [0090.085] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-30.png", dwFileAttributes=0x20) returned 0 [0090.087] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b1760) returned 1 Thread: id = 1888 os_tid = 0x2ad8 [0090.088] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-30_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-30_altform-unplated.png")) returned 0x20 [0090.090] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-30_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0090.092] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-30_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-30_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.094] GetLastError () returned 0x5 [0090.094] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-30_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0090.095] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75872b8) returned 1 Thread: id = 1889 os_tid = 0x2adc [0090.097] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-32.png")) returned 0x20 [0090.098] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-32.png", dwFileAttributes=0x20) returned 0 [0090.100] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-32.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.102] GetLastError () returned 0x5 [0090.102] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-32.png", dwFileAttributes=0x20) returned 0 [0090.103] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b2480) returned 1 Thread: id = 1890 os_tid = 0x2ae0 [0090.104] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-32_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-32_altform-unplated.png")) returned 0x20 [0090.106] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-32_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0090.108] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-32_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-32_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.109] GetLastError () returned 0x5 [0090.109] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-32_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0090.111] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7587660) returned 1 Thread: id = 1891 os_tid = 0x2ae4 [0090.112] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-36.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-36.png")) returned 0x20 [0090.114] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-36.png", dwFileAttributes=0x20) returned 0 [0090.116] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-36.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-36.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.118] GetLastError () returned 0x5 [0090.118] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-36.png", dwFileAttributes=0x20) returned 0 [0090.119] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b0928) returned 1 Thread: id = 1892 os_tid = 0x2ae8 [0090.121] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-36_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-36_altform-unplated.png")) returned 0x20 [0090.122] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-36_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0090.124] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-36_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-36_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.125] GetLastError () returned 0x5 [0090.125] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-36_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0090.126] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7587b40) returned 1 Thread: id = 1893 os_tid = 0x2aec [0090.128] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-40.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-40.png")) returned 0x20 [0090.130] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-40.png", dwFileAttributes=0x20) returned 0 [0090.131] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-40.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-40.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.133] GetLastError () returned 0x5 [0090.133] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-40.png", dwFileAttributes=0x20) returned 0 [0090.134] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b1990) returned 1 Thread: id = 1894 os_tid = 0x2af0 [0090.135] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-40_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-40_altform-unplated.png")) returned 0x20 [0090.137] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-40_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0090.138] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-40_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-40_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.139] GetLastError () returned 0x5 [0090.139] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-40_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0090.141] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7588020) returned 1 Thread: id = 1895 os_tid = 0x2af4 [0090.142] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-48.png")) returned 0x20 [0090.144] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-48.png", dwFileAttributes=0x20) returned 0 [0090.145] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-48.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.147] GetLastError () returned 0x5 [0090.147] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-48.png", dwFileAttributes=0x20) returned 0 [0090.148] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b0d88) returned 1 Thread: id = 1896 os_tid = 0x2af8 [0090.149] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-48_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-48_altform-unplated.png")) returned 0x20 [0090.151] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-48_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0090.153] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-48_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-48_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.154] GetLastError () returned 0x5 [0090.154] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-48_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0090.156] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7587798) returned 1 Thread: id = 1897 os_tid = 0x2afc [0090.157] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-60.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-60.png")) returned 0x20 [0090.159] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-60.png", dwFileAttributes=0x20) returned 0 [0090.160] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-60.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-60.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.162] GetLastError () returned 0x5 [0090.162] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-60.png", dwFileAttributes=0x20) returned 0 [0090.163] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b0c70) returned 1 Thread: id = 1898 os_tid = 0x2b00 [0090.164] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-60_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-60_altform-unplated.png")) returned 0x20 [0090.165] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-60_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0090.167] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-60_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-60_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.168] GetLastError () returned 0x5 [0090.168] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-60_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0090.170] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75878d0) returned 1 Thread: id = 1899 os_tid = 0x2b04 [0090.171] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-64.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-64.png")) returned 0x20 [0090.173] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-64.png", dwFileAttributes=0x20) returned 0 [0090.174] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-64.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-64.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.176] GetLastError () returned 0x5 [0090.176] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-64.png", dwFileAttributes=0x20) returned 0 [0090.177] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b2598) returned 1 Thread: id = 1900 os_tid = 0x2b08 [0090.178] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-64_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-64_altform-unplated.png")) returned 0x20 [0090.180] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-64_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0090.181] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-64_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-64_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.183] GetLastError () returned 0x5 [0090.183] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-64_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0090.184] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7587c78) returned 1 Thread: id = 1901 os_tid = 0x2b0c [0090.185] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-72.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-72.png")) returned 0x20 [0090.187] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-72.png", dwFileAttributes=0x20) returned 0 [0090.189] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-72.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-72.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.190] GetLastError () returned 0x5 [0090.190] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-72.png", dwFileAttributes=0x20) returned 0 [0090.191] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b1300) returned 1 Thread: id = 1902 os_tid = 0x2b10 [0090.192] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-72_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-72_altform-unplated.png")) returned 0x20 [0090.194] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-72_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0090.195] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-72_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-72_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.196] GetLastError () returned 0x5 [0090.196] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-72_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0090.198] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75861a8) returned 1 Thread: id = 1903 os_tid = 0x2b14 [0090.199] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-80.png")) returned 0x20 [0090.201] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-80.png", dwFileAttributes=0x20) returned 0 [0090.202] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-80.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.204] GetLastError () returned 0x5 [0090.204] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-80.png", dwFileAttributes=0x20) returned 0 [0090.205] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b1aa8) returned 1 Thread: id = 1904 os_tid = 0x2b18 [0090.207] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-80_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-80_altform-unplated.png")) returned 0x20 [0090.209] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-80_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0090.210] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-80_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-80_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.211] GetLastError () returned 0x5 [0090.211] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-80_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0090.213] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75862e0) returned 1 Thread: id = 1905 os_tid = 0x2b1c [0090.214] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-96.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-96.png")) returned 0x20 [0090.216] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-96.png", dwFileAttributes=0x20) returned 0 [0090.217] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-96.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-96.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.219] GetLastError () returned 0x5 [0090.219] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-96.png", dwFileAttributes=0x20) returned 0 [0090.220] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b1bc0) returned 1 Thread: id = 1906 os_tid = 0x2b20 [0090.222] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-96_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-96_altform-unplated.png")) returned 0x20 [0090.223] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-96_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0090.225] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-96_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-96_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.226] GetLastError () returned 0x5 [0090.226] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-96_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0090.227] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7586a30) returned 1 Thread: id = 1907 os_tid = 0x2b24 [0090.229] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageBadgeLogo.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackagebadgelogo.scale-200.png")) returned 0x20 [0090.231] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageBadgeLogo.scale-200.png", dwFileAttributes=0x20) returned 0 [0090.232] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageBadgeLogo.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackagebadgelogo.scale-200.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.234] GetLastError () returned 0x5 [0090.235] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageBadgeLogo.scale-200.png", dwFileAttributes=0x20) returned 0 [0090.236] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b0fb8) returned 1 Thread: id = 1908 os_tid = 0x2b28 [0090.237] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageLargeTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackagelargetile.scale-200.png")) returned 0x20 [0090.239] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageLargeTile.scale-200.png", dwFileAttributes=0x20) returned 0 [0090.241] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageLargeTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackagelargetile.scale-200.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.242] GetLastError () returned 0x5 [0090.242] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageLargeTile.scale-200.png", dwFileAttributes=0x20) returned 0 [0090.243] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b2138) returned 1 Thread: id = 1909 os_tid = 0x2b2c [0090.244] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageMedTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackagemedtile.scale-200.png")) returned 0x20 [0090.247] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageMedTile.scale-200.png", dwFileAttributes=0x20) returned 0 [0090.248] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageMedTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackagemedtile.scale-200.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.250] GetLastError () returned 0x5 [0090.250] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageMedTile.scale-200.png", dwFileAttributes=0x20) returned 0 [0090.251] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b1cd8) returned 1 Thread: id = 1910 os_tid = 0x2b30 [0090.252] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageSmallTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackagesmalltile.scale-200.png")) returned 0x20 [0090.254] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageSmallTile.scale-200.png", dwFileAttributes=0x20) returned 0 [0090.256] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageSmallTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackagesmalltile.scale-200.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.257] GetLastError () returned 0x5 [0090.257] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageSmallTile.scale-200.png", dwFileAttributes=0x20) returned 0 [0090.259] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b10d0) returned 1 Thread: id = 1911 os_tid = 0x2b34 [0090.260] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageSplashScreen.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackagesplashscreen.scale-200.png")) returned 0x20 [0090.262] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageSplashScreen.scale-200.png", dwFileAttributes=0x20) returned 0 [0090.263] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageSplashScreen.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackagesplashscreen.scale-200.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.265] GetLastError () returned 0x5 [0090.265] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageSplashScreen.scale-200.png", dwFileAttributes=0x20) returned 0 [0090.266] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b26b0) returned 1 Thread: id = 1912 os_tid = 0x2b38 [0090.267] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageStoreLogo.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackagestorelogo.scale-200.png")) returned 0x20 [0090.269] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageStoreLogo.scale-200.png", dwFileAttributes=0x20) returned 0 [0090.271] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageStoreLogo.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackagestorelogo.scale-200.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.272] GetLastError () returned 0x5 [0090.272] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageStoreLogo.scale-200.png", dwFileAttributes=0x20) returned 0 [0090.273] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b1530) returned 1 Thread: id = 1913 os_tid = 0x2b3c [0090.274] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageWideTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackagewidetile.scale-200.png")) returned 0x20 [0090.276] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageWideTile.scale-200.png", dwFileAttributes=0x20) returned 0 [0090.278] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageWideTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackagewidetile.scale-200.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.279] GetLastError () returned 0x5 [0090.279] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageWideTile.scale-200.png", dwFileAttributes=0x20) returned 0 [0090.281] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b27c8) returned 1 Thread: id = 1914 os_tid = 0x2b40 [0090.282] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe4) returned 0x54b9eb8 [0090.282] wcscpy (in: _Dest=0x54b9eb8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black" [0090.282] wcscat (in: _Dest=0x54b9eb8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\" [0090.282] wcscat (in: _Dest=0x54b9eb8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\*" [0090.282] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3937d10 [0090.282] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\*", lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cf75299, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab3100a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d080313, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54452c0 [0090.285] wcscmp (_String1=".", _String2=".") returned 0 [0090.285] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cf75299, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab3100a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d080313, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.285] wcscmp (_String1="..", _String2=".") returned 1 [0090.285] wcscmp (_String1="..", _String2="..") returned 0 [0090.285] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cf75299, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9cf75299, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9cf75299, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.scale-200_contrast-black.png", cAlternateFileName="")) returned 1 [0090.286] wcscmp (_String1="AppPackageAppList.scale-200_contrast-black.png", _String2=".") returned 1 [0090.286] wcscmp (_String1="AppPackageAppList.scale-200_contrast-black.png", _String2="..") returned 1 [0090.286] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x13e) returned 0x758a590 [0090.286] wcscpy (in: _Dest=0x758a590, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black" [0090.286] wcscat (in: _Dest=0x758a590, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\" [0090.286] wcscat (in: _Dest=0x758a590, _Source="AppPackageAppList.scale-200_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.scale-200_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.scale-200_contrast-black.png" [0090.286] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x758a590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1050 [0090.286] FindNextFileW (in: hFindFile=0x54452c0, lpFindFileData=0x3937d10 | out: lpFindFileData=0x3937d10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cf75299, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9cf75299, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9cf75299, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.targetsize-16_altform-unplated_contrast-black.png", cAlternateFileName="")) returned 1 [0090.286] wcscmp (_String1="AppPackageAppList.targetsize-16_altform-unplated_contrast-black.png", _String2=".") returned 1 [0090.286] wcscmp (_String1="AppPackageAppList.targetsize-16_altform-unplated_contrast-black.png", _String2="..") returned 1 [0090.286] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x168) returned 0x39790e8 [0091.422] wcscpy (in: _Dest=0x39790e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black" [0091.422] wcscat (in: _Dest=0x39790e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\" [0091.422] wcscat (in: _Dest=0x39790e8, _Source="AppPackageAppList.targetsize-16_altform-unplated_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-16_altform-unplated_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-16_altform-unplated_contrast-black.png" Thread: id = 1915 os_tid = 0x2b44 [0090.287] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe4) returned 0x54b9fa8 [0090.287] wcscpy (in: _Dest=0x54b9fa8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white" [0090.287] wcscat (in: _Dest=0x54b9fa8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\" [0090.287] wcscat (in: _Dest=0x54b9fa8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\*" [0090.287] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x39381e0 [0090.287] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\*", lpFindFileData=0x39381e0 | out: lpFindFileData=0x39381e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d080313, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab39d704, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d18b39b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445300 [0090.289] wcscmp (_String1=".", _String2=".") returned 0 [0090.289] FindNextFileW (in: hFindFile=0x5445300, lpFindFileData=0x39381e0 | out: lpFindFileData=0x39381e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d080313, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab39d704, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d18b39b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.289] wcscmp (_String1="..", _String2=".") returned 1 [0090.289] wcscmp (_String1="..", _String2="..") returned 0 [0090.289] FindNextFileW (in: hFindFile=0x5445300, lpFindFileData=0x39381e0 | out: lpFindFileData=0x39381e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d080313, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9d080313, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9d080313, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x288, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.scale-200_contrast-white.png", cAlternateFileName="")) returned 1 [0090.290] wcscmp (_String1="AppPackageAppList.scale-200_contrast-white.png", _String2=".") returned 1 [0090.290] wcscmp (_String1="AppPackageAppList.scale-200_contrast-white.png", _String2="..") returned 1 [0090.290] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x13e) returned 0x758a6d8 [0090.290] wcscpy (in: _Dest=0x758a6d8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white" [0090.290] wcscat (in: _Dest=0x758a6d8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\" [0090.290] wcscat (in: _Dest=0x758a6d8, _Source="AppPackageAppList.scale-200_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.scale-200_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.scale-200_contrast-white.png" [0090.290] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x758a6d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1010 [0090.290] FindNextFileW (in: hFindFile=0x5445300, lpFindFileData=0x39381e0 | out: lpFindFileData=0x39381e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d080313, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9d080313, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9d080313, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.targetsize-16_altform-unplated_contrast-white.png", cAlternateFileName="")) returned 1 [0090.290] wcscmp (_String1="AppPackageAppList.targetsize-16_altform-unplated_contrast-white.png", _String2=".") returned 1 [0090.290] wcscmp (_String1="AppPackageAppList.targetsize-16_altform-unplated_contrast-white.png", _String2="..") returned 1 [0090.290] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x168) returned 0x53fd590 [0091.422] wcscpy (in: _Dest=0x53fd590, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white" [0091.422] wcscat (in: _Dest=0x53fd590, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\" [0091.422] wcscat (in: _Dest=0x53fd590, _Source="AppPackageAppList.targetsize-16_altform-unplated_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-16_altform-unplated_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-16_altform-unplated_contrast-white.png" Thread: id = 1916 os_tid = 0x2b48 [0090.291] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xda) returned 0x54f1430 [0090.291] wcscpy (in: _Dest=0x54f1430, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons" [0090.291] wcscat (in: _Dest=0x54f1430, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\" [0090.291] wcscat (in: _Dest=0x54f1430, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\*" [0090.291] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3938448 [0090.291] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\*", lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d18b39b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab446b84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d1d7849, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54453c0 [0090.292] wcscmp (_String1=".", _String2=".") returned 0 [0090.292] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d18b39b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab446b84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d1d7849, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.292] wcscmp (_String1="..", _String2=".") returned 1 [0090.292] wcscmp (_String1="..", _String2="..") returned 0 [0090.292] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d1b15f4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9d1b15f4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9d1b15f4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x11c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileLogoExtensions.targetsize-16.png", cAlternateFileName="")) returned 1 [0090.292] wcscmp (_String1="FileLogoExtensions.targetsize-16.png", _String2=".") returned 1 [0090.292] wcscmp (_String1="FileLogoExtensions.targetsize-16.png", _String2="..") returned 1 [0090.292] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x120) returned 0x54bca90 [0090.292] wcscpy (in: _Dest=0x54bca90, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons" [0090.292] wcscat (in: _Dest=0x54bca90, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\" [0090.292] wcscat (in: _Dest=0x54bca90, _Source="FileLogoExtensions.targetsize-16.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-16.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-16.png" [0090.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bca90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1008 [0090.293] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d1b15f4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9d1b15f4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9d1b15f4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileLogoExtensions.targetsize-20.png", cAlternateFileName="")) returned 1 [0090.293] wcscmp (_String1="FileLogoExtensions.targetsize-20.png", _String2=".") returned 1 [0090.293] wcscmp (_String1="FileLogoExtensions.targetsize-20.png", _String2="..") returned 1 [0090.293] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x120) returned 0x54bd3d0 [0090.293] wcscpy (in: _Dest=0x54bd3d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons" [0090.293] wcscat (in: _Dest=0x54bd3d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\" [0090.293] wcscat (in: _Dest=0x54bd3d0, _Source="FileLogoExtensions.targetsize-20.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-20.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-20.png" [0090.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bd3d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfcc [0090.294] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d1b15f4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9d1b15f4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9d1b15f4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileLogoExtensions.targetsize-24.png", cAlternateFileName="")) returned 1 [0090.294] wcscmp (_String1="FileLogoExtensions.targetsize-24.png", _String2=".") returned 1 [0090.294] wcscmp (_String1="FileLogoExtensions.targetsize-24.png", _String2="..") returned 1 [0090.294] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x120) returned 0x54bcbb8 [0090.294] wcscpy (in: _Dest=0x54bcbb8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons" [0090.294] wcscat (in: _Dest=0x54bcbb8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\" [0090.294] wcscat (in: _Dest=0x54bcbb8, _Source="FileLogoExtensions.targetsize-24.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-24.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-24.png" [0090.294] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bcbb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf68 [0090.295] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d1d7849, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9d1d7849, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9d1d7849, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x21a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileLogoExtensions.targetsize-256.png", cAlternateFileName="")) returned 1 [0090.295] wcscmp (_String1="FileLogoExtensions.targetsize-256.png", _String2=".") returned 1 [0090.295] wcscmp (_String1="FileLogoExtensions.targetsize-256.png", _String2="..") returned 1 [0090.295] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x122) returned 0x5ba9d38 [0090.295] wcscpy (in: _Dest=0x5ba9d38, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons" [0090.295] wcscat (in: _Dest=0x5ba9d38, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\" [0090.295] wcscat (in: _Dest=0x5ba9d38, _Source="FileLogoExtensions.targetsize-256.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-256.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-256.png" [0090.295] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba9d38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf5c [0090.295] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d1d7849, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9d1d7849, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9d1d7849, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileLogoExtensions.targetsize-32.png", cAlternateFileName="")) returned 1 [0090.296] wcscmp (_String1="FileLogoExtensions.targetsize-32.png", _String2=".") returned 1 [0090.296] wcscmp (_String1="FileLogoExtensions.targetsize-32.png", _String2="..") returned 1 [0090.296] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x120) returned 0x54bcce0 [0090.296] wcscpy (in: _Dest=0x54bcce0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons" [0090.296] wcscat (in: _Dest=0x54bcce0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\" [0090.296] wcscat (in: _Dest=0x54bcce0, _Source="FileLogoExtensions.targetsize-32.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-32.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-32.png" [0090.296] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bcce0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf58 [0090.296] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d1d7849, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9d1d7849, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9d1d7849, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileLogoExtensions.targetsize-40.png", cAlternateFileName="")) returned 1 [0090.296] wcscmp (_String1="FileLogoExtensions.targetsize-40.png", _String2=".") returned 1 [0090.296] wcscmp (_String1="FileLogoExtensions.targetsize-40.png", _String2="..") returned 1 [0090.296] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x120) returned 0x54bc968 [0090.296] wcscpy (in: _Dest=0x54bc968, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons" [0090.296] wcscat (in: _Dest=0x54bc968, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\" [0090.297] wcscat (in: _Dest=0x54bc968, _Source="FileLogoExtensions.targetsize-40.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-40.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-40.png" [0090.297] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bc968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc4 [0090.297] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d1d7849, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9d1d7849, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9d1d7849, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x6c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileLogoExtensions.targetsize-48.png", cAlternateFileName="")) returned 1 [0090.297] wcscmp (_String1="FileLogoExtensions.targetsize-48.png", _String2=".") returned 1 [0090.297] wcscmp (_String1="FileLogoExtensions.targetsize-48.png", _String2="..") returned 1 [0090.297] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x120) returned 0x54bd058 [0090.297] wcscpy (in: _Dest=0x54bd058, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons" [0090.297] wcscat (in: _Dest=0x54bd058, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\" [0090.297] wcscat (in: _Dest=0x54bd058, _Source="FileLogoExtensions.targetsize-48.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-48.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-48.png" [0090.297] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bd058, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc0 [0090.298] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d1d7849, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9d1d7849, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9d1d7849, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x959, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileLogoExtensions.targetsize-64.png", cAlternateFileName="")) returned 1 [0090.298] wcscmp (_String1="FileLogoExtensions.targetsize-64.png", _String2=".") returned 1 [0090.298] wcscmp (_String1="FileLogoExtensions.targetsize-64.png", _String2="..") returned 1 [0090.298] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x120) returned 0x54bd180 [0090.298] wcscpy (in: _Dest=0x54bd180, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons" [0090.298] wcscat (in: _Dest=0x54bd180, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\" [0090.298] wcscat (in: _Dest=0x54bd180, _Source="FileLogoExtensions.targetsize-64.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-64.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-64.png" [0090.298] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bd180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x408 [0090.299] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d1d7849, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9d1d7849, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9d1d7849, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x959, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileLogoExtensions.targetsize-64.png", cAlternateFileName="")) returned 0 [0090.299] FindClose (in: hFindFile=0x54453c0 | out: hFindFile=0x54453c0) returned 1 [0090.299] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3938448) returned 1 [0090.300] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f1430) returned 1 [0090.300] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3934488) returned 1 Thread: id = 1917 os_tid = 0x2b4c [0090.301] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\resources. 20a37ca.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\resources. 20a37ca.pri")) returned 0x2020 [0090.301] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\resources. 20a37ca.pri", dwFileAttributes=0x20) returned 0 [0090.302] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\resources. 20a37ca.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\resources. 20a37ca.pri"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.302] GetLastError () returned 0x5 [0090.302] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\resources. 20a37ca.pri", dwFileAttributes=0x2020) returned 0 [0090.302] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7587048) returned 1 Thread: id = 1918 os_tid = 0x2b50 [0090.303] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\S-1-5-21-1051304884-625712362-2192934891-1000-MergedResources-0.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\s-1-5-21-1051304884-625712362-2192934891-1000-mergedresources-0.pri")) returned 0x2020 [0091.420] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\S-1-5-21-1051304884-625712362-2192934891-1000-MergedResources-0.pri", dwFileAttributes=0x20) returned 0 [0091.421] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\S-1-5-21-1051304884-625712362-2192934891-1000-MergedResources-0.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\s-1-5-21-1051304884-625712362-2192934891-1000-mergedresources-0.pri"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.421] GetLastError () returned 0x5 [0091.421] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\S-1-5-21-1051304884-625712362-2192934891-1000-MergedResources-0.pri", dwFileAttributes=0x2020) returned 0 [0091.421] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe018ea8) returned 1 Thread: id = 1919 os_tid = 0x2b54 [0090.303] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x82) returned 0x549cd88 [0090.303] wcscpy (in: _Dest=0x549cd88, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0" [0090.303] wcscat (in: _Dest=0x549cd88, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0090.303] wcscat (in: _Dest=0x549cd88, _Source="*" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*" [0090.303] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3938448 [0090.303] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*", lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe795770f, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79a3b1b, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79a3b1b, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54453c0 [0090.305] wcscmp (_String1=".", _String2=".") returned 0 [0090.305] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe795770f, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79a3b1b, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79a3b1b, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.305] wcscmp (_String1="..", _String2=".") returned 1 [0090.305] wcscmp (_String1="..", _String2="..") returned 0 [0090.305] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x521bc005, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x521bc005, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xb81a9200, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x92000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationBuildTasks.dll", cAlternateFileName="")) returned 1 [0090.305] wcscmp (_String1="PresentationBuildTasks.dll", _String2=".") returned 1 [0090.305] wcscmp (_String1="PresentationBuildTasks.dll", _String2="..") returned 1 [0090.305] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5208acea, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x5208acea, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xb81a9200, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x3d2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationCore.dll", cAlternateFileName="")) returned 1 [0090.305] wcscmp (_String1="PresentationCore.dll", _String2=".") returned 1 [0090.305] wcscmp (_String1="PresentationCore.dll", _String2="..") returned 1 [0090.305] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x521e226f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x521e226f, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xb94bbf00, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Aero.dll", cAlternateFileName="")) returned 1 [0090.305] wcscmp (_String1="PresentationFramework.Aero.dll", _String2=".") returned 1 [0090.305] wcscmp (_String1="PresentationFramework.Aero.dll", _String2="..") returned 1 [0090.305] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x521e226f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x521e226f, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xb94bbf00, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Classic.dll", cAlternateFileName="")) returned 1 [0090.305] wcscmp (_String1="PresentationFramework.Classic.dll", _String2=".") returned 1 [0090.305] wcscmp (_String1="PresentationFramework.Classic.dll", _String2="..") returned 1 [0090.305] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x522084cb, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x522084cb, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xb94bbf00, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x46d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.dll", cAlternateFileName="")) returned 1 [0090.305] wcscmp (_String1="PresentationFramework.dll", _String2=".") returned 1 [0090.306] wcscmp (_String1="PresentationFramework.dll", _String2="..") returned 1 [0090.306] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x521e226f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x521e226f, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xb94bbf00, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x5d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Luna.dll", cAlternateFileName="")) returned 1 [0090.306] wcscmp (_String1="PresentationFramework.Luna.dll", _String2=".") returned 1 [0090.306] wcscmp (_String1="PresentationFramework.Luna.dll", _String2="..") returned 1 [0090.306] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x522084cb, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x522084cb, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xb94bbf00, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Royale.dll", cAlternateFileName="")) returned 1 [0090.306] wcscmp (_String1="PresentationFramework.Royale.dll", _String2=".") returned 1 [0090.306] wcscmp (_String1="PresentationFramework.Royale.dll", _String2="..") returned 1 [0090.306] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5227abf5, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x5227abf5, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xb94bbf00, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x82000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReachFramework.dll", cAlternateFileName="")) returned 1 [0090.306] wcscmp (_String1="ReachFramework.dll", _String2=".") returned 1 [0090.306] wcscmp (_String1="ReachFramework.dll", _String2="..") returned 1 [0090.306] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79a3b1b, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79a3b1b, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79a3b1b, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 1 [0090.306] wcscmp (_String1="RedistList", _String2=".") returned 1 [0090.306] wcscmp (_String1="RedistList", _String2="..") returned 1 [0090.306] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x94) returned 0x55c53f8 [0090.306] wcscpy (in: _Dest=0x55c53f8, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0" [0090.306] wcscat (in: _Dest=0x55c53f8, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0090.306] wcscat (in: _Dest=0x55c53f8, _Source="RedistList" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList" [0090.306] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55c53f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb0 [0090.307] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9093563c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6df28692, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x6df4e8ff, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x63000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1 [0090.307] wcscmp (_String1="System.IdentityModel.dll", _String2=".") returned 1 [0090.307] wcscmp (_String1="System.IdentityModel.dll", _String2="..") returned 1 [0090.307] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9090f3d9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6e7cd0e4, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x6e7f3397, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.Selectors.dll", cAlternateFileName="")) returned 1 [0090.307] wcscmp (_String1="System.IdentityModel.Selectors.dll", _String2=".") returned 1 [0090.307] wcscmp (_String1="System.IdentityModel.Selectors.dll", _String2="..") returned 1 [0090.307] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9089cc9f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x67be8f4c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x67c0f17b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IO.Log.dll", cAlternateFileName="")) returned 1 [0090.307] wcscmp (_String1="System.IO.Log.dll", _String2=".") returned 1 [0090.307] wcscmp (_String1="System.IO.Log.dll", _String2="..") returned 1 [0090.307] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x521498dc, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x521498dc, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xb94bbf00, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x57800, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Printing.dll", cAlternateFileName="")) returned 1 [0090.307] wcscmp (_String1="System.Printing.dll", _String2=".") returned 1 [0090.307] wcscmp (_String1="System.Printing.dll", _String2="..") returned 1 [0090.307] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908e9169, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6a50a3f9, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x6a55675f, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0xcf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.Serialization.dll", cAlternateFileName="")) returned 1 [0090.307] wcscmp (_String1="System.Runtime.Serialization.dll", _String2=".") returned 1 [0090.307] wcscmp (_String1="System.Runtime.Serialization.dll", _String2="..") returned 1 [0090.307] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908c2efe, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6a1769df, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x6a2819c4, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x516000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.dll", cAlternateFileName="")) returned 1 [0090.307] wcscmp (_String1="System.ServiceModel.dll", _String2=".") returned 1 [0090.307] wcscmp (_String1="System.ServiceModel.dll", _String2="..") returned 1 [0090.307] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5227abf5, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x5227abf5, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xb94bbf00, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0xa9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Speech.dll", cAlternateFileName="")) returned 1 [0090.307] wcscmp (_String1="System.Speech.dll", _String2=".") returned 1 [0090.307] wcscmp (_String1="System.Speech.dll", _String2="..") returned 1 [0090.307] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x522ed308, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x522ed308, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xb94bbf00, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x103000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.Activities.dll", cAlternateFileName="")) returned 1 [0090.307] wcscmp (_String1="System.Workflow.Activities.dll", _String2=".") returned 1 [0090.307] wcscmp (_String1="System.Workflow.Activities.dll", _String2="..") returned 1 [0090.307] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x522ed308, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x522ed308, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xb94bbf00, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x173000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.ComponentModel.dll", cAlternateFileName="")) returned 1 [0090.307] wcscmp (_String1="System.Workflow.ComponentModel.dll", _String2=".") returned 1 [0090.308] wcscmp (_String1="System.Workflow.ComponentModel.dll", _String2="..") returned 1 [0090.308] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52313584, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x52313584, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xba7cec00, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x6f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.Runtime.dll", cAlternateFileName="")) returned 1 [0090.308] wcscmp (_String1="System.Workflow.Runtime.dll", _String2=".") returned 1 [0090.308] wcscmp (_String1="System.Workflow.Runtime.dll", _String2="..") returned 1 [0090.308] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x522a0e4e, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x522a0e4e, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xb94bbf00, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x2a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationClient.dll", cAlternateFileName="")) returned 1 [0090.308] wcscmp (_String1="UIAutomationClient.dll", _String2=".") returned 1 [0090.308] wcscmp (_String1="UIAutomationClient.dll", _String2="..") returned 1 [0090.308] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x522a0e4e, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x522a0e4e, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xb94bbf00, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x5d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationClientsideProviders.dll", cAlternateFileName="")) returned 1 [0090.308] wcscmp (_String1="UIAutomationClientsideProviders.dll", _String2=".") returned 1 [0090.308] wcscmp (_String1="UIAutomationClientsideProviders.dll", _String2="..") returned 1 [0090.308] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x522a0e4e, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x522a0e4e, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xb94bbf00, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationProvider.dll", cAlternateFileName="")) returned 1 [0090.308] wcscmp (_String1="UIAutomationProvider.dll", _String2=".") returned 1 [0090.308] wcscmp (_String1="UIAutomationProvider.dll", _String2="..") returned 1 [0090.308] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x522a0e4e, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x522a0e4e, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xb94bbf00, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationTypes.dll", cAlternateFileName="")) returned 1 [0090.308] wcscmp (_String1="UIAutomationTypes.dll", _String2=".") returned 1 [0090.308] wcscmp (_String1="UIAutomationTypes.dll", _String2="..") returned 1 [0090.308] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x522a0e4e, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x522a0e4e, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xb94bbf00, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x110000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsBase.dll", cAlternateFileName="")) returned 1 [0090.308] wcscmp (_String1="WindowsBase.dll", _String2=".") returned 1 [0090.308] wcscmp (_String1="WindowsBase.dll", _String2="..") returned 1 [0090.308] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x522c70c1, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x522c70c1, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xb94bbf00, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsFormsIntegration.dll", cAlternateFileName="")) returned 1 [0090.308] wcscmp (_String1="WindowsFormsIntegration.dll", _String2=".") returned 1 [0090.308] wcscmp (_String1="WindowsFormsIntegration.dll", _String2="..") returned 1 [0090.308] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe797d8f5, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe4e9367d, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe4eb997b, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinFXList.xml", cAlternateFileName="WINFXL~1.XML")) returned 1 [0090.308] wcscmp (_String1="WinFXList.xml", _String2=".") returned 1 [0090.308] wcscmp (_String1="WinFXList.xml", _String2="..") returned 1 [0090.308] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9a) returned 0x38ac838 [0090.308] wcscpy (in: _Dest=0x38ac838, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0" [0090.308] wcscat (in: _Dest=0x38ac838, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0090.308] wcscat (in: _Dest=0x38ac838, _Source="WinFXList.xml" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" [0090.308] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x38ac838, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdac [0090.309] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe797d8f5, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe4e9367d, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe4eb997b, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinFXList.xml", cAlternateFileName="WINFXL~1.XML")) returned 0 [0090.309] FindClose (in: hFindFile=0x54453c0 | out: hFindFile=0x54453c0) returned 1 [0090.310] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3938448) returned 1 [0090.310] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549cd88) returned 1 [0090.310] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3976e68) returned 1 Thread: id = 1920 os_tid = 0x2b58 [0090.311] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x82) returned 0x549cd88 [0090.311] wcscpy (in: _Dest=0x549cd88, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5" [0090.312] wcscat (in: _Dest=0x549cd88, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0090.312] wcscat (in: _Dest=0x549cd88, _Source="*" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*" [0090.312] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3938448 [0090.312] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*", lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79a3b1b, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79effb3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79effb3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54453c0 [0090.313] wcscmp (_String1=".", _String2=".") returned 0 [0090.313] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79a3b1b, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79effb3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79effb3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.314] wcscmp (_String1="..", _String2=".") returned 1 [0090.314] wcscmp (_String1="..", _String2="..") returned 0 [0090.314] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51e9adc0, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51e9adc0, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Conversion.v3.5.dll", cAlternateFileName="")) returned 1 [0090.314] wcscmp (_String1="Microsoft.Build.Conversion.v3.5.dll", _String2=".") returned 1 [0090.314] wcscmp (_String1="Microsoft.Build.Conversion.v3.5.dll", _String2="..") returned 1 [0090.314] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51e9adc0, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51e9adc0, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x9c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Engine.dll", cAlternateFileName="")) returned 1 [0090.314] wcscmp (_String1="Microsoft.Build.Engine.dll", _String2=".") returned 1 [0090.314] wcscmp (_String1="Microsoft.Build.Engine.dll", _String2="..") returned 1 [0090.314] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51e9adc0, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51e9adc0, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Framework.dll", cAlternateFileName="")) returned 1 [0090.314] wcscmp (_String1="Microsoft.Build.Framework.dll", _String2=".") returned 1 [0090.314] wcscmp (_String1="Microsoft.Build.Framework.dll", _String2="..") returned 1 [0090.314] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51e9adc0, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51e9adc0, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Utilities.v3.5.dll", cAlternateFileName="")) returned 1 [0090.314] wcscmp (_String1="Microsoft.Build.Utilities.v3.5.dll", _String2=".") returned 1 [0090.314] wcscmp (_String1="Microsoft.Build.Utilities.v3.5.dll", _String2="..") returned 1 [0090.314] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51ec103c, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51ec103c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualC.STLCLR.dll", cAlternateFileName="")) returned 1 [0090.314] wcscmp (_String1="Microsoft.VisualC.STLCLR.dll", _String2=".") returned 1 [0090.314] wcscmp (_String1="Microsoft.VisualC.STLCLR.dll", _String2="..") returned 1 [0090.314] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79effb3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79effb3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 1 [0090.315] wcscmp (_String1="RedistList", _String2=".") returned 1 [0090.315] wcscmp (_String1="RedistList", _String2="..") returned 1 [0090.315] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x94) returned 0x55c5498 [0090.315] wcscpy (in: _Dest=0x55c5498, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5" [0090.315] wcscat (in: _Dest=0x55c5498, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0090.315] wcscat (in: _Dest=0x55c5498, _Source="RedistList" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" [0090.315] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x55c5498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xda8 [0090.315] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51ee72a2, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51ee72a2, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 1 [0090.315] wcscmp (_String1="System.AddIn.Contract.dll", _String2=".") returned 1 [0090.315] wcscmp (_String1="System.AddIn.Contract.dll", _String2="..") returned 1 [0090.315] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51ee72a2, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51ee72a2, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.dll", cAlternateFileName="")) returned 1 [0090.315] wcscmp (_String1="System.AddIn.dll", _String2=".") returned 1 [0090.316] wcscmp (_String1="System.AddIn.dll", _String2="..") returned 1 [0090.316] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51ec103c, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51ec103c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ComponentModel.DataAnnotations.dll", cAlternateFileName="")) returned 1 [0090.316] wcscmp (_String1="System.ComponentModel.DataAnnotations.dll", _String2=".") returned 1 [0090.316] wcscmp (_String1="System.ComponentModel.DataAnnotations.dll", _String2="..") returned 1 [0090.316] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51ee72a2, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51ee72a2, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0xa4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Core.dll", cAlternateFileName="")) returned 1 [0090.316] wcscmp (_String1="System.Core.dll", _String2=".") returned 1 [0090.316] wcscmp (_String1="System.Core.dll", _String2="..") returned 1 [0090.316] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51ec103c, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51ec103c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.DataSetExtensions.dll", cAlternateFileName="")) returned 1 [0090.316] wcscmp (_String1="System.Data.DataSetExtensions.dll", _String2=".") returned 1 [0090.316] wcscmp (_String1="System.Data.DataSetExtensions.dll", _String2="..") returned 1 [0090.316] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51ee72a2, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51ee72a2, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Entity.Design.dll", cAlternateFileName="")) returned 1 [0090.316] wcscmp (_String1="System.Data.Entity.Design.dll", _String2=".") returned 1 [0090.316] wcscmp (_String1="System.Data.Entity.Design.dll", _String2="..") returned 1 [0090.316] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51ee72a2, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51ee72a2, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x2bf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Entity.dll", cAlternateFileName="")) returned 1 [0090.316] wcscmp (_String1="System.Data.Entity.dll", _String2=".") returned 1 [0090.316] wcscmp (_String1="System.Data.Entity.dll", _String2="..") returned 1 [0090.316] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51f0d4ff, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51f0d4ff, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0xa7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Linq.dll", cAlternateFileName="")) returned 1 [0090.316] wcscmp (_String1="System.Data.Linq.dll", _String2=".") returned 1 [0090.316] wcscmp (_String1="System.Data.Linq.dll", _String2="..") returned 1 [0090.316] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51f33762, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51f33762, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x71000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Services.Client.dll", cAlternateFileName="")) returned 1 [0090.316] wcscmp (_String1="System.Data.Services.Client.dll", _String2=".") returned 1 [0090.316] wcscmp (_String1="System.Data.Services.Client.dll", _String2="..") returned 1 [0090.316] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51f33762, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51f33762, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Services.Design.dll", cAlternateFileName="")) returned 1 [0090.316] wcscmp (_String1="System.Data.Services.Design.dll", _String2=".") returned 1 [0090.316] wcscmp (_String1="System.Data.Services.Design.dll", _String2="..") returned 1 [0090.316] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51f33762, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51f33762, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0xaa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Services.dll", cAlternateFileName="")) returned 1 [0090.316] wcscmp (_String1="System.Data.Services.dll", _String2=".") returned 1 [0090.316] wcscmp (_String1="System.Data.Services.dll", _String2="..") returned 1 [0090.316] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51ee72a2, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51ee72a2, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x47000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.DirectoryServices.AccountManagement.dll", cAlternateFileName="")) returned 1 [0090.316] wcscmp (_String1="System.DirectoryServices.AccountManagement.dll", _String2=".") returned 1 [0090.316] wcscmp (_String1="System.DirectoryServices.AccountManagement.dll", _String2="..") returned 1 [0090.316] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51ec103c, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51ec103c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Management.Instrumentation.dll", cAlternateFileName="")) returned 1 [0090.316] wcscmp (_String1="System.Management.Instrumentation.dll", _String2=".") returned 1 [0090.316] wcscmp (_String1="System.Management.Instrumentation.dll", _String2="..") returned 1 [0090.317] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51f33762, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51f33762, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x3a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Net.dll", cAlternateFileName="")) returned 1 [0090.317] wcscmp (_String1="System.Net.dll", _String2=".") returned 1 [0090.317] wcscmp (_String1="System.Net.dll", _String2="..") returned 1 [0090.317] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51e286aa, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51e286aa, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x78000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.Web.dll", cAlternateFileName="")) returned 1 [0090.317] wcscmp (_String1="System.ServiceModel.Web.dll", _String2=".") returned 1 [0090.317] wcscmp (_String1="System.ServiceModel.Web.dll", _String2="..") returned 1 [0090.317] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51f33762, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51f33762, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Abstractions.dll", cAlternateFileName="")) returned 1 [0090.317] wcscmp (_String1="System.Web.Abstractions.dll", _String2=".") returned 1 [0090.317] wcscmp (_String1="System.Web.Abstractions.dll", _String2="..") returned 1 [0090.317] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51ec103c, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51ec103c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.DynamicData.Design.dll", cAlternateFileName="")) returned 1 [0090.317] wcscmp (_String1="System.Web.DynamicData.Design.dll", _String2=".") returned 1 [0090.317] wcscmp (_String1="System.Web.DynamicData.Design.dll", _String2="..") returned 1 [0090.317] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51f599bf, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51f599bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.DynamicData.dll", cAlternateFileName="")) returned 1 [0090.317] wcscmp (_String1="System.Web.DynamicData.dll", _String2=".") returned 1 [0090.317] wcscmp (_String1="System.Web.DynamicData.dll", _String2="..") returned 1 [0090.317] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51f599bf, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51f599bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Entity.Design.dll", cAlternateFileName="")) returned 1 [0090.317] wcscmp (_String1="System.Web.Entity.Design.dll", _String2=".") returned 1 [0090.317] wcscmp (_String1="System.Web.Entity.Design.dll", _String2="..") returned 1 [0090.317] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51f599bf, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51f599bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Entity.dll", cAlternateFileName="")) returned 1 [0090.317] wcscmp (_String1="System.Web.Entity.dll", _String2=".") returned 1 [0090.317] wcscmp (_String1="System.Web.Entity.dll", _String2="..") returned 1 [0090.317] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51f599bf, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51f599bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x52000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Extensions.Design.dll", cAlternateFileName="")) returned 1 [0090.317] wcscmp (_String1="System.Web.Extensions.Design.dll", _String2=".") returned 1 [0090.317] wcscmp (_String1="System.Web.Extensions.Design.dll", _String2="..") returned 1 [0090.317] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51f599bf, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51f599bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x86093000, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x139000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Extensions.dll", cAlternateFileName="")) returned 1 [0090.317] wcscmp (_String1="System.Web.Extensions.dll", _String2=".") returned 1 [0090.317] wcscmp (_String1="System.Web.Extensions.dll", _String2="..") returned 1 [0090.317] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51f7fc32, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51f7fc32, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x86093000, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Routing.dll", cAlternateFileName="")) returned 1 [0090.317] wcscmp (_String1="System.Web.Routing.dll", _String2=".") returned 1 [0090.317] wcscmp (_String1="System.Web.Routing.dll", _String2="..") returned 1 [0090.317] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51fcc0f8, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51fcc0f8, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x873a5d00, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Windows.Presentation.dll", cAlternateFileName="")) returned 1 [0090.317] wcscmp (_String1="System.Windows.Presentation.dll", _String2=".") returned 1 [0090.318] wcscmp (_String1="System.Windows.Presentation.dll", _String2="..") returned 1 [0090.318] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51e286aa, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51e286aa, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x75000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.WorkflowServices.dll", cAlternateFileName="")) returned 1 [0090.318] wcscmp (_String1="System.WorkflowServices.dll", _String2=".") returned 1 [0090.318] wcscmp (_String1="System.WorkflowServices.dll", _String2="..") returned 1 [0090.318] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51f7fc32, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51f7fc32, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x86093000, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Xml.Linq.dll", cAlternateFileName="")) returned 1 [0090.318] wcscmp (_String1="System.Xml.Linq.dll", _String2=".") returned 1 [0090.318] wcscmp (_String1="System.Xml.Linq.dll", _String2="..") returned 1 [0090.318] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51f7fc32, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51f7fc32, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x86093000, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Xml.Linq.dll", cAlternateFileName="")) returned 0 [0090.318] FindClose (in: hFindFile=0x54453c0 | out: hFindFile=0x54453c0) returned 1 [0090.319] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3938448) returned 1 [0090.319] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549cd88) returned 1 [0090.319] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3977770) returned 1 Thread: id = 1921 os_tid = 0x2b5c [0090.320] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe8) returned 0x54ba278 [0090.320] wcscpy (in: _Dest=0x54ba278, _Source="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64" [0090.320] wcscat (in: _Dest=0x54ba278, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\" [0090.320] wcscat (in: _Dest=0x54ba278, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*" [0090.320] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3938448 [0090.320] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54453c0 [0090.320] wcscmp (_String1=".", _String2=".") returned 0 [0090.320] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.320] wcscmp (_String1="..", _String2=".") returned 1 [0090.320] wcscmp (_String1="..", _String2="..") returned 0 [0090.320] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb69f0b00, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0xb69f0b00, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0xb69f0b00, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0x588124, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0090.320] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0090.320] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0090.320] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5197e500, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x5197e500, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x5197e500, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0090.320] wcscmp (_String1="vc_runtimeAdditional_x64.msi", _String2=".") returned 1 [0090.320] wcscmp (_String1="vc_runtimeAdditional_x64.msi", _String2="..") returned 1 [0090.320] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5197e500, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x5197e500, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x5197e500, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0090.320] FindClose (in: hFindFile=0x54453c0 | out: hFindFile=0x54453c0) returned 1 [0090.321] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3938448) returned 1 [0090.321] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54ba278) returned 1 [0090.321] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b9468) returned 1 Thread: id = 1922 os_tid = 0x2b60 [0090.322] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6c) returned 0x74b0378 [0090.322] wcscpy (in: _Dest=0x74b0378, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC" [0090.322] wcscat (in: _Dest=0x74b0378, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\" [0090.322] wcscat (in: _Dest=0x74b0378, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\*" [0090.322] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3938448 [0090.322] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\*", lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ea075c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ea075c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54453c0 [0090.323] wcscmp (_String1=".", _String2=".") returned 0 [0090.323] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ea075c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ea075c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.323] wcscmp (_String1="..", _String2=".") returned 1 [0090.323] wcscmp (_String1="..", _String2="..") returned 0 [0090.323] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f3911d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f3911d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0090.323] wcscmp (_String1="Linguistics", _String2=".") returned 1 [0090.323] wcscmp (_String1="Linguistics", _String2="..") returned 1 [0090.323] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x80) returned 0x3976bc0 [0090.323] wcscpy (in: _Dest=0x3976bc0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC" [0090.323] wcscat (in: _Dest=0x3976bc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\" [0090.323] wcscat (in: _Dest=0x3976bc0, _Source="Linguistics" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics" [0090.323] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x3976bc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xda4 [0090.324] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f3911d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f3911d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 0 [0090.324] FindClose (in: hFindFile=0x54453c0 | out: hFindFile=0x54453c0) returned 1 [0090.324] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3938448) returned 1 [0090.324] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b0378) returned 1 [0090.324] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b2258) returned 1 Thread: id = 1923 os_tid = 0x2b64 [0090.326] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x74) returned 0x38d1020 [0090.326] wcscpy (in: _Dest=0x38d1020, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US" [0090.326] wcscat (in: _Dest=0x38d1020, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\" [0090.326] wcscat (in: _Dest=0x38d1020, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\*" [0090.326] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3938448 [0090.326] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\*", lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3420de7a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3420de7a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3420de7a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54453c0 [0090.326] wcscmp (_String1=".", _String2=".") returned 0 [0090.326] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3420de7a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3420de7a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3420de7a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.326] wcscmp (_String1="..", _String2=".") returned 1 [0090.326] wcscmp (_String1="..", _String2="..") returned 0 [0090.326] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3420de7a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_DC.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0090.326] wcscmp (_String1="Reader_DC.helpcfg", _String2=".") returned 1 [0090.326] wcscmp (_String1="Reader_DC.helpcfg", _String2="..") returned 1 [0090.326] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x94) returned 0x55c5538 [0090.326] wcscpy (in: _Dest=0x55c5538, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US" [0090.326] wcscat (in: _Dest=0x55c5538, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\" [0090.326] wcscat (in: _Dest=0x55c5538, _Source="Reader_DC.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\Reader_DC.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\Reader_DC.helpcfg" [0090.326] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x55c5538, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xda0 [0090.327] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3420de7a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_DC.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0090.327] FindClose (in: hFindFile=0x54453c0 | out: hFindFile=0x54453c0) returned 1 [0090.327] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3938448) returned 1 [0090.327] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38d1020) returned 1 [0090.327] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x766de60) returned 1 Thread: id = 1924 os_tid = 0x2b68 [0090.329] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x68) returned 0x5468b70 [0090.329] wcscpy (in: _Dest=0x5468b70, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0" [0090.329] wcscat (in: _Dest=0x5468b70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\" [0090.329] wcscat (in: _Dest=0x5468b70, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\*" [0090.329] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3938448 [0090.329] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\*", lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x33e07dd6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x31d47305, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x31d47305, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54453c0 [0090.330] wcscmp (_String1=".", _String2=".") returned 0 [0090.330] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x33e07dd6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x31d47305, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x31d47305, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.330] wcscmp (_String1="..", _String2=".") returned 1 [0090.330] wcscmp (_String1="..", _String2="..") returned 0 [0090.330] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bd8a600, ftCreationTime.dwHighDateTime=0x1d3377b, ftLastAccessTime.dwLowDateTime=0xb352d8c, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x2bd8a600, ftLastWriteTime.dwHighDateTime=0x1d3377b, nFileSizeHigh=0x0, nFileSizeLow=0x11e018, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeARM.exe", cAlternateFileName="")) returned 1 [0090.330] wcscmp (_String1="AdobeARM.exe", _String2=".") returned 1 [0090.330] wcscmp (_String1="AdobeARM.exe", _String2="..") returned 1 [0090.330] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bd8a600, ftCreationTime.dwHighDateTime=0x1d3377b, ftLastAccessTime.dwLowDateTime=0xb352d8c, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x2bd8a600, ftLastWriteTime.dwHighDateTime=0x1d3377b, nFileSizeHigh=0x0, nFileSizeLow=0x67628, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeARMHelper.exe", cAlternateFileName="ADOBEA~1.EXE")) returned 1 [0090.330] wcscmp (_String1="AdobeARMHelper.exe", _String2=".") returned 1 [0090.330] wcscmp (_String1="AdobeARMHelper.exe", _String2="..") returned 1 [0090.330] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bd8a600, ftCreationTime.dwHighDateTime=0x1d3377b, ftLastAccessTime.dwLowDateTime=0xb378ff7, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x2bd8a600, ftLastWriteTime.dwHighDateTime=0x1d3377b, nFileSizeHigh=0x0, nFileSizeLow=0x14810, dwReserved0=0x0, dwReserved1=0x0, cFileName="armsvc.exe", cAlternateFileName="")) returned 1 [0090.330] wcscmp (_String1="armsvc.exe", _String2=".") returned 1 [0090.330] wcscmp (_String1="armsvc.exe", _String2="..") returned 1 [0090.330] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82ac63e5, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0xa87217e, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xa87217e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0090.330] wcscmp (_String1="Cache", _String2=".") returned 1 [0090.330] wcscmp (_String1="Cache", _String2="..") returned 1 [0090.330] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0x74b0378 [0090.330] wcscpy (in: _Dest=0x74b0378, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0" [0090.330] wcscat (in: _Dest=0x74b0378, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\" [0090.330] wcscat (in: _Dest=0x74b0378, _Source="Cache" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\Cache") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\Cache" [0090.330] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x74b0378, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd9c [0090.331] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82ac63e5, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0xa87217e, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xa87217e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 0 [0090.331] FindClose (in: hFindFile=0x54453c0 | out: hFindFile=0x54453c0) returned 1 [0090.332] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3938448) returned 1 [0090.332] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5468b70) returned 1 [0090.332] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5468e80) returned 1 Thread: id = 1925 os_tid = 0x2b6c [0090.333] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x78) returned 0x38d1020 [0090.333] wcscpy (in: _Dest=0x38d1020, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0090.333] wcscat (in: _Dest=0x38d1020, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0090.333] wcscat (in: _Dest=0x38d1020, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\*" [0090.333] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3938448 [0090.333] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\*", lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33bf1c6c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xbb3faac8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xde8f7271, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54453c0 [0090.335] wcscmp (_String1=".", _String2=".") returned 0 [0090.335] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33bf1c6c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xbb3faac8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xde8f7271, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.335] wcscmp (_String1="..", _String2=".") returned 1 [0090.335] wcscmp (_String1="..", _String2="..") returned 0 [0090.335] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xde812478, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x751f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.dll", cAlternateFileName="")) returned 1 [0090.335] wcscmp (_String1="AcroPDF.dll", _String2=".") returned 1 [0090.335] wcscmp (_String1="AcroPDF.dll", _String2="..") returned 1 [0090.335] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xde8f7271, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x7e1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF64.dll", cAlternateFileName="ACROPD~3.DLL")) returned 1 [0090.335] wcscmp (_String1="AcroPDF64.dll", _String2=".") returned 1 [0090.335] wcscmp (_String1="AcroPDF64.dll", _String2="..") returned 1 [0090.335] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xde85e91b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xafdf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDFImpl.dll", cAlternateFileName="ACROPD~1.DLL")) returned 1 [0090.335] wcscmp (_String1="AcroPDFImpl.dll", _String2=".") returned 1 [0090.336] wcscmp (_String1="AcroPDFImpl.dll", _String2="..") returned 1 [0090.336] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xde884b66, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x1097f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDFImpl64.dll", cAlternateFileName="ACROPD~2.DLL")) returned 1 [0090.336] wcscmp (_String1="AcroPDFImpl64.dll", _String2=".") returned 1 [0090.336] wcscmp (_String1="AcroPDFImpl64.dll", _String2="..") returned 1 [0090.336] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xde884b66, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x1097f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDFImpl64.dll", cAlternateFileName="ACROPD~2.DLL")) returned 0 [0090.336] FindClose (in: hFindFile=0x54453c0 | out: hFindFile=0x54453c0) returned 1 [0090.336] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3938448) returned 1 [0090.336] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38d1020) returned 1 [0090.337] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38d1da0) returned 1 Thread: id = 1926 os_tid = 0x2b70 [0090.337] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.targets")) returned 0x20 [0090.339] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", dwFileAttributes=0x20) returned 0 [0090.339] CreateFileW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.targets"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.339] GetLastError () returned 0x5 [0090.339] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", dwFileAttributes=0x20) returned 0 [0090.339] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5b160d0) returned 1 Thread: id = 1927 os_tid = 0x2b74 [0090.340] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.visualbasic.targets")) returned 0x20 [0090.340] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", dwFileAttributes=0x20) returned 0 [0090.342] CreateFileW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.visualbasic.targets"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.342] GetLastError () returned 0x5 [0090.342] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", dwFileAttributes=0x20) returned 0 [0090.342] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7580780) returned 1 Thread: id = 1928 os_tid = 0x2b78 [0090.344] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.targets")) returned 0x20 [0090.345] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", dwFileAttributes=0x20) returned 1 [0090.345] CreateFileW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.targets"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x100c [0090.346] GetFileSizeEx (in: hFile=0x100c, lpFileSize=0x41d7ff0c | out: lpFileSize=0x41d7ff0c*=4726) returned 1 [0090.346] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0x1272, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.346] ReadFile (in: hFile=0x100c, lpBuffer=0x41d7fe90, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x41d7fe8c, lpOverlapped=0x0 | out: lpBuffer=0x41d7fe90*, lpNumberOfBytesRead=0x41d7fe8c*=0x4, lpOverlapped=0x0) returned 1 [0090.347] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.347] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080718 [0090.347] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080e98 [0090.347] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080c18 [0090.347] NtQuerySystemTime (in: CurrentTime=0x41d7fe6c | out: CurrentTime=0x41d7fe6c*=132260136475087797) returned 0x0 [0090.347] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0x5a5737b4 [0090.347] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0xc104ec72 [0090.347] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0xe2a0a494 [0090.347] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0xcaecdcc9 [0090.347] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0xe4802de3 [0090.347] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0x784670ca [0090.347] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0x9f8916ae [0090.347] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0xcea942f3 [0090.347] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0xae85a537 [0090.347] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0xdb016d0e [0090.347] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0x7e5cc7d7 [0090.347] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0x157df455 [0090.347] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0x817b9d3f [0090.347] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0x9e752530 [0090.348] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0x9bb28ffb [0090.348] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0x514d7831 [0090.348] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0xa7065c75 [0090.348] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0xe730accd [0090.348] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0xf3e793e6 [0090.348] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0xadc98e33 [0090.348] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0x58ef9440 [0090.348] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0x689a72f4 [0090.348] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0x510f08d6 [0090.348] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0x3490bbdb [0090.348] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0x987115f4 [0090.348] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0x479ab042 [0090.348] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0xf1b16e55 [0090.348] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0x7c91cadc [0090.348] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0xf19d9ce9 [0090.348] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0xf04502fe [0090.348] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0x4133eae8 [0090.348] RtlRandom (in: Seed=0x41d7fe78 | out: Seed=0x41d7fe78) returned 0x8ea28c33 [0091.419] ReadFile (in: hFile=0x100c, lpBuffer=0xe1e2a60, nNumberOfBytesToRead=0x1276, lpNumberOfBytesRead=0x41d7fe68, lpOverlapped=0x0 | out: lpBuffer=0xe1e2a60*, lpNumberOfBytesRead=0x41d7fe68*=0x1276, lpOverlapped=0x0) returned 1 [0091.420] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.420] WriteFile (hFile=0x100c, lpBuffer=0xe1ef268, nNumberOfBytesToWrite=0x1276, lpNumberOfBytesWritten=0x41d7fe64, lpOverlapped=0x0) Thread: id = 1929 os_tid = 0x2b7c [0090.357] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.visualbasic.targets")) returned 0x20 [0090.357] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", dwFileAttributes=0x20) returned 1 [0090.358] CreateFileW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.visualbasic.targets"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd98 [0090.358] GetFileSizeEx (in: hFile=0xd98, lpFileSize=0x41dffa6c | out: lpFileSize=0x41dffa6c*=5182) returned 1 [0090.358] SetFilePointerEx (in: hFile=0xd98, liDistanceToMove=0x143a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.358] ReadFile (in: hFile=0xd98, lpBuffer=0x41dff9f0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x41dff9ec, lpOverlapped=0x0 | out: lpBuffer=0x41dff9f0*, lpNumberOfBytesRead=0x41dff9ec*=0x4, lpOverlapped=0x0) returned 1 [0090.359] SetFilePointerEx (in: hFile=0xd98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.359] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080718 [0090.359] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080ec0 [0090.359] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080c18 [0090.359] NtQuerySystemTime (in: CurrentTime=0x41dff9cc | out: CurrentTime=0x41dff9cc*=132260136475243864) returned 0x0 [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0x6f77360e [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0x3cb41340 [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0x25ae8034 [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0x14b0f7e [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0xddedbdba [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0x689a47ba [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0x6bee9be2 [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0x822b2942 [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0x7526cb11 [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0x3f03a7d5 [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0x84b43c12 [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0xa5eb88d7 [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0xdddbd8f8 [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0x8b97ba9b [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0x72069418 [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0x75f896cb [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0x8d155170 [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0x310d8b7 [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0x8a86e025 [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0xad922929 [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0x62490c2 [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0xe5895e51 [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0x524e7ab8 [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0xd9b14b7c [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0x8207394e [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0xd1837c67 [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0xb9a17617 [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0xe259ef10 [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0xe433f213 [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0x123633ce [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0xfd067861 [0090.360] RtlRandom (in: Seed=0x41dff9d8 | out: Seed=0x41dff9d8) returned 0x37ad4941 [0091.417] ReadFile (in: hFile=0xd98, lpBuffer=0xe1c8a48, nNumberOfBytesToRead=0x143e, lpNumberOfBytesRead=0x41dff9c8, lpOverlapped=0x0 | out: lpBuffer=0xe1c8a48*, lpNumberOfBytesRead=0x41dff9c8*=0x143e, lpOverlapped=0x0) returned 1 [0091.419] SetFilePointerEx (in: hFile=0xd98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.419] WriteFile (hFile=0xd98, lpBuffer=0xe1d5250, nNumberOfBytesToWrite=0x143e, lpNumberOfBytesWritten=0x41dff9c4, lpOverlapped=0x0) Thread: id = 1930 os_tid = 0x2b80 [0090.369] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x76) returned 0x38d1f20 [0090.369] wcscpy (in: _Dest=0x38d1f20, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\User\\Default" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\User\\Default") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\User\\Default" [0090.369] wcscat (in: _Dest=0x38d1f20, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\User\\Default\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\User\\Default\\" [0090.369] wcscat (in: _Dest=0x38d1f20, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\User\\Default\\*") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\User\\Default\\*" [0090.369] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3938448 [0090.370] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\User\\Default\\*", lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd678d991, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd678d991, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd678d991, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54453c0 [0090.370] wcscmp (_String1=".", _String2=".") returned 0 [0090.370] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd678d991, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd678d991, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd678d991, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.370] wcscmp (_String1="..", _String2=".") returned 1 [0090.370] wcscmp (_String1="..", _String2="..") returned 0 [0090.370] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd678d991, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd678d991, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd678d991, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0090.370] FindClose (in: hFindFile=0x54453c0 | out: hFindFile=0x54453c0) returned 1 [0090.370] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3938448) returned 1 [0090.370] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38d1f20) returned 1 [0090.370] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38d1d20) returned 1 Thread: id = 1931 os_tid = 0x2b84 [0090.371] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53f9da8 [0090.371] wcscpy (in: _Dest=0x53f9da8, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata" [0090.372] wcscat (in: _Dest=0x53f9da8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata\\" [0090.372] wcscat (in: _Dest=0x53f9da8, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata\\*") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata\\*" [0090.372] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3938448 [0090.372] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata\\*", lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf98c0dcf, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf98c8304, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf98c8304, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54453c0 [0090.372] wcscmp (_String1=".", _String2=".") returned 0 [0090.372] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf98c0dcf, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf98c8304, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf98c8304, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.373] wcscmp (_String1="..", _String2=".") returned 1 [0090.373] wcscmp (_String1="..", _String2="..") returned 0 [0090.373] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf98c6f7b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf98c6f7b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf98c6f7b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0090.373] wcscmp (_String1="container.dat", _String2=".") returned 1 [0090.373] wcscmp (_String1="container.dat", _String2="..") returned 1 [0090.373] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd6) returned 0x39342c8 [0090.373] wcscpy (in: _Dest=0x39342c8, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata" [0090.373] wcscat (in: _Dest=0x39342c8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata\\" [0090.373] wcscat (in: _Dest=0x39342c8, _Source="container.dat" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata\\container.dat") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata\\container.dat" [0090.373] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x39342c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd90 [0090.373] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf98c6f7b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf98c6f7b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf98c6f7b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0090.373] FindClose (in: hFindFile=0x54453c0 | out: hFindFile=0x54453c0) returned 1 [0090.374] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3938448) returned 1 [0090.374] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f9da8) returned 1 [0090.375] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f96a0) returned 1 Thread: id = 1932 os_tid = 0x2b88 [0090.376] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53f9da8 [0090.376] wcscpy (in: _Dest=0x53f9da8, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException" [0090.376] wcscat (in: _Dest=0x53f9da8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException\\" [0090.376] wcscat (in: _Dest=0x53f9da8, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException\\*") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException\\*" [0090.376] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3938448 [0090.376] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException\\*", lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9090a172, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9090a172, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x909a2acc, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54453c0 [0090.377] wcscmp (_String1=".", _String2=".") returned 0 [0090.377] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9090a172, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9090a172, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x909a2acc, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.377] wcscmp (_String1="..", _String2=".") returned 1 [0090.377] wcscmp (_String1="..", _String2="..") returned 0 [0090.377] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x909a2acc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x909a2acc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x909a2acc, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0090.377] wcscmp (_String1="container.dat", _String2=".") returned 1 [0090.377] wcscmp (_String1="container.dat", _String2="..") returned 1 [0090.378] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd6) returned 0x3934488 [0090.378] wcscpy (in: _Dest=0x3934488, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException" [0090.378] wcscat (in: _Dest=0x3934488, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException\\" [0090.378] wcscat (in: _Dest=0x3934488, _Source="container.dat" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException\\container.dat") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException\\container.dat" [0090.378] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3934488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd8c [0090.378] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x909a2acc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x909a2acc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x909a2acc, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0090.378] FindClose (in: hFindFile=0x54453c0 | out: hFindFile=0x54453c0) returned 1 [0090.379] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3938448) returned 1 [0090.379] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f9da8) returned 1 [0090.379] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3975d60) returned 1 Thread: id = 1933 os_tid = 0x2b8c [0090.380] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53f9da8 [0090.380] wcscpy (in: _Dest=0x53f9da8, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieSiteList" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieSiteList") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieSiteList" [0090.380] wcscat (in: _Dest=0x53f9da8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieSiteList\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieSiteList\\" [0090.380] wcscat (in: _Dest=0x53f9da8, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieSiteList\\*") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieSiteList\\*" [0090.380] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3938448 [0090.380] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieSiteList\\*", lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x92a91af7, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92a91af7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92a91af7, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54453c0 [0090.381] wcscmp (_String1=".", _String2=".") returned 0 [0090.381] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x92a91af7, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92a91af7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92a91af7, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.381] wcscmp (_String1="..", _String2=".") returned 1 [0090.381] wcscmp (_String1="..", _String2="..") returned 0 [0090.381] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x92a91af7, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92a91af7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92a91af7, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0090.382] wcscmp (_String1="container.dat", _String2=".") returned 1 [0090.382] wcscmp (_String1="container.dat", _String2="..") returned 1 [0090.382] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd6) returned 0x3934fe8 [0090.382] wcscpy (in: _Dest=0x3934fe8, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieSiteList" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieSiteList") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieSiteList" [0090.382] wcscat (in: _Dest=0x3934fe8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieSiteList\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieSiteList\\" [0090.382] wcscat (in: _Dest=0x3934fe8, _Source="container.dat" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieSiteList\\container.dat") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieSiteList\\container.dat" [0090.382] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3934fe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd88 [0090.382] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x92a91af7, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92a91af7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92a91af7, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0090.382] FindClose (in: hFindFile=0x54453c0 | out: hFindFile=0x54453c0) returned 1 [0090.383] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3938448) returned 1 [0090.383] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f9da8) returned 1 [0090.383] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3975018) returned 1 Thread: id = 1934 os_tid = 0x2b90 [0090.385] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbe) returned 0x53f9da8 [0090.385] wcscpy (in: _Dest=0x53f9da8, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieUserList" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieUserList") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieUserList" [0090.385] wcscat (in: _Dest=0x53f9da8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieUserList\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieUserList\\" [0090.385] wcscat (in: _Dest=0x53f9da8, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieUserList\\*") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieUserList\\*" [0090.385] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3938448 [0090.385] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieUserList\\*", lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x92addfb1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92addfb1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92b04223, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54453c0 [0090.386] wcscmp (_String1=".", _String2=".") returned 0 [0090.386] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x92addfb1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92addfb1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92b04223, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.386] wcscmp (_String1="..", _String2=".") returned 1 [0090.386] wcscmp (_String1="..", _String2="..") returned 0 [0090.386] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x92b04223, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92b04223, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92b04223, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0090.386] wcscmp (_String1="container.dat", _String2=".") returned 1 [0090.386] wcscmp (_String1="container.dat", _String2="..") returned 1 [0090.386] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd6) returned 0x3933768 [0090.386] wcscpy (in: _Dest=0x3933768, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieUserList" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieUserList") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieUserList" [0090.386] wcscat (in: _Dest=0x3933768, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieUserList\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieUserList\\" [0090.386] wcscat (in: _Dest=0x3933768, _Source="container.dat" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieUserList\\container.dat") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieUserList\\container.dat" [0090.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3933768, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd84 [0090.386] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x92b04223, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92b04223, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92b04223, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0090.387] FindClose (in: hFindFile=0x54453c0 | out: hFindFile=0x54453c0) returned 1 [0090.387] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3938448) returned 1 [0090.387] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f9da8) returned 1 [0090.387] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3975bd0) returned 1 Thread: id = 1935 os_tid = 0x2b94 [0090.388] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb6) returned 0x5b16550 [0090.388] wcscpy (in: _Dest=0x5b16550, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat" [0090.389] wcscat (in: _Dest=0x5b16550, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\" [0090.389] wcscat (in: _Dest=0x5b16550, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\*") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\*" [0090.389] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3938448 [0090.389] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\*", lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xe0889c9e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe0889c9e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54453c0 [0090.390] wcscmp (_String1=".", _String2=".") returned 0 [0090.390] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xe0889c9e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe0889c9e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.390] wcscmp (_String1="..", _String2=".") returned 1 [0090.390] wcscmp (_String1="..", _String2="..") returned 0 [0090.390] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf542405, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf542405, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf542405, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0090.390] wcscmp (_String1="container.dat", _String2=".") returned 1 [0090.390] wcscmp (_String1="container.dat", _String2="..") returned 1 [0090.390] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce) returned 0x757f5c8 [0090.390] wcscpy (in: _Dest=0x757f5c8, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat" [0090.390] wcscat (in: _Dest=0x757f5c8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\" [0090.390] wcscat (in: _Dest=0x757f5c8, _Source="container.dat" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\container.dat") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\container.dat" [0090.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x757f5c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd80 [0090.391] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe0889c9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe0889c9e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x31bb6535, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x132e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="IECompatData.xml", cAlternateFileName="IECOMP~1.XML")) returned 1 [0090.391] wcscmp (_String1="IECompatData.xml", _String2=".") returned 1 [0090.391] wcscmp (_String1="IECompatData.xml", _String2="..") returned 1 [0090.391] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd4) returned 0x3935528 [0090.391] wcscpy (in: _Dest=0x3935528, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat" [0090.391] wcscat (in: _Dest=0x3935528, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\" [0090.391] wcscat (in: _Dest=0x3935528, _Source="IECompatData.xml" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\IECompatData.xml") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\IECompatData.xml" [0090.391] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3935528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd78 [0090.391] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe0889c9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe0889c9e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x31bb6535, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x132e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="IECompatData.xml", cAlternateFileName="IECOMP~1.XML")) returned 0 [0090.391] FindClose (in: hFindFile=0x54453c0 | out: hFindFile=0x54453c0) returned 1 [0090.392] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3938448) returned 1 [0090.392] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5b16550) returned 1 [0090.392] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5b16490) returned 1 Thread: id = 1936 os_tid = 0x2b98 [0090.393] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba) returned 0x53f9da8 [0090.393] wcscpy (in: _Dest=0x53f9da8, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua" [0090.393] wcscat (in: _Dest=0x53f9da8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua\\" [0090.393] wcscat (in: _Dest=0x53f9da8, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua\\*") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua\\*" [0090.393] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3938448 [0090.394] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua\\*", lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf5b4b18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf5b4b18, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf5b4b18, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54453c0 [0090.394] wcscmp (_String1=".", _String2=".") returned 0 [0090.394] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf5b4b18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf5b4b18, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf5b4b18, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.394] wcscmp (_String1="..", _String2=".") returned 1 [0090.394] wcscmp (_String1="..", _String2="..") returned 0 [0090.395] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf5b4b18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf5b4b18, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf5b4b18, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0090.395] wcscmp (_String1="container.dat", _String2=".") returned 1 [0090.395] wcscmp (_String1="container.dat", _String2="..") returned 1 [0090.395] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd2) returned 0x3935288 [0090.395] wcscpy (in: _Dest=0x3935288, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua" [0090.395] wcscat (in: _Dest=0x3935288, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua\\" [0090.395] wcscat (in: _Dest=0x3935288, _Source="container.dat" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua\\container.dat") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua\\container.dat" [0090.395] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x3935288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd74 [0090.395] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf5b4b18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf5b4b18, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf5b4b18, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0090.395] FindClose (in: hFindFile=0x54453c0 | out: hFindFile=0x54453c0) returned 1 [0090.396] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3938448) returned 1 [0090.396] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f9da8) returned 1 [0090.396] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5b166d0) returned 1 Thread: id = 1937 os_tid = 0x2b9c [0090.397] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc) returned 0x53f9da8 [0090.397] wcscpy (in: _Dest=0x53f9da8, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead" [0090.397] wcscat (in: _Dest=0x53f9da8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead\\" [0090.397] wcscat (in: _Dest=0x53f9da8, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead\\*") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead\\*" [0090.397] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3938448 [0090.398] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead\\*", lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf58e291f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf58ffddd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf58ffddd, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54453c0 [0090.398] wcscmp (_String1=".", _String2=".") returned 0 [0090.398] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf58e291f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf58ffddd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf58ffddd, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.398] wcscmp (_String1="..", _String2=".") returned 1 [0090.398] wcscmp (_String1="..", _String2="..") returned 0 [0090.398] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf58ffddd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf58ffddd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf58ffddd, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0090.399] wcscmp (_String1="container.dat", _String2=".") returned 1 [0090.399] wcscmp (_String1="container.dat", _String2="..") returned 1 [0090.399] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd4) returned 0x54b1ab8 [0090.399] wcscpy (in: _Dest=0x54b1ab8, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead" [0090.399] wcscat (in: _Dest=0x54b1ab8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead\\" [0090.399] wcscat (in: _Dest=0x54b1ab8, _Source="container.dat" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead\\container.dat") returned="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead\\container.dat" [0090.399] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54b1ab8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd70 [0090.399] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf58ffddd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf58ffddd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf58ffddd, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0090.399] FindClose (in: hFindFile=0x54453c0 | out: hFindFile=0x54453c0) returned 1 [0090.400] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3938448) returned 1 [0090.400] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f9da8) returned 1 [0090.400] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5b16790) returned 1 Thread: id = 1938 os_tid = 0x2ba0 [0090.402] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDB.chk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\tiledatalayer\\database\\edb.chk")) returned 0x20 [0090.402] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDB.chk", dwFileAttributes=0x20) returned 1 [0090.402] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDB.chk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\tiledatalayer\\database\\edb.chk"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd94 [0090.402] GetFileSizeEx (in: hFile=0xd94, lpFileSize=0x4227f8a8 | out: lpFileSize=0x4227f8a8*=8192) returned 1 [0090.402] SetFilePointerEx (in: hFile=0xd94, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.402] ReadFile (in: hFile=0xd94, lpBuffer=0x4227f82c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4227f828, lpOverlapped=0x0 | out: lpBuffer=0x4227f82c*, lpNumberOfBytesRead=0x4227f828*=0x4, lpOverlapped=0x0) returned 1 [0090.403] SetFilePointerEx (in: hFile=0xd94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.403] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080718 [0090.403] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080ee8 [0090.403] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080c18 [0090.403] NtQuerySystemTime (in: CurrentTime=0x4227f808 | out: CurrentTime=0x4227f808*=132260136475556884) returned 0x0 [0090.403] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0x2402778d [0090.403] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0xff003a2f [0090.403] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0x574286a9 [0090.403] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0xc0465e9b [0090.403] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0xf6a06af2 [0090.403] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0x1adb6ba0 [0090.403] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0xbba6ab4b [0090.403] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0xc0aca69a [0090.403] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0x67c49e4d [0090.403] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0xb59e6863 [0090.403] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0xf5d741ee [0090.404] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0xc544007d [0090.404] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0x5c92c07f [0090.404] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0x4574b291 [0090.404] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0xf5133619 [0090.404] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0xb572081f [0090.404] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0x360b0a48 [0090.404] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0xb4b0219 [0090.404] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0x4b923c90 [0090.404] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0xf06aed72 [0090.404] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0xa9a38bfc [0090.404] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0x49b2551a [0090.404] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0x46fd755e [0090.404] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0x28c4aeaf [0090.404] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0xfe643c6a [0090.404] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0xa7df11ba [0090.404] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0xa5067266 [0090.404] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0xf7a3b5f7 [0090.404] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0xe6538c6e [0090.404] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0x9dc62247 [0090.404] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0x644016c8 [0090.404] RtlRandom (in: Seed=0x4227f814 | out: Seed=0x4227f814) returned 0x603b135a [0091.413] ReadFile (in: hFile=0xd94, lpBuffer=0xe1bb238, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x4227f804, lpOverlapped=0x0 | out: lpBuffer=0xe1bb238*, lpNumberOfBytesRead=0x4227f804*=0x2000, lpOverlapped=0x0) returned 1 [0091.413] SetFilePointerEx (in: hFile=0xd94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.413] WriteFile (hFile=0xd94, lpBuffer=0xe216a90, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x4227f800, lpOverlapped=0x0) Thread: id = 1939 os_tid = 0x2ba4 [0090.414] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDB.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\tiledatalayer\\database\\edb.log")) returned 0x20 [0090.414] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDB.log", dwFileAttributes=0x20) returned 1 [0090.414] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDB.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\tiledatalayer\\database\\edb.log"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.414] GetLastError () returned 0x20 [0090.415] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8) returned 0x38a3df0 [0090.415] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0090.415] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a3df0) returned 1 [0090.415] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x550d850, Size=0x18) returned 0x38a81a0 [0090.415] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7a) returned 0x3976e68 [0090.415] wcscpy (in: _Dest=0x3976e68, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDB.log" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDB.log") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDB.log" [0090.415] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDB.log", dwFileAttributes=0x20) returned 1 [0090.415] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39777f8) returned 1 Thread: id = 1940 os_tid = 0x2ba8 [0090.416] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDB00006.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\tiledatalayer\\database\\edb00006.log")) returned 0x20 [0090.417] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDB00006.log", dwFileAttributes=0x20) returned 1 [0090.417] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDB00006.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\tiledatalayer\\database\\edb00006.log"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3b4 [0090.417] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x4237f7c8 | out: lpFileSize=0x4237f7c8*=2097152) returned 1 [0090.417] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x1ffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.417] ReadFile (in: hFile=0x3b4, lpBuffer=0x4237f74c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4237f748, lpOverlapped=0x0 | out: lpBuffer=0x4237f74c*, lpNumberOfBytesRead=0x4237f748*=0x4, lpOverlapped=0x0) returned 1 [0090.419] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.419] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080718 [0090.419] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080f10 [0090.419] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080c18 [0090.419] NtQuerySystemTime (in: CurrentTime=0x4237f728 | out: CurrentTime=0x4237f728*=132260136475713065) returned 0x0 [0090.419] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0x35df7354 [0090.419] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0x29909ad4 [0090.419] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0x8efc8f4e [0090.419] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0x765bd32f [0090.419] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0xf50528f5 [0090.419] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0x89505cfe [0090.419] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0xaba774a9 [0090.419] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0x631ed70e [0090.419] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0xbb36c1f0 [0090.419] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0xe8bc26e9 [0090.419] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0xa285140f [0090.419] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0x3d42161c [0090.419] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0xfba67ec0 [0090.419] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0x44705210 [0090.419] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0x89d9a144 [0090.419] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0x7ae470a6 [0090.419] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0x19bef67e [0090.420] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0xcf7c08a0 [0090.420] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0xacdc3dc2 [0090.420] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0xe31744cb [0090.420] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0x1a560538 [0090.420] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0x8053f557 [0090.420] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0x6fb465b3 [0090.420] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0xfcca8c1f [0090.420] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0xdf19618e [0090.420] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0x806e892e [0090.420] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0x16681b5c [0090.420] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0x16dab421 [0090.420] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0x138fdd3d [0090.420] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0xc17f28dc [0090.420] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0xac2282b9 [0090.420] RtlRandom (in: Seed=0x4237f734 | out: Seed=0x4237f734) returned 0x8a8670cf [0091.410] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.410] ReadFile (in: hFile=0x3b4, lpBuffer=0xe1aea30, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x4237f6e0, lpOverlapped=0x0 | out: lpBuffer=0xe1aea30*, lpNumberOfBytesRead=0x4237f6e0*=0xc800, lpOverlapped=0x0) returned 1 [0091.413] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.414] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8570 [0091.414] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0xe4d0518 [0091.414] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0804e8 [0091.414] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0804e8) returned 1 [0091.414] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe223298 [0091.415] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0804e8 [0091.415] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080510 [0091.415] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe080510) returned 1 [0091.416] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4d0518) returned 1 [0091.416] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8570) returned 1 [0091.416] WriteFile (hFile=0x3b4, lpBuffer=0xe223298, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x4237f6e0, lpOverlapped=0x0) Thread: id = 1941 os_tid = 0x2bac [0090.430] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDBres00001.jrs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\tiledatalayer\\database\\edbres00001.jrs")) returned 0x20 [0090.430] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDBres00001.jrs", dwFileAttributes=0x20) returned 1 [0090.430] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDBres00001.jrs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\tiledatalayer\\database\\edbres00001.jrs"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14b4 [0090.430] GetFileSizeEx (in: hFile=0x14b4, lpFileSize=0x423ffcec | out: lpFileSize=0x423ffcec*=2097152) returned 1 [0090.430] SetFilePointerEx (in: hFile=0x14b4, liDistanceToMove=0x1ffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.430] ReadFile (in: hFile=0x14b4, lpBuffer=0x423ffc70, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x423ffc6c, lpOverlapped=0x0 | out: lpBuffer=0x423ffc70*, lpNumberOfBytesRead=0x423ffc6c*=0x4, lpOverlapped=0x0) returned 1 [0090.431] SetFilePointerEx (in: hFile=0x14b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.431] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080718 [0090.431] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080b78 [0090.431] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080c18 [0090.431] NtQuerySystemTime (in: CurrentTime=0x423ffc4c | out: CurrentTime=0x423ffc4c*=132260136475869098) returned 0x0 [0090.431] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0x8e0f5884 [0090.431] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0xa87a16df [0090.431] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0xc413857d [0090.431] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0x650732a3 [0090.431] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0xd18194e1 [0090.431] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0x9c787488 [0090.432] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0x173031a [0090.432] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0xc18a7c3a [0090.432] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0x5ef9aa7b [0090.432] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0xba3af735 [0090.432] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0xacd240fe [0090.432] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0x5879e542 [0090.432] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0x4789491d [0090.432] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0x867b5bf0 [0090.432] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0x634acc3b [0090.432] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0xaef7a11f [0090.432] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0xb1a8f757 [0090.432] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0x95f011ca [0090.432] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0x23d87647 [0090.432] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0x429a642d [0090.432] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0xa9ec2994 [0090.432] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0x116adaa [0090.432] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0x8ba9d7e4 [0090.432] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0xd29bd31a [0090.432] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0x4300b1d5 [0090.432] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0xab710405 [0090.432] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0x20a71304 [0090.432] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0x297bd4e6 [0090.432] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0xd05031e9 [0090.432] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0x9db3c07c [0090.432] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0x6d7b85ba [0090.432] RtlRandom (in: Seed=0x423ffc58 | out: Seed=0x423ffc58) returned 0xb47c7b5a [0091.406] SetFilePointerEx (in: hFile=0x14b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.406] ReadFile (in: hFile=0x14b4, lpBuffer=0xe194a18, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x423ffc04, lpOverlapped=0x0 | out: lpBuffer=0xe194a18*, lpNumberOfBytesRead=0x423ffc04*=0xc800, lpOverlapped=0x0) returned 1 [0091.407] SetFilePointerEx (in: hFile=0x14b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.407] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8570 [0091.407] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0xe4d0518 [0091.407] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0804c0 [0091.407] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0804c0) returned 1 [0091.408] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe1a1220 [0091.409] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0804c0 [0091.409] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0804e8 [0091.409] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0804e8) returned 1 [0091.409] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4d0518) returned 1 [0091.409] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8570) returned 1 [0091.409] WriteFile (hFile=0x14b4, lpBuffer=0xe1a1220, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x423ffc04, lpOverlapped=0x0) Thread: id = 1942 os_tid = 0x2bb0 [0090.451] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDBres00002.jrs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\tiledatalayer\\database\\edbres00002.jrs")) returned 0x20 [0090.451] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDBres00002.jrs", dwFileAttributes=0x20) returned 1 [0090.451] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDBres00002.jrs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\tiledatalayer\\database\\edbres00002.jrs"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xbd0 [0090.452] GetFileSizeEx (in: hFile=0xbd0, lpFileSize=0x4247fa6c | out: lpFileSize=0x4247fa6c*=2097152) returned 1 [0090.452] SetFilePointerEx (in: hFile=0xbd0, liDistanceToMove=0x1ffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.452] ReadFile (in: hFile=0xbd0, lpBuffer=0x4247f9f0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4247f9ec, lpOverlapped=0x0 | out: lpBuffer=0x4247f9f0*, lpNumberOfBytesRead=0x4247f9ec*=0x4, lpOverlapped=0x0) returned 1 [0090.453] SetFilePointerEx (in: hFile=0xbd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.453] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080718 [0090.453] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080bf0 [0090.453] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080c18 [0090.453] NtQuerySystemTime (in: CurrentTime=0x4247f9cc | out: CurrentTime=0x4247f9cc*=132260136476181845) returned 0x0 [0090.453] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0xeebd1d57 [0090.453] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0x94a72ff4 [0090.453] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0xf48cf10e [0090.453] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0x7c7e917 [0090.453] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0x673f1d15 [0090.453] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0xbe6f9638 [0090.453] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0x7f813a41 [0090.453] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0x65d3bf6 [0090.453] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0xb80235b4 [0090.453] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0x14f20569 [0090.453] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0xbc0853f8 [0090.453] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0xa022734a [0090.453] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0xab37e719 [0090.453] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0xbdc0d316 [0090.453] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0x3dff1110 [0090.453] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0x83fbba7c [0090.453] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0x668c758 [0090.453] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0x1ecefdcd [0090.453] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0xe86f3c4d [0090.453] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0x8c5ba531 [0090.453] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0x163a07da [0090.453] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0x17492618 [0090.453] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0xebf14dae [0090.453] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0xc9748ceb [0090.453] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0xc34e43df [0090.453] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0x10ed634e [0090.453] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0xa2aeabad [0090.453] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0xdde7574a [0090.453] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0xcfb6e0fd [0090.453] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0x793d629 [0090.454] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0xca5898a8 [0090.454] RtlRandom (in: Seed=0x4247f9d8 | out: Seed=0x4247f9d8) returned 0x6089d53b [0091.401] SetFilePointerEx (in: hFile=0xbd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.401] ReadFile (in: hFile=0xbd0, lpBuffer=0xe11b1a0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x4247f984, lpOverlapped=0x0 | out: lpBuffer=0xe11b1a0*, lpNumberOfBytesRead=0x4247f984*=0xc800, lpOverlapped=0x0) returned 1 [0091.403] SetFilePointerEx (in: hFile=0xbd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.403] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8570 [0091.403] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0xe4d0518 [0091.403] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080498 [0091.403] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe080498) returned 1 [0091.404] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe1279a8 [0091.405] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080498 [0091.405] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0804c0 [0091.405] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0804c0) returned 1 [0091.405] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4d0518) returned 1 [0091.405] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8570) returned 1 [0091.405] WriteFile (hFile=0xbd0, lpBuffer=0xe1279a8, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x4247f984, lpOverlapped=0x0) Thread: id = 1943 os_tid = 0x2bb4 [0090.463] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDBtmp.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\tiledatalayer\\database\\edbtmp.log")) returned 0x20 [0090.463] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDBtmp.log", dwFileAttributes=0x20) returned 1 [0090.464] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDBtmp.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\tiledatalayer\\database\\edbtmp.log"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xbcc [0090.464] GetFileSizeEx (in: hFile=0xbcc, lpFileSize=0x424ffe60 | out: lpFileSize=0x424ffe60*=2097152) returned 1 [0090.464] SetFilePointerEx (in: hFile=0xbcc, liDistanceToMove=0x1ffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.464] ReadFile (in: hFile=0xbcc, lpBuffer=0x424ffde4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x424ffde0, lpOverlapped=0x0 | out: lpBuffer=0x424ffde4*, lpNumberOfBytesRead=0x424ffde0*=0x4, lpOverlapped=0x0) returned 1 [0090.465] SetFilePointerEx (in: hFile=0xbcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.466] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080718 [0090.466] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080c18 [0090.466] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080c90 [0090.466] NtQuerySystemTime (in: CurrentTime=0x424ffdc0 | out: CurrentTime=0x424ffdc0*=132260136476181845) returned 0x0 [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0x5f68eb14 [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0xa9877558 [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0xecf82837 [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0xad805c5c [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0xa68ec125 [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0xcf6d1288 [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0xd72bec38 [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0xcb503ab [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0x5887dba2 [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0xa58a588f [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0x14051f3 [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0x5bab07af [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0x5992d902 [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0x86276f66 [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0x4e974c56 [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0xbed1f041 [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0xccb67916 [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0x5794db33 [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0x30968c10 [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0x92779179 [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0x4b0b2d43 [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0x4fd8f9b5 [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0x6339587f [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0x963b03ca [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0x881ee7fd [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0x8d4064b1 [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0x575a8df9 [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0xdc516d7d [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0x275ae1f2 [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0xd41eff9a [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0xa56014 [0090.466] RtlRandom (in: Seed=0x424ffdcc | out: Seed=0x424ffdcc) returned 0xdecf0546 [0091.396] SetFilePointerEx (in: hFile=0xbcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.396] ReadFile (in: hFile=0xbcc, lpBuffer=0xe101188, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x424ffd78, lpOverlapped=0x0 | out: lpBuffer=0xe101188*, lpNumberOfBytesRead=0x424ffd78*=0xc800, lpOverlapped=0x0) returned 1 [0091.398] SetFilePointerEx (in: hFile=0xbcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.398] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8570 [0091.398] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0xe4d0518 [0091.398] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080470 [0091.398] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe080470) returned 1 [0091.399] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe10d990 [0091.400] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080470 [0091.400] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080498 [0091.400] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe080498) returned 1 [0091.400] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4d0518) returned 1 [0091.400] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8570) returned 1 [0091.400] WriteFile (hFile=0xbcc, lpBuffer=0xe10d990, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x424ffd78, lpOverlapped=0x0) Thread: id = 1944 os_tid = 0x2bb8 [0090.476] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")) returned 0x20 [0090.476] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb", dwFileAttributes=0x20) returned 1 [0090.476] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.476] GetLastError () returned 0x20 [0090.476] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8) returned 0x38a3df0 [0090.476] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0090.476] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a3df0) returned 1 [0090.476] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0x38a81a0, Size=0x20) returned 0xe080718 [0090.477] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8a) returned 0x549f0a8 [0090.477] wcscpy (in: _Dest=0x549f0a8, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" [0090.477] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb", dwFileAttributes=0x20) returned 1 [0090.477] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549eee0) returned 1 Thread: id = 1945 os_tid = 0x2bbc [0090.478] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.jfm" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\tiledatalayer\\database\\vedatamodel.jfm")) returned 0x20 [0090.478] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.jfm", dwFileAttributes=0x20) returned 1 [0090.479] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.jfm" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\tiledatalayer\\database\\vedatamodel.jfm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.479] GetLastError () returned 0x20 [0090.479] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8) returned 0x38a3df0 [0090.479] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0090.479] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a3df0) returned 1 [0090.479] RtlReAllocateHeap (Heap=0x3880000, Flags=0x8, Ptr=0xe080718, Size=0x28) returned 0x38a69d0 [0090.479] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8a) returned 0x549eee0 [0090.479] wcscpy (in: _Dest=0x549eee0, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.jfm" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.jfm") returned="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.jfm" [0090.479] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.jfm", dwFileAttributes=0x20) returned 1 [0090.479] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549f8f8) returned 1 Thread: id = 1946 os_tid = 0x2bc0 [0090.480] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Live\\WLive48x48.png" (normalized: "c:\\programdata\\microsoft\\windows live\\wlive48x48.png")) returned 0x20 [0090.482] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Live\\WLive48x48.png", dwFileAttributes=0x20) returned 1 [0090.482] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Live\\WLive48x48.png" (normalized: "c:\\programdata\\microsoft\\windows live\\wlive48x48.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xbc0 [0090.482] GetFileSizeEx (in: hFile=0xbc0, lpFileSize=0x4267fefc | out: lpFileSize=0x4267fefc*=4657) returned 1 [0090.482] SetFilePointerEx (in: hFile=0xbc0, liDistanceToMove=0x122d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.482] ReadFile (in: hFile=0xbc0, lpBuffer=0x4267fe80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4267fe7c, lpOverlapped=0x0 | out: lpBuffer=0x4267fe80*, lpNumberOfBytesRead=0x4267fe7c*=0x4, lpOverlapped=0x0) returned 1 [0090.484] SetFilePointerEx (in: hFile=0xbc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.484] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080718 [0090.484] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080c90 [0090.484] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080d08 [0090.484] NtQuerySystemTime (in: CurrentTime=0x4267fe5c | out: CurrentTime=0x4267fe5c*=132260136476494197) returned 0x0 [0090.484] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0x97154a9 [0090.484] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0x169407db [0090.484] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0x592d18c3 [0090.484] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0xfd1b8ee9 [0090.484] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0x6eac6813 [0090.484] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0x9d4ed8d4 [0090.484] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0x7c984bf0 [0090.484] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0x13ba3e24 [0090.484] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0x201b8fd7 [0090.484] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0x80447033 [0090.484] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0x3d2fb0eb [0090.485] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0xf6d1f78 [0090.485] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0xa0fd9585 [0090.485] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0x95313c9c [0090.485] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0xb24f0401 [0090.485] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0xbbb9dfa0 [0090.485] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0x6b7b088d [0090.485] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0x63abf6e3 [0090.485] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0xbd3c8d05 [0090.485] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0x393a95c6 [0090.485] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0xc85c8994 [0090.485] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0x9aa67498 [0090.485] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0x22269ca5 [0090.485] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0xf973277e [0090.485] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0xbe58d18e [0090.485] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0x2213996f [0090.485] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0xd6db2524 [0090.485] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0x315e7c64 [0090.485] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0xb3b458c4 [0090.485] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0xfead94b2 [0090.485] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0x9d94dea6 [0090.485] RtlRandom (in: Seed=0x4267fe68 | out: Seed=0x4267fe68) returned 0x34aa8f81 [0091.395] ReadFile (in: hFile=0xbc0, lpBuffer=0xe09b138, nNumberOfBytesToRead=0x1231, lpNumberOfBytesRead=0x4267fe58, lpOverlapped=0x0 | out: lpBuffer=0xe09b138*, lpNumberOfBytesRead=0x4267fe58*=0x1231, lpOverlapped=0x0) returned 1 [0091.397] SetFilePointerEx (in: hFile=0xbc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.397] WriteFile (hFile=0xbc0, lpBuffer=0xe0a7940, nNumberOfBytesToWrite=0x1231, lpNumberOfBytesWritten=0x4267fe54, lpOverlapped=0x0) Thread: id = 1947 os_tid = 0x2bc4 [0090.494] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\ads_win10_300x250.scale-100.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\ads_win10_300x250.scale-100.jpg")) returned 0x20 [0090.495] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\ads_win10_300x250.scale-100.jpg", dwFileAttributes=0x20) returned 0 [0090.495] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\ads_win10_300x250.scale-100.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\ads_win10_300x250.scale-100.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.495] GetLastError () returned 0x5 [0090.495] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\ads_win10_300x250.scale-100.jpg", dwFileAttributes=0x20) returned 0 [0090.495] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x758ae88) returned 1 Thread: id = 1948 os_tid = 0x2bc8 [0090.496] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\ads_win10_728x90.scale-100.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\ads_win10_728x90.scale-100.jpg")) returned 0x20 [0090.496] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\ads_win10_728x90.scale-100.jpg", dwFileAttributes=0x20) returned 0 [0090.496] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\ads_win10_728x90.scale-100.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\ads_win10_728x90.scale-100.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.496] GetLastError () returned 0x5 [0090.496] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\ads_win10_728x90.scale-100.jpg", dwFileAttributes=0x20) returned 0 [0090.497] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x758abf8) returned 1 Thread: id = 1949 os_tid = 0x2bcc [0090.498] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x54bcf30 [0090.498] wcscpy (in: _Dest=0x54bcf30, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Livetiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Livetiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Livetiles" [0090.498] wcscat (in: _Dest=0x54bcf30, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Livetiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Livetiles\\" [0090.498] wcscat (in: _Dest=0x54bcf30, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Livetiles\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Livetiles\\*" [0090.498] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3938448 [0090.498] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Livetiles\\*", lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39211056, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabe5a941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x392372b0, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445800 [0090.499] wcscmp (_String1=".", _String2=".") returned 0 [0090.499] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39211056, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabe5a941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x392372b0, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.499] wcscmp (_String1="..", _String2=".") returned 1 [0090.499] wcscmp (_String1="..", _String2="..") returned 0 [0090.499] FindNextFileW (in: hFindFile=0x5445800, lpFindFileData=0x3938448 | out: lpFindFileData=0x3938448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39211056, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x39211056, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x39211056, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x7e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftSolitaireAppList.scale-100.png", cAlternateFileName="")) returned 1 [0090.499] wcscmp (_String1="MicrosoftSolitaireAppList.scale-100.png", _String2=".") returned 1 [0090.499] wcscmp (_String1="MicrosoftSolitaireAppList.scale-100.png", _String2="..") returned 1 [0090.499] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x15e) returned 0x546dff8 [0091.393] wcscpy (in: _Dest=0x546dff8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Livetiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Livetiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Livetiles" [0091.393] wcscat (in: _Dest=0x546dff8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Livetiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Livetiles\\" [0091.393] wcscat (in: _Dest=0x546dff8, _Source="MicrosoftSolitaireAppList.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Livetiles\\MicrosoftSolitaireAppList.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Livetiles\\MicrosoftSolitaireAppList.scale-100.png" Thread: id = 1950 os_tid = 0x2bd0 [0090.499] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\splashscreen.scale-100.png")) returned 0x20 [0090.500] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\SplashScreen.scale-100.png", dwFileAttributes=0x20) returned 0 [0090.500] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\splashscreen.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.500] GetLastError () returned 0x5 [0090.500] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\SplashScreen.scale-100.png", dwFileAttributes=0x20) returned 0 [0090.501] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba1d18) returned 1 Thread: id = 1951 os_tid = 0x2bd4 [0090.502] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x74dc1a8 [0090.502] wcscpy (in: _Dest=0x74dc1a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen" [0090.502] wcscat (in: _Dest=0x74dc1a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\" [0090.502] wcscat (in: _Dest=0x74dc1a8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*" [0090.502] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3938b80 [0090.502] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x3938b80 | out: lpFindFileData=0x3938b80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdfcbee3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xdfcbee3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdfcbee3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54453c0 [0090.502] wcscmp (_String1=".", _String2=".") returned 0 [0090.503] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938b80 | out: lpFindFileData=0x3938b80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdfcbee3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xdfcbee3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdfcbee3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.503] wcscmp (_String1="..", _String2=".") returned 1 [0090.503] wcscmp (_String1="..", _String2="..") returned 0 [0090.503] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938b80 | out: lpFindFileData=0x3938b80*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xdfcbee3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xdfcbee3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe8242d0, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0xee4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="JSByteCodeCache_64", cAlternateFileName="JSBYTE~1")) returned 1 [0090.503] wcscmp (_String1="JSByteCodeCache_64", _String2=".") returned 1 [0090.503] wcscmp (_String1="JSByteCodeCache_64", _String2="..") returned 1 [0090.503] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x128) returned 0x5ba9720 [0090.503] wcscpy (in: _Dest=0x5ba9720, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen" [0090.503] wcscat (in: _Dest=0x5ba9720, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\" [0090.503] wcscat (in: _Dest=0x5ba9720, _Source="JSByteCodeCache_64" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\JSByteCodeCache_64") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\JSByteCodeCache_64" [0090.503] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba9720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb50 [0090.503] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938b80 | out: lpFindFileData=0x3938b80*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xdfcbee3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xdfcbee3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe8242d0, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0xee4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="JSByteCodeCache_64", cAlternateFileName="JSBYTE~1")) returned 0 [0090.503] FindClose (in: hFindFile=0x54453c0 | out: hFindFile=0x54453c0) returned 1 [0090.504] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3938b80) returned 1 [0090.504] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74dc1a8) returned 1 [0090.504] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x743a690) returned 1 Thread: id = 1952 os_tid = 0x2bd8 [0090.505] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageSplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apppackagesplashscreen.scale-100.png")) returned 0x20 [0090.507] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageSplashScreen.scale-100.png", dwFileAttributes=0x20) returned 0 [0090.508] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageSplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apppackagesplashscreen.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.510] GetLastError () returned 0x5 [0090.510] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageSplashScreen.scale-100.png", dwFileAttributes=0x20) returned 0 [0090.511] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x546dff8) returned 1 Thread: id = 1953 os_tid = 0x2bdc [0090.512] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageStoreLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apppackagestorelogo.scale-100.png")) returned 0x20 [0090.513] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageStoreLogo.scale-100.png", dwFileAttributes=0x20) returned 0 [0090.515] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageStoreLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apppackagestorelogo.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.516] GetLastError () returned 0x5 [0090.516] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageStoreLogo.scale-100.png", dwFileAttributes=0x20) returned 0 [0090.518] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba1358) returned 1 Thread: id = 1954 os_tid = 0x2be0 [0090.520] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageWideTile.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apppackagewidetile.scale-100.png")) returned 0x20 [0090.523] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageWideTile.scale-100.png", dwFileAttributes=0x20) returned 0 [0090.524] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageWideTile.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apppackagewidetile.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.526] GetLastError () returned 0x5 [0090.526] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageWideTile.scale-100.png", dwFileAttributes=0x20) returned 0 [0090.527] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba1490) returned 1 Thread: id = 1955 os_tid = 0x2be4 [0090.529] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0x74dc1a8 [0090.529] wcscpy (in: _Dest=0x74dc1a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black" [0090.529] wcscat (in: _Dest=0x74dc1a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\" [0090.529] wcscat (in: _Dest=0x74dc1a8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\*" [0090.529] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3938b80 [0090.529] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\*", lpFindFileData=0x3938b80 | out: lpFindFileData=0x3938b80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d308b21, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab1ce307, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d32ed7f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54453c0 [0090.531] wcscmp (_String1=".", _String2=".") returned 0 [0090.531] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938b80 | out: lpFindFileData=0x3938b80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d308b21, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab1ce307, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d32ed7f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.531] wcscmp (_String1="..", _String2=".") returned 1 [0090.531] wcscmp (_String1="..", _String2="..") returned 0 [0090.531] FindNextFileW (in: hFindFile=0x54453c0, lpFindFileData=0x3938b80 | out: lpFindFileData=0x3938b80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d308b21, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9d308b21, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9d308b21, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x123, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.scale-100_contrast-black.png", cAlternateFileName="")) returned 1 [0090.531] wcscmp (_String1="AppPackageAppList.scale-100_contrast-black.png", _String2=".") returned 1 [0090.531] wcscmp (_String1="AppPackageAppList.scale-100_contrast-black.png", _String2="..") returned 1 [0090.531] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x164) returned 0x38b4e90 [0091.392] wcscpy (in: _Dest=0x38b4e90, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black" [0091.392] wcscat (in: _Dest=0x38b4e90, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\" [0091.392] wcscat (in: _Dest=0x38b4e90, _Source="AppPackageAppList.scale-100_contrast-black.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.scale-100_contrast-black.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.scale-100_contrast-black.png" Thread: id = 1956 os_tid = 0x2be8 [0090.532] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0x74dc2c0 [0090.532] wcscpy (in: _Dest=0x74dc2c0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white" [0090.532] wcscat (in: _Dest=0x74dc2c0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\" [0090.532] wcscat (in: _Dest=0x74dc2c0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\*" [0090.532] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3939050 [0090.532] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\*", lpFindFileData=0x3939050 | out: lpFindFileData=0x3939050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d32ed7f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab1d0bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d37b231, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445600 [0090.534] wcscmp (_String1=".", _String2=".") returned 0 [0090.534] FindNextFileW (in: hFindFile=0x5445600, lpFindFileData=0x3939050 | out: lpFindFileData=0x3939050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d32ed7f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab1d0bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d37b231, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.534] wcscmp (_String1="..", _String2=".") returned 1 [0090.535] wcscmp (_String1="..", _String2="..") returned 0 [0090.535] FindNextFileW (in: hFindFile=0x5445600, lpFindFileData=0x3939050 | out: lpFindFileData=0x3939050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d32ed7f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9d32ed7f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9d32ed7f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPackageAppList.scale-100_contrast-white.png", cAlternateFileName="")) returned 1 [0090.535] wcscmp (_String1="AppPackageAppList.scale-100_contrast-white.png", _String2=".") returned 1 [0090.535] wcscmp (_String1="AppPackageAppList.scale-100_contrast-white.png", _String2="..") returned 1 [0090.535] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x164) returned 0x5470a08 [0091.392] wcscpy (in: _Dest=0x5470a08, _Source="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white" [0091.392] wcscat (in: _Dest=0x5470a08, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\" [0091.392] wcscat (in: _Dest=0x5470a08, _Source="AppPackageAppList.scale-100_contrast-white.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.scale-100_contrast-white.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.scale-100_contrast-white.png" Thread: id = 1957 os_tid = 0x2bec [0090.535] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfe) returned 0x549a448 [0090.535] wcscpy (in: _Dest=0x549a448, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen" [0090.535] wcscat (in: _Dest=0x549a448, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\" [0090.535] wcscat (in: _Dest=0x549a448, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*" [0090.535] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x39399f0 [0090.535] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x10032a71, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x10032a71, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x10032a71, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445640 [0090.536] wcscmp (_String1=".", _String2=".") returned 0 [0090.536] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x10032a71, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x10032a71, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x10032a71, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.536] wcscmp (_String1="..", _String2=".") returned 1 [0090.536] wcscmp (_String1="..", _String2="..") returned 0 [0090.536] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x10032a71, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x10032a71, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x103c648d, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x8cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="JSByteCodeCache_64", cAlternateFileName="JSBYTE~1")) returned 1 [0090.536] wcscmp (_String1="JSByteCodeCache_64", _String2=".") returned 1 [0090.536] wcscmp (_String1="JSByteCodeCache_64", _String2="..") returned 1 [0090.536] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x120) returned 0x54bd2a8 [0090.536] wcscpy (in: _Dest=0x54bd2a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen" [0090.536] wcscat (in: _Dest=0x54bd2a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\" [0090.536] wcscat (in: _Dest=0x54bd2a8, _Source="JSByteCodeCache_64" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\JSByteCodeCache_64") returned="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\JSByteCodeCache_64" [0090.536] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bd2a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb40 [0090.537] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x10032a71, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x10032a71, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x103c648d, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x8cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="JSByteCodeCache_64", cAlternateFileName="JSBYTE~1")) returned 0 [0090.537] FindClose (in: hFindFile=0x5445640 | out: hFindFile=0x5445640) returned 1 [0090.537] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39399f0) returned 1 [0090.537] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549a448) returned 1 [0090.537] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54999f8) returned 1 Thread: id = 1958 os_tid = 0x2bf0 [0090.538] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x74dc3d8 [0090.538] wcscpy (in: _Dest=0x74dc3d8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen" [0090.538] wcscat (in: _Dest=0x74dc3d8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\" [0090.538] wcscat (in: _Dest=0x74dc3d8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*" [0090.538] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x39399f0 [0090.538] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe0183a1, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xe0183a1, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe0183a1, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445640 [0090.539] wcscmp (_String1=".", _String2=".") returned 0 [0090.539] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe0183a1, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xe0183a1, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe0183a1, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.539] wcscmp (_String1="..", _String2=".") returned 1 [0090.539] wcscmp (_String1="..", _String2="..") returned 0 [0090.539] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe0183a1, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xe0183a1, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xeb6b6f5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0xee4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="JSByteCodeCache_32", cAlternateFileName="JSBYTE~1")) returned 1 [0090.539] wcscmp (_String1="JSByteCodeCache_32", _String2=".") returned 1 [0090.539] wcscmp (_String1="JSByteCodeCache_32", _String2="..") returned 1 [0090.539] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x128) returned 0x5ba9858 [0090.539] wcscpy (in: _Dest=0x5ba9858, _Source="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen" [0090.539] wcscat (in: _Dest=0x5ba9858, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\" [0090.539] wcscat (in: _Dest=0x5ba9858, _Source="JSByteCodeCache_32" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\JSByteCodeCache_32") returned="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\JSByteCodeCache_32" [0090.539] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba9858, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb3c [0090.540] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe0183a1, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xe0183a1, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xeb6b6f5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0xee4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="JSByteCodeCache_32", cAlternateFileName="JSBYTE~1")) returned 0 [0090.540] FindClose (in: hFindFile=0x5445640 | out: hFindFile=0x5445640) returned 1 [0090.540] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39399f0) returned 1 [0090.540] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74dc3d8) returned 1 [0090.540] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x743a578) returned 1 Thread: id = 1959 os_tid = 0x2bf4 [0090.541] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x54bc840 [0090.541] wcscpy (in: _Dest=0x54bc840, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared" [0090.541] wcscat (in: _Dest=0x54bc840, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\" [0090.541] wcscat (in: _Dest=0x54bc840, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\*" [0090.541] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x39399f0 [0090.541] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\*", lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6395ccec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd7feb3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x6395ccec, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445640 [0090.542] wcscmp (_String1=".", _String2=".") returned 0 [0090.542] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6395ccec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd7feb3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x6395ccec, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.542] wcscmp (_String1="..", _String2=".") returned 1 [0090.542] wcscmp (_String1="..", _String2="..") returned 0 [0090.542] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x6395ccec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd7feb3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x662a39a5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0090.542] wcscmp (_String1="OFFICE16", _String2=".") returned 1 [0090.542] wcscmp (_String1="OFFICE16", _String2="..") returned 1 [0090.542] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x120) returned 0x74da3b8 [0090.542] wcscpy (in: _Dest=0x74da3b8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared" [0090.542] wcscat (in: _Dest=0x74da3b8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\" [0090.542] wcscat (in: _Dest=0x74da3b8, _Source="OFFICE16" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16" [0090.542] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x74da3b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb38 [0090.543] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x6395ccec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd7feb3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x662a39a5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="OFFICE16", cAlternateFileName="")) returned 0 [0090.543] FindClose (in: hFindFile=0x5445640 | out: hFindFile=0x5445640) returned 1 [0090.543] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39399f0) returned 1 [0090.543] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bc840) returned 1 [0090.543] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b3880) returned 1 Thread: id = 1960 os_tid = 0x2bf8 [0090.544] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd8) returned 0x54b20d8 [0090.544] wcscpy (in: _Dest=0x54b20d8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\SystemX64" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\SystemX64") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\SystemX64" [0090.544] wcscat (in: _Dest=0x54b20d8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\SystemX64\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\SystemX64\\" [0090.544] wcscat (in: _Dest=0x54b20d8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\SystemX64\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\SystemX64\\*" [0090.544] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x39399f0 [0090.544] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\SystemX64\\*", lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x662a39a5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd7feb3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x663ae9ff, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445640 [0090.545] wcscmp (_String1=".", _String2=".") returned 0 [0090.545] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x662a39a5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd7feb3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x663ae9ff, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.545] wcscmp (_String1="..", _String2=".") returned 1 [0090.545] wcscmp (_String1="..", _String2="..") returned 0 [0090.545] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x662a39a5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x662efe37, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x662efe37, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x51b18, dwReserved0=0x0, dwReserved1=0x0, cFileName="concrt140.dll", cAlternateFileName="")) returned 1 [0090.545] wcscmp (_String1="concrt140.dll", _String2=".") returned 1 [0090.545] wcscmp (_String1="concrt140.dll", _String2="..") returned 1 [0090.545] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66316095, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x66362547, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x66362547, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x9c2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp140.dll", cAlternateFileName="")) returned 1 [0090.545] wcscmp (_String1="msvcp140.dll", _String2=".") returned 1 [0090.545] wcscmp (_String1="msvcp140.dll", _String2="..") returned 1 [0090.545] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66362547, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x663887a5, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x663887a5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x60508, dwReserved0=0x0, dwReserved1=0x0, cFileName="vccorlib140.dll", cAlternateFileName="")) returned 1 [0090.545] wcscmp (_String1="vccorlib140.dll", _String2=".") returned 1 [0090.545] wcscmp (_String1="vccorlib140.dll", _String2="..") returned 1 [0090.545] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x663887a5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x663d4c5d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x663d4c5d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x15cf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="")) returned 1 [0090.545] wcscmp (_String1="vcruntime140.dll", _String2=".") returned 1 [0090.545] wcscmp (_String1="vcruntime140.dll", _String2="..") returned 1 [0090.545] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x663887a5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x663d4c5d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x663d4c5d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x15cf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="")) returned 0 [0090.545] FindClose (in: hFindFile=0x5445640 | out: hFindFile=0x5445640) returned 1 [0090.545] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39399f0) returned 1 [0090.545] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b20d8) returned 1 [0090.546] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3934c68) returned 1 Thread: id = 1961 os_tid = 0x2bfc [0090.547] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_tilewide.scale-100.png")) returned 0x20 [0090.550] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileWide.scale-100.png", dwFileAttributes=0x20) returned 0 [0090.552] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_tilewide.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.553] GetLastError () returned 0x5 [0090.553] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileWide.scale-100.png", dwFileAttributes=0x20) returned 0 [0090.554] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b1df0) returned 1 Thread: id = 1962 os_tid = 0x1fb4 [0090.556] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc) returned 0x54f1430 [0090.556] wcscpy (in: _Dest=0x54f1430, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" [0090.556] wcscat (in: _Dest=0x54f1430, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\" [0090.556] wcscat (in: _Dest=0x54f1430, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\*" [0090.556] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x39399f0 [0090.556] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\*", lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa457e69, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445640 [0090.558] wcscmp (_String1=".", _String2=".") returned 0 [0090.558] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa457e69, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.558] wcscmp (_String1="..", _String2=".") returned 1 [0090.558] wcscmp (_String1="..", _String2="..") returned 0 [0090.558] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704c73fb, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1 [0090.558] wcscmp (_String1="News_LogoSmall.scale-100.png", _String2=".") returned 1 [0090.558] wcscmp (_String1="News_LogoSmall.scale-100.png", _String2="..") returned 1 [0090.558] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x74d9388 [0090.558] wcscpy (in: _Dest=0x74d9388, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" [0090.558] wcscat (in: _Dest=0x74d9388, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\" [0090.558] wcscat (in: _Dest=0x74d9388, _Source="News_LogoSmall.scale-100.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.scale-100.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.scale-100.png" [0090.558] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74d9388, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb30 [0090.559] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704c73fb, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-16.png", cAlternateFileName="")) returned 1 [0090.559] wcscmp (_String1="News_LogoSmall.targetsize-16.png", _String2=".") returned 1 [0090.559] wcscmp (_String1="News_LogoSmall.targetsize-16.png", _String2="..") returned 1 [0090.559] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11a) returned 0x74d94b0 [0090.559] wcscpy (in: _Dest=0x74d94b0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" [0090.559] wcscat (in: _Dest=0x74d94b0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\" [0090.559] wcscat (in: _Dest=0x74d94b0, _Source="News_LogoSmall.targetsize-16.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-16.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-16.png" [0090.559] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74d94b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb2c [0090.560] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704c73fb, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-24.png", cAlternateFileName="")) returned 1 [0090.560] wcscmp (_String1="News_LogoSmall.targetsize-24.png", _String2=".") returned 1 [0090.560] wcscmp (_String1="News_LogoSmall.targetsize-24.png", _String2="..") returned 1 [0090.560] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11a) returned 0x74d9950 [0090.560] wcscpy (in: _Dest=0x74d9950, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" [0090.560] wcscat (in: _Dest=0x74d9950, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\" [0090.560] wcscat (in: _Dest=0x74d9950, _Source="News_LogoSmall.targetsize-24.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-24.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-24.png" [0090.560] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74d9950, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb24 [0090.561] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704c73fb, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x372, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-256.png", cAlternateFileName="")) returned 1 [0090.561] wcscmp (_String1="News_LogoSmall.targetsize-256.png", _String2=".") returned 1 [0090.561] wcscmp (_String1="News_LogoSmall.targetsize-256.png", _String2="..") returned 1 [0090.561] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11c) returned 0x54bc840 [0090.561] wcscpy (in: _Dest=0x54bc840, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" [0090.561] wcscat (in: _Dest=0x54bc840, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\" [0090.561] wcscat (in: _Dest=0x54bc840, _Source="News_LogoSmall.targetsize-256.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-256.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-256.png" [0090.561] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54bc840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb20 [0090.561] FindNextFileW (in: hFindFile=0x5445640, lpFindFileData=0x39399f0 | out: lpFindFileData=0x39399f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704c73fb, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-32.png", cAlternateFileName="")) returned 1 [0090.561] wcscmp (_String1="News_LogoSmall.targetsize-32.png", _String2=".") returned 1 [0090.561] wcscmp (_String1="News_LogoSmall.targetsize-32.png", _String2="..") returned 1 [0090.561] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11a) returned 0x74d7380 [0091.391] wcscpy (in: _Dest=0x74d7380, _Source="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" [0091.391] wcscat (in: _Dest=0x74d7380, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\" [0091.391] wcscat (in: _Dest=0x74d7380, _Source="News_LogoSmall.targetsize-32.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-32.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-32.png" Thread: id = 1963 os_tid = 0x19f0 [0090.562] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_logosmall.scale-100.png")) returned 0x20 [0090.562] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.scale-100.png", dwFileAttributes=0x20) returned 0 [0090.562] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_logosmall.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.562] GetLastError () returned 0x5 [0090.562] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.scale-100.png", dwFileAttributes=0x20) returned 0 [0090.562] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba30f8) returned 1 Thread: id = 1964 os_tid = 0x19f8 [0090.563] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_logosmall.targetsize-16.png")) returned 0x20 [0090.564] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-16.png", dwFileAttributes=0x20) returned 0 [0090.564] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_logosmall.targetsize-16.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.564] GetLastError () returned 0x5 [0090.564] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-16.png", dwFileAttributes=0x20) returned 0 [0090.564] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75816b8) returned 1 Thread: id = 1965 os_tid = 0x1e2c [0090.565] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_logosmall.targetsize-24.png")) returned 0x20 [0090.565] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-24.png", dwFileAttributes=0x20) returned 0 [0090.565] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_logosmall.targetsize-24.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.565] GetLastError () returned 0x5 [0090.565] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-24.png", dwFileAttributes=0x20) returned 0 [0090.566] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75819d0) returned 1 Thread: id = 1966 os_tid = 0x1e30 [0090.567] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_logosmall.targetsize-256.png")) returned 0x20 [0090.567] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-256.png", dwFileAttributes=0x20) returned 0 [0090.567] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_logosmall.targetsize-256.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.567] GetLastError () returned 0x5 [0090.567] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-256.png", dwFileAttributes=0x20) returned 0 [0090.567] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7581190) returned 1 Thread: id = 1967 os_tid = 0x1e34 [0090.568] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_logosmall.targetsize-32.png")) returned 0x20 [0090.568] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-32.png", dwFileAttributes=0x20) returned 0 [0090.569] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_logosmall.targetsize-32.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.569] GetLastError () returned 0x5 [0090.569] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-32.png", dwFileAttributes=0x20) returned 0 [0090.569] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75814a8) returned 1 Thread: id = 1968 os_tid = 0x1e38 [0090.570] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_logosmall.targetsize-48.png")) returned 0x20 [0090.570] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-48.png", dwFileAttributes=0x20) returned 0 [0090.571] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_logosmall.targetsize-48.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.571] GetLastError () returned 0x5 [0090.571] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-48.png", dwFileAttributes=0x20) returned 0 [0090.572] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7582b58) returned 1 Thread: id = 1969 os_tid = 0x1424 [0090.573] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_splashscreen.scale-100.png")) returned 0x20 [0090.573] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_SplashScreen.scale-100.png", dwFileAttributes=0x20) returned 0 [0090.573] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_splashscreen.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.574] GetLastError () returned 0x5 [0090.574] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_SplashScreen.scale-100.png", dwFileAttributes=0x20) returned 0 [0090.574] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7582738) returned 1 Thread: id = 1970 os_tid = 0x19fc [0090.575] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_tilelargesquare.scale-100.png")) returned 0x20 [0090.575] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileLargeSquare.scale-100.png", dwFileAttributes=0x20) returned 0 [0090.576] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_tilelargesquare.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.576] GetLastError () returned 0x5 [0090.576] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileLargeSquare.scale-100.png", dwFileAttributes=0x20) returned 0 [0090.576] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7582840) returned 1 Thread: id = 1971 os_tid = 0x1428 [0090.577] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_tilemediumsquare.scale-100.png")) returned 0x20 [0090.578] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileMediumSquare.scale-100.png", dwFileAttributes=0x20) returned 0 [0090.578] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_tilemediumsquare.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.578] GetLastError () returned 0x5 [0090.578] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileMediumSquare.scale-100.png", dwFileAttributes=0x20) returned 0 [0090.578] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b2250) returned 1 Thread: id = 1972 os_tid = 0x1a00 [0090.579] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_tilesmallsquare.scale-100.png")) returned 0x20 [0090.579] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileSmallSquare.scale-100.png", dwFileAttributes=0x20) returned 0 [0090.580] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_tilesmallsquare.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.580] GetLastError () returned 0x5 [0090.580] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileSmallSquare.scale-100.png", dwFileAttributes=0x20) returned 0 [0090.580] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7581ef8) returned 1 Thread: id = 1973 os_tid = 0x14c4 [0090.581] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_tilewide.scale-100.png")) returned 0x20 [0090.581] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileWide.scale-100.png", dwFileAttributes=0x20) returned 0 [0090.581] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_tilewide.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.582] GetLastError () returned 0x5 [0090.582] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileWide.scale-100.png", dwFileAttributes=0x20) returned 0 [0090.582] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba22f8) returned 1 Thread: id = 1974 os_tid = 0x1fc4 [0090.583] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\StoreLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\storelogo.png")) returned 0x20 [0090.585] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\StoreLogo.png", dwFileAttributes=0x20) returned 0 [0090.585] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\StoreLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\storelogo.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.585] GetLastError () returned 0x5 [0090.585] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\StoreLogo.png", dwFileAttributes=0x20) returned 0 [0090.585] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39349c8) returned 1 Thread: id = 1975 os_tid = 0x1e44 [0090.586] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20 [0091.390] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml", dwFileAttributes=0x20) returned 0 [0091.390] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.390] GetLastError () returned 0x5 [0091.390] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml", dwFileAttributes=0x20) returned 0 [0091.390] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e2968) returned 1 Thread: id = 1976 os_tid = 0x14f8 [0090.586] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm.xml")) returned 0x20 [0090.682] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm.xml", dwFileAttributes=0x20) returned 0 [0090.682] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.683] GetLastError () returned 0x5 [0090.683] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm.xml", dwFileAttributes=0x20) returned 0 [0090.683] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3975e28) returned 1 Thread: id = 1977 os_tid = 0x14fc [0090.587] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20 [0091.360] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml", dwFileAttributes=0x20) returned 0 [0091.360] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.360] GetLastError () returned 0x5 [0091.360] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml", dwFileAttributes=0x20) returned 0 [0091.360] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b0a40) returned 1 Thread: id = 1978 os_tid = 0x1508 [0090.588] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml")) returned 0x20 [0091.359] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml", dwFileAttributes=0x20) returned 0 [0091.359] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.359] GetLastError () returned 0x5 [0091.359] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml", dwFileAttributes=0x20) returned 0 [0091.359] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3933bc8) returned 1 Thread: id = 1979 os_tid = 0x1a04 [0090.588] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml")) returned 0x20 [0091.357] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml", dwFileAttributes=0x20) returned 0 [0091.358] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.358] GetLastError () returned 0x5 [0091.358] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml", dwFileAttributes=0x20) returned 0 [0091.358] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3933ca8) returned 1 Thread: id = 1980 os_tid = 0x1868 [0090.589] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20 [0091.355] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml", dwFileAttributes=0x20) returned 0 [0091.356] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.357] GetLastError () returned 0x5 [0091.357] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml", dwFileAttributes=0x20) returned 0 [0091.357] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3933f48) returned 1 Thread: id = 1981 os_tid = 0x12e0 [0090.589] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x76) returned 0x38d1f20 [0090.589] wcscpy (in: _Dest=0x38d1f20, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Downlevel" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Downlevel") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Downlevel" [0090.589] wcscat (in: _Dest=0x38d1f20, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Downlevel\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Downlevel\\" [0090.589] wcscat (in: _Dest=0x38d1f20, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Downlevel\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Downlevel\\*" [0090.589] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3939ec0 [0090.589] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Downlevel\\*", lpFindFileData=0x3939ec0 | out: lpFindFileData=0x3939ec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b49b215, ftCreationTime.dwHighDateTime=0x1d32793, ftLastAccessTime.dwLowDateTime=0x7b4c1487, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x7b4c1487, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f280 [0091.356] wcscmp (_String1=".", _String2=".") returned 0 [0091.356] FindNextFileW (in: hFindFile=0x389f280, lpFindFileData=0x3939ec0 | out: lpFindFileData=0x3939ec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b49b215, ftCreationTime.dwHighDateTime=0x1d32793, ftLastAccessTime.dwLowDateTime=0x7b4c1487, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x7b4c1487, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.356] wcscmp (_String1="..", _String2=".") returned 1 [0091.356] wcscmp (_String1="..", _String2="..") returned 0 [0091.356] FindNextFileW (in: hFindFile=0x389f280, lpFindFileData=0x3939ec0 | out: lpFindFileData=0x3939ec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ab2d90, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xe6ab2d90, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xf6701bd8, ftLastWriteTime.dwHighDateTime=0x1d3273c, nFileSizeHigh=0x0, nFileSizeLow=0x220000, dwReserved0=0x0, dwReserved1=0x0, cFileName="StateRepository-Machine.srd", cAlternateFileName="STATER~1.SRD")) returned 1 [0091.356] wcscmp (_String1="StateRepository-Machine.srd", _String2=".") returned 1 [0091.356] wcscmp (_String1="StateRepository-Machine.srd", _String2="..") returned 1 [0091.356] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xaa) returned 0x55c87e0 [0091.356] wcscpy (in: _Dest=0x55c87e0, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Downlevel" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Downlevel") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Downlevel" [0091.356] wcscat (in: _Dest=0x55c87e0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Downlevel\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Downlevel\\" [0091.356] wcscat (in: _Dest=0x55c87e0, _Source="StateRepository-Machine.srd" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Downlevel\\StateRepository-Machine.srd") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Downlevel\\StateRepository-Machine.srd" Thread: id = 1982 os_tid = 0x1a08 [0090.590] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml")) returned 0x20 [0091.350] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml", dwFileAttributes=0x20) returned 0 [0091.350] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.350] GetLastError () returned 0x5 [0091.350] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml", dwFileAttributes=0x20) returned 0 [0091.350] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b0b58) returned 1 Thread: id = 1983 os_tid = 0x1a0c [0090.590] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml")) returned 0x20 [0091.353] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml", dwFileAttributes=0x20) returned 0 [0091.354] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.354] GetLastError () returned 0x5 [0091.354] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml", dwFileAttributes=0x20) returned 0 [0091.354] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757fd60) returned 1 Thread: id = 1984 os_tid = 0x19f4 [0090.591] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x74) returned 0x38d1fa0 [0090.591] wcscpy (in: _Dest=0x38d1fa0, _Source="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Families" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Families") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Families" [0090.591] wcscat (in: _Dest=0x38d1fa0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Families\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Families\\" [0090.591] wcscat (in: _Dest=0x38d1fa0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Families\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Families\\*" [0090.591] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393a128 [0090.591] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Families\\*", lpFindFileData=0x393a128 | out: lpFindFileData=0x393a128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe702f6a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f300 [0091.387] wcscmp (_String1=".", _String2=".") returned 0 [0091.387] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x393a128 | out: lpFindFileData=0x393a128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe702f6a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.387] wcscmp (_String1="..", _String2=".") returned 1 [0091.387] wcscmp (_String1="..", _String2="..") returned 0 [0091.387] FindNextFileW (in: hFindFile=0x389f300, lpFindFileData=0x393a128 | out: lpFindFileData=0x393a128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe702f6a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0091.387] FindClose (in: hFindFile=0x389f300 | out: hFindFile=0x389f300) returned 1 [0091.388] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393a128) returned 1 [0091.388] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38d1fa0) returned 1 [0091.388] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b00a8) returned 1 Thread: id = 1985 os_tid = 0x16b8 [0090.592] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy.xml")) returned 0x20 [0091.352] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy.xml", dwFileAttributes=0x20) returned 0 [0091.352] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.353] GetLastError () returned 0x5 [0091.353] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy.xml", dwFileAttributes=0x20) returned 0 [0091.353] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3976148) returned 1 Thread: id = 1986 os_tid = 0x126c [0090.592] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy.xml")) returned 0x20 [0091.351] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy.xml", dwFileAttributes=0x20) returned 0 [0091.351] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.351] GetLastError () returned 0x5 [0091.351] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy.xml", dwFileAttributes=0x20) returned 0 [0091.351] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f7a20) returned 1 Thread: id = 1987 os_tid = 0x11ec [0090.594] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy.xml")) returned 0x20 [0091.389] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy.xml", dwFileAttributes=0x20) returned 0 [0091.389] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.389] GetLastError () returned 0x5 [0091.389] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy.xml", dwFileAttributes=0x20) returned 0 [0091.389] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f6f90) returned 1 Thread: id = 1988 os_tid = 0xdd4 [0090.594] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20 [0091.386] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml", dwFileAttributes=0x20) returned 0 [0091.386] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.386] GetLastError () returned 0x5 [0091.386] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml", dwFileAttributes=0x20) returned 0 [0091.387] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3934e28) returned 1 Thread: id = 1989 os_tid = 0xc20 [0090.595] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml")) returned 0x20 [0091.385] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml", dwFileAttributes=0x20) returned 0 [0091.385] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.385] GetLastError () returned 0x5 [0091.385] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml", dwFileAttributes=0x20) returned 0 [0091.385] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba2ef8) returned 1 Thread: id = 1990 os_tid = 0x1890 [0090.595] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml")) returned 0x20 [0091.384] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml", dwFileAttributes=0x20) returned 0 [0091.384] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.384] GetLastError () returned 0x5 [0091.384] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml", dwFileAttributes=0x20) returned 0 [0091.384] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba20f8) returned 1 Thread: id = 1991 os_tid = 0x1894 [0090.596] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml")) returned 0x20 [0091.383] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml", dwFileAttributes=0x20) returned 0 [0091.383] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.383] GetLastError () returned 0x5 [0091.383] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml", dwFileAttributes=0x20) returned 0 [0091.383] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3933928) returned 1 Thread: id = 1992 os_tid = 0x1898 [0090.596] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml")) returned 0x20 [0091.382] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml", dwFileAttributes=0x20) returned 0 [0091.382] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.382] GetLastError () returned 0x5 [0091.382] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml", dwFileAttributes=0x20) returned 0 [0091.382] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x757fc88) returned 1 Thread: id = 1993 os_tid = 0x189c [0090.597] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Square44x44Logo.targetsize-24_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\assets\\images\\tiles\\square44x44logo.targetsize-24_altform-unplated.png")) returned 0x20 [0091.317] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Square44x44Logo.targetsize-24_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0091.320] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Square44x44Logo.targetsize-24_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\assets\\images\\tiles\\square44x44logo.targetsize-24_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.322] GetLastError () returned 0x5 [0091.322] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Square44x44Logo.targetsize-24_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0091.323] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bddc0) returned 1 Thread: id = 1994 os_tid = 0x18a0 [0090.598] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Square71x71Logo.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\assets\\images\\tiles\\square71x71logo.scale-200.png")) returned 0x20 [0090.601] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Square71x71Logo.scale-200.png", dwFileAttributes=0x20) returned 0 [0090.602] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Square71x71Logo.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\assets\\images\\tiles\\square71x71logo.scale-200.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.604] GetLastError () returned 0x5 [0090.604] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Square71x71Logo.scale-200.png", dwFileAttributes=0x20) returned 0 [0090.605] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74d9828) returned 1 Thread: id = 1995 os_tid = 0xc94 [0090.606] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\StoreLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\assets\\images\\tiles\\storelogo.png")) returned 0x20 [0090.609] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\StoreLogo.png", dwFileAttributes=0x20) returned 0 [0090.612] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\StoreLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\assets\\images\\tiles\\storelogo.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.613] GetLastError () returned 0x5 [0090.613] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\StoreLogo.png", dwFileAttributes=0x20) returned 0 [0090.614] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7582000) returned 1 Thread: id = 1996 os_tid = 0x37c [0090.615] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Wide310x150Logo.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\assets\\images\\tiles\\wide310x150logo.scale-200.png")) returned 0x20 [0090.618] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Wide310x150Logo.scale-200.png", dwFileAttributes=0x20) returned 0 [0090.620] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Wide310x150Logo.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\assets\\images\\tiles\\wide310x150logo.scale-200.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.621] GetLastError () returned 0x5 [0090.621] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\Wide310x150Logo.scale-200.png", dwFileAttributes=0x20) returned 0 [0090.623] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74daf48) returned 1 Thread: id = 1997 os_tid = 0x67c [0090.625] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\release-config.json" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\assets\\release-config.json")) returned 0x20 [0090.627] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\release-config.json", dwFileAttributes=0x20) returned 0 [0090.627] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\release-config.json" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\assets\\release-config.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.627] GetLastError () returned 0x5 [0090.627] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\release-config.json", dwFileAttributes=0x20) returned 0 [0090.627] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393ecd8) returned 1 Thread: id = 2025 os_tid = 0x448 [0090.716] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8a) returned 0x549f8f8 [0090.716] wcscpy (in: _Dest=0x549f8f8, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility" [0090.716] wcscat (in: _Dest=0x549f8f8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\" [0090.716] wcscat (in: _Dest=0x549f8f8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\*" [0090.716] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x39358f8 [0090.717] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\*", lpFindFileData=0x39358f8 | out: lpFindFileData=0x39358f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc23497a5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a94a259, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54456c0 [0090.717] wcscmp (_String1=".", _String2=".") returned 0 [0090.717] FindNextFileW (in: hFindFile=0x54456c0, lpFindFileData=0x39358f8 | out: lpFindFileData=0x39358f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc23497a5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a94a259, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.717] wcscmp (_String1="..", _String2=".") returned 1 [0090.717] wcscmp (_String1="..", _String2="..") returned 0 [0090.717] FindNextFileW (in: hFindFile=0x54456c0, lpFindFileData=0x39358f8 | out: lpFindFileData=0x39358f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a94a259, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f43b93, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e5b1b6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0090.717] wcscmp (_String1="Desktop.ini", _String2=".") returned 1 [0090.717] wcscmp (_String1="Desktop.ini", _String2="..") returned 1 [0090.717] FindNextFileW (in: hFindFile=0x54456c0, lpFindFileData=0x39358f8 | out: lpFindFileData=0x39358f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech Recognition.lnk", cAlternateFileName="")) returned 1 [0090.717] wcscmp (_String1="Speech Recognition.lnk", _String2=".") returned 1 [0090.717] wcscmp (_String1="Speech Recognition.lnk", _String2="..") returned 1 [0090.717] FindNextFileW (in: hFindFile=0x54456c0, lpFindFileData=0x39358f8 | out: lpFindFileData=0x39358f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech Recognition.lnk", cAlternateFileName="")) returned 0 [0090.717] FindClose (in: hFindFile=0x54456c0 | out: hFindFile=0x54456c0) returned 1 [0090.717] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39358f8) returned 1 [0090.717] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549f8f8) returned 1 [0090.717] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549d568) returned 1 Thread: id = 2066 os_tid = 0x14cc [0090.879] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\N UnSNd.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\llmkz1w\\pgoc85gxnnyitp5yb\\n unsnd.swf")) returned 0x20 [0090.879] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\N UnSNd.swf", dwFileAttributes=0x20) returned 1 [0090.879] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\N UnSNd.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\llmkz1w\\pgoc85gxnnyitp5yb\\n unsnd.swf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdb8 [0090.879] GetFileSizeEx (in: hFile=0xdb8, lpFileSize=0x461fff34 | out: lpFileSize=0x461fff34*=55241) returned 1 [0090.879] SetFilePointerEx (in: hFile=0xdb8, liDistanceToMove=0xd7c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.880] ReadFile (in: hFile=0xdb8, lpBuffer=0x461ffeb8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x461ffeb4, lpOverlapped=0x0 | out: lpBuffer=0x461ffeb8*, lpNumberOfBytesRead=0x461ffeb4*=0x4, lpOverlapped=0x0) returned 1 [0090.880] SetFilePointerEx (in: hFile=0xdb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.880] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080718 [0090.880] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080268 [0090.880] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0802e0 [0090.880] NtQuerySystemTime (in: CurrentTime=0x461ffe94 | out: CurrentTime=0x461ffe94*=132260136480400753) returned 0x0 [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0x40469dee [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0x4929c00e [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0x66957b5d [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0x1e4057ea [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0xf3b07eb5 [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0x758b2a21 [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0x589fba04 [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0xa079d980 [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0xf9248c57 [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0x49df4684 [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0x8a463676 [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0x9582660a [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0x76865819 [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0x6bad7167 [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0xf7fdb17c [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0x1bfd701b [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0xbeee4c98 [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0x38e0941d [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0xf55af996 [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0x162eb880 [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0xede86b4a [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0xc13ba401 [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0x83b2d8f8 [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0x450f8ea3 [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0x190c9aee [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0x40abc364 [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0x68452795 [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0x95bc2269 [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0x2d919591 [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0xf93f4e29 [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0xd850475e [0090.880] RtlRandom (in: Seed=0x461ffea0 | out: Seed=0x461ffea0) returned 0x5d104448 [0091.281] SetFilePointerEx (in: hFile=0xdb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.281] ReadFile (in: hFile=0xdb8, lpBuffer=0x7394810, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x461ffe74, lpOverlapped=0x0 | out: lpBuffer=0x7394810*, lpNumberOfBytesRead=0x461ffe74*=0xc800, lpOverlapped=0x0) returned 1 [0091.282] SetFilePointerEx (in: hFile=0xdb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.282] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40) returned 0x5ba8600 [0091.282] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x70) returned 0xe4d0428 [0091.282] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080358 [0091.282] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe080358) returned 1 [0091.283] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc800) returned 0xe33f390 [0091.289] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080358 [0091.289] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0803d0 [0091.289] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe0803d0) returned 1 [0091.289] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0xe4d0428) returned 1 [0091.289] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba8600) returned 1 [0091.289] WriteFile (hFile=0xdb8, lpBuffer=0xe33f390, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x461ffe74, lpOverlapped=0x0) Thread: id = 2067 os_tid = 0x14d0 [0090.939] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\Z0m0eECvz66.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\llmkz1w\\pgoc85gxnnyitp5yb\\z0m0eecvz66.swf")) returned 0x20 [0090.939] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\Z0m0eECvz66.swf", dwFileAttributes=0x20) returned 1 [0090.939] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\lLMKz1W\\pGOC85GxnNYiTp5YB\\Z0m0eECvz66.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\llmkz1w\\pgoc85gxnnyitp5yb\\z0m0eecvz66.swf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xdbc [0090.939] GetFileSizeEx (in: hFile=0xdbc, lpFileSize=0x4627fd04 | out: lpFileSize=0x4627fd04*=10205) returned 1 [0090.939] SetFilePointerEx (in: hFile=0xdbc, liDistanceToMove=0x27d9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.939] ReadFile (in: hFile=0xdbc, lpBuffer=0x4627fc88, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4627fc84, lpOverlapped=0x0 | out: lpBuffer=0x4627fc88*, lpNumberOfBytesRead=0x4627fc84*=0x4, lpOverlapped=0x0) returned 1 [0090.939] SetFilePointerEx (in: hFile=0xdbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.939] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080718 [0090.939] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0802e0 [0090.940] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe080358 [0090.940] NtQuerySystemTime (in: CurrentTime=0x4627fc64 | out: CurrentTime=0x4627fc64*=132260136481025733) returned 0x0 [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0x84ada2ab [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0xaddcf4d1 [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0x898df934 [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0x2cd962d6 [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0x12c1c591 [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0x4113508b [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0xf0b5a727 [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0x7ed41874 [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0x7156e7ee [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0xaccba8ee [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0x542e5f6a [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0x914f923b [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0x9d39c9af [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0x4a87d7d3 [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0xaa726a1e [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0x9f76dba5 [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0xf054b093 [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0xe1151dbc [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0x161c6b96 [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0x4fd4ceff [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0xb122fe93 [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0x202beb42 [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0x33d85108 [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0xd270e8b7 [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0x8b0fa45a [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0x825fdac7 [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0x5d406378 [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0x79385625 [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0x25743abf [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0x54cbc5e1 [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0x199545f9 [0090.940] RtlRandom (in: Seed=0x4627fc70 | out: Seed=0x4627fc70) returned 0xd7fea664 [0091.279] ReadFile (in: hFile=0xdbc, lpBuffer=0x7406060, nNumberOfBytesToRead=0x27dd, lpNumberOfBytesRead=0x4627fc60, lpOverlapped=0x0 | out: lpBuffer=0x7406060*, lpNumberOfBytesRead=0x4627fc60*=0x27dd, lpOverlapped=0x0) returned 1 [0091.280] SetFilePointerEx (in: hFile=0xdbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.280] WriteFile (hFile=0xdbc, lpBuffer=0xe13a1c8, nNumberOfBytesToWrite=0x27dd, lpNumberOfBytesWritten=0x4627fc5c, lpOverlapped=0x0) Thread: id = 2068 os_tid = 0x14d4 [0090.950] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml")) returned 0x20 [0090.952] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml", dwFileAttributes=0x20) returned 0 [0090.954] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.956] GetLastError () returned 0x5 [0090.956] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml", dwFileAttributes=0x20) returned 0 [0090.958] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7439cb8) returned 1 Thread: id = 2069 os_tid = 0x14dc [0090.963] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml")) returned 0x20 [0091.271] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml", dwFileAttributes=0x20) returned 0 [0091.272] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftofficehub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.274] GetLastError () returned 0x5 [0091.274] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml", dwFileAttributes=0x20) returned 0 [0091.275] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74db258) returned 1 Thread: id = 2070 os_tid = 0x1510 [0090.964] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat")) returned 0x20 [0090.966] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0090.966] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.966] GetLastError () returned 0x5 [0090.966] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", dwFileAttributes=0x20) returned 0 [0090.966] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e1e78) returned 1 Thread: id = 2071 os_tid = 0x1520 [0090.967] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\3_awards_years_base.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\arkadium.win10.awards\\assets\\3_awards_years_base.png")) returned 0x20 [0090.970] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\3_awards_years_base.png", dwFileAttributes=0x20) returned 0 [0090.971] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\3_awards_years_base.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\arkadium.win10.awards\\assets\\3_awards_years_base.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.973] GetLastError () returned 0x5 [0090.973] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\3_awards_years_base.png", dwFileAttributes=0x20) returned 0 [0090.974] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7586b68) returned 1 Thread: id = 2072 os_tid = 0x152c [0090.975] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\awards_circle_gray.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\arkadium.win10.awards\\assets\\awards_circle_gray.png")) returned 0x20 [0090.978] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\awards_circle_gray.png", dwFileAttributes=0x20) returned 0 [0090.979] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\awards_circle_gray.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\arkadium.win10.awards\\assets\\awards_circle_gray.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.980] GetLastError () returned 0x5 [0090.980] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\awards_circle_gray.png", dwFileAttributes=0x20) returned 0 [0090.982] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba10e8) returned 1 Thread: id = 2073 os_tid = 0x1558 [0090.983] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\awards_corner_gray.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\arkadium.win10.awards\\assets\\awards_corner_gray.png")) returned 0x20 [0090.984] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\awards_corner_gray.png", dwFileAttributes=0x20) returned 0 [0090.986] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\awards_corner_gray.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\arkadium.win10.awards\\assets\\awards_corner_gray.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.987] GetLastError () returned 0x5 [0090.987] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\awards_corner_gray.png", dwFileAttributes=0x20) returned 0 [0090.988] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba1838) returned 1 Thread: id = 2074 os_tid = 0x1570 [0090.990] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\Awards_cup.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\arkadium.win10.awards\\assets\\awards_cup.png")) returned 0x20 [0090.991] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\Awards_cup.png", dwFileAttributes=0x20) returned 0 [0090.992] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\Awards_cup.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\arkadium.win10.awards\\assets\\awards_cup.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0090.994] GetLastError () returned 0x5 [0090.994] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\Awards_cup.png", dwFileAttributes=0x20) returned 0 [0090.995] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74da040) returned 1 Thread: id = 2075 os_tid = 0x157c [0090.997] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\awards_sign_in_tile.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\arkadium.win10.awards\\assets\\awards_sign_in_tile.jpg")) returned 0x20 [0091.000] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\awards_sign_in_tile.jpg", dwFileAttributes=0x20) returned 0 [0091.001] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\awards_sign_in_tile.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\arkadium.win10.awards\\assets\\awards_sign_in_tile.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.003] GetLastError () returned 0x5 [0091.003] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\awards_sign_in_tile.jpg", dwFileAttributes=0x20) returned 0 [0091.004] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba1220) returned 1 Thread: id = 2076 os_tid = 0x158c [0091.005] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\awards_years_base.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\arkadium.win10.awards\\assets\\awards_years_base.png")) returned 0x20 [0091.007] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\awards_years_base.png", dwFileAttributes=0x20) returned 0 [0091.009] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\awards_years_base.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\arkadium.win10.awards\\assets\\awards_years_base.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.010] GetLastError () returned 0x5 [0091.010] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\awards_years_base.png", dwFileAttributes=0x20) returned 0 [0091.012] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba15c8) returned 1 Thread: id = 2077 os_tid = 0x1f64 [0091.013] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\Sign_in_size.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\arkadium.win10.awards\\assets\\sign_in_size.jpg")) returned 0x20 [0091.017] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\Sign_in_size.jpg", dwFileAttributes=0x20) returned 0 [0091.018] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\Sign_in_size.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\arkadium.win10.awards\\assets\\sign_in_size.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.019] GetLastError () returned 0x5 [0091.019] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\Sign_in_size.jpg", dwFileAttributes=0x20) returned 0 [0091.021] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba1700) returned 1 Thread: id = 2078 os_tid = 0x15cc [0091.022] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x116) returned 0x74da040 [0091.022] wcscpy (in: _Dest=0x74da040, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets" [0091.022] wcscat (in: _Dest=0x74da040, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets\\" [0091.022] wcscat (in: _Dest=0x74da040, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets\\*" [0091.022] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3935b60 [0091.022] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets\\*", lpFindFileData=0x3935b60 | out: lpFindFileData=0x3935b60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342dac13, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabffc808, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3472fed7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f0c0 [0091.277] wcscmp (_String1=".", _String2=".") returned 0 [0091.277] FindNextFileW (in: hFindFile=0x389f0c0, lpFindFileData=0x3935b60 | out: lpFindFileData=0x3935b60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342dac13, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabffc808, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3472fed7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.277] wcscmp (_String1="..", _String2=".") returned 1 [0091.277] wcscmp (_String1="..", _String2="..") returned 0 [0091.277] FindNextFileW (in: hFindFile=0x389f0c0, lpFindFileData=0x3935b60 | out: lpFindFileData=0x3935b60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342dac13, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac04346d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x344583a2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Animation", cAlternateFileName="ANIMAT~1")) returned 1 [0091.277] wcscmp (_String1="Animation", _String2=".") returned 1 [0091.277] wcscmp (_String1="Animation", _String2="..") returned 1 [0091.277] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x126) returned 0x5baa968 [0091.277] wcscpy (in: _Dest=0x5baa968, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets" [0091.277] wcscat (in: _Dest=0x5baa968, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets\\" [0091.277] wcscat (in: _Dest=0x5baa968, _Source="Animation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets\\Animation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets\\Animation" Thread: id = 2079 os_tid = 0x15d8 [0091.023] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\newsBackground.html" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\arkadium.win10.news\\assets\\newsbackground.html")) returned 0x20 [0091.025] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\newsBackground.html", dwFileAttributes=0x20) returned 0 [0091.026] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\newsBackground.html" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\arkadium.win10.news\\assets\\newsbackground.html"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.027] GetLastError () returned 0x5 [0091.028] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\newsBackground.html", dwFileAttributes=0x20) returned 0 [0091.029] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75868f8) returned 1 Thread: id = 2080 os_tid = 0x1640 [0091.030] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\news_button.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\arkadium.win10.news\\assets\\news_button.png")) returned 0x20 [0091.033] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\news_button.png", dwFileAttributes=0x20) returned 0 [0091.034] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\news_button.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\arkadium.win10.news\\assets\\news_button.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.035] GetLastError () returned 0x5 [0091.035] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\news_button.png", dwFileAttributes=0x20) returned 0 [0091.037] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74d9138) returned 1 Thread: id = 2081 os_tid = 0x1644 [0091.038] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\news_button_down.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\arkadium.win10.news\\assets\\news_button_down.png")) returned 0x20 [0091.039] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\news_button_down.png", dwFileAttributes=0x20) returned 0 [0091.041] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\news_button_down.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\arkadium.win10.news\\assets\\news_button_down.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.043] GetLastError () returned 0x5 [0091.043] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\news_button_down.png", dwFileAttributes=0x20) returned 0 [0091.045] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74df4f8) returned 1 Thread: id = 2082 os_tid = 0x1f68 [0091.046] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\news_button_over.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\arkadium.win10.news\\assets\\news_button_over.png")) returned 0x20 [0091.049] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\news_button_over.png", dwFileAttributes=0x20) returned 0 [0091.051] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\news_button_over.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\arkadium.win10.news\\assets\\news_button_over.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.052] GetLastError () returned 0x5 [0091.052] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\news_button_over.png", dwFileAttributes=0x20) returned 0 [0091.053] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74dfeb8) returned 1 Thread: id = 2083 os_tid = 0x1660 [0091.055] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\News_icon-over.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\arkadium.win10.news\\assets\\news_icon-over.png")) returned 0x20 [0091.056] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\News_icon-over.png", dwFileAttributes=0x20) returned 0 [0091.057] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\News_icon-over.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\arkadium.win10.news\\assets\\news_icon-over.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.059] GetLastError () returned 0x5 [0091.059] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\News_icon-over.png", dwFileAttributes=0x20) returned 0 [0091.060] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74df150) returned 1 Thread: id = 2084 os_tid = 0x1664 [0091.062] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\News_icon-press.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\arkadium.win10.news\\assets\\news_icon-press.png")) returned 0x20 [0091.063] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\News_icon-press.png", dwFileAttributes=0x20) returned 0 [0091.066] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\News_icon-press.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\arkadium.win10.news\\assets\\news_icon-press.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.067] GetLastError () returned 0x5 [0091.067] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\News_icon-press.png", dwFileAttributes=0x20) returned 0 [0091.069] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e0ae8) returned 1 Thread: id = 2085 os_tid = 0x1680 [0091.070] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\News_icon-up.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\arkadium.win10.news\\assets\\news_icon-up.png")) returned 0x20 [0091.071] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\News_icon-up.png", dwFileAttributes=0x20) returned 0 [0091.072] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\News_icon-up.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\arkadium.win10.news\\assets\\news_icon-up.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.074] GetLastError () returned 0x5 [0091.074] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\News_icon-up.png", dwFileAttributes=0x20) returned 0 [0091.075] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74d9260) returned 1 Thread: id = 2086 os_tid = 0x1684 [0091.076] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x108) returned 0x74b3ab0 [0091.076] wcscpy (in: _Dest=0x74b3ab0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets" [0091.076] wcscat (in: _Dest=0x74b3ab0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\" [0091.076] wcscat (in: _Dest=0x74b3ab0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\*" [0091.076] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3935dc8 [0091.076] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\*", lpFindFileData=0x3935dc8 | out: lpFindFileData=0x3935dc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x347a261b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac275cac, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3499a434, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x54456c0 [0091.079] wcscmp (_String1=".", _String2=".") returned 0 [0091.079] FindNextFileW (in: hFindFile=0x54456c0, lpFindFileData=0x3935dc8 | out: lpFindFileData=0x3935dc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x347a261b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac275cac, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3499a434, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.079] wcscmp (_String1="..", _String2=".") returned 1 [0091.079] wcscmp (_String1="..", _String2="..") returned 0 [0091.079] FindNextFileW (in: hFindFile=0x54456c0, lpFindFileData=0x3935dc8 | out: lpFindFileData=0x3935dc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x347a261b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac318bc0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x347eead2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Animation", cAlternateFileName="ANIMAT~1")) returned 1 [0091.079] wcscmp (_String1="Animation", _String2=".") returned 1 [0091.079] wcscmp (_String1="Animation", _String2="..") returned 1 [0091.079] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x118) returned 0x74d9138 [0091.079] wcscpy (in: _Dest=0x74d9138, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets" [0091.079] wcscat (in: _Dest=0x74d9138, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\" [0091.079] wcscat (in: _Dest=0x74d9138, _Source="Animation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\Animation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\Animation" [0091.079] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x74d9138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe00 [0091.080] FindNextFileW (in: hFindFile=0x54456c0, lpFindFileData=0x3935dc8 | out: lpFindFileData=0x3935dc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34814d2b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac3196ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34814d2b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Badges", cAlternateFileName="")) returned 1 [0091.080] wcscmp (_String1="Badges", _String2=".") returned 1 [0091.080] wcscmp (_String1="Badges", _String2="..") returned 1 [0091.080] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x74d9260 [0091.080] wcscpy (in: _Dest=0x74d9260, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets" [0091.080] wcscat (in: _Dest=0x74d9260, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\" [0091.080] wcscat (in: _Dest=0x74d9260, _Source="Badges" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\Badges") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\Badges" [0091.080] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x74d9260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe40 [0091.081] FindNextFileW (in: hFindFile=0x54456c0, lpFindFileData=0x3935dc8 | out: lpFindFileData=0x3935dc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3483af85, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3483af85, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3483af85, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="collection_base.png", cAlternateFileName="")) returned 1 [0091.081] wcscmp (_String1="collection_base.png", _String2=".") returned 1 [0091.081] wcscmp (_String1="collection_base.png", _String2="..") returned 1 [0091.081] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12c) returned 0x5baa5c0 [0091.081] wcscpy (in: _Dest=0x5baa5c0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets" [0091.081] wcscat (in: _Dest=0x5baa5c0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\" [0091.081] wcscat (in: _Dest=0x5baa5c0, _Source="collection_base.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\collection_base.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\collection_base.png" [0091.081] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5baa5c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe70 [0091.081] FindNextFileW (in: hFindFile=0x54456c0, lpFindFileData=0x3935dc8 | out: lpFindFileData=0x3935dc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3483af85, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3483af85, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3483af85, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x137d, dwReserved0=0x0, dwReserved1=0x0, cFileName="collection_grey.png", cAlternateFileName="")) returned 1 [0091.081] wcscmp (_String1="collection_grey.png", _String2=".") returned 1 [0091.081] wcscmp (_String1="collection_grey.png", _String2="..") returned 1 [0091.081] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12c) returned 0x5ba8fd0 [0091.082] wcscpy (in: _Dest=0x5ba8fd0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets" [0091.082] wcscat (in: _Dest=0x5ba8fd0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\" [0091.082] wcscat (in: _Dest=0x5ba8fd0, _Source="collection_grey.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\collection_grey.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\collection_grey.png" [0091.082] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba8fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1630 [0091.082] FindNextFileW (in: hFindFile=0x54456c0, lpFindFileData=0x3935dc8 | out: lpFindFileData=0x3935dc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3483af85, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x348653d9, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x348653d9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x29ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="crown.png", cAlternateFileName="")) returned 1 [0091.082] wcscmp (_String1="crown.png", _String2=".") returned 1 [0091.082] wcscmp (_String1="crown.png", _String2="..") returned 1 [0091.082] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x118) returned 0x7462fc8 [0091.259] wcscpy (in: _Dest=0x7462fc8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets" [0091.259] wcscat (in: _Dest=0x7462fc8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\" [0091.259] wcscat (in: _Dest=0x7462fc8, _Source="crown.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\crown.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\crown.png" Thread: id = 2087 os_tid = 0x168c [0091.083] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Premium_badge_compact.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\assets\\premium_badge_compact.png")) returned 0x20 [0091.084] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Premium_badge_compact.png", dwFileAttributes=0x20) returned 0 [0091.086] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Premium_badge_compact.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\assets\\premium_badge_compact.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.086] GetLastError () returned 0x5 [0091.086] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Premium_badge_compact.png", dwFileAttributes=0x20) returned 0 [0091.086] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7579bd8) returned 1 Thread: id = 2088 os_tid = 0x1714 [0091.087] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Premium_base.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\assets\\premium_base.jpg")) returned 0x20 [0091.088] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Premium_base.jpg", dwFileAttributes=0x20) returned 0 [0091.088] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Premium_base.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\assets\\premium_base.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.089] GetLastError () returned 0x5 [0091.089] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Premium_base.jpg", dwFileAttributes=0x20) returned 0 [0091.089] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba39f8) returned 1 Thread: id = 2089 os_tid = 0x1740 [0091.090] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\premium_ribbon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\assets\\premium_ribbon.png")) returned 0x20 [0091.090] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\premium_ribbon.png", dwFileAttributes=0x20) returned 0 [0091.091] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\premium_ribbon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\assets\\premium_ribbon.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.091] GetLastError () returned 0x5 [0091.091] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\premium_ribbon.png", dwFileAttributes=0x20) returned 0 [0091.091] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75818c8) returned 1 Thread: id = 2090 os_tid = 0x1744 [0091.093] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba36f8 [0091.093] wcscpy (in: _Dest=0x5ba36f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader" [0091.093] wcscat (in: _Dest=0x5ba36f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader\\" [0091.093] wcscat (in: _Dest=0x5ba36f8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader\\*" [0091.093] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3936030 [0091.093] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader\\*", lpFindFileData=0x3936030 | out: lpFindFileData=0x3936030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x366fcec2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad349c2a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36723120, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0091.093] wcscmp (_String1=".", _String2=".") returned 0 [0091.093] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x3936030 | out: lpFindFileData=0x3936030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x366fcec2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad349c2a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36723120, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.094] wcscmp (_String1="..", _String2=".") returned 1 [0091.094] wcscmp (_String1="..", _String2="..") returned 0 [0091.094] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x3936030 | out: lpFindFileData=0x3936030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x366fcec2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x366fcec2, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x366fcec2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x390, dwReserved0=0x0, dwReserved1=0x0, cFileName="avatar.png", cAlternateFileName="")) returned 1 [0091.094] wcscmp (_String1="avatar.png", _String2=".") returned 1 [0091.094] wcscmp (_String1="avatar.png", _String2="..") returned 1 [0091.094] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x104) returned 0x74b30d8 [0091.094] wcscpy (in: _Dest=0x74b30d8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader" [0091.094] wcscat (in: _Dest=0x74b30d8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader\\" [0091.094] wcscat (in: _Dest=0x74b30d8, _Source="avatar.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader\\avatar.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader\\avatar.png" [0091.094] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b30d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf98 [0091.094] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x3936030 | out: lpFindFileData=0x3936030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x366fcec2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x366fcec2, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x366fcec2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x132, dwReserved0=0x0, dwReserved1=0x0, cFileName="fullscreen32.png", cAlternateFileName="")) returned 1 [0091.094] wcscmp (_String1="fullscreen32.png", _String2=".") returned 1 [0091.094] wcscmp (_String1="fullscreen32.png", _String2="..") returned 1 [0091.094] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x110) returned 0x74b4370 [0091.094] wcscpy (in: _Dest=0x74b4370, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader" [0091.095] wcscat (in: _Dest=0x74b4370, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader\\" [0091.095] wcscat (in: _Dest=0x74b4370, _Source="fullscreen32.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader\\fullscreen32.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader\\fullscreen32.png" [0091.095] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b4370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf9c [0091.095] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x3936030 | out: lpFindFileData=0x3936030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x366fcec2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x366fcec2, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x366fcec2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x25d, dwReserved0=0x0, dwReserved1=0x0, cFileName="globe32.png", cAlternateFileName="")) returned 1 [0091.095] wcscmp (_String1="globe32.png", _String2=".") returned 1 [0091.095] wcscmp (_String1="globe32.png", _String2="..") returned 1 [0091.095] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x74b3f10 [0091.095] wcscpy (in: _Dest=0x74b3f10, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader" [0091.095] wcscat (in: _Dest=0x74b3f10, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader\\" [0091.095] wcscat (in: _Dest=0x74b3f10, _Source="globe32.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader\\globe32.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader\\globe32.png" [0091.095] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b3f10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa4 [0091.096] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x3936030 | out: lpFindFileData=0x3936030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x366fcec2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x366fcec2, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x366fcec2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x561, dwReserved0=0x0, dwReserved1=0x0, cFileName="news.png", cAlternateFileName="")) returned 1 [0091.096] wcscmp (_String1="news.png", _String2=".") returned 1 [0091.096] wcscmp (_String1="news.png", _String2="..") returned 1 [0091.096] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100) returned 0x54994d0 [0091.096] wcscpy (in: _Dest=0x54994d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader" [0091.096] wcscat (in: _Dest=0x54994d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader\\" [0091.096] wcscat (in: _Dest=0x54994d0, _Source="news.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader\\news.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader\\news.png" [0091.096] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x54994d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x364 [0091.097] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x3936030 | out: lpFindFileData=0x3936030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36723120, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x36723120, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x36723120, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="xbox.png", cAlternateFileName="")) returned 1 [0091.097] wcscmp (_String1="xbox.png", _String2=".") returned 1 [0091.097] wcscmp (_String1="xbox.png", _String2="..") returned 1 [0091.097] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100) returned 0x549ac88 [0091.097] wcscpy (in: _Dest=0x549ac88, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader" [0091.097] wcscat (in: _Dest=0x549ac88, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader\\" [0091.097] wcscat (in: _Dest=0x549ac88, _Source="xbox.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader\\xbox.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader\\xbox.png" [0091.097] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549ac88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1604 [0091.097] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x3936030 | out: lpFindFileData=0x3936030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36723120, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x36723120, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x36723120, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="xbox.png", cAlternateFileName="")) returned 0 [0091.097] FindClose (in: hFindFile=0x5445700 | out: hFindFile=0x5445700) returned 1 [0091.098] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3936030) returned 1 [0091.098] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba36f8) returned 1 [0091.098] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393df48) returned 1 Thread: id = 2091 os_tid = 0x1748 [0091.099] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\shadow.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\assets\\shadow.png")) returned 0x20 [0091.100] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\shadow.png", dwFileAttributes=0x20) returned 0 [0091.100] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\shadow.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\assets\\shadow.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.101] GetLastError () returned 0x5 [0091.101] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\shadow.png", dwFileAttributes=0x20) returned 0 [0091.101] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393e230) returned 1 Thread: id = 2092 os_tid = 0x176c [0091.102] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Solitaire25.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\assets\\solitaire25.png")) returned 0x20 [0091.105] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Solitaire25.png", dwFileAttributes=0x20) returned 0 [0091.105] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Solitaire25.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\assets\\solitaire25.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.105] GetLastError () returned 0x5 [0091.105] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Solitaire25.png", dwFileAttributes=0x20) returned 0 [0091.105] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba25f8) returned 1 Thread: id = 2093 os_tid = 0x1770 [0091.106] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba36f8 [0091.106] wcscpy (in: _Dest=0x5ba36f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen" [0091.106] wcscat (in: _Dest=0x5ba36f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen\\" [0091.106] wcscat (in: _Dest=0x5ba36f8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen\\*" [0091.106] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3936030 [0091.106] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen\\*", lpFindFileData=0x3936030 | out: lpFindFileData=0x3936030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36723120, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad3af563, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36749379, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445700 [0091.109] wcscmp (_String1=".", _String2=".") returned 0 [0091.109] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x3936030 | out: lpFindFileData=0x3936030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36723120, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad3af563, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36749379, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.109] wcscmp (_String1="..", _String2=".") returned 1 [0091.109] wcscmp (_String1="..", _String2="..") returned 0 [0091.109] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x3936030 | out: lpFindFileData=0x3936030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36723120, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x36723120, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x36723120, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x930, dwReserved0=0x0, dwReserved1=0x0, cFileName="ArkadiumLogo.png", cAlternateFileName="")) returned 1 [0091.109] wcscmp (_String1="ArkadiumLogo.png", _String2=".") returned 1 [0091.109] wcscmp (_String1="ArkadiumLogo.png", _String2="..") returned 1 [0091.109] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x110) returned 0x74b31f0 [0091.109] wcscpy (in: _Dest=0x74b31f0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen" [0091.109] wcscat (in: _Dest=0x74b31f0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen\\" [0091.109] wcscat (in: _Dest=0x74b31f0, _Source="ArkadiumLogo.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen\\ArkadiumLogo.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen\\ArkadiumLogo.png" [0091.109] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b31f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13ec [0091.110] FindNextFileW (in: hFindFile=0x5445700, lpFindFileData=0x3936030 | out: lpFindFileData=0x3936030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36723120, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x36723120, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x36723120, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xfa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftStudiosLogo.png", cAlternateFileName="")) returned 1 [0091.110] wcscmp (_String1="MicrosoftStudiosLogo.png", _String2=".") returned 1 [0091.110] wcscmp (_String1="MicrosoftStudiosLogo.png", _String2="..") returned 1 [0091.110] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x120) returned 0x7461210 [0091.257] wcscpy (in: _Dest=0x7461210, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen" [0091.257] wcscat (in: _Dest=0x7461210, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen\\" [0091.257] wcscat (in: _Dest=0x7461210, _Source="MicrosoftStudiosLogo.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen\\MicrosoftStudiosLogo.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen\\MicrosoftStudiosLogo.png" Thread: id = 2094 os_tid = 0x1774 [0091.110] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\assets\\splashscreen.scale-200.png")) returned 0x20 [0091.258] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen.scale-200.png", dwFileAttributes=0x20) returned 0 [0091.258] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\assets\\splashscreen.scale-200.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.258] GetLastError () returned 0x5 [0091.258] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen.scale-200.png", dwFileAttributes=0x20) returned 0 [0091.258] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7579cf0) returned 1 Thread: id = 2095 os_tid = 0x1778 [0091.111] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xea) returned 0x544ffd8 [0091.111] wcscpy (in: _Dest=0x544ffd8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\StarClub" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\StarClub") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\StarClub" [0091.111] wcscat (in: _Dest=0x544ffd8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\StarClub\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\StarClub\\" [0091.111] wcscat (in: _Dest=0x544ffd8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\StarClub\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\StarClub\\*" [0091.111] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3936298 [0091.111] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\StarClub\\*", lpFindFileData=0x3936298 | out: lpFindFileData=0x3936298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3676f5d7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad3b11e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36795830, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5445740 [0091.112] wcscmp (_String1=".", _String2=".") returned 0 [0091.112] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x3936298 | out: lpFindFileData=0x3936298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3676f5d7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad3b11e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36795830, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.112] wcscmp (_String1="..", _String2=".") returned 1 [0091.113] wcscmp (_String1="..", _String2="..") returned 0 [0091.113] FindNextFileW (in: hFindFile=0x5445740, lpFindFileData=0x3936298 | out: lpFindFileData=0x3936298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3676f5d7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3676f5d7, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3676f5d7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x19a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="challenge_freecell.jpg", cAlternateFileName="")) returned 1 [0091.113] wcscmp (_String1="challenge_freecell.jpg", _String2=".") returned 1 [0091.113] wcscmp (_String1="challenge_freecell.jpg", _String2="..") returned 1 [0091.113] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x114) returned 0xe02e4a0 [0091.250] wcscpy (in: _Dest=0xe02e4a0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\StarClub" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\StarClub") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\StarClub" [0091.250] wcscat (in: _Dest=0xe02e4a0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\StarClub\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\StarClub\\" [0091.250] wcscat (in: _Dest=0xe02e4a0, _Source="challenge_freecell.jpg" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\StarClub\\challenge_freecell.jpg") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\StarClub\\challenge_freecell.jpg" Thread: id = 2096 os_tid = 0x177c [0091.113] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xee) returned 0x54504b0 [0091.113] wcscpy (in: _Dest=0x54504b0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Statistics" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Statistics") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Statistics" [0091.113] wcscat (in: _Dest=0x54504b0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Statistics\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Statistics\\" [0091.113] wcscat (in: _Dest=0x54504b0, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Statistics\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Statistics\\*" [0091.113] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3936500 [0091.113] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Statistics\\*", lpFindFileData=0x3936500 | out: lpFindFileData=0x3936500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x367bba89, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad3b1c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x367e1ce3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f380 [0091.113] wcscmp (_String1=".", _String2=".") returned 0 [0091.113] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x3936500 | out: lpFindFileData=0x3936500*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x367bba89, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad3b1c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x367e1ce3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.113] wcscmp (_String1="..", _String2=".") returned 1 [0091.113] wcscmp (_String1="..", _String2="..") returned 0 [0091.113] FindNextFileW (in: hFindFile=0x389f380, lpFindFileData=0x3936500 | out: lpFindFileData=0x3936500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x367bba89, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x367bba89, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x367bba89, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="AwardsDefinitions.xml", cAlternateFileName="")) returned 1 [0091.113] wcscmp (_String1="AwardsDefinitions.xml", _String2=".") returned 1 [0091.114] wcscmp (_String1="AwardsDefinitions.xml", _String2="..") returned 1 [0091.114] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x116) returned 0xe02ba30 [0091.249] wcscpy (in: _Dest=0xe02ba30, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Statistics" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Statistics") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Statistics" [0091.249] wcscat (in: _Dest=0xe02ba30, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Statistics\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Statistics\\" [0091.249] wcscat (in: _Dest=0xe02ba30, _Source="AwardsDefinitions.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Statistics\\AwardsDefinitions.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Statistics\\AwardsDefinitions.xml" Thread: id = 2097 os_tid = 0x1780 [0091.114] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\sticker.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\assets\\sticker.png")) returned 0x20 [0091.115] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\sticker.png", dwFileAttributes=0x20) returned 0 [0091.116] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\sticker.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\assets\\sticker.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.116] GetLastError () returned 0x5 [0091.116] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\sticker.png", dwFileAttributes=0x20) returned 0 [0091.116] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393edd0) returned 1 Thread: id = 2098 os_tid = 0x1788 [0091.117] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe4) returned 0x396f898 [0091.117] wcscpy (in: _Dest=0x396f898, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Store" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Store") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Store" [0091.117] wcscat (in: _Dest=0x396f898, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Store\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Store\\" [0091.117] wcscat (in: _Dest=0x396f898, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Store\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Store\\*" [0091.117] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3936768 [0091.117] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Store\\*", lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36807f40, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad3b269d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36807f40, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f3c0 [0091.118] wcscmp (_String1=".", _String2=".") returned 0 [0091.118] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36807f40, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad3b269d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36807f40, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.118] wcscmp (_String1="..", _String2=".") returned 1 [0091.118] wcscmp (_String1="..", _String2="..") returned 0 [0091.118] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36807f40, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x36807f40, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x36807f40, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x16a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreSimulatorProxy.xml", cAlternateFileName="")) returned 1 [0091.118] wcscmp (_String1="StoreSimulatorProxy.xml", _String2=".") returned 1 [0091.118] wcscmp (_String1="StoreSimulatorProxy.xml", _String2="..") returned 1 [0091.118] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x110) returned 0x74b3308 [0091.118] wcscpy (in: _Dest=0x74b3308, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Store" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Store") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Store" [0091.118] wcscat (in: _Dest=0x74b3308, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Store\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Store\\" [0091.118] wcscat (in: _Dest=0x74b3308, _Source="StoreSimulatorProxy.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Store\\StoreSimulatorProxy.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Store\\StoreSimulatorProxy.xml" [0091.118] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b3308, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13e8 [0091.119] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36807f40, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x36807f40, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x36807f40, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x16a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreSimulatorProxy.xml", cAlternateFileName="")) returned 0 [0091.119] FindClose (in: hFindFile=0x389f3c0 | out: hFindFile=0x389f3c0) returned 1 [0091.119] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3936768) returned 1 [0091.119] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396f898) returned 1 [0091.119] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f1600) returned 1 Thread: id = 2099 os_tid = 0x17a4 [0091.120] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\StoreLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\assets\\storelogo.png")) returned 0x20 [0091.121] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\StoreLogo.png", dwFileAttributes=0x20) returned 0 [0091.122] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\StoreLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\assets\\storelogo.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.122] GetLastError () returned 0x5 [0091.122] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\StoreLogo.png", dwFileAttributes=0x20) returned 0 [0091.122] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393d880) returned 1 Thread: id = 2100 os_tid = 0x17a8 [0091.123] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf4) returned 0x5ba39f8 [0091.123] wcscpy (in: _Dest=0x5ba39f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.123] wcscat (in: _Dest=0x5ba39f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.123] wcscat (in: _Dest=0x5ba39f8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\*" [0091.123] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3936768 [0091.123] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\*", lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3682e19a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad463d9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36a24610, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f3c0 [0091.125] wcscmp (_String1=".", _String2=".") returned 0 [0091.125] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3682e19a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad463d9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36a24610, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.126] wcscmp (_String1="..", _String2=".") returned 1 [0091.126] wcscmp (_String1="..", _String2="..") returned 0 [0091.126] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3682e19a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3682e19a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3682e19a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x382, dwReserved0=0x0, dwReserved1=0x0, cFileName="All_cards.png", cAlternateFileName="")) returned 1 [0091.126] wcscmp (_String1="All_cards.png", _String2=".") returned 1 [0091.126] wcscmp (_String1="All_cards.png", _String2="..") returned 1 [0091.126] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10c) returned 0x74b3420 [0091.126] wcscpy (in: _Dest=0x74b3420, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.126] wcscat (in: _Dest=0x74b3420, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.126] wcscat (in: _Dest=0x74b3420, _Source="All_cards.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\All_cards.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\All_cards.png" [0091.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b3420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13e4 [0091.127] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3682e19a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3682e19a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3682e19a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1db, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apply.png", cAlternateFileName="")) returned 1 [0091.127] wcscmp (_String1="Apply.png", _String2=".") returned 1 [0091.127] wcscmp (_String1="Apply.png", _String2="..") returned 1 [0091.127] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x104) returned 0x74b4488 [0091.127] wcscpy (in: _Dest=0x74b4488, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.127] wcscat (in: _Dest=0x74b4488, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.127] wcscat (in: _Dest=0x74b4488, _Source="Apply.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Apply.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Apply.png" [0091.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b4488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1634 [0091.128] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3682e19a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x368543f8, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x368543f8, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x661e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AquariumDeck4.jpg", cAlternateFileName="")) returned 1 [0091.128] wcscmp (_String1="AquariumDeck4.jpg", _String2=".") returned 1 [0091.128] wcscmp (_String1="AquariumDeck4.jpg", _String2="..") returned 1 [0091.128] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x114) returned 0xe02b270 [0091.216] wcscpy (in: _Dest=0xe02b270, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.216] wcscat (in: _Dest=0xe02b270, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.216] wcscat (in: _Dest=0xe02b270, _Source="AquariumDeck4.jpg" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\AquariumDeck4.jpg") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\AquariumDeck4.jpg" [0091.217] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0xe02b270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x163c [0091.217] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3687a656, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3687a656, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3687a656, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x6d8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutumnDeck4.jpg", cAlternateFileName="")) returned 1 [0091.217] wcscmp (_String1="AutumnDeck4.jpg", _String2=".") returned 1 [0091.217] wcscmp (_String1="AutumnDeck4.jpg", _String2="..") returned 1 [0091.217] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x110) returned 0x74b3ce0 [0091.217] wcscpy (in: _Dest=0x74b3ce0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.217] wcscat (in: _Dest=0x74b3ce0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.217] wcscat (in: _Dest=0x74b3ce0, _Source="AutumnDeck4.jpg" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\AutumnDeck4.jpg") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\AutumnDeck4.jpg" [0091.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b3ce0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10d0 [0091.219] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3687a656, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3687a656, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3687a656, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x51a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BeachDeck4.jpg", cAlternateFileName="")) returned 1 [0091.219] wcscmp (_String1="BeachDeck4.jpg", _String2=".") returned 1 [0091.219] wcscmp (_String1="BeachDeck4.jpg", _String2="..") returned 1 [0091.219] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x74b3df8 [0091.219] wcscpy (in: _Dest=0x74b3df8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.219] wcscat (in: _Dest=0x74b3df8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.219] wcscat (in: _Dest=0x74b3df8, _Source="BeachDeck4.jpg" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\BeachDeck4.jpg") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\BeachDeck4.jpg" [0091.219] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b3df8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c8 [0091.220] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3687a656, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3687a656, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3687a656, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x139, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cancel.png", cAlternateFileName="")) returned 1 [0091.220] wcscmp (_String1="Cancel.png", _String2=".") returned 1 [0091.220] wcscmp (_String1="Cancel.png", _String2="..") returned 1 [0091.220] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x74b2b60 [0091.220] wcscpy (in: _Dest=0x74b2b60, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.220] wcscat (in: _Dest=0x74b2b60, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.220] wcscat (in: _Dest=0x74b2b60, _Source="Cancel.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Cancel.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Cancel.png" [0091.220] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b2b60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c4 [0091.220] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x368a08af, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x368a08af, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x368a08af, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Change.png", cAlternateFileName="")) returned 1 [0091.220] wcscmp (_String1="Change.png", _String2=".") returned 1 [0091.220] wcscmp (_String1="Change.png", _String2="..") returned 1 [0091.220] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x74b2c78 [0091.221] wcscpy (in: _Dest=0x74b2c78, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.221] wcscat (in: _Dest=0x74b2c78, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.221] wcscat (in: _Dest=0x74b2c78, _Source="Change.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Change.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Change.png" [0091.221] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b2c78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c0 [0091.221] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x368a08af, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x368a08af, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x368a08af, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x7eaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClassicDeck4.jpg", cAlternateFileName="")) returned 1 [0091.221] wcscmp (_String1="ClassicDeck4.jpg", _String2=".") returned 1 [0091.221] wcscmp (_String1="ClassicDeck4.jpg", _String2="..") returned 1 [0091.221] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0xe02b5e8 [0091.221] wcscpy (in: _Dest=0xe02b5e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.221] wcscat (in: _Dest=0xe02b5e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.221] wcscat (in: _Dest=0xe02b5e8, _Source="ClassicDeck4.jpg" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\ClassicDeck4.jpg") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\ClassicDeck4.jpg" [0091.222] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0xe02b5e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10b8 [0091.222] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x368a08af, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x368a08af, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x368a08af, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xbc3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="commoneffects.respack", cAlternateFileName="")) returned 1 [0091.222] wcscmp (_String1="commoneffects.respack", _String2=".") returned 1 [0091.222] wcscmp (_String1="commoneffects.respack", _String2="..") returned 1 [0091.222] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11c) returned 0xe029c78 [0091.222] wcscpy (in: _Dest=0xe029c78, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.222] wcscat (in: _Dest=0xe029c78, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.222] wcscat (in: _Dest=0xe029c78, _Source="commoneffects.respack" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\commoneffects.respack") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\commoneffects.respack" [0091.222] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0xe029c78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10b4 [0091.223] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x368a08af, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x368a08af, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x368a08af, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x0, dwReserved1=0x0, cFileName="commoneffectsassets.xml", cAlternateFileName="")) returned 1 [0091.223] wcscmp (_String1="commoneffectsassets.xml", _String2=".") returned 1 [0091.223] wcscmp (_String1="commoneffectsassets.xml", _String2="..") returned 1 [0091.223] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x120) returned 0xe029da0 [0091.223] wcscpy (in: _Dest=0xe029da0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.223] wcscat (in: _Dest=0xe029da0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.223] wcscat (in: _Dest=0xe029da0, _Source="commoneffectsassets.xml" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\commoneffectsassets.xml") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\commoneffectsassets.xml" [0091.223] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0xe029da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10b0 [0091.224] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x368a08af, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x368a08af, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x368a08af, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x203, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default1.png", cAlternateFileName="")) returned 1 [0091.224] wcscmp (_String1="Default1.png", _String2=".") returned 1 [0091.224] wcscmp (_String1="Default1.png", _String2="..") returned 1 [0091.224] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0x74e2a80 [0091.224] wcscpy (in: _Dest=0x74e2a80, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.224] wcscat (in: _Dest=0x74e2a80, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.224] wcscat (in: _Dest=0x74e2a80, _Source="Default1.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Default1.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Default1.png" [0091.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e2a80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10ac [0091.225] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x368c6b0d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x368c6b0d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x368c6b0d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Delete.png", cAlternateFileName="")) returned 1 [0091.225] wcscmp (_String1="Delete.png", _String2=".") returned 1 [0091.225] wcscmp (_String1="Delete.png", _String2="..") returned 1 [0091.225] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x74e2850 [0091.225] wcscpy (in: _Dest=0x74e2850, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.225] wcscat (in: _Dest=0x74e2850, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.225] wcscat (in: _Dest=0x74e2850, _Source="Delete.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Delete.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Delete.png" [0091.225] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e2850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10a8 [0091.225] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x368c6b0d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x368c6b0d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x368c6b0d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Edit.png", cAlternateFileName="")) returned 1 [0091.225] wcscmp (_String1="Edit.png", _String2=".") returned 1 [0091.225] wcscmp (_String1="Edit.png", _String2="..") returned 1 [0091.226] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x102) returned 0x74e1158 [0091.226] wcscpy (in: _Dest=0x74e1158, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.226] wcscat (in: _Dest=0x74e1158, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.226] wcscat (in: _Dest=0x74e1158, _Source="Edit.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Edit.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Edit.png" [0091.226] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e1158, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10a4 [0091.226] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x368c6b0d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad4dd181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36939219, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Effects", cAlternateFileName="")) returned 1 [0091.226] wcscmp (_String1="Effects", _String2=".") returned 1 [0091.226] wcscmp (_String1="Effects", _String2="..") returned 1 [0091.226] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100) returned 0x54996e0 [0091.226] wcscpy (in: _Dest=0x54996e0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.226] wcscat (in: _Dest=0x54996e0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.226] wcscat (in: _Dest=0x54996e0, _Source="Effects" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Effects") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Effects" [0091.226] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54996e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10a0 [0091.227] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36939219, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x36939219, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x36939219, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x11f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Export.png", cAlternateFileName="")) returned 1 [0091.227] wcscmp (_String1="Export.png", _String2=".") returned 1 [0091.227] wcscmp (_String1="Export.png", _String2="..") returned 1 [0091.227] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x74e1270 [0091.227] wcscpy (in: _Dest=0x74e1270, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.227] wcscat (in: _Dest=0x74e1270, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.227] wcscat (in: _Dest=0x74e1270, _Source="Export.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Export.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Export.png" [0091.227] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e1270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x109c [0091.228] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36939219, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3695f472, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3695f472, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x65b, dwReserved0=0x0, dwReserved1=0x0, cFileName="hide_icon.png", cAlternateFileName="")) returned 1 [0091.228] wcscmp (_String1="hide_icon.png", _String2=".") returned 1 [0091.228] wcscmp (_String1="hide_icon.png", _String2="..") returned 1 [0091.228] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10c) returned 0x74e17e8 [0091.228] wcscpy (in: _Dest=0x74e17e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.228] wcscat (in: _Dest=0x74e17e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.228] wcscat (in: _Dest=0x74e17e8, _Source="hide_icon.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\hide_icon.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\hide_icon.png" [0091.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e17e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1098 [0091.229] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3695f472, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3695f472, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3695f472, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4a09, dwReserved0=0x0, dwReserved1=0x0, cFileName="JumboDeck4.jpg", cAlternateFileName="")) returned 1 [0091.229] wcscmp (_String1="JumboDeck4.jpg", _String2=".") returned 1 [0091.229] wcscmp (_String1="JumboDeck4.jpg", _String2="..") returned 1 [0091.229] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10e) returned 0x74e20a8 [0091.229] wcscpy (in: _Dest=0x74e20a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.229] wcscat (in: _Dest=0x74e20a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.229] wcscat (in: _Dest=0x74e20a8, _Source="JumboDeck4.jpg" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\JumboDeck4.jpg") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\JumboDeck4.jpg" [0091.229] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e20a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1094 [0091.229] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3695f472, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3695f472, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3695f472, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x45a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="lobby_add_photos_mobile.png", cAlternateFileName="")) returned 1 [0091.230] wcscmp (_String1="lobby_add_photos_mobile.png", _String2=".") returned 1 [0091.230] wcscmp (_String1="lobby_add_photos_mobile.png", _String2="..") returned 1 [0091.230] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x128) returned 0x5baa488 [0091.230] wcscpy (in: _Dest=0x5baa488, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.230] wcscat (in: _Dest=0x5baa488, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.230] wcscat (in: _Dest=0x5baa488, _Source="lobby_add_photos_mobile.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\lobby_add_photos_mobile.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\lobby_add_photos_mobile.png" [0091.230] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5baa488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1090 [0091.230] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3695f472, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3695f472, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3695f472, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x5e56, dwReserved0=0x0, dwReserved1=0x0, cFileName="lobby_deck_style_aquarium.png", cAlternateFileName="")) returned 1 [0091.230] wcscmp (_String1="lobby_deck_style_aquarium.png", _String2=".") returned 1 [0091.230] wcscmp (_String1="lobby_deck_style_aquarium.png", _String2="..") returned 1 [0091.230] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12c) returned 0x5ba9108 [0091.230] wcscpy (in: _Dest=0x5ba9108, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.230] wcscat (in: _Dest=0x5ba9108, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.230] wcscat (in: _Dest=0x5ba9108, _Source="lobby_deck_style_aquarium.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\lobby_deck_style_aquarium.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\lobby_deck_style_aquarium.png" [0091.230] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba9108, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x108c [0091.231] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369856d4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x369856d4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x369856d4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x7cbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="lobby_deck_style_autumn.png", cAlternateFileName="")) returned 1 [0091.231] wcscmp (_String1="lobby_deck_style_autumn.png", _String2=".") returned 1 [0091.231] wcscmp (_String1="lobby_deck_style_autumn.png", _String2="..") returned 1 [0091.231] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x128) returned 0x5ba9fa8 [0091.231] wcscpy (in: _Dest=0x5ba9fa8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.231] wcscat (in: _Dest=0x5ba9fa8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.231] wcscat (in: _Dest=0x5ba9fa8, _Source="lobby_deck_style_autumn.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\lobby_deck_style_autumn.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\lobby_deck_style_autumn.png" [0091.231] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba9fa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1088 [0091.232] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369856d4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x369856d4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x369856d4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3ef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="lobby_deck_style_beach.png", cAlternateFileName="")) returned 1 [0091.232] wcscmp (_String1="lobby_deck_style_beach.png", _String2=".") returned 1 [0091.232] wcscmp (_String1="lobby_deck_style_beach.png", _String2="..") returned 1 [0091.232] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x126) returned 0x5baabd8 [0091.232] wcscpy (in: _Dest=0x5baabd8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.232] wcscat (in: _Dest=0x5baabd8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.232] wcscat (in: _Dest=0x5baabd8, _Source="lobby_deck_style_beach.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\lobby_deck_style_beach.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\lobby_deck_style_beach.png" [0091.232] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5baabd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1084 [0091.233] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369856d4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x369856d4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x369856d4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x47f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="lobby_deck_style_classic.png", cAlternateFileName="")) returned 1 [0091.233] wcscmp (_String1="lobby_deck_style_classic.png", _String2=".") returned 1 [0091.233] wcscmp (_String1="lobby_deck_style_classic.png", _String2="..") returned 1 [0091.233] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12a) returned 0x5baa218 [0091.233] wcscpy (in: _Dest=0x5baa218, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.233] wcscat (in: _Dest=0x5baa218, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.233] wcscat (in: _Dest=0x5baa218, _Source="lobby_deck_style_classic.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\lobby_deck_style_classic.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\lobby_deck_style_classic.png" [0091.233] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5baa218, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1080 [0091.234] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369856d4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x369856d4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x369856d4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x8616, dwReserved0=0x0, dwReserved1=0x0, cFileName="lobby_deck_style_fable.png", cAlternateFileName="")) returned 1 [0091.234] wcscmp (_String1="lobby_deck_style_fable.png", _String2=".") returned 1 [0091.234] wcscmp (_String1="lobby_deck_style_fable.png", _String2="..") returned 1 [0091.234] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x126) returned 0x5ba9990 [0091.234] wcscpy (in: _Dest=0x5ba9990, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.234] wcscat (in: _Dest=0x5ba9990, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.234] wcscat (in: _Dest=0x5ba9990, _Source="lobby_deck_style_fable.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\lobby_deck_style_fable.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\lobby_deck_style_fable.png" [0091.234] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba9990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x107c [0091.235] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369d1b87, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x369d1b87, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x369d1b87, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x317d, dwReserved0=0x0, dwReserved1=0x0, cFileName="lobby_deck_style_jumbo.png", cAlternateFileName="")) returned 1 [0091.235] wcscmp (_String1="lobby_deck_style_jumbo.png", _String2=".") returned 1 [0091.235] wcscmp (_String1="lobby_deck_style_jumbo.png", _String2="..") returned 1 [0091.235] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x126) returned 0x5baa6f8 [0091.235] wcscpy (in: _Dest=0x5baa6f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.235] wcscat (in: _Dest=0x5baa6f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.235] wcscat (in: _Dest=0x5baa6f8, _Source="lobby_deck_style_jumbo.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\lobby_deck_style_jumbo.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\lobby_deck_style_jumbo.png" [0091.235] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5baa6f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1078 [0091.236] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369d1b87, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x369d1b87, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x369d1b87, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4198, dwReserved0=0x0, dwReserved1=0x0, cFileName="lobby_deck_style_mobile.png", cAlternateFileName="")) returned 1 [0091.236] wcscmp (_String1="lobby_deck_style_mobile.png", _String2=".") returned 1 [0091.236] wcscmp (_String1="lobby_deck_style_mobile.png", _String2="..") returned 1 [0091.236] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x128) returned 0x5baa0e0 [0091.236] wcscpy (in: _Dest=0x5baa0e0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.236] wcscat (in: _Dest=0x5baa0e0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.236] wcscat (in: _Dest=0x5baa0e0, _Source="lobby_deck_style_mobile.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\lobby_deck_style_mobile.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\lobby_deck_style_mobile.png" [0091.236] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5baa0e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1074 [0091.236] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369d1b87, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x369d1b87, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x369d1b87, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x7a8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="lobby_deck_style_western.png", cAlternateFileName="")) returned 1 [0091.237] wcscmp (_String1="lobby_deck_style_western.png", _String2=".") returned 1 [0091.237] wcscmp (_String1="lobby_deck_style_western.png", _String2="..") returned 1 [0091.237] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12a) returned 0x5baa830 [0091.237] wcscpy (in: _Dest=0x5baa830, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.237] wcscat (in: _Dest=0x5baa830, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.237] wcscat (in: _Dest=0x5baa830, _Source="lobby_deck_style_western.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\lobby_deck_style_western.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\lobby_deck_style_western.png" [0091.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5baa830, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1070 [0091.237] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369d1b87, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x369d1b87, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x369d1b87, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x22f, dwReserved0=0x0, dwReserved1=0x0, cFileName="None.png", cAlternateFileName="")) returned 1 [0091.237] wcscmp (_String1="None.png", _String2=".") returned 1 [0091.237] wcscmp (_String1="None.png", _String2="..") returned 1 [0091.237] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x102) returned 0x74e2508 [0091.237] wcscpy (in: _Dest=0x74e2508, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.237] wcscat (in: _Dest=0x74e2508, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.237] wcscat (in: _Dest=0x74e2508, _Source="None.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\None.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\None.png" [0091.238] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e2508, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x106c [0091.238] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369f7de0, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x369f7de0, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x369f7de0, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Preview.png", cAlternateFileName="")) returned 1 [0091.238] wcscmp (_String1="Preview.png", _String2=".") returned 1 [0091.238] wcscmp (_String1="Preview.png", _String2="..") returned 1 [0091.238] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x108) returned 0x74e22d8 [0091.238] wcscpy (in: _Dest=0x74e22d8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.238] wcscat (in: _Dest=0x74e22d8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.238] wcscat (in: _Dest=0x74e22d8, _Source="Preview.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Preview.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Preview.png" [0091.238] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e22d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1068 [0091.239] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369f7de0, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x369f7de0, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x369f7de0, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rename.png", cAlternateFileName="")) returned 1 [0091.239] wcscmp (_String1="Rename.png", _String2=".") returned 1 [0091.239] wcscmp (_String1="Rename.png", _String2="..") returned 1 [0091.239] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x74e1e78 [0091.239] wcscpy (in: _Dest=0x74e1e78, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.239] wcscat (in: _Dest=0x74e1e78, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.239] wcscat (in: _Dest=0x74e1e78, _Source="Rename.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Rename.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Rename.png" [0091.239] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e1e78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1064 [0091.240] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369f7de0, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x369f7de0, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x369f7de0, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reset.png", cAlternateFileName="")) returned 1 [0091.240] wcscmp (_String1="Reset.png", _String2=".") returned 1 [0091.240] wcscmp (_String1="Reset.png", _String2="..") returned 1 [0091.240] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x104) returned 0x74e21c0 [0091.240] wcscpy (in: _Dest=0x74e21c0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.240] wcscat (in: _Dest=0x74e21c0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.240] wcscat (in: _Dest=0x74e21c0, _Source="Reset.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Reset.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Reset.png" [0091.240] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e21c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1060 [0091.241] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369f7de0, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x369f7de0, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x369f7de0, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate.png", cAlternateFileName="")) returned 1 [0091.241] wcscmp (_String1="Rotate.png", _String2=".") returned 1 [0091.241] wcscmp (_String1="Rotate.png", _String2="..") returned 1 [0091.241] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x74e2cb0 [0091.241] wcscpy (in: _Dest=0x74e2cb0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.241] wcscat (in: _Dest=0x74e2cb0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.241] wcscat (in: _Dest=0x74e2cb0, _Source="Rotate.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Rotate.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Rotate.png" [0091.241] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e2cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x105c [0091.241] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369f7de0, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x369f7de0, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x369f7de0, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.png", cAlternateFileName="")) returned 1 [0091.242] wcscmp (_String1="Save.png", _String2=".") returned 1 [0091.242] wcscmp (_String1="Save.png", _String2="..") returned 1 [0091.242] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x102) returned 0x74e23f0 [0091.242] wcscpy (in: _Dest=0x74e23f0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.242] wcscat (in: _Dest=0x74e23f0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.242] wcscat (in: _Dest=0x74e23f0, _Source="Save.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Save.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Save.png" [0091.242] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e23f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1058 [0091.242] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369f7de0, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x369f7de0, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x369f7de0, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Show.png", cAlternateFileName="")) returned 1 [0091.242] wcscmp (_String1="Show.png", _String2=".") returned 1 [0091.242] wcscmp (_String1="Show.png", _String2="..") returned 1 [0091.242] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x102) returned 0x74e2620 [0091.242] wcscpy (in: _Dest=0x74e2620, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.242] wcscat (in: _Dest=0x74e2620, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.243] wcscat (in: _Dest=0x74e2620, _Source="Show.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Show.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Show.png" [0091.243] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e2620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1054 [0091.243] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a21243, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x36a24610, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x36a24610, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x5a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="show_icon.png", cAlternateFileName="")) returned 1 [0091.243] wcscmp (_String1="show_icon.png", _String2=".") returned 1 [0091.243] wcscmp (_String1="show_icon.png", _String2="..") returned 1 [0091.243] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10c) returned 0x74e1b30 [0091.243] wcscpy (in: _Dest=0x74e1b30, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.243] wcscat (in: _Dest=0x74e1b30, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.243] wcscat (in: _Dest=0x74e1b30, _Source="show_icon.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\show_icon.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\show_icon.png" [0091.243] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e1b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12e0 [0091.244] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a24610, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x36a24610, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x36a24610, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="themes_page_menu_button.jpg", cAlternateFileName="")) returned 1 [0091.244] wcscmp (_String1="themes_page_menu_button.jpg", _String2=".") returned 1 [0091.244] wcscmp (_String1="themes_page_menu_button.jpg", _String2="..") returned 1 [0091.244] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x128) returned 0x5ba9240 [0091.244] wcscpy (in: _Dest=0x5ba9240, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.244] wcscat (in: _Dest=0x5ba9240, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.244] wcscat (in: _Dest=0x5ba9240, _Source="themes_page_menu_button.jpg" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\themes_page_menu_button.jpg") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\themes_page_menu_button.jpg" [0091.244] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba9240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1770 [0091.245] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a24610, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x36a24610, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x36a24610, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x9a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="tile_base.jpg", cAlternateFileName="")) returned 1 [0091.245] wcscmp (_String1="tile_base.jpg", _String2=".") returned 1 [0091.245] wcscmp (_String1="tile_base.jpg", _String2="..") returned 1 [0091.245] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10c) returned 0x74e2738 [0091.245] wcscpy (in: _Dest=0x74e2738, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.245] wcscat (in: _Dest=0x74e2738, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.245] wcscat (in: _Dest=0x74e2738, _Source="tile_base.jpg" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\tile_base.jpg") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\tile_base.jpg" [0091.245] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e2738, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1774 [0091.246] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a24610, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x36a24610, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x36a24610, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x835b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WesternDeck4.jpg", cAlternateFileName="")) returned 1 [0091.246] wcscmp (_String1="WesternDeck4.jpg", _String2=".") returned 1 [0091.246] wcscmp (_String1="WesternDeck4.jpg", _String2="..") returned 1 [0091.246] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0xe02b4c0 [0091.246] wcscpy (in: _Dest=0xe02b4c0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.246] wcscat (in: _Dest=0xe02b4c0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.246] wcscat (in: _Dest=0xe02b4c0, _Source="WesternDeck4.jpg" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\WesternDeck4.jpg") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\WesternDeck4.jpg" [0091.246] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0xe02b4c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1780 [0091.247] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a24610, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x36a24610, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x36a24610, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zoom_in.png", cAlternateFileName="")) returned 1 [0091.247] wcscmp (_String1="Zoom_in.png", _String2=".") returned 1 [0091.247] wcscmp (_String1="Zoom_in.png", _String2="..") returned 1 [0091.247] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x108) returned 0x74e2b98 [0091.247] wcscpy (in: _Dest=0x74e2b98, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.247] wcscat (in: _Dest=0x74e2b98, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.247] wcscat (in: _Dest=0x74e2b98, _Source="Zoom_in.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Zoom_in.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Zoom_in.png" [0091.247] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e2b98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1784 [0091.248] FindNextFileW (in: hFindFile=0x389f3c0, lpFindFileData=0x3936768 | out: lpFindFileData=0x3936768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a24610, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x36a24610, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x36a24610, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zoom_out.png", cAlternateFileName="")) returned 1 [0091.248] wcscmp (_String1="Zoom_out.png", _String2=".") returned 1 [0091.248] wcscmp (_String1="Zoom_out.png", _String2="..") returned 1 [0091.248] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0x74e15b8 [0091.248] wcscpy (in: _Dest=0x74e15b8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation" [0091.248] wcscat (in: _Dest=0x74e15b8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\" [0091.248] wcscat (in: _Dest=0x74e15b8, _Source="Zoom_out.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Zoom_out.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Zoom_out.png" [0091.248] CreateThread (lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74e15b8, dwCreationFlags=0x0, lpThreadId=0x0) Thread: id = 2101 os_tid = 0x17b0 [0091.128] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf4) returned 0x5ba25f8 [0091.128] wcscpy (in: _Dest=0x5ba25f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload" [0091.128] wcscat (in: _Dest=0x5ba25f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload\\" [0091.128] wcscat (in: _Dest=0x5ba25f8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload\\*" [0091.128] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x39369d0 [0091.128] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload\\*", lpFindFileData=0x39369d0 | out: lpFindFileData=0x39369d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36a24610, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad4ddf83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36a4a88e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f400 [0091.128] wcscmp (_String1=".", _String2=".") returned 0 [0091.128] FindNextFileW (in: hFindFile=0x389f400, lpFindFileData=0x39369d0 | out: lpFindFileData=0x39369d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36a24610, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad4ddf83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36a4a88e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.128] wcscmp (_String1="..", _String2=".") returned 1 [0091.128] wcscmp (_String1="..", _String2="..") returned 0 [0091.129] FindNextFileW (in: hFindFile=0x389f400, lpFindFileData=0x39369d0 | out: lpFindFileData=0x39369d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a24610, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x36a24610, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x36a24610, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x120, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_pause.png", cAlternateFileName="")) returned 1 [0091.129] wcscmp (_String1="button_pause.png", _String2=".") returned 1 [0091.129] wcscmp (_String1="button_pause.png", _String2="..") returned 1 [0091.129] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0xe028ef0 [0091.211] wcscpy (in: _Dest=0xe028ef0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload" [0091.211] wcscat (in: _Dest=0xe028ef0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload\\" [0091.211] wcscat (in: _Dest=0xe028ef0, _Source="button_pause.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload\\button_pause.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload\\button_pause.png" [0091.211] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0xe028ef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1640 [0091.212] FindNextFileW (in: hFindFile=0x389f400, lpFindFileData=0x39369d0 | out: lpFindFileData=0x39369d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a4a88e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x36a4a88e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x36a4a88e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="download_bar.png", cAlternateFileName="")) returned 1 [0091.212] wcscmp (_String1="download_bar.png", _String2=".") returned 1 [0091.212] wcscmp (_String1="download_bar.png", _String2="..") returned 1 [0091.212] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0xe028488 [0091.212] wcscpy (in: _Dest=0xe028488, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload" [0091.212] wcscat (in: _Dest=0xe028488, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload\\" [0091.212] wcscat (in: _Dest=0xe028488, _Source="download_bar.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload\\download_bar.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload\\download_bar.png" [0091.212] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0xe028488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10d8 [0091.213] FindNextFileW (in: hFindFile=0x389f400, lpFindFileData=0x39369d0 | out: lpFindFileData=0x39369d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a4a88e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x36a4a88e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x36a4a88e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="download_bar_base.png", cAlternateFileName="")) returned 1 [0091.213] wcscmp (_String1="download_bar_base.png", _String2=".") returned 1 [0091.213] wcscmp (_String1="download_bar_base.png", _String2="..") returned 1 [0091.213] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11c) returned 0xe0286d8 [0091.213] wcscpy (in: _Dest=0xe0286d8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload" [0091.213] wcscat (in: _Dest=0xe0286d8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload\\" [0091.213] wcscat (in: _Dest=0xe0286d8, _Source="download_bar_base.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload\\download_bar_base.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload\\download_bar_base.png" [0091.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0xe0286d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10d4 [0091.213] FindNextFileW (in: hFindFile=0x389f400, lpFindFileData=0x39369d0 | out: lpFindFileData=0x39369d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a4a88e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x36a4a88e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x36a4a88e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="download_bar_base.png", cAlternateFileName="")) returned 0 [0091.214] FindClose (in: hFindFile=0x389f400 | out: hFindFile=0x389f400) returned 1 [0091.214] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39369d0) returned 1 [0091.214] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba25f8) returned 1 [0091.214] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393db68) returned 1 Thread: id = 2102 os_tid = 0x17b4 [0091.129] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba50f8 [0091.129] wcscpy (in: _Dest=0x5ba50f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview" [0091.129] wcscat (in: _Dest=0x5ba50f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview\\" [0091.129] wcscat (in: _Dest=0x5ba50f8, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview\\*" [0091.129] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3936c38 [0091.129] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview\\*", lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36a4a88e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad4de80d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36c3a737, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f440 [0091.131] wcscmp (_String1=".", _String2=".") returned 0 [0091.131] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36a4a88e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad4de80d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36c3a737, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.131] wcscmp (_String1="..", _String2=".") returned 1 [0091.131] wcscmp (_String1="..", _String2="..") returned 0 [0091.132] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36a4a88e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad524849, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36abcfa3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 1 [0091.132] wcscmp (_String1="Backgrounds", _String2=".") returned 1 [0091.132] wcscmp (_String1="Backgrounds", _String2="..") returned 1 [0091.132] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106) returned 0x74b3538 [0091.132] wcscpy (in: _Dest=0x74b3538, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview" [0091.132] wcscat (in: _Dest=0x74b3538, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview\\" [0091.132] wcscat (in: _Dest=0x74b3538, _Source="Backgrounds" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview\\Backgrounds") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview\\Backgrounds" [0091.132] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x74b3538, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13dc [0091.132] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36abcfa3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad56501d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36b09456, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CardBacks", cAlternateFileName="CARDBA~1")) returned 1 [0091.132] wcscmp (_String1="CardBacks", _String2=".") returned 1 [0091.132] wcscmp (_String1="CardBacks", _String2="..") returned 1 [0091.133] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x102) returned 0x74b45a0 [0091.133] wcscpy (in: _Dest=0x74b45a0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview" [0091.133] wcscat (in: _Dest=0x74b45a0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview\\" [0091.133] wcscat (in: _Dest=0x74b45a0, _Source="CardBacks" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview\\CardBacks") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview\\CardBacks" [0091.133] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x74b45a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1648 [0091.133] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36b2f6b4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad565f3b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36c144d9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Effects", cAlternateFileName="")) returned 1 [0091.133] wcscmp (_String1="Effects", _String2=".") returned 1 [0091.133] wcscmp (_String1="Effects", _String2="..") returned 1 [0091.133] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfe) returned 0x549ab80 [0091.133] wcscpy (in: _Dest=0x549ab80, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview" [0091.133] wcscat (in: _Dest=0x549ab80, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview\\" [0091.134] wcscat (in: _Dest=0x549ab80, _Source="Effects" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview\\Effects") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview\\Effects" [0091.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x549ab80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc2c [0091.134] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36c3a737, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad603ea4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36cd309d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1 [0091.134] wcscmp (_String1="Themes", _String2=".") returned 1 [0091.134] wcscmp (_String1="Themes", _String2="..") returned 1 [0091.134] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfc) returned 0x54995d8 [0091.134] wcscpy (in: _Dest=0x54995d8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview" [0091.134] wcscat (in: _Dest=0x54995d8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview\\" [0091.134] wcscat (in: _Dest=0x54995d8, _Source="Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview\\Themes" [0091.135] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54995d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcd8 [0091.135] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36c3a737, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad603ea4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36cd309d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0 [0091.135] FindClose (in: hFindFile=0x389f440 | out: hFindFile=0x389f440) returned 1 [0091.136] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3936c38) returned 1 [0091.136] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba50f8) returned 1 [0091.136] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393f1b0) returned 1 Thread: id = 2103 os_tid = 0x17b8 [0091.137] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe6) returned 0x396f898 [0091.137] wcscpy (in: _Dest=0x396f898, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes" [0091.137] wcscat (in: _Dest=0x396f898, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\" [0091.138] wcscat (in: _Dest=0x396f898, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\*" [0091.138] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3936c38 [0091.138] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\*", lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36cf92fa, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad604f5a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x374f1a3e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f440 [0091.140] wcscmp (_String1=".", _String2=".") returned 0 [0091.140] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36cf92fa, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad604f5a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x374f1a3e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.140] wcscmp (_String1="..", _String2=".") returned 1 [0091.140] wcscmp (_String1="..", _String2="..") returned 0 [0091.140] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36cf92fa, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad660916, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36db7ebd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aquarium", cAlternateFileName="")) returned 1 [0091.140] wcscmp (_String1="Aquarium", _String2=".") returned 1 [0091.140] wcscmp (_String1="Aquarium", _String2="..") returned 1 [0091.140] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf4) returned 0x5ba47f8 [0091.140] wcscpy (in: _Dest=0x5ba47f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes" [0091.140] wcscat (in: _Dest=0x5ba47f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\" [0091.140] wcscat (in: _Dest=0x5ba47f8, _Source="Aquarium" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\Aquarium") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\Aquarium" [0091.140] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba47f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1650 [0091.141] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36e9cce3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad6c0df3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36f5b8ab, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autumn", cAlternateFileName="")) returned 1 [0091.141] wcscmp (_String1="Autumn", _String2=".") returned 1 [0091.141] wcscmp (_String1="Autumn", _String2="..") returned 1 [0091.141] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x54505a8 [0091.141] wcscpy (in: _Dest=0x54505a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes" [0091.141] wcscat (in: _Dest=0x54505a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\" [0091.141] wcscat (in: _Dest=0x54505a8, _Source="Autumn" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\Autumn") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\Autumn" [0091.141] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54505a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xff8 [0091.142] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36ff4214, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad77eea6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x370ff293, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Beach", cAlternateFileName="")) returned 1 [0091.142] wcscmp (_String1="Beach", _String2=".") returned 1 [0091.142] wcscmp (_String1="Beach", _String2="..") returned 1 [0091.142] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xee) returned 0x54506a0 [0091.142] wcscpy (in: _Dest=0x54506a0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes" [0091.142] wcscat (in: _Dest=0x54506a0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\" [0091.142] wcscat (in: _Dest=0x54506a0, _Source="Beach" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\Beach") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\Beach" [0091.142] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x54506a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1654 [0091.142] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37197c02, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x37197c02, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x37197c02, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="card_shadow.png", cAlternateFileName="")) returned 1 [0091.142] wcscmp (_String1="card_shadow.png", _String2=".") returned 1 [0091.143] wcscmp (_String1="card_shadow.png", _String2="..") returned 1 [0091.143] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x102) returned 0x74b2930 [0091.143] wcscpy (in: _Dest=0x74b2930, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes" [0091.143] wcscat (in: _Dest=0x74b2930, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\" [0091.143] wcscat (in: _Dest=0x74b2930, _Source="card_shadow.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\card_shadow.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\card_shadow.png" [0091.143] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b2930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20a4 [0091.143] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x371bde5b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x371bde5b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x371bde5b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="card_shadow_big.png", cAlternateFileName="")) returned 1 [0091.143] wcscmp (_String1="card_shadow_big.png", _String2=".") returned 1 [0091.143] wcscmp (_String1="card_shadow_big.png", _String2="..") returned 1 [0091.143] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0x74b4258 [0091.143] wcscpy (in: _Dest=0x74b4258, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes" [0091.143] wcscat (in: _Dest=0x74b4258, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\" [0091.143] wcscat (in: _Dest=0x74b4258, _Source="card_shadow_big.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\card_shadow_big.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\card_shadow_big.png" [0091.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b4258, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2280 [0091.144] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x371bde5b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad7d10a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3728a569, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic", cAlternateFileName="")) returned 1 [0091.144] wcscmp (_String1="Classic", _String2=".") returned 1 [0091.144] wcscmp (_String1="Classic", _String2="..") returned 1 [0091.144] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba45f8 [0091.144] wcscpy (in: _Dest=0x5ba45f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes" [0091.144] wcscat (in: _Dest=0x5ba45f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\" [0091.144] wcscat (in: _Dest=0x5ba45f8, _Source="Classic" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\Classic") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\Classic" [0091.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba45f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2284 [0091.145] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x372fcc79, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad912c92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37399629, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fable", cAlternateFileName="")) returned 1 [0091.145] wcscmp (_String1="Fable", _String2=".") returned 1 [0091.145] wcscmp (_String1="Fable", _String2="..") returned 1 [0091.145] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xee) returned 0x7286e68 [0091.145] wcscpy (in: _Dest=0x7286e68, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes" [0091.145] wcscat (in: _Dest=0x7286e68, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\" [0091.145] wcscat (in: _Dest=0x7286e68, _Source="Fable" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\Fable") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\Fable" [0091.145] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7286e68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2288 [0091.146] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37399629, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x37399629, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x37399629, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xce7, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon_preview_big.png", cAlternateFileName="")) returned 1 [0091.146] wcscmp (_String1="icon_preview_big.png", _String2=".") returned 1 [0091.146] wcscmp (_String1="icon_preview_big.png", _String2="..") returned 1 [0091.146] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10c) returned 0x74b4028 [0091.146] wcscpy (in: _Dest=0x74b4028, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes" [0091.146] wcscat (in: _Dest=0x74b4028, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\" [0091.146] wcscat (in: _Dest=0x74b4028, _Source="icon_preview_big.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\icon_preview_big.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\icon_preview_big.png" [0091.146] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b4028, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x228c [0091.147] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37399629, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad991296, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x374581f1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jumbo", cAlternateFileName="")) returned 1 [0091.147] wcscmp (_String1="Jumbo", _String2=".") returned 1 [0091.147] wcscmp (_String1="Jumbo", _String2="..") returned 1 [0091.147] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xee) returned 0x7287248 [0091.147] wcscpy (in: _Dest=0x7287248, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes" [0091.147] wcscat (in: _Dest=0x7287248, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\" [0091.147] wcscat (in: _Dest=0x7287248, _Source="Jumbo" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\Jumbo") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\Jumbo" [0091.147] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7287248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2290 [0091.148] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x374f1a3e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xada1fcdb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x374f1a3e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mobile", cAlternateFileName="")) returned 1 [0091.148] wcscmp (_String1="Mobile", _String2=".") returned 1 [0091.148] wcscmp (_String1="Mobile", _String2="..") returned 1 [0091.148] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x7287818 [0091.148] wcscpy (in: _Dest=0x7287818, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes" [0091.148] wcscat (in: _Dest=0x7287818, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\" [0091.148] wcscat (in: _Dest=0x7287818, _Source="Mobile" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\Mobile") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\Mobile" [0091.148] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x7287818, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2294 [0091.149] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x374f1a3e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x374f1a3e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x374f1a3e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x5f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="themes_frame.png", cAlternateFileName="")) returned 1 [0091.149] wcscmp (_String1="themes_frame.png", _String2=".") returned 1 [0091.149] wcscmp (_String1="themes_frame.png", _String2="..") returned 1 [0091.149] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x104) returned 0x74b2d90 [0091.149] wcscpy (in: _Dest=0x74b2d90, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes" [0091.149] wcscat (in: _Dest=0x74b2d90, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\" [0091.149] wcscat (in: _Dest=0x74b2d90, _Source="themes_frame.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\themes_frame.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\themes_frame.png" [0091.149] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b2d90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2298 [0091.149] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x374f1a3e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xada5d89c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x376785a9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Western", cAlternateFileName="")) returned 1 [0091.149] wcscmp (_String1="Western", _String2=".") returned 1 [0091.149] wcscmp (_String1="Western", _String2="..") returned 1 [0091.149] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf2) returned 0x5ba46f8 [0091.149] wcscpy (in: _Dest=0x5ba46f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes" [0091.150] wcscat (in: _Dest=0x5ba46f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\" [0091.150] wcscat (in: _Dest=0x5ba46f8, _Source="Western" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\Western") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\Western" [0091.150] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3662460, lpParameter=0x5ba46f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x229c [0091.150] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x374f1a3e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xada5d89c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x376785a9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Western", cAlternateFileName="")) returned 0 [0091.150] FindClose (in: hFindFile=0x389f440 | out: hFindFile=0x389f440) returned 1 [0091.151] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3936c38) returned 1 [0091.151] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396f898) returned 1 [0091.151] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b9378) returned 1 Thread: id = 2104 os_tid = 0x17bc [0091.153] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe4) returned 0x396f898 [0091.153] wcscpy (in: _Dest=0x396f898, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles" [0091.153] wcscat (in: _Dest=0x396f898, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\" [0091.153] wcscat (in: _Dest=0x396f898, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\*" [0091.153] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3936c38 [0091.153] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\*", lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3769e802, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb15f48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x376c4a60, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f440 [0091.155] wcscmp (_String1=".", _String2=".") returned 0 [0091.155] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3769e802, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb15f48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x376c4a60, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.155] wcscmp (_String1="..", _String2=".") returned 1 [0091.155] wcscmp (_String1="..", _String2="..") returned 0 [0091.155] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3769e802, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3769e802, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3769e802, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xde1, dwReserved0=0x0, dwReserved1=0x0, cFileName="create-new-theme.jpg", cAlternateFileName="")) returned 1 [0091.155] wcscmp (_String1="create-new-theme.jpg", _String2=".") returned 1 [0091.155] wcscmp (_String1="create-new-theme.jpg", _String2="..") returned 1 [0091.155] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0x74b3650 [0091.155] wcscpy (in: _Dest=0x74b3650, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles" [0091.155] wcscat (in: _Dest=0x74b3650, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\" [0091.155] wcscat (in: _Dest=0x74b3650, _Source="create-new-theme.jpg" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\create-new-theme.jpg") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\create-new-theme.jpg" [0091.156] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b3650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22a0 [0091.156] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3769e802, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x376c4a60, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x376c4a60, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x8d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="freecell.jpg", cAlternateFileName="")) returned 1 [0091.156] wcscmp (_String1="freecell.jpg", _String2=".") returned 1 [0091.156] wcscmp (_String1="freecell.jpg", _String2="..") returned 1 [0091.156] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfa) returned 0x549afa0 [0091.156] wcscpy (in: _Dest=0x549afa0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles" [0091.156] wcscat (in: _Dest=0x549afa0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\" [0091.156] wcscat (in: _Dest=0x549afa0, _Source="freecell.jpg" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\freecell.jpg") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\freecell.jpg" [0091.156] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549afa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22a4 [0091.157] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376c4a60, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x376c4a60, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x376c4a60, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x61cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="klondike.jpg", cAlternateFileName="")) returned 1 [0091.157] wcscmp (_String1="klondike.jpg", _String2=".") returned 1 [0091.157] wcscmp (_String1="klondike.jpg", _String2="..") returned 1 [0091.157] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfa) returned 0x549ad90 [0091.157] wcscpy (in: _Dest=0x549ad90, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles" [0091.157] wcscat (in: _Dest=0x549ad90, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\" [0091.157] wcscat (in: _Dest=0x549ad90, _Source="klondike.jpg" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\klondike.jpg") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\klondike.jpg" [0091.157] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549ad90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22a8 [0091.158] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376c4a60, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x376c4a60, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x376c4a60, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x46f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pyramid.jpg", cAlternateFileName="")) returned 1 [0091.158] wcscmp (_String1="pyramid.jpg", _String2=".") returned 1 [0091.158] wcscmp (_String1="pyramid.jpg", _String2="..") returned 1 [0091.158] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf8) returned 0x5ba40f8 [0091.158] wcscpy (in: _Dest=0x5ba40f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles" [0091.158] wcscat (in: _Dest=0x5ba40f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\" [0091.158] wcscat (in: _Dest=0x5ba40f8, _Source="pyramid.jpg" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\pyramid.jpg") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\pyramid.jpg" [0091.158] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba40f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22ac [0091.159] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376c4a60, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x376c4a60, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x376c4a60, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="shadow.png", cAlternateFileName="")) returned 1 [0091.159] wcscmp (_String1="shadow.png", _String2=".") returned 1 [0091.159] wcscmp (_String1="shadow.png", _String2="..") returned 1 [0091.159] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf6) returned 0x5ba58f8 [0091.159] wcscpy (in: _Dest=0x5ba58f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles" [0091.159] wcscat (in: _Dest=0x5ba58f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\" [0091.159] wcscat (in: _Dest=0x5ba58f8, _Source="shadow.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\shadow.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\shadow.png" [0091.159] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba58f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22b0 [0091.160] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376c4a60, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x376c4a60, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x376c4a60, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x705c, dwReserved0=0x0, dwReserved1=0x0, cFileName="spider.jpg", cAlternateFileName="")) returned 1 [0091.160] wcscmp (_String1="spider.jpg", _String2=".") returned 1 [0091.160] wcscmp (_String1="spider.jpg", _String2="..") returned 1 [0091.160] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf6) returned 0x5ba48f8 [0091.160] wcscpy (in: _Dest=0x5ba48f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles" [0091.160] wcscat (in: _Dest=0x5ba48f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\" [0091.160] wcscat (in: _Dest=0x5ba48f8, _Source="spider.jpg" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\spider.jpg") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\spider.jpg" [0091.160] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5ba48f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22b4 [0091.160] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376c4a60, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x376c4a60, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x376c4a60, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x61cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="tripeaks.jpg", cAlternateFileName="")) returned 1 [0091.160] wcscmp (_String1="tripeaks.jpg", _String2=".") returned 1 [0091.160] wcscmp (_String1="tripeaks.jpg", _String2="..") returned 1 [0091.160] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xfa) returned 0x549ae98 [0091.160] wcscpy (in: _Dest=0x549ae98, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles" [0091.160] wcscat (in: _Dest=0x549ae98, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\" [0091.161] wcscat (in: _Dest=0x549ae98, _Source="tripeaks.jpg" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\tripeaks.jpg") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\tripeaks.jpg" [0091.161] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549ae98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22b8 [0091.161] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376c4a60, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x376c4a60, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x376c4a60, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x61cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="tripeaks.jpg", cAlternateFileName="")) returned 0 [0091.161] FindClose (in: hFindFile=0x389f440 | out: hFindFile=0x389f440) returned 1 [0091.162] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3936c38) returned 1 [0091.162] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396f898) returned 1 [0091.162] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f04c8) returned 1 Thread: id = 2105 os_tid = 0x17c0 [0091.164] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\TMP_tournament_trophy_blue.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\assets\\tmp_tournament_trophy_blue.png")) returned 0x20 [0091.215] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\TMP_tournament_trophy_blue.png", dwFileAttributes=0x20) returned 0 [0091.215] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\TMP_tournament_trophy_blue.png" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\assets\\tmp_tournament_trophy_blue.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.215] GetLastError () returned 0x5 [0091.215] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\TMP_tournament_trophy_blue.png", dwFileAttributes=0x20) returned 0 [0091.215] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74d9f18) returned 1 Thread: id = 2106 os_tid = 0x17c4 [0091.164] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xee) returned 0x7286b80 [0091.164] wcscpy (in: _Dest=0x7286b80, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" [0091.164] wcscat (in: _Dest=0x7286b80, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\" [0091.164] wcscat (in: _Dest=0x7286b80, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\*" [0091.164] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3936c38 [0091.164] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\*", lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x376ebbff, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb1841a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x377d0a4a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f440 [0091.166] wcscmp (_String1=".", _String2=".") returned 0 [0091.166] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x376ebbff, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb1841a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x377d0a4a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.166] wcscmp (_String1="..", _String2=".") returned 1 [0091.166] wcscmp (_String1="..", _String2="..") returned 0 [0091.166] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376ebbff, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x376ebbff, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x376ebbff, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x134c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Avatar.png", cAlternateFileName="")) returned 1 [0091.166] wcscmp (_String1="Avatar.png", _String2=".") returned 1 [0091.166] wcscmp (_String1="Avatar.png", _String2="..") returned 1 [0091.166] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100) returned 0x5499e18 [0091.166] wcscpy (in: _Dest=0x5499e18, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" [0091.166] wcscat (in: _Dest=0x5499e18, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\" [0091.166] wcscat (in: _Dest=0x5499e18, _Source="Avatar.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\Avatar.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\Avatar.png" [0091.166] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5499e18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22bc [0091.167] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376ebbff, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x376ebbff, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x376ebbff, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x295e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Awards.png", cAlternateFileName="")) returned 1 [0091.167] wcscmp (_String1="Awards.png", _String2=".") returned 1 [0091.167] wcscmp (_String1="Awards.png", _String2="..") returned 1 [0091.167] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100) returned 0x549b0a8 [0091.167] wcscpy (in: _Dest=0x549b0a8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" [0091.167] wcscat (in: _Dest=0x549b0a8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\" [0091.167] wcscat (in: _Dest=0x549b0a8, _Source="Awards.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\Awards.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\Awards.png" [0091.167] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x549b0a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c0 [0091.168] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376ebbff, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x37711e82, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x37711e82, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x24f32, dwReserved0=0x0, dwReserved1=0x0, cFileName="CenterBackground.png", cAlternateFileName="")) returned 1 [0091.168] wcscmp (_String1="CenterBackground.png", _String2=".") returned 1 [0091.168] wcscmp (_String1="CenterBackground.png", _String2="..") returned 1 [0091.168] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x114) returned 0x7283790 [0091.191] wcscpy (in: _Dest=0x7283790, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" [0091.191] wcscat (in: _Dest=0x7283790, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\" [0091.191] wcscat (in: _Dest=0x7283790, _Source="CenterBackground.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\CenterBackground.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\CenterBackground.png" [0091.191] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7283790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1edc [0091.191] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37711e82, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x37711e82, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x37711e82, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1795, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameModeFreeCell.png", cAlternateFileName="")) returned 1 [0091.191] wcscmp (_String1="GameModeFreeCell.png", _String2=".") returned 1 [0091.191] wcscmp (_String1="GameModeFreeCell.png", _String2="..") returned 1 [0091.191] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x114) returned 0x7283668 [0091.191] wcscpy (in: _Dest=0x7283668, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" [0091.192] wcscat (in: _Dest=0x7283668, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\" [0091.192] wcscat (in: _Dest=0x7283668, _Source="GameModeFreeCell.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\GameModeFreeCell.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\GameModeFreeCell.png" [0091.192] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7283668, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ed8 [0091.192] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37711e82, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x37711e82, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x37711e82, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x12d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameModeKlondike.png", cAlternateFileName="")) returned 1 [0091.192] wcscmp (_String1="GameModeKlondike.png", _String2=".") returned 1 [0091.192] wcscmp (_String1="GameModeKlondike.png", _String2="..") returned 1 [0091.192] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x114) returned 0x7284448 [0091.192] wcscpy (in: _Dest=0x7284448, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" [0091.192] wcscat (in: _Dest=0x7284448, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\" [0091.192] wcscat (in: _Dest=0x7284448, _Source="GameModeKlondike.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\GameModeKlondike.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\GameModeKlondike.png" [0091.192] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7284448, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ed4 [0091.193] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37711e82, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x377380dc, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x377380dc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x14ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameModePyramid.png", cAlternateFileName="")) returned 1 [0091.193] wcscmp (_String1="GameModePyramid.png", _String2=".") returned 1 [0091.193] wcscmp (_String1="GameModePyramid.png", _String2="..") returned 1 [0091.193] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x112) returned 0x7284698 [0091.193] wcscpy (in: _Dest=0x7284698, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" [0091.193] wcscat (in: _Dest=0x7284698, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\" [0091.193] wcscat (in: _Dest=0x7284698, _Source="GameModePyramid.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\GameModePyramid.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\GameModePyramid.png" [0091.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7284698, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x198c [0091.194] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x377380dc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x377380dc, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x377380dc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1cf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameModeSpider.png", cAlternateFileName="")) returned 1 [0091.194] wcscmp (_String1="GameModeSpider.png", _String2=".") returned 1 [0091.194] wcscmp (_String1="GameModeSpider.png", _String2="..") returned 1 [0091.194] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x110) returned 0x74b47d0 [0091.194] wcscpy (in: _Dest=0x74b47d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" [0091.194] wcscat (in: _Dest=0x74b47d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\" [0091.194] wcscat (in: _Dest=0x74b47d0, _Source="GameModeSpider.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\GameModeSpider.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\GameModeSpider.png" [0091.194] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b47d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f0 [0091.195] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x377380dc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x377380dc, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x377380dc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1a67, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameModeTripeaks.png", cAlternateFileName="")) returned 1 [0091.195] wcscmp (_String1="GameModeTripeaks.png", _String2=".") returned 1 [0091.195] wcscmp (_String1="GameModeTripeaks.png", _String2="..") returned 1 [0091.195] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x114) returned 0x7284fd8 [0091.195] wcscpy (in: _Dest=0x7284fd8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" [0091.195] wcscat (in: _Dest=0x7284fd8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\" [0091.195] wcscat (in: _Dest=0x7284fd8, _Source="GameModeTripeaks.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\GameModeTripeaks.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\GameModeTripeaks.png" [0091.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7284fd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1238 [0091.195] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x377380dc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x37784593, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x37784593, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4e4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="LevelIndicator.png", cAlternateFileName="")) returned 1 [0091.195] wcscmp (_String1="LevelIndicator.png", _String2=".") returned 1 [0091.195] wcscmp (_String1="LevelIndicator.png", _String2="..") returned 1 [0091.195] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x110) returned 0x74b2ea8 [0091.195] wcscpy (in: _Dest=0x74b2ea8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" [0091.196] wcscat (in: _Dest=0x74b2ea8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\" [0091.196] wcscat (in: _Dest=0x74b2ea8, _Source="LevelIndicator.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\LevelIndicator.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\LevelIndicator.png" [0091.196] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b2ea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1244 [0091.196] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37784593, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x37784593, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x37784593, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x5124, dwReserved0=0x0, dwReserved1=0x0, cFileName="PlayButton.png", cAlternateFileName="")) returned 1 [0091.196] wcscmp (_String1="PlayButton.png", _String2=".") returned 1 [0091.196] wcscmp (_String1="PlayButton.png", _String2="..") returned 1 [0091.196] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x108) returned 0x74b2fc0 [0091.196] wcscpy (in: _Dest=0x74b2fc0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" [0091.196] wcscat (in: _Dest=0x74b2fc0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\" [0091.196] wcscat (in: _Dest=0x74b2fc0, _Source="PlayButton.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\PlayButton.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\PlayButton.png" [0091.196] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b2fc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1284 [0091.197] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37784593, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x37784593, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x37784593, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2518, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgressBarFilled.png", cAlternateFileName="")) returned 1 [0091.197] wcscmp (_String1="ProgressBarFilled.png", _String2=".") returned 1 [0091.197] wcscmp (_String1="ProgressBarFilled.png", _String2="..") returned 1 [0091.197] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x116) returned 0x7284b38 [0091.197] wcscpy (in: _Dest=0x7284b38, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" [0091.197] wcscat (in: _Dest=0x7284b38, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\" [0091.197] wcscat (in: _Dest=0x7284b38, _Source="ProgressBarFilled.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\ProgressBarFilled.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\ProgressBarFilled.png" [0091.197] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7284b38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c0 [0091.198] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37784593, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x37784593, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x37784593, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x300f, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedRectangle.png", cAlternateFileName="")) returned 1 [0091.198] wcscmp (_String1="RedRectangle.png", _String2=".") returned 1 [0091.198] wcscmp (_String1="RedRectangle.png", _String2="..") returned 1 [0091.198] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10c) returned 0x74b4140 [0091.198] wcscpy (in: _Dest=0x74b4140, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" [0091.198] wcscat (in: _Dest=0x74b4140, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\" [0091.198] wcscat (in: _Dest=0x74b4140, _Source="RedRectangle.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\RedRectangle.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\RedRectangle.png" [0091.198] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b4140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18bc [0091.199] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x377aa7ec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x377aa7ec, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x377aa7ec, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x163f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SampleCompetitor1.png", cAlternateFileName="")) returned 1 [0091.199] wcscmp (_String1="SampleCompetitor1.png", _String2=".") returned 1 [0091.199] wcscmp (_String1="SampleCompetitor1.png", _String2="..") returned 1 [0091.199] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x116) returned 0x72832f0 [0091.199] wcscpy (in: _Dest=0x72832f0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" [0091.199] wcscat (in: _Dest=0x72832f0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\" [0091.199] wcscat (in: _Dest=0x72832f0, _Source="SampleCompetitor1.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\SampleCompetitor1.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\SampleCompetitor1.png" [0091.199] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x72832f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12bc [0091.199] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x377aa7ec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x377d0a4a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x377d0a4a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xd5b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScoreTrophy.png", cAlternateFileName="")) returned 1 [0091.199] wcscmp (_String1="ScoreTrophy.png", _String2=".") returned 1 [0091.199] wcscmp (_String1="ScoreTrophy.png", _String2="..") returned 1 [0091.199] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10a) returned 0x74b2a48 [0091.199] wcscpy (in: _Dest=0x74b2a48, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" [0091.199] wcscat (in: _Dest=0x74b2a48, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\" [0091.200] wcscat (in: _Dest=0x74b2a48, _Source="ScoreTrophy.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\ScoreTrophy.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\ScoreTrophy.png" [0091.200] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b2a48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1578 [0091.200] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x377d0a4a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x377d0a4a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x377d0a4a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x63d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShowLeaderboardButton.png", cAlternateFileName="")) returned 1 [0091.200] wcscmp (_String1="ShowLeaderboardButton.png", _String2=".") returned 1 [0091.200] wcscmp (_String1="ShowLeaderboardButton.png", _String2="..") returned 1 [0091.200] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11e) returned 0x7283418 [0091.200] wcscpy (in: _Dest=0x7283418, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" [0091.200] wcscat (in: _Dest=0x7283418, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\" [0091.200] wcscat (in: _Dest=0x7283418, _Source="ShowLeaderboardButton.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\ShowLeaderboardButton.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\ShowLeaderboardButton.png" [0091.200] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x7283418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10f8 [0091.201] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x377d0a4a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x377d0a4a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x377d0a4a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xb6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Strike.png", cAlternateFileName="")) returned 1 [0091.201] wcscmp (_String1="Strike.png", _String2=".") returned 1 [0091.201] wcscmp (_String1="Strike.png", _String2="..") returned 1 [0091.201] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100) returned 0x5499b00 [0091.201] wcscpy (in: _Dest=0x5499b00, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" [0091.201] wcscat (in: _Dest=0x5499b00, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\" [0091.201] wcscat (in: _Dest=0x5499b00, _Source="Strike.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\Strike.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\Strike.png" [0091.201] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x5499b00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10e8 [0091.202] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x377d0a4a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x377d0a4a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x377d0a4a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="StrikeBackground.png", cAlternateFileName="")) returned 1 [0091.202] wcscmp (_String1="StrikeBackground.png", _String2=".") returned 1 [0091.202] wcscmp (_String1="StrikeBackground.png", _String2="..") returned 1 [0091.202] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x114) returned 0x72841f8 [0091.202] wcscpy (in: _Dest=0x72841f8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" [0091.202] wcscat (in: _Dest=0x72841f8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\" [0091.202] wcscat (in: _Dest=0x72841f8, _Source="StrikeBackground.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\StrikeBackground.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\StrikeBackground.png" [0091.202] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x72841f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10e4 [0091.203] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x377d0a4a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x377d0a4a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x377d0a4a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1afca, dwReserved0=0x0, dwReserved1=0x0, cFileName="TournamentHeaderSpider.png", cAlternateFileName="")) returned 1 [0091.203] wcscmp (_String1="TournamentHeaderSpider.png", _String2=".") returned 1 [0091.203] wcscmp (_String1="TournamentHeaderSpider.png", _String2="..") returned 1 [0091.203] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x120) returned 0x72848e8 [0091.203] wcscpy (in: _Dest=0x72848e8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament" [0091.203] wcscat (in: _Dest=0x72848e8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\" [0091.203] wcscat (in: _Dest=0x72848e8, _Source="TournamentHeaderSpider.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\TournamentHeaderSpider.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\TournamentHeaderSpider.png" [0091.203] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x72848e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10e0 [0091.204] FindNextFileW (in: hFindFile=0x389f440, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x377d0a4a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x377d0a4a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x377d0a4a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1afca, dwReserved0=0x0, dwReserved1=0x0, cFileName="TournamentHeaderSpider.png", cAlternateFileName="")) returned 0 [0091.204] FindClose (in: hFindFile=0x389f440 | out: hFindFile=0x389f440) returned 1 [0091.205] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3936c38) returned 1 [0091.205] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7286b80) returned 1 [0091.205] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393dc60) returned 1 Thread: id = 2107 os_tid = 0x17c8 [0091.168] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\upPremium.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\assets\\uppremium.jpg")) returned 0x20 [0091.169] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\upPremium.jpg", dwFileAttributes=0x20) returned 0 [0091.169] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\upPremium.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\assets\\uppremium.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.169] GetLastError () returned 0x5 [0091.169] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\upPremium.jpg", dwFileAttributes=0x20) returned 0 [0091.170] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393dd58) returned 1 Thread: id = 2108 os_tid = 0x17cc [0091.172] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf0) returned 0x7286f60 [0091.172] wcscpy (in: _Dest=0x7286f60, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxControl" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxControl") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxControl" [0091.172] wcscat (in: _Dest=0x7286f60, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxControl\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxControl\\" [0091.172] wcscat (in: _Dest=0x7286f60, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxControl\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxControl\\*" [0091.172] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3936ea0 [0091.172] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxControl\\*", lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x377d0a4a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb19197, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x377f6ca3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f640 [0091.172] wcscmp (_String1=".", _String2=".") returned 0 [0091.172] FindNextFileW (in: hFindFile=0x389f640, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x377d0a4a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb19197, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x377f6ca3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.172] wcscmp (_String1="..", _String2=".") returned 1 [0091.172] wcscmp (_String1="..", _String2="..") returned 0 [0091.172] FindNextFileW (in: hFindFile=0x389f640, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x377d0a4a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x377d0a4a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x377d0a4a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x60d, dwReserved0=0x0, dwReserved1=0x0, cFileName="avatar-mask.png", cAlternateFileName="")) returned 1 [0091.172] wcscmp (_String1="avatar-mask.png", _String2=".") returned 1 [0091.172] wcscmp (_String1="avatar-mask.png", _String2="..") returned 1 [0091.172] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10c) returned 0x74b3768 [0091.172] wcscpy (in: _Dest=0x74b3768, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxControl" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxControl") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxControl" [0091.172] wcscat (in: _Dest=0x74b3768, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxControl\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxControl\\" [0091.172] wcscat (in: _Dest=0x74b3768, _Source="avatar-mask.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxControl\\avatar-mask.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxControl\\avatar-mask.png" [0091.172] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b3768, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c8 [0091.173] FindNextFileW (in: hFindFile=0x389f640, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x377f6ca3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x377f6ca3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x377f6ca3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x7fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefaultAvatar.png", cAlternateFileName="")) returned 1 [0091.173] wcscmp (_String1="DefaultAvatar.png", _String2=".") returned 1 [0091.173] wcscmp (_String1="DefaultAvatar.png", _String2="..") returned 1 [0091.173] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x110) returned 0x74b46b8 [0091.173] wcscpy (in: _Dest=0x74b46b8, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxControl" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxControl") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxControl" [0091.173] wcscat (in: _Dest=0x74b46b8, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxControl\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxControl\\" [0091.173] wcscat (in: _Dest=0x74b46b8, _Source="DefaultAvatar.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxControl\\DefaultAvatar.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxControl\\DefaultAvatar.png" [0091.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b46b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22cc [0091.174] FindNextFileW (in: hFindFile=0x389f640, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x377f6ca3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x377f6ca3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x377f6ca3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x7fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefaultAvatar.png", cAlternateFileName="")) returned 0 [0091.174] FindClose (in: hFindFile=0x389f640 | out: hFindFile=0x389f640) returned 1 [0091.174] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3936ea0) returned 1 [0091.174] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7286f60) returned 1 [0091.174] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393f2a8) returned 1 Thread: id = 2109 os_tid = 0x17d0 [0091.175] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xea) returned 0x7286f60 [0091.175] wcscpy (in: _Dest=0x7286f60, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxFlow" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxFlow") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxFlow" [0091.175] wcscat (in: _Dest=0x7286f60, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxFlow\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxFlow\\" [0091.175] wcscat (in: _Dest=0x7286f60, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxFlow\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxFlow\\*" [0091.175] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3936ea0 [0091.175] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxFlow\\*", lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x377f6ca3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb19d17, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x377f6ca3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f640 [0091.176] wcscmp (_String1=".", _String2=".") returned 0 [0091.176] FindNextFileW (in: hFindFile=0x389f640, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x377f6ca3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb19d17, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x377f6ca3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.176] wcscmp (_String1="..", _String2=".") returned 1 [0091.176] wcscmp (_String1="..", _String2="..") returned 0 [0091.176] FindNextFileW (in: hFindFile=0x389f640, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x377f6ca3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x377f6ca3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x377f6ca3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4458f, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0091.176] wcscmp (_String1="background.png", _String2=".") returned 1 [0091.176] wcscmp (_String1="background.png", _String2="..") returned 1 [0091.176] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x104) returned 0x74b3880 [0091.176] wcscpy (in: _Dest=0x74b3880, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxFlow" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxFlow") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxFlow" [0091.176] wcscat (in: _Dest=0x74b3880, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxFlow\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxFlow\\" [0091.176] wcscat (in: _Dest=0x74b3880, _Source="background.png" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxFlow\\background.png") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxFlow\\background.png" [0091.176] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3659640, lpParameter=0x74b3880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22d0 [0091.177] FindNextFileW (in: hFindFile=0x389f640, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x377f6ca3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x377f6ca3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x377f6ca3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4458f, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 0 [0091.177] FindClose (in: hFindFile=0x389f640 | out: hFindFile=0x389f640) returned 1 [0091.177] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3936ea0) returned 1 [0091.177] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7286f60) returned 1 [0091.177] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b8fb8) returned 1 Thread: id = 2110 os_tid = 0x17d8 [0091.867] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-30_contrast-black.png")) returned 0x20 [0091.867] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.867] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-30_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.867] GetLastError () returned 0x5 [0091.867] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.867] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7589ad8) returned 1 Thread: id = 2111 os_tid = 0x17dc [0091.869] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-30_contrast-white.png")) returned 0x20 [0091.869] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_contrast-white.png", dwFileAttributes=0x20) returned 0 [0091.870] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-30_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.870] GetLastError () returned 0x5 [0091.870] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_contrast-white.png", dwFileAttributes=0x20) returned 0 [0091.870] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7588ed0) returned 1 Thread: id = 2112 os_tid = 0x17e0 [0091.871] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-32.png")) returned 0x20 [0091.872] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32.png", dwFileAttributes=0x20) returned 0 [0091.872] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-32.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.872] GetLastError () returned 0x5 [0091.872] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32.png", dwFileAttributes=0x20) returned 0 [0091.872] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393e610) returned 1 Thread: id = 2113 os_tid = 0x17ec [0091.873] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-32_altform-unplated.png")) returned 0x20 [0091.873] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0091.873] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-32_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.873] GetLastError () returned 0x5 [0091.873] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0091.873] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75859e8) returned 1 Thread: id = 2114 os_tid = 0x17f0 [0091.875] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-32_altform-unplated_contrast-black.png")) returned 0x20 [0091.875] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_altform-unplated_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.875] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-32_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.875] GetLastError () returned 0x5 [0091.875] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_altform-unplated_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.875] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e0fc8) returned 1 Thread: id = 2115 os_tid = 0x17f8 [0091.876] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-32_altform-unplated_contrast-white.png")) returned 0x20 [0091.876] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_altform-unplated_contrast-white.png", dwFileAttributes=0x20) returned 0 [0091.877] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-32_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.877] GetLastError () returned 0x5 [0091.877] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_altform-unplated_contrast-white.png", dwFileAttributes=0x20) returned 0 [0091.877] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e04d0) returned 1 Thread: id = 2116 os_tid = 0x17fc [0091.878] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-32_contrast-black.png")) returned 0x20 [0091.878] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.878] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-32_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.878] GetLastError () returned 0x5 [0091.878] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.878] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7589e20) returned 1 Thread: id = 2117 os_tid = 0xf98 [0091.879] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-32_contrast-white.png")) returned 0x20 [0091.879] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_contrast-white.png", dwFileAttributes=0x20) returned 0 [0091.880] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-32_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.880] GetLastError () returned 0x5 [0091.880] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_contrast-white.png", dwFileAttributes=0x20) returned 0 [0091.880] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7589100) returned 1 Thread: id = 2118 os_tid = 0x1314 [0091.881] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-36.png")) returned 0x20 [0091.882] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36.png", dwFileAttributes=0x20) returned 0 [0091.882] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-36.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.882] GetLastError () returned 0x5 [0091.882] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36.png", dwFileAttributes=0x20) returned 0 [0091.882] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393e518) returned 1 Thread: id = 2119 os_tid = 0x12a8 [0091.883] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-36_altform-unplated.png")) returned 0x20 [0091.883] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0091.883] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-36_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.883] GetLastError () returned 0x5 [0091.883] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0091.883] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7585b10) returned 1 Thread: id = 2120 os_tid = 0x1278 [0091.885] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-36_altform-unplated_contrast-black.png")) returned 0x20 [0091.885] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_altform-unplated_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.885] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-36_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.885] GetLastError () returned 0x5 [0091.885] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_altform-unplated_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.885] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74df8a0) returned 1 Thread: id = 2121 os_tid = 0x12dc [0091.886] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-36_altform-unplated_contrast-white.png")) returned 0x20 [0091.887] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_altform-unplated_contrast-white.png", dwFileAttributes=0x20) returned 0 [0091.887] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-36_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.887] GetLastError () returned 0x5 [0091.887] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_altform-unplated_contrast-white.png", dwFileAttributes=0x20) returned 0 [0091.887] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74dfb10) returned 1 Thread: id = 2122 os_tid = 0x12b4 [0091.888] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-36_contrast-black.png")) returned 0x20 [0091.888] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.889] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-36_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.889] GetLastError () returned 0x5 [0091.889] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.889] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7588ca0) returned 1 Thread: id = 2123 os_tid = 0x1348 [0091.890] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-36_contrast-white.png")) returned 0x20 [0091.890] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_contrast-white.png", dwFileAttributes=0x20) returned 0 [0091.890] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-36_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.891] GetLastError () returned 0x5 [0091.891] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_contrast-white.png", dwFileAttributes=0x20) returned 0 [0091.891] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7589bf0) returned 1 Thread: id = 2124 os_tid = 0x1344 [0091.892] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-40.png")) returned 0x20 [0091.892] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40.png", dwFileAttributes=0x20) returned 0 [0091.893] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-40.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.893] GetLastError () returned 0x5 [0091.893] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40.png", dwFileAttributes=0x20) returned 0 [0091.893] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393e708) returned 1 Thread: id = 2125 os_tid = 0x129c [0091.894] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-40_altform-unplated.png")) returned 0x20 [0091.894] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0091.894] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-40_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.894] GetLastError () returned 0x5 [0091.894] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0091.894] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7585c38) returned 1 Thread: id = 2126 os_tid = 0x1298 [0091.895] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-40_altform-unplated_contrast-black.png")) returned 0x20 [0091.896] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_altform-unplated_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.896] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-40_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.896] GetLastError () returned 0x5 [0091.896] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_altform-unplated_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.896] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74df9d8) returned 1 Thread: id = 2127 os_tid = 0x12d0 [0091.897] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-40_altform-unplated_contrast-white.png")) returned 0x20 [0091.898] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_altform-unplated_contrast-white.png", dwFileAttributes=0x20) returned 0 [0091.898] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-40_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.898] GetLastError () returned 0x5 [0091.898] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_altform-unplated_contrast-white.png", dwFileAttributes=0x20) returned 0 [0091.898] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74df630) returned 1 Thread: id = 2128 os_tid = 0x12b0 [0091.899] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-40_contrast-black.png")) returned 0x20 [0091.899] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.899] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-40_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.899] GetLastError () returned 0x5 [0091.899] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.899] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7589330) returned 1 Thread: id = 2129 os_tid = 0x184 [0091.901] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-40_contrast-white.png")) returned 0x20 [0091.901] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_contrast-white.png", dwFileAttributes=0x20) returned 0 [0091.901] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-40_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.901] GetLastError () returned 0x5 [0091.901] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_contrast-white.png", dwFileAttributes=0x20) returned 0 [0091.901] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7589678) returned 1 Thread: id = 2130 os_tid = 0x1258 [0091.902] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-48.png")) returned 0x20 [0091.903] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48.png", dwFileAttributes=0x20) returned 0 [0091.903] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-48.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.903] GetLastError () returned 0x5 [0091.903] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48.png", dwFileAttributes=0x20) returned 0 [0091.903] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393f3a0) returned 1 Thread: id = 2131 os_tid = 0x600 [0091.904] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-48_altform-unplated.png")) returned 0x20 [0091.904] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0091.905] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-48_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.905] GetLastError () returned 0x5 [0091.905] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0091.905] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7585d60) returned 1 Thread: id = 2132 os_tid = 0x11e4 [0091.906] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-48_altform-unplated_contrast-black.png")) returned 0x20 [0091.906] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_altform-unplated_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.906] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-48_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.906] GetLastError () returned 0x5 [0091.906] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_altform-unplated_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.906] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74df768) returned 1 Thread: id = 2133 os_tid = 0x1950 [0091.908] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-48_altform-unplated_contrast-white.png")) returned 0x20 [0091.909] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_altform-unplated_contrast-white.png", dwFileAttributes=0x20) returned 0 [0091.909] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-48_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.909] GetLastError () returned 0x5 [0091.909] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_altform-unplated_contrast-white.png", dwFileAttributes=0x20) returned 0 [0091.909] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e0d58) returned 1 Thread: id = 2134 os_tid = 0x1ee4 [0091.911] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-48_contrast-black.png")) returned 0x20 [0091.911] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.911] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-48_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.911] GetLastError () returned 0x5 [0091.911] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.911] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7588db8) returned 1 Thread: id = 2135 os_tid = 0x1a70 [0091.912] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-48_contrast-white.png")) returned 0x20 [0091.912] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_contrast-white.png", dwFileAttributes=0x20) returned 0 [0091.912] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-48_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.912] GetLastError () returned 0x5 [0091.912] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_contrast-white.png", dwFileAttributes=0x20) returned 0 [0091.913] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x758a050) returned 1 Thread: id = 2136 os_tid = 0x1a84 [0091.914] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-60.png")) returned 0x20 [0091.914] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60.png", dwFileAttributes=0x20) returned 0 [0091.914] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-60.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.915] GetLastError () returned 0x5 [0091.915] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60.png", dwFileAttributes=0x20) returned 0 [0091.915] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393f498) returned 1 Thread: id = 2137 os_tid = 0x1aa8 [0091.916] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-60_altform-unplated.png")) returned 0x20 [0091.916] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0091.916] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-60_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.916] GetLastError () returned 0x5 [0091.916] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0091.916] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7585e88) returned 1 Thread: id = 2138 os_tid = 0x1ab0 [0091.917] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-60_altform-unplated_contrast-black.png")) returned 0x20 [0091.918] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_altform-unplated_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.918] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-60_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.918] GetLastError () returned 0x5 [0091.918] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_altform-unplated_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.918] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74dfc48) returned 1 Thread: id = 2139 os_tid = 0x1ab4 [0091.919] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-60_altform-unplated_contrast-white.png")) returned 0x20 [0091.919] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_altform-unplated_contrast-white.png", dwFileAttributes=0x20) returned 0 [0091.919] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-60_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.919] GetLastError () returned 0x5 [0091.919] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_altform-unplated_contrast-white.png", dwFileAttributes=0x20) returned 0 [0091.919] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e0878) returned 1 Thread: id = 2140 os_tid = 0x1ab8 [0091.921] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-60_contrast-black.png")) returned 0x20 [0091.921] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.921] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-60_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.921] GetLastError () returned 0x5 [0091.921] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.921] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7588958) returned 1 Thread: id = 2141 os_tid = 0x1abc [0091.924] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-60_contrast-white.png")) returned 0x20 [0091.925] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_contrast-white.png", dwFileAttributes=0x20) returned 0 [0091.925] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-60_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.925] GetLastError () returned 0x5 [0091.925] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_contrast-white.png", dwFileAttributes=0x20) returned 0 [0091.925] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7589790) returned 1 Thread: id = 2142 os_tid = 0x1ac0 [0091.926] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-64.png")) returned 0x20 [0091.927] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64.png", dwFileAttributes=0x20) returned 0 [0091.927] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-64.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.927] GetLastError () returned 0x5 [0091.927] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64.png", dwFileAttributes=0x20) returned 0 [0091.927] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393d690) returned 1 Thread: id = 2143 os_tid = 0x1ac4 [0091.929] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-64_altform-unplated.png")) returned 0x20 [0091.929] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0091.929] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-64_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.929] GetLastError () returned 0x5 [0091.929] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0091.929] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7585fb0) returned 1 Thread: id = 2144 os_tid = 0x1ac8 [0091.931] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-64_altform-unplated_contrast-black.png")) returned 0x20 [0091.931] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_altform-unplated_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.931] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-64_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.931] GetLastError () returned 0x5 [0091.931] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_altform-unplated_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.931] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e0260) returned 1 Thread: id = 2145 os_tid = 0x1acc [0091.932] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-64_altform-unplated_contrast-white.png")) returned 0x20 [0091.933] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_altform-unplated_contrast-white.png", dwFileAttributes=0x20) returned 0 [0091.933] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-64_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.933] GetLastError () returned 0x5 [0091.933] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_altform-unplated_contrast-white.png", dwFileAttributes=0x20) returned 0 [0091.933] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74dfd80) returned 1 Thread: id = 2146 os_tid = 0x1ad0 [0091.934] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-64_contrast-black.png")) returned 0x20 [0091.935] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.935] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-64_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.935] GetLastError () returned 0x5 [0091.935] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.935] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7588a70) returned 1 Thread: id = 2147 os_tid = 0x1ad4 [0091.936] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-64_contrast-white.png")) returned 0x20 [0091.936] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_contrast-white.png", dwFileAttributes=0x20) returned 0 [0091.936] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-64_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.936] GetLastError () returned 0x5 [0091.936] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_contrast-white.png", dwFileAttributes=0x20) returned 0 [0091.937] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75881b0) returned 1 Thread: id = 2148 os_tid = 0x1ad8 [0091.938] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-72.png")) returned 0x20 [0091.938] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72.png", dwFileAttributes=0x20) returned 0 [0091.938] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-72.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.939] GetLastError () returned 0x5 [0091.939] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72.png", dwFileAttributes=0x20) returned 0 [0091.939] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54500d0) returned 1 Thread: id = 2149 os_tid = 0x1ae0 [0091.940] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-72_altform-unplated.png")) returned 0x20 [0091.940] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0091.940] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-72_altform-unplated.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.940] GetLastError () returned 0x5 [0091.940] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72_altform-unplated.png", dwFileAttributes=0x20) returned 0 [0091.940] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75841a0) returned 1 Thread: id = 2150 os_tid = 0x1ae4 [0091.960] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedapplist.scale-200.png")) returned 0x20 [0091.962] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-200.png", dwFileAttributes=0x20) returned 0 [0091.963] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedapplist.scale-200.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.964] GetLastError () returned 0x5 [0091.964] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-200.png", dwFileAttributes=0x20) returned 0 [0091.966] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7588840) returned 1 Thread: id = 2151 os_tid = 0x1ae8 [0091.967] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedapplist.scale-200_contrast-black.png")) returned 0x20 [0091.969] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-200_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.970] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedapplist.scale-200_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.972] GetLastError () returned 0x5 [0091.972] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-200_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.973] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e0c20) returned 1 Thread: id = 2152 os_tid = 0x1aec [0091.974] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedapplist.scale-200_contrast-white.png")) returned 0x20 [0091.976] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-200_contrast-white.png", dwFileAttributes=0x20) returned 0 [0091.977] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedapplist.scale-200_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.979] GetLastError () returned 0x5 [0091.979] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-200_contrast-white.png", dwFileAttributes=0x20) returned 0 [0091.980] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74dfff0) returned 1 Thread: id = 2153 os_tid = 0x1b20 [0091.981] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedlargetile.scale-200.png")) returned 0x20 [0091.983] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-200.png", dwFileAttributes=0x20) returned 0 [0091.985] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedlargetile.scale-200.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.986] GetLastError () returned 0x5 [0091.986] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-200.png", dwFileAttributes=0x20) returned 0 [0091.988] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x75842c8) returned 1 Thread: id = 2154 os_tid = 0x1b3c [0091.989] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedlargetile.scale-200_contrast-black.png")) returned 0x20 [0091.990] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-200_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.992] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedlargetile.scale-200_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0091.993] GetLastError () returned 0x5 [0091.993] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-200_contrast-black.png", dwFileAttributes=0x20) returned 0 [0091.994] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e0128) returned 1 Thread: id = 2155 os_tid = 0x1b40 [0091.995] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedlargetile.scale-200_contrast-white.png")) returned 0x20 [0092.000] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-200_contrast-white.png", dwFileAttributes=0x20) returned 0 [0092.001] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedlargetile.scale-200_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.002] GetLastError () returned 0x5 [0092.002] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-200_contrast-white.png", dwFileAttributes=0x20) returned 0 [0092.004] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e0398) returned 1 Thread: id = 2156 os_tid = 0x1b44 [0092.005] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedmedtile.scale-200.png")) returned 0x20 [0092.007] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-200.png", dwFileAttributes=0x20) returned 0 [0092.009] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedmedtile.scale-200.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.010] GetLastError () returned 0x5 [0092.010] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-200.png", dwFileAttributes=0x20) returned 0 [0092.011] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7589448) returned 1 Thread: id = 2157 os_tid = 0x1b48 [0092.013] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedmedtile.scale-200_contrast-black.png")) returned 0x20 [0092.014] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-200_contrast-black.png", dwFileAttributes=0x20) returned 0 [0092.016] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedmedtile.scale-200_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.017] GetLastError () returned 0x5 [0092.017] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-200_contrast-black.png", dwFileAttributes=0x20) returned 0 [0092.018] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e0740) returned 1 Thread: id = 2158 os_tid = 0x1b60 [0092.019] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedmedtile.scale-200_contrast-white.png")) returned 0x20 [0092.021] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-200_contrast-white.png", dwFileAttributes=0x20) returned 0 [0092.022] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedmedtile.scale-200_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.023] GetLastError () returned 0x5 [0092.023] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-200_contrast-white.png", dwFileAttributes=0x20) returned 0 [0092.025] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e0e90) returned 1 Thread: id = 2159 os_tid = 0x1b98 [0092.026] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedsmalltile.scale-200.png")) returned 0x20 [0092.028] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-200.png", dwFileAttributes=0x20) returned 0 [0092.030] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedsmalltile.scale-200.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.031] GetLastError () returned 0x5 [0092.031] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-200.png", dwFileAttributes=0x20) returned 0 [0092.033] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bd620) returned 1 Thread: id = 2160 os_tid = 0x1bd8 [0092.034] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedsmalltile.scale-200_contrast-black.png")) returned 0x20 [0092.035] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-200_contrast-black.png", dwFileAttributes=0x20) returned 0 [0092.037] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedsmalltile.scale-200_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.038] GetLastError () returned 0x5 [0092.038] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-200_contrast-black.png", dwFileAttributes=0x20) returned 0 [0092.040] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e0608) returned 1 Thread: id = 2161 os_tid = 0x12c0 [0092.041] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedsmalltile.scale-200_contrast-white.png")) returned 0x20 [0092.043] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-200_contrast-white.png", dwFileAttributes=0x20) returned 0 [0092.044] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedsmalltile.scale-200_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.046] GetLastError () returned 0x5 [0092.046] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-200_contrast-white.png", dwFileAttributes=0x20) returned 0 [0092.047] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74e09b0) returned 1 Thread: id = 2162 os_tid = 0x130c [0092.049] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedsplash.scale-200.png")) returned 0x20 [0092.050] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-200.png", dwFileAttributes=0x20) returned 0 [0092.052] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedsplash.scale-200.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.053] GetLastError () returned 0x5 [0092.053] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-200.png", dwFileAttributes=0x20) returned 0 [0092.055] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7589d08) returned 1 Thread: id = 2163 os_tid = 0x1310 [0092.056] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedsplash.scale-200_contrast-black.png")) returned 0x20 [0092.057] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-200_contrast-black.png", dwFileAttributes=0x20) returned 0 [0092.059] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedsplash.scale-200_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.060] GetLastError () returned 0x5 [0092.060] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-200_contrast-black.png", dwFileAttributes=0x20) returned 0 [0092.062] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74df288) returned 1 Thread: id = 2164 os_tid = 0xce4 [0092.063] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedsplash.scale-200_contrast-white.png")) returned 0x20 [0092.064] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-200_contrast-white.png", dwFileAttributes=0x20) returned 0 [0092.066] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedsplash.scale-200_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.067] GetLastError () returned 0x5 [0092.067] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-200_contrast-white.png", dwFileAttributes=0x20) returned 0 [0092.068] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74df3c0) returned 1 Thread: id = 2165 os_tid = 0x4c0 [0092.070] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedwidetile.scale-200.png")) returned 0x20 [0092.072] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-200.png", dwFileAttributes=0x20) returned 0 [0092.073] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedwidetile.scale-200.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.074] GetLastError () returned 0x5 [0092.074] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-200.png", dwFileAttributes=0x20) returned 0 [0092.076] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7589f38) returned 1 Thread: id = 2166 os_tid = 0x4bc [0092.109] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedwidetile.scale-200_contrast-black.png")) returned 0x20 [0092.111] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-200_contrast-black.png", dwFileAttributes=0x20) returned 0 [0092.112] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedwidetile.scale-200_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.114] GetLastError () returned 0x5 [0092.114] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-200_contrast-black.png", dwFileAttributes=0x20) returned 0 [0092.115] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7587528) returned 1 Thread: id = 2167 os_tid = 0xcdc [0092.116] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedwidetile.scale-200_contrast-white.png")) returned 0x20 [0092.118] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-200_contrast-white.png", dwFileAttributes=0x20) returned 0 [0092.119] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedwidetile.scale-200_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.121] GetLastError () returned 0x5 [0092.121] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-200_contrast-white.png", dwFileAttributes=0x20) returned 0 [0092.122] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5baa350) returned 1 Thread: id = 2168 os_tid = 0x1ef8 [0092.320] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\heart.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\periscope\\heart.png")) returned 0x20 [0092.322] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\heart.png", dwFileAttributes=0x20) returned 0 [0092.323] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\heart.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\periscope\\heart.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.325] GetLastError () returned 0x5 [0092.325] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\heart.png", dwFileAttributes=0x20) returned 0 [0092.326] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f7470) returned 1 Thread: id = 2169 os_tid = 0x1c2c [0092.328] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\periscope-logo-white-text-nobg.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\periscope\\periscope-logo-white-text-nobg.png")) returned 0x20 [0092.330] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\periscope-logo-white-text-nobg.png", dwFileAttributes=0x20) returned 0 [0092.332] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\periscope-logo-white-text-nobg.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\periscope\\periscope-logo-white-text-nobg.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.333] GetLastError () returned 0x5 [0092.333] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\periscope-logo-white-text-nobg.png", dwFileAttributes=0x20) returned 0 [0092.334] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7582c60) returned 1 Thread: id = 2170 os_tid = 0x1c48 [0092.336] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\periscope\\periscope_logo.png")) returned 0x20 [0092.337] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo.png", dwFileAttributes=0x20) returned 0 [0092.339] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\periscope\\periscope_logo.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.340] GetLastError () returned 0x5 [0092.340] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo.png", dwFileAttributes=0x20) returned 0 [0092.342] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f0950) returned 1 Thread: id = 2171 os_tid = 0x1c4c [0092.343] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_bw.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\periscope\\periscope_logo_bw.png")) returned 0x20 [0092.347] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_bw.png", dwFileAttributes=0x20) returned 0 [0092.348] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_bw.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\periscope\\periscope_logo_bw.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.350] GetLastError () returned 0x5 [0092.350] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_bw.png", dwFileAttributes=0x20) returned 0 [0092.351] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f0fa8) returned 1 Thread: id = 2172 os_tid = 0x1c50 [0092.353] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_color.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\periscope\\periscope_logo_color.png")) returned 0x20 [0092.354] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_color.png", dwFileAttributes=0x20) returned 0 [0092.356] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_color.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\periscope\\periscope_logo_color.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.357] GetLastError () returned 0x5 [0092.357] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_color.png", dwFileAttributes=0x20) returned 0 [0092.358] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b9558) returned 1 Thread: id = 2173 os_tid = 0x1c54 [0092.360] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_color_circle.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\periscope\\periscope_logo_color_circle.png")) returned 0x20 [0092.361] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_color_circle.png", dwFileAttributes=0x20) returned 0 [0092.363] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_color_circle.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\periscope\\periscope_logo_color_circle.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.364] GetLastError () returned 0x5 [0092.364] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_color_circle.png", dwFileAttributes=0x20) returned 0 [0092.365] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba44f8) returned 1 Thread: id = 2174 os_tid = 0x1c58 [0092.367] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_color_rounded_corners.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\periscope\\periscope_logo_color_rounded_corners.png")) returned 0x20 [0092.368] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_color_rounded_corners.png", dwFileAttributes=0x20) returned 0 [0092.370] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_color_rounded_corners.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\periscope\\periscope_logo_color_rounded_corners.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.371] GetLastError () returned 0x5 [0092.371] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_color_rounded_corners.png", dwFileAttributes=0x20) returned 0 [0092.373] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x7589560) returned 1 Thread: id = 2175 os_tid = 0x1c5c [0092.374] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\periscope_logo_icon.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\periscope\\periscope_logo_icon.png")) returned 0x20 [0092.375] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\periscope_logo_icon.png", dwFileAttributes=0x20) returned 0 [0092.377] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\periscope_logo_icon.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\periscope\\periscope_logo_icon.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.378] GetLastError () returned 0x5 [0092.378] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\periscope_logo_icon.png", dwFileAttributes=0x20) returned 0 [0092.380] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b9be8) returned 1 Thread: id = 2176 os_tid = 0x1eec [0092.381] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\viewers_icon.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\periscope\\viewers_icon.png")) returned 0x20 [0092.382] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\viewers_icon.png", dwFileAttributes=0x20) returned 0 [0092.384] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\viewers_icon.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\periscope\\viewers_icon.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.385] GetLastError () returned 0x5 [0092.385] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\viewers_icon.png", dwFileAttributes=0x20) returned 0 [0092.387] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3934d48) returned 1 Thread: id = 2177 os_tid = 0x1c64 [0092.388] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\viewers_icon_grey.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\periscope\\viewers_icon_grey.png")) returned 0x20 [0092.389] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\viewers_icon_grey.png", dwFileAttributes=0x20) returned 0 [0092.391] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\viewers_icon_grey.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\periscope\\viewers_icon_grey.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.392] GetLastError () returned 0x5 [0092.392] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\viewers_icon_grey.png", dwFileAttributes=0x20) returned 0 [0092.393] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f1b70) returned 1 Thread: id = 2178 os_tid = 0x1c68 [0092.395] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\Default\\MSCasualGames.zip" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\arkadium.win10.upsell\\default\\mscasualgames.zip")) returned 0x20 [0092.396] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\Default\\MSCasualGames.zip", dwFileAttributes=0x20) returned 0 [0092.396] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\Default\\MSCasualGames.zip" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\arkadium.win10.upsell\\default\\mscasualgames.zip"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.396] GetLastError () returned 0x5 [0092.396] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\Default\\MSCasualGames.zip", dwFileAttributes=0x20) returned 0 [0092.396] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba94b0) returned 1 Thread: id = 2179 os_tid = 0x1c6c [0092.397] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png")) returned 0x20 [0092.400] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", dwFileAttributes=0x20) returned 0 [0092.401] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.403] GetLastError () returned 0x5 [0092.403] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", dwFileAttributes=0x20) returned 0 [0092.404] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f7540) returned 1 Thread: id = 2180 os_tid = 0x1c70 [0092.405] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml")) returned 0x20 [0092.407] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", dwFileAttributes=0x20) returned 0 [0092.408] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.410] GetLastError () returned 0x5 [0092.410] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", dwFileAttributes=0x20) returned 0 [0092.411] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f84b0) returned 1 Thread: id = 2181 os_tid = 0x1c74 [0092.412] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png")) returned 0x20 [0092.415] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", dwFileAttributes=0x20) returned 0 [0092.416] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.418] GetLastError () returned 0x5 [0092.418] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", dwFileAttributes=0x20) returned 0 [0092.419] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f9768) returned 1 Thread: id = 2182 os_tid = 0x1c78 [0092.420] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png")) returned 0x20 [0092.423] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", dwFileAttributes=0x20) returned 0 [0092.425] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.426] GetLastError () returned 0x5 [0092.426] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", dwFileAttributes=0x20) returned 0 [0092.428] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f9a88) returned 1 Thread: id = 2183 os_tid = 0x1c7c [0092.429] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png")) returned 0x20 [0092.431] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", dwFileAttributes=0x20) returned 0 [0092.432] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.434] GetLastError () returned 0x5 [0092.434] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", dwFileAttributes=0x20) returned 0 [0092.437] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f7880) returned 1 Thread: id = 2184 os_tid = 0x1c80 [0092.447] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png")) returned 0x20 [0092.450] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", dwFileAttributes=0x20) returned 0 [0092.450] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.450] GetLastError () returned 0x5 [0092.450] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", dwFileAttributes=0x20) returned 0 [0092.450] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f7610) returned 1 Thread: id = 2185 os_tid = 0x1c84 [0092.451] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml")) returned 0x20 [0092.451] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", dwFileAttributes=0x20) returned 0 [0092.452] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.452] GetLastError () returned 0x5 [0092.452] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", dwFileAttributes=0x20) returned 0 [0092.452] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f8580) returned 1 Thread: id = 2186 os_tid = 0x1c88 [0092.453] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png")) returned 0x20 [0092.453] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", dwFileAttributes=0x20) returned 0 [0092.453] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.453] GetLastError () returned 0x5 [0092.453] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", dwFileAttributes=0x20) returned 0 [0092.455] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53f76e0) returned 1 Thread: id = 2187 os_tid = 0x1c94 [0092.456] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0x24 [0092.456] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", dwFileAttributes=0x20) returned 0 [0092.456] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.456] GetLastError () returned 0x5 [0092.456] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", dwFileAttributes=0x24) returned 0 [0092.456] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54501c8) returned 1 Thread: id = 2188 os_tid = 0x1c98 [0092.764] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0x24 [0092.764] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", dwFileAttributes=0x20) Thread: id = 2189 os_tid = 0x1c9c [0092.771] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.scale-200_contrast-black.png")) returned 0x20 [0092.772] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.scale-200_contrast-black.png", dwFileAttributes=0x20) returned 0 [0092.772] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.scale-200_contrast-black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.772] GetLastError () returned 0x5 [0092.772] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.scale-200_contrast-black.png", dwFileAttributes=0x20) returned 0 [0092.773] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x758a590) returned 1 Thread: id = 2190 os_tid = 0x1ca0 [0092.774] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.scale-200_contrast-white.png")) returned 0x20 [0092.774] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.scale-200_contrast-white.png", dwFileAttributes=0x20) returned 0 [0092.774] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.scale-200_contrast-white.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.775] GetLastError () returned 0x5 [0092.775] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.scale-200_contrast-white.png", dwFileAttributes=0x20) returned 0 [0092.775] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x758a6d8) returned 1 Thread: id = 2191 os_tid = 0x1ca4 [0092.777] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\fileicons\\filelogoextensions.targetsize-16.png")) returned 0x20 [0092.779] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-16.png", dwFileAttributes=0x20) returned 0 [0092.781] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\fileicons\\filelogoextensions.targetsize-16.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.782] GetLastError () returned 0x5 [0092.782] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-16.png", dwFileAttributes=0x20) returned 0 [0092.784] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bca90) returned 1 Thread: id = 2192 os_tid = 0x1cac [0092.785] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-20.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\fileicons\\filelogoextensions.targetsize-20.png")) returned 0x20 [0092.787] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-20.png", dwFileAttributes=0x20) returned 0 [0092.788] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-20.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\fileicons\\filelogoextensions.targetsize-20.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.790] GetLastError () returned 0x5 [0092.790] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-20.png", dwFileAttributes=0x20) returned 0 [0092.791] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bd3d0) returned 1 Thread: id = 2193 os_tid = 0x1cb0 [0092.792] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\fileicons\\filelogoextensions.targetsize-24.png")) returned 0x20 [0092.794] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-24.png", dwFileAttributes=0x20) returned 0 [0092.795] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\fileicons\\filelogoextensions.targetsize-24.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.796] GetLastError () returned 0x5 [0092.796] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-24.png", dwFileAttributes=0x20) returned 0 [0092.798] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bcbb8) returned 1 Thread: id = 2194 os_tid = 0x1cb4 [0092.799] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\fileicons\\filelogoextensions.targetsize-256.png")) returned 0x20 [0092.801] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-256.png", dwFileAttributes=0x20) returned 0 [0092.802] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\fileicons\\filelogoextensions.targetsize-256.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.804] GetLastError () returned 0x5 [0092.804] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-256.png", dwFileAttributes=0x20) returned 0 [0092.805] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba9d38) returned 1 Thread: id = 2195 os_tid = 0x1cb8 [0092.806] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\fileicons\\filelogoextensions.targetsize-32.png")) returned 0x20 [0092.808] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-32.png", dwFileAttributes=0x20) returned 0 [0092.809] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\fileicons\\filelogoextensions.targetsize-32.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.810] GetLastError () returned 0x5 [0092.810] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-32.png", dwFileAttributes=0x20) returned 0 [0092.812] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bcce0) returned 1 Thread: id = 2196 os_tid = 0x1cc0 [0092.813] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-40.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\fileicons\\filelogoextensions.targetsize-40.png")) returned 0x20 [0092.814] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-40.png", dwFileAttributes=0x20) returned 0 [0092.816] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-40.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\fileicons\\filelogoextensions.targetsize-40.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.817] GetLastError () returned 0x5 [0092.817] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-40.png", dwFileAttributes=0x20) returned 0 [0092.818] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bc968) returned 1 Thread: id = 2197 os_tid = 0x1de8 [0092.820] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\fileicons\\filelogoextensions.targetsize-48.png")) returned 0x20 [0092.822] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-48.png", dwFileAttributes=0x20) returned 0 [0092.823] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\fileicons\\filelogoextensions.targetsize-48.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.825] GetLastError () returned 0x5 [0092.825] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-48.png", dwFileAttributes=0x20) returned 0 [0092.826] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bd058) returned 1 Thread: id = 2198 os_tid = 0x1df0 [0092.827] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-64.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\fileicons\\filelogoextensions.targetsize-64.png")) returned 0x20 [0092.829] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-64.png", dwFileAttributes=0x20) returned 0 [0092.830] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-64.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\fileicons\\filelogoextensions.targetsize-64.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.831] GetLastError () returned 0x5 [0092.831] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-64.png", dwFileAttributes=0x20) returned 0 [0092.833] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bd180) returned 1 Thread: id = 2199 os_tid = 0x1df4 [0092.834] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x98) returned 0x55c61b8 [0092.834] wcscpy (in: _Dest=0x55c61b8, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList" [0092.834] wcscat (in: _Dest=0x55c61b8, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\" [0092.834] wcscat (in: _Dest=0x55c61b8, _Source="*" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*" [0092.834] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x393a128 [0092.834] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*", lpFindFileData=0x393a128 | out: lpFindFileData=0x393a128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79a3b1b, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79a3b1b, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79a3b1b, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f000 [0092.835] wcscmp (_String1=".", _String2=".") returned 0 [0092.835] FindNextFileW (in: hFindFile=0x389f000, lpFindFileData=0x393a128 | out: lpFindFileData=0x393a128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79a3b1b, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79a3b1b, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79a3b1b, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.836] wcscmp (_String1="..", _String2=".") returned 1 [0092.836] wcscmp (_String1="..", _String2="..") returned 0 [0092.836] FindNextFileW (in: hFindFile=0x389f000, lpFindFileData=0x393a128 | out: lpFindFileData=0x393a128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe79a3b1b, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe4eb997b, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe4eb997b, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x1bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="FRAMEW~1.XML")) returned 1 [0092.836] wcscmp (_String1="FrameworkList.xml", _String2=".") returned 1 [0092.836] wcscmp (_String1="FrameworkList.xml", _String2="..") returned 1 [0092.836] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb8) returned 0x5b175d0 [0092.836] wcscpy (in: _Dest=0x5b175d0, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList" [0092.836] wcscat (in: _Dest=0x5b175d0, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\" [0092.836] wcscat (in: _Dest=0x5b175d0, _Source="FrameworkList.xml" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml" Thread: id = 2200 os_tid = 0x1dfc [0092.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\winfxlist.xml")) returned 0x20 [0092.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml", dwFileAttributes=0x20) returned 1 [0092.838] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\winfxlist.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17c0 [0092.838] GetFileSizeEx (in: hFile=0x17c0, lpFileSize=0x4a4ffe48 | out: lpFileSize=0x4a4ffe48*=2578) returned 1 [0092.838] SetFilePointerEx (in: hFile=0x17c0, liDistanceToMove=0xa0e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.838] ReadFile (in: hFile=0x17c0, lpBuffer=0x4a4ffdcc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4a4ffdc8, lpOverlapped=0x0 | out: lpBuffer=0x4a4ffdcc*, lpNumberOfBytesRead=0x4a4ffdc8*=0x4, lpOverlapped=0x0) returned 1 [0092.839] SetFilePointerEx (in: hFile=0x17c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.839] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0661d8 [0092.839] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0668b8 [0092.839] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0669f8 [0092.839] NtQuerySystemTime (in: CurrentTime=0x4a4ffda8 | out: CurrentTime=0x4a4ffda8*=132260136500025779) returned 0x0 [0092.839] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0xfc24cb27 [0092.839] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0xf639eb4b [0092.839] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0x1276bfa4 [0092.839] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0xeb02779e [0092.839] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0x45cdca93 [0092.839] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0x3a2b00a4 [0092.839] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0x85de319c [0092.840] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0xa7c99c48 [0092.840] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0x97faae70 [0092.840] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0x67883f12 [0092.840] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0x5481a5e4 [0092.840] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0x68bb96e8 [0092.840] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0x3cadc81f [0092.840] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0x6f45249c [0092.840] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0x1b960e8c [0092.840] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0x6c588cda [0092.840] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0x6595e2fb [0092.840] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0xed4964c2 [0092.840] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0x1279f7f2 [0092.840] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0x3af0a54c [0092.840] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0x3b2552d4 [0092.840] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0x29eb9ec2 [0092.840] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0xd48df7c4 [0092.840] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0xd0a8ffd7 [0092.840] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0xa35b65f6 [0092.840] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0xf08468e4 [0092.840] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0x76404ba8 [0092.840] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0x215d066e [0092.840] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0x8dcb7b74 [0092.840] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0x5a196805 [0092.840] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0x2ac277dd [0092.840] RtlRandom (in: Seed=0x4a4ffdb4 | out: Seed=0x4a4ffdb4) returned 0x97e375fb Thread: id = 2201 os_tid = 0x1e04 [0092.849] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x98) returned 0x55c6258 [0092.849] wcscpy (in: _Dest=0x55c6258, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" [0092.849] wcscat (in: _Dest=0x55c6258, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\" [0092.849] wcscat (in: _Dest=0x55c6258, _Source="*" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*" [0092.849] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x39369d0 [0092.849] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*", lpFindFileData=0x39369d0 | out: lpFindFileData=0x39369d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79effb3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79effb3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f040 [0092.850] wcscmp (_String1=".", _String2=".") returned 0 [0092.850] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x39369d0 | out: lpFindFileData=0x39369d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79effb3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79effb3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.850] wcscmp (_String1="..", _String2=".") returned 1 [0092.850] wcscmp (_String1="..", _String2="..") returned 0 [0092.850] FindNextFileW (in: hFindFile=0x389f040, lpFindFileData=0x39369d0 | out: lpFindFileData=0x39369d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51e74b83, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51e74b83, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x5ec3, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 1 [0092.850] wcscmp (_String1="FrameworkList.xml", _String2=".") returned 1 [0092.850] wcscmp (_String1="FrameworkList.xml", _String2="..") returned 1 [0092.850] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb8) returned 0x5b17690 [0092.850] wcscpy (in: _Dest=0x5b17690, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" [0092.850] wcscat (in: _Dest=0x5b17690, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\" [0092.850] wcscat (in: _Dest=0x5b17690, _Source="FrameworkList.xml" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml" Thread: id = 2202 os_tid = 0x1e10 [0092.851] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x84) returned 0x549cf38 [0092.851] wcscpy (in: _Dest=0x549cf38, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics" [0092.851] wcscat (in: _Dest=0x549cf38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\" [0092.851] wcscat (in: _Dest=0x549cf38, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\*" [0092.851] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3936c38 [0092.851] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\*", lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f3911d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f3911d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389f080 [0092.851] wcscmp (_String1=".", _String2=".") returned 0 [0092.851] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f3911d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f3911d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.851] wcscmp (_String1="..", _String2=".") returned 1 [0092.851] wcscmp (_String1="..", _String2="..") returned 0 [0092.851] FindNextFileW (in: hFindFile=0x389f080, lpFindFileData=0x3936c38 | out: lpFindFileData=0x3936c38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f3911d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f5f358, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageNames2", cAlternateFileName="LANGUA~1")) returned 1 [0092.851] wcscmp (_String1="LanguageNames2", _String2=".") returned 1 [0092.851] wcscmp (_String1="LanguageNames2", _String2="..") returned 1 [0092.851] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9e) returned 0xe0268b8 [0092.851] wcscpy (in: _Dest=0xe0268b8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics" [0092.851] wcscat (in: _Dest=0xe0268b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\" [0092.851] wcscat (in: _Dest=0xe0268b8, _Source="LanguageNames2" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\LanguageNames2" Thread: id = 2203 os_tid = 0x1e14 [0092.856] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\Reader_DC.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\en_us\\reader_dc.helpcfg")) returned 0x20 [0092.856] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\Reader_DC.helpcfg", dwFileAttributes=0x20) returned 1 [0092.856] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\Reader_DC.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\en_us\\reader_dc.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x39c [0092.856] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x4a67f8c8 | out: lpFileSize=0x4a67f8c8*=714) returned 1 [0092.856] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x2c6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.856] ReadFile (in: hFile=0x39c, lpBuffer=0x4a67f84c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4a67f848, lpOverlapped=0x0 | out: lpBuffer=0x4a67f84c*, lpNumberOfBytesRead=0x4a67f848*=0x4, lpOverlapped=0x0) returned 1 [0092.858] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.858] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0661d8 [0092.858] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0668e0 [0092.858] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0669f8 [0092.858] NtQuerySystemTime (in: CurrentTime=0x4a67f828 | out: CurrentTime=0x4a67f828*=132260136500185602) returned 0x0 [0092.858] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0x940d087c [0092.858] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0x12894db2 [0092.858] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0x73a05400 [0092.858] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0x2f7ff633 [0092.858] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0xd6e667e5 [0092.858] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0x146adbfd [0092.858] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0x313f4ee3 [0092.858] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0x4f466364 [0092.858] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0x4823d96b [0092.858] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0xf4b935eb [0092.858] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0x9a9edd8f [0092.858] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0x88e246bd [0092.858] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0x1a0ac2c5 [0092.858] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0x251baaba [0092.858] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0x37fa74fa [0092.858] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0x5ede4841 [0092.858] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0xd18ab59d [0092.859] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0x313e38ef [0092.859] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0x67c5556f [0092.859] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0x4083cee4 [0092.859] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0xf5c88280 [0092.859] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0x2b7bdd2b [0092.859] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0xd18ac5a [0092.859] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0x44df5ea7 [0092.859] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0x1492af5f [0092.859] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0x587572a3 [0092.859] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0x342d4c7c [0092.859] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0x281a47d [0092.859] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0x712383bb [0092.859] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0x30a8d4e1 [0092.859] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0x44df5708 [0092.859] RtlRandom (in: Seed=0x4a67f834 | out: Seed=0x4a67f834) returned 0xd6f4be61 Thread: id = 2204 os_tid = 0x1f3c [0092.868] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x74) returned 0x38d1920 [0092.868] wcscpy (in: _Dest=0x38d1920, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\Cache" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\Cache") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\Cache" [0092.868] wcscat (in: _Dest=0x38d1920, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\Cache\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\Cache\\" [0092.868] wcscat (in: _Dest=0x38d1920, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\Cache\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\Cache\\*" [0092.868] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3936ea0 [0092.868] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\Cache\\*", lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82ac63e5, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0xa87217e, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xa87217e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e800 [0092.870] wcscmp (_String1=".", _String2=".") returned 0 [0092.870] FindNextFileW (in: hFindFile=0x389e800, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82ac63e5, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0xa87217e, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xa87217e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.870] wcscmp (_String1="..", _String2=".") returned 1 [0092.870] wcscmp (_String1="..", _String2="..") returned 0 [0092.871] FindNextFileW (in: hFindFile=0x389e800, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910cfa2, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x910cfa2, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x910cfa2, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0xd6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Arm_001824245926_1644620493770141623153545149044142307.msi", cAlternateFileName="ARM_00~1.MSI")) returned 1 [0092.871] wcscmp (_String1="Arm_001824245926_1644620493770141623153545149044142307.msi", _String2=".") returned 1 [0092.871] wcscmp (_String1="Arm_001824245926_1644620493770141623153545149044142307.msi", _String2="..") returned 1 [0092.871] FindNextFileW (in: hFindFile=0x389e800, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910cfa2, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x910cfa2, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x910cfa2, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0xd6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Arm_001824245926_1644620493770141623153545149044142307.msi", cAlternateFileName="ARM_00~1.MSI")) returned 0 [0092.871] FindClose (in: hFindFile=0x389e800 | out: hFindFile=0x389e800) returned 1 [0092.871] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3936ea0) returned 1 [0092.871] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38d1920) returned 1 [0092.871] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74b0378) returned 1 Thread: id = 2205 os_tid = 0x1f44 [0092.873] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_bingpagedata\\container.dat")) returned 0x2026 [0092.874] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata\\container.dat", dwFileAttributes=0x20) Thread: id = 2206 os_tid = 0x1f4c [0092.876] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_dntexception\\container.dat")) returned 0x2026 [0092.876] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException\\container.dat", dwFileAttributes=0x20) Thread: id = 2207 os_tid = 0x1f50 [0092.876] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieSiteList\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_emiesitelist\\container.dat")) returned 0x2026 [0092.877] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieSiteList\\container.dat", dwFileAttributes=0x20) Thread: id = 2208 os_tid = 0x1f58 [0092.877] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieUserList\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_emieuserlist\\container.dat")) returned 0x2026 [0092.877] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieUserList\\container.dat", dwFileAttributes=0x20) Thread: id = 2209 os_tid = 0x1f70 [0092.878] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompat\\container.dat")) returned 0x2026 [0092.878] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\container.dat", dwFileAttributes=0x20) Thread: id = 2210 os_tid = 0x1f94 [0092.879] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\IECompatData.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompat\\iecompatdata.xml")) returned 0x2020 [0092.880] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\IECompatData.xml", dwFileAttributes=0x20) Thread: id = 2211 os_tid = 0x1fa0 [0092.880] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompatua\\container.dat")) returned 0x2026 [0092.880] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua\\container.dat", dwFileAttributes=0x20) Thread: id = 2212 os_tid = 0x1fac [0092.881] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_ieflipahead\\container.dat")) returned 0x2026 [0092.881] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead\\container.dat", dwFileAttributes=0x20) Thread: id = 2213 os_tid = 0x1fb0 [0092.915] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\JSByteCodeCache_64" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\autogen\\jsbytecodecache_64")) returned 0x2024 [0092.915] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\JSByteCodeCache_64", dwFileAttributes=0x20) returned 0 [0092.915] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\JSByteCodeCache_64" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\autogen\\jsbytecodecache_64"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.915] GetLastError () returned 0x5 [0092.916] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\JSByteCodeCache_64", dwFileAttributes=0x2024) returned 0 [0092.916] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba9720) returned 1 Thread: id = 2214 os_tid = 0x1fbc [0092.917] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\JSByteCodeCache_64" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\autogen\\jsbytecodecache_64")) returned 0x2024 [0092.917] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\JSByteCodeCache_64", dwFileAttributes=0x20) returned 0 [0092.917] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\JSByteCodeCache_64" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\autogen\\jsbytecodecache_64"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.917] GetLastError () returned 0x5 [0092.917] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\JSByteCodeCache_64", dwFileAttributes=0x2024) returned 0 [0092.917] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bd2a8) returned 1 Thread: id = 2215 os_tid = 0x1fc8 [0092.918] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\JSByteCodeCache_32" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\autogen\\jsbytecodecache_32")) returned 0x2024 [0092.918] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\JSByteCodeCache_32", dwFileAttributes=0x20) returned 0 [0092.919] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\JSByteCodeCache_32" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\autogen\\jsbytecodecache_32"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.919] GetLastError () returned 0x5 [0092.919] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\JSByteCodeCache_32", dwFileAttributes=0x2024) returned 0 [0092.919] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba9858) returned 1 Thread: id = 2216 os_tid = 0x1fcc [0092.920] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x124) returned 0x7587180 [0092.920] wcscpy (in: _Dest=0x7587180, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16" [0092.920] wcscat (in: _Dest=0x7587180, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\" [0092.920] wcscat (in: _Dest=0x7587180, _Source="*" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\*") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\*" [0092.920] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x250) returned 0x3936ea0 [0092.920] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\*", lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6395ccec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd7feb3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x662a39a5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x389e940 [0092.923] wcscmp (_String1=".", _String2=".") returned 0 [0092.923] FindNextFileW (in: hFindFile=0x389e940, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6395ccec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd7feb3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x662a39a5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.925] wcscmp (_String1="..", _String2=".") returned 1 [0092.925] wcscmp (_String1="..", _String2="..") returned 0 [0092.925] FindNextFileW (in: hFindFile=0x389e940, lpFindFileData=0x3936ea0 | out: lpFindFileData=0x3936ea0*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x6395ccec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd7feb3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x63a1b8af, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0092.925] wcscmp (_String1="1033", _String2=".") returned 1 [0092.925] wcscmp (_String1="1033", _String2="..") returned 1 [0092.925] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12a) returned 0x75878d0 [0092.925] wcscpy (in: _Dest=0x75878d0, _Source="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16" [0092.925] wcscat (in: _Dest=0x75878d0, _Source="\\" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\" [0092.925] wcscat (in: _Dest=0x75878d0, _Source="1033" | out: _Dest="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033") returned="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033" Thread: id = 2217 os_tid = 0x1fd0 [0092.926] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\news_logosmall.scale-100.png")) returned 0x20 [0092.926] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.scale-100.png", dwFileAttributes=0x20) returned 0 [0092.926] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\news_logosmall.scale-100.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.927] GetLastError () returned 0x5 [0092.927] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.scale-100.png", dwFileAttributes=0x20) returned 0 [0092.927] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74d9388) returned 1 Thread: id = 2218 os_tid = 0x1fd4 [0092.928] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\news_logosmall.targetsize-16.png")) returned 0x20 [0092.928] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-16.png", dwFileAttributes=0x20) returned 0 [0092.928] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\news_logosmall.targetsize-16.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.929] GetLastError () returned 0x5 [0092.929] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-16.png", dwFileAttributes=0x20) returned 0 [0092.929] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74d94b0) returned 1 Thread: id = 2219 os_tid = 0x1fd8 [0092.930] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\news_logosmall.targetsize-24.png")) returned 0x20 [0092.930] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-24.png", dwFileAttributes=0x20) returned 0 [0092.930] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\news_logosmall.targetsize-24.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.930] GetLastError () returned 0x5 [0092.931] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-24.png", dwFileAttributes=0x20) returned 0 [0092.931] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x74d9950) returned 1 Thread: id = 2220 os_tid = 0x1fe0 [0092.932] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\news_logosmall.targetsize-256.png")) returned 0x20 [0092.932] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-256.png", dwFileAttributes=0x20) returned 0 [0092.932] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\news_logosmall.targetsize-256.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.935] GetLastError () returned 0x5 [0092.935] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-256.png", dwFileAttributes=0x20) returned 0 [0092.935] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54bc840) returned 1 Thread: id = 2221 os_tid = 0x1fe4 [0092.938] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Viewer\\Default-Scene.bxf" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\assets\\viewer\\default-scene.bxf")) returned 0x20 [0092.938] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Viewer\\Default-Scene.bxf", dwFileAttributes=0x20) returned 0 [0092.938] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Viewer\\Default-Scene.bxf" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\assets\\viewer\\default-scene.bxf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.938] GetLastError () returned 0x5 [0092.938] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Viewer\\Default-Scene.bxf", dwFileAttributes=0x20) returned 0 [0092.938] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5ba28f8) returned 1 Thread: id = 2222 os_tid = 0x1fec [0092.939] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Viewer\\ViewEnv.hdr" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\assets\\viewer\\viewenv.hdr")) returned 0x20 [0092.940] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Viewer\\ViewEnv.hdr", dwFileAttributes=0x20) returned 0 [0092.940] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Viewer\\ViewEnv.hdr" (normalized: "c:\\program files\\windowsapps\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\assets\\viewer\\viewenv.hdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0092.940] GetLastError () returned 0x5 [0092.940] SetFileAttributesW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Viewer\\ViewEnv.hdr", dwFileAttributes=0x20) returned 0 [0092.940] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5450c70) returned 1 Thread: id = 2223 os_tid = 0x1ff0 [0092.941] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\02305155-8ac1-1189-ff55-b7119a53887c.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\02305155-8ac1-1189-ff55-b7119a53887c.xml")) returned 0x20 [0092.942] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\02305155-8ac1-1189-ff55-b7119a53887c.xml", dwFileAttributes=0x20) returned 1 [0092.942] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\02305155-8ac1-1189-ff55-b7119a53887c.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\02305155-8ac1-1189-ff55-b7119a53887c.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x960 [0092.942] GetFileSizeEx (in: hFile=0x960, lpFileSize=0x4b07fca0 | out: lpFileSize=0x4b07fca0*=3190) returned 1 [0092.942] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0xc72, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.943] ReadFile (in: hFile=0x960, lpBuffer=0x4b07fc24, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4b07fc20, lpOverlapped=0x0 | out: lpBuffer=0x4b07fc24*, lpNumberOfBytesRead=0x4b07fc20*=0x4, lpOverlapped=0x0) returned 1 [0092.944] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.944] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0661d8 [0092.944] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066908 [0092.944] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0666b0 [0092.944] NtQuerySystemTime (in: CurrentTime=0x4b07fc00 | out: CurrentTime=0x4b07fc00*=132260136500963848) returned 0x0 [0092.944] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0x9b64cb10 [0092.944] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0xbb335eff [0092.944] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0x36af17e [0092.944] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0x499fb84e [0092.944] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0xb2cc3349 [0092.944] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0x6a99ce37 [0092.944] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0x3b4bade2 [0092.944] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0x7099bc03 [0092.944] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0xa570fa04 [0092.944] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0x6f95d8b1 [0092.944] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0x4452adb5 [0092.944] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0x7b9ed270 [0092.944] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0x3e66a73a [0092.944] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0xacbdadc1 [0092.944] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0x66366701 [0092.944] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0x554ccd67 [0092.944] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0xdbf30634 [0092.944] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0x8d990d53 [0092.944] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0xebe59d1b [0092.944] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0x892c4acb [0092.945] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0x83bc45e0 [0092.945] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0x685e9f59 [0092.945] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0x233b5427 [0092.945] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0xde74bab1 [0092.945] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0x65ceb4d4 [0092.945] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0x268c1887 [0092.945] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0xb188df1a [0092.945] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0xf6e1c700 [0092.945] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0x5ea16b5 [0092.945] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0xbe6a5da9 [0092.945] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0x836d789a [0092.945] RtlRandom (in: Seed=0x4b07fc0c | out: Seed=0x4b07fc0c) returned 0x2ec8e6f1 Thread: id = 2224 os_tid = 0x1ff8 [0092.955] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml")) returned 0x20 [0092.957] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml", dwFileAttributes=0x20) returned 1 [0092.957] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x844 [0092.957] GetFileSizeEx (in: hFile=0x844, lpFileSize=0x4b0ffc40 | out: lpFileSize=0x4b0ffc40*=3223) returned 1 [0092.957] SetFilePointerEx (in: hFile=0x844, liDistanceToMove=0xc93, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.957] ReadFile (in: hFile=0x844, lpBuffer=0x4b0ffbc4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4b0ffbc0, lpOverlapped=0x0 | out: lpBuffer=0x4b0ffbc4*, lpNumberOfBytesRead=0x4b0ffbc0*=0x4, lpOverlapped=0x0) returned 1 [0092.959] SetFilePointerEx (in: hFile=0x844, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.959] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0661d8 [0092.959] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0666b0 [0092.959] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066728 [0092.959] NtQuerySystemTime (in: CurrentTime=0x4b0ffba0 | out: CurrentTime=0x4b0ffba0*=132260136501120169) returned 0x0 [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0x297bdd5 [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0xbf6a0f9c [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0xdf81f4e3 [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0x418e514c [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0x535f5456 [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0x1e359c92 [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0xc63d8faf [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0x6b74d574 [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0xedcc4088 [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0x46c3c65d [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0x144fe22e [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0x43efeed1 [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0x1392e549 [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0xca7d36d9 [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0x17ae646c [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0xe17bd8bf [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0x60244148 [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0xd1a56b17 [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0x4f3deba0 [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0x8e871cc0 [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0xeef350ca [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0xc9f751d6 [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0xa6fadcbd [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0x9ee963ec [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0xc18738eb [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0xb5cb7bb7 [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0xcf4495b4 [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0xab228605 [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0x6d125fa7 [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0x9c8b01de [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0x4264082f [0092.959] RtlRandom (in: Seed=0x4b0ffbac | out: Seed=0x4b0ffbac) returned 0x2b1cb70d Thread: id = 2225 os_tid = 0x1ffc [0092.969] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0890ad2f-b74f-c384-f684-9c33f8f67924.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\0890ad2f-b74f-c384-f684-9c33f8f67924.xml")) returned 0x20 [0092.970] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0890ad2f-b74f-c384-f684-9c33f8f67924.xml", dwFileAttributes=0x20) returned 1 [0092.970] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0890ad2f-b74f-c384-f684-9c33f8f67924.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\0890ad2f-b74f-c384-f684-9c33f8f67924.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f9c [0092.970] GetFileSizeEx (in: hFile=0x1f9c, lpFileSize=0x4b17f964 | out: lpFileSize=0x4b17f964*=3201) returned 1 [0092.970] SetFilePointerEx (in: hFile=0x1f9c, liDistanceToMove=0xc7d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.970] ReadFile (in: hFile=0x1f9c, lpBuffer=0x4b17f8e8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4b17f8e4, lpOverlapped=0x0 | out: lpBuffer=0x4b17f8e8*, lpNumberOfBytesRead=0x4b17f8e4*=0x4, lpOverlapped=0x0) returned 1 [0092.972] SetFilePointerEx (in: hFile=0x1f9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.972] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0661d8 [0092.972] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066728 [0092.972] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0667a0 [0092.972] NtQuerySystemTime (in: CurrentTime=0x4b17f8c4 | out: CurrentTime=0x4b17f8c4*=132260136501275994) returned 0x0 [0092.972] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0x7113e8e1 [0092.972] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0x31b4aae4 [0092.972] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0x68d845e1 [0092.972] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0x8c9b9784 [0092.972] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0xa3eee289 [0092.972] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0xc34754e6 [0092.972] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0x8c440aeb [0092.972] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0x8024ae90 [0092.972] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0x5449061c [0092.972] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0xc9374c48 [0092.972] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0xab451488 [0092.972] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0xf9f05d10 [0092.972] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0xefb9ee64 [0092.972] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0x866696ca [0092.972] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0xe5c17df [0092.972] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0x767a66ea [0092.972] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0xfeaec3ca [0092.972] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0xfb760c1f [0092.972] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0xa6ce91f4 [0092.972] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0x964651a2 [0092.972] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0x98e283 [0092.972] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0x73770635 [0092.972] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0x7a2bc64f [0092.972] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0xacbf8b [0092.972] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0xe802275a [0092.972] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0x595e4892 [0092.972] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0xefc1b6b8 [0092.972] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0x8399f0a2 [0092.972] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0x58fc9e25 [0092.973] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0xe3f6c295 [0092.973] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0x2c45cb19 [0092.973] RtlRandom (in: Seed=0x4b17f8d0 | out: Seed=0x4b17f8d0) returned 0xf877d81c Thread: id = 2226 os_tid = 0x16c4 [0092.971] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\08961e67-fd90-a888-a0c1-ffdc19a3386f.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\08961e67-fd90-a888-a0c1-ffdc19a3386f.xml")) returned 0x20 [0092.982] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\08961e67-fd90-a888-a0c1-ffdc19a3386f.xml", dwFileAttributes=0x20) returned 1 [0092.982] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\08961e67-fd90-a888-a0c1-ffdc19a3386f.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\08961e67-fd90-a888-a0c1-ffdc19a3386f.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1828 [0092.982] GetFileSizeEx (in: hFile=0x1828, lpFileSize=0x4b1ffba8 | out: lpFileSize=0x4b1ffba8*=2794) returned 1 [0092.982] SetFilePointerEx (in: hFile=0x1828, liDistanceToMove=0xae6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.982] ReadFile (in: hFile=0x1828, lpBuffer=0x4b1ffb2c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4b1ffb28, lpOverlapped=0x0 | out: lpBuffer=0x4b1ffb2c*, lpNumberOfBytesRead=0x4b1ffb28*=0x4, lpOverlapped=0x0) returned 1 [0092.983] SetFilePointerEx (in: hFile=0x1828, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.983] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0661d8 [0092.983] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0667a0 [0092.983] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066818 [0092.983] NtQuerySystemTime (in: CurrentTime=0x4b1ffb08 | out: CurrentTime=0x4b1ffb08*=132260136501432207) returned 0x0 [0092.983] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0xf0e6a324 [0092.983] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0x73980b28 [0092.984] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0x75ceec60 [0092.984] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0xd323d42f [0092.984] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0x5fa3659b [0092.984] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0xb70bd2df [0092.984] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0xf484f721 [0092.984] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0x62119152 [0092.984] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0xbd6c396a [0092.984] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0x2b522fe6 [0092.984] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0xcff5aeb2 [0092.984] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0x1a27a918 [0092.984] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0xce969e8c [0092.984] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0xa2d667cf [0092.984] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0x962eec3c [0092.984] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0x4996fcc2 [0092.984] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0xa132887c [0092.984] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0x2c6585ec [0092.984] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0x20322201 [0092.984] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0xeb738875 [0092.984] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0x8aabc82a [0092.984] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0x185c945d [0092.984] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0x9d501b23 [0092.984] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0x9ef14b05 [0092.984] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0x586e5e31 [0092.984] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0xc7bd865a [0092.984] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0x36227d98 [0092.984] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0x78922355 [0092.984] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0x92ae273c [0092.984] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0x38c7dcb3 [0092.984] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0xfa82928f [0092.984] RtlRandom (in: Seed=0x4b1ffb14 | out: Seed=0x4b1ffb14) returned 0xc8d38743 Thread: id = 2227 os_tid = 0x16c8 [0092.993] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0a8c1492-65ca-6a01-de25-0e183559d10d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\0a8c1492-65ca-6a01-de25-0e183559d10d.xml")) returned 0x20 [0092.994] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0a8c1492-65ca-6a01-de25-0e183559d10d.xml", dwFileAttributes=0x20) returned 1 [0092.994] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0a8c1492-65ca-6a01-de25-0e183559d10d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\0a8c1492-65ca-6a01-de25-0e183559d10d.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xbb8 [0092.994] GetFileSizeEx (in: hFile=0xbb8, lpFileSize=0x4b27f748 | out: lpFileSize=0x4b27f748*=2630) returned 1 [0092.994] SetFilePointerEx (in: hFile=0xbb8, liDistanceToMove=0xa42, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.994] ReadFile (in: hFile=0xbb8, lpBuffer=0x4b27f6cc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4b27f6c8, lpOverlapped=0x0 | out: lpBuffer=0x4b27f6cc*, lpNumberOfBytesRead=0x4b27f6c8*=0x4, lpOverlapped=0x0) returned 1 [0092.995] SetFilePointerEx (in: hFile=0xbb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.995] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0661d8 [0092.995] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066818 [0092.996] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066ef8 [0092.996] NtQuerySystemTime (in: CurrentTime=0x4b27f6a8 | out: CurrentTime=0x4b27f6a8*=132260136501588255) returned 0x0 [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0xee70e916 [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0x55caf807 [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0x279e4767 [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0x393b9133 [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0x311783ac [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0xbcbca969 [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0x86bb5644 [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0xb6aeb1bf [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0x5b0a5cc1 [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0x7290ff0 [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0xf209dbe8 [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0xfeceb12c [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0x28b12edf [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0xc04f2d58 [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0xb663fc09 [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0xe7f91947 [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0xd086ebed [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0xb5764d42 [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0x260517e [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0xbf7c46be [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0xde0ef68 [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0x252c2f3a [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0x9b5b5632 [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0x7dd572e8 [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0x3fb475a5 [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0x28854677 [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0xf80844b7 [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0x4fe9d70b [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0x4d7dbcae [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0x2bccbd19 [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0xe2c779c0 [0092.996] RtlRandom (in: Seed=0x4b27f6b4 | out: Seed=0x4b27f6b4) returned 0xafd10388 Thread: id = 2228 os_tid = 0x16d8 [0093.005] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0cb4ef12-226b-0a51-6930-2dbfb63f3e7d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\0cb4ef12-226b-0a51-6930-2dbfb63f3e7d.xml")) returned 0x20 [0093.005] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0cb4ef12-226b-0a51-6930-2dbfb63f3e7d.xml", dwFileAttributes=0x20) returned 1 [0093.006] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0cb4ef12-226b-0a51-6930-2dbfb63f3e7d.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\0cb4ef12-226b-0a51-6930-2dbfb63f3e7d.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xbb4 [0093.006] GetFileSizeEx (in: hFile=0xbb4, lpFileSize=0x4b2ff7e0 | out: lpFileSize=0x4b2ff7e0*=2777) returned 1 [0093.006] SetFilePointerEx (in: hFile=0xbb4, liDistanceToMove=0xad5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.006] ReadFile (in: hFile=0xbb4, lpBuffer=0x4b2ff764, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4b2ff760, lpOverlapped=0x0 | out: lpBuffer=0x4b2ff764*, lpNumberOfBytesRead=0x4b2ff760*=0x4, lpOverlapped=0x0) returned 1 [0093.007] SetFilePointerEx (in: hFile=0xbb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.007] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0661d8 [0093.007] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066d40 [0093.007] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066ef8 [0093.007] NtQuerySystemTime (in: CurrentTime=0x4b2ff740 | out: CurrentTime=0x4b2ff740*=132260136501588255) returned 0x0 [0093.007] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0x75619cd [0093.008] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0x38ebd5ca [0093.008] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0x245c8dd0 [0093.008] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0xd2d5974e [0093.008] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0xd084cdb2 [0093.008] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0xffb3b66 [0093.008] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0xa8537dda [0093.008] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0x7cf77cce [0093.008] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0xfcdbd886 [0093.008] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0x4e27f8ae [0093.008] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0x1e22e62b [0093.008] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0xfdcaae48 [0093.008] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0x98fe0a0c [0093.008] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0xa2442134 [0093.008] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0x702b3820 [0093.008] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0xef34c5d [0093.008] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0x4dd3d70 [0093.008] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0x809afcf3 [0093.008] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0x50eacc78 [0093.008] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0x39a42629 [0093.008] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0xbaac4ab5 [0093.008] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0xc53d85ca [0093.008] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0x803ebb75 [0093.008] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0xf2451be7 [0093.008] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0xe4eba654 [0093.008] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0x63924eef [0093.008] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0xac8f9aa9 [0093.008] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0x29d069d6 [0093.008] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0x83108547 [0093.008] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0x2cf3cbd7 [0093.008] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0xe9d68ee1 [0093.008] RtlRandom (in: Seed=0x4b2ff74c | out: Seed=0x4b2ff74c) returned 0xa22caba0 Thread: id = 2229 os_tid = 0x14bc [0093.017] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\13ba8772-845b-29a1-ae9e-fb2793ccf4ea.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\13ba8772-845b-29a1-ae9e-fb2793ccf4ea.xml")) returned 0x20 [0093.018] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\13ba8772-845b-29a1-ae9e-fb2793ccf4ea.xml", dwFileAttributes=0x20) returned 1 [0093.018] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\13ba8772-845b-29a1-ae9e-fb2793ccf4ea.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\13ba8772-845b-29a1-ae9e-fb2793ccf4ea.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb94 [0093.018] GetFileSizeEx (in: hFile=0xb94, lpFileSize=0x4b37f8f0 | out: lpFileSize=0x4b37f8f0*=3179) returned 1 [0093.018] SetFilePointerEx (in: hFile=0xb94, liDistanceToMove=0xc67, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.018] ReadFile (in: hFile=0xb94, lpBuffer=0x4b37f874, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4b37f870, lpOverlapped=0x0 | out: lpBuffer=0x4b37f874*, lpNumberOfBytesRead=0x4b37f870*=0x4, lpOverlapped=0x0) returned 1 [0093.020] SetFilePointerEx (in: hFile=0xb94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.020] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0661d8 [0093.020] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066d68 [0093.020] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066ef8 [0093.020] NtQuerySystemTime (in: CurrentTime=0x4b37f850 | out: CurrentTime=0x4b37f850*=132260136501744588) returned 0x0 [0093.020] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0xcfa1e80a [0093.020] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0x491abdb6 [0093.020] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0x1b81252b [0093.020] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0xbad22f3e [0093.020] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0x92e8bdaa [0093.020] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0xced957fd [0093.020] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0x3c2d4e16 [0093.020] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0x802bd9d1 [0093.020] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0xa2ab1808 [0093.020] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0x2a5fc130 [0093.020] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0x175e8ac4 [0093.020] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0x8f385e12 [0093.020] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0xcf8ef6de [0093.020] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0x63c76068 [0093.020] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0xe6083d40 [0093.020] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0xcdd289a2 [0093.020] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0xa71f1809 [0093.020] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0xbc665d34 [0093.020] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0x31aa1b7 [0093.020] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0xe04c7842 [0093.020] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0xd24afed2 [0093.020] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0xebedd069 [0093.020] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0x39f2ac59 [0093.020] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0xa7053c48 [0093.020] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0xfa388236 [0093.020] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0x17b554f3 [0093.020] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0x899de01c [0093.020] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0x7aa361ab [0093.020] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0xee079b86 [0093.020] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0x42a3504c [0093.021] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0x25e7e45a [0093.021] RtlRandom (in: Seed=0x4b37f85c | out: Seed=0x4b37f85c) returned 0x118ee2a5 Thread: id = 2230 os_tid = 0x142c [0093.030] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1659a225-428e-84f0-ba52-5fb2b85d55b3.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\1659a225-428e-84f0-ba52-5fb2b85d55b3.xml")) returned 0x20 [0093.030] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1659a225-428e-84f0-ba52-5fb2b85d55b3.xml", dwFileAttributes=0x20) returned 1 [0093.030] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1659a225-428e-84f0-ba52-5fb2b85d55b3.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\1659a225-428e-84f0-ba52-5fb2b85d55b3.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb90 [0093.030] GetFileSizeEx (in: hFile=0xb90, lpFileSize=0x4b3ffb68 | out: lpFileSize=0x4b3ffb68*=3544) returned 1 [0093.030] SetFilePointerEx (in: hFile=0xb90, liDistanceToMove=0xdd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.030] ReadFile (in: hFile=0xb90, lpBuffer=0x4b3ffaec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4b3ffae8, lpOverlapped=0x0 | out: lpBuffer=0x4b3ffaec*, lpNumberOfBytesRead=0x4b3ffae8*=0x4, lpOverlapped=0x0) returned 1 [0093.032] SetFilePointerEx (in: hFile=0xb90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.032] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0661d8 [0093.032] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066d90 [0093.032] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066ef8 [0093.032] NtQuerySystemTime (in: CurrentTime=0x4b3ffac8 | out: CurrentTime=0x4b3ffac8*=132260136501901475) returned 0x0 [0093.032] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0xd5367017 [0093.032] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0xb4ea138b [0093.032] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0x645cef5 [0093.032] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0xf4c7655e [0093.032] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0x4f7cf07a [0093.032] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0xd5f41c97 [0093.032] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0x10045daf [0093.032] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0x18496f33 [0093.032] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0xd4382dd [0093.032] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0xcc55c54d [0093.032] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0x7aa08dac [0093.032] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0xd68c0b43 [0093.032] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0x3dc4cbc [0093.032] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0x7b998a36 [0093.032] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0xa314468b [0093.032] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0xa00c4ef0 [0093.032] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0x8d83c8f5 [0093.032] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0xdd8e2a88 [0093.032] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0x82bca0d8 [0093.032] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0xc273d97b [0093.032] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0x675049f1 [0093.032] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0x1f4aa38b [0093.032] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0x183d59dd [0093.032] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0x4daba027 [0093.032] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0xed6e9146 [0093.032] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0x37279351 [0093.032] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0x48b4879c [0093.032] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0xae3447a8 [0093.032] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0xfc52d02 [0093.032] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0xf32bcb68 [0093.033] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0x6a9350b6 [0093.033] RtlRandom (in: Seed=0x4b3ffad4 | out: Seed=0x4b3ffad4) returned 0xb7e001c7 Thread: id = 2231 os_tid = 0x16e4 [0093.042] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1dae14df-4c42-28af-691e-10cc07a990b4.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\1dae14df-4c42-28af-691e-10cc07a990b4.xml")) returned 0x20 [0093.042] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1dae14df-4c42-28af-691e-10cc07a990b4.xml", dwFileAttributes=0x20) returned 1 [0093.043] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1dae14df-4c42-28af-691e-10cc07a990b4.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\1dae14df-4c42-28af-691e-10cc07a990b4.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x8b0 [0093.043] GetFileSizeEx (in: hFile=0x8b0, lpFileSize=0x4b47fb68 | out: lpFileSize=0x4b47fb68*=3190) returned 1 [0093.043] SetFilePointerEx (in: hFile=0x8b0, liDistanceToMove=0xc72, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.043] ReadFile (in: hFile=0x8b0, lpBuffer=0x4b47faec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4b47fae8, lpOverlapped=0x0 | out: lpBuffer=0x4b47faec*, lpNumberOfBytesRead=0x4b47fae8*=0x4, lpOverlapped=0x0) returned 1 [0093.044] SetFilePointerEx (in: hFile=0x8b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.044] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0661d8 [0093.044] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066db8 [0093.044] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066ef8 [0093.044] NtQuerySystemTime (in: CurrentTime=0x4b47fac8 | out: CurrentTime=0x4b47fac8*=132260136502057591) returned 0x0 [0093.044] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0x91b6d23d [0093.044] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0x3af4135d [0093.044] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0x71810a18 [0093.044] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0xfe9e362c [0093.044] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0xf474ea2c [0093.044] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0x1be44799 [0093.044] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0xd9271304 [0093.044] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0xd0c7d423 [0093.044] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0x4b02230b [0093.045] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0x28c16222 [0093.045] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0x93b05d18 [0093.045] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0xf3e2be45 [0093.045] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0x32cbc295 [0093.045] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0x6ce746e5 [0093.045] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0xb3a5b77b [0093.045] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0x8b09875c [0093.045] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0x8486ea42 [0093.045] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0x9f4cca33 [0093.045] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0x3c6c3a08 [0093.045] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0xcd2639c0 [0093.045] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0xf6100f54 [0093.045] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0xfe7abcf5 [0093.045] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0x4c0041b [0093.045] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0x931e77f1 [0093.045] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0x24627bc6 [0093.045] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0x8051fabc [0093.045] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0x317c6689 [0093.045] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0x69ec16c2 [0093.045] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0x8b20f890 [0093.045] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0xff98f7c1 [0093.045] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0xc5159095 [0093.045] RtlRandom (in: Seed=0x4b47fad4 | out: Seed=0x4b47fad4) returned 0x157e8bf6 Thread: id = 2232 os_tid = 0x16f4 [0093.054] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml")) returned 0x20 [0093.055] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml", dwFileAttributes=0x20) returned 1 [0093.055] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f98 [0093.056] GetFileSizeEx (in: hFile=0x1f98, lpFileSize=0x4b4ffa1c | out: lpFileSize=0x4b4ffa1c*=2634) returned 1 [0093.056] SetFilePointerEx (in: hFile=0x1f98, liDistanceToMove=0xa46, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.056] ReadFile (in: hFile=0x1f98, lpBuffer=0x4b4ff9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4b4ff99c, lpOverlapped=0x0 | out: lpBuffer=0x4b4ff9a0*, lpNumberOfBytesRead=0x4b4ff99c*=0x4, lpOverlapped=0x0) returned 1 [0093.057] SetFilePointerEx (in: hFile=0x1f98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.057] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0661d8 [0093.057] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066de0 [0093.057] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066ef8 [0093.057] NtQuerySystemTime (in: CurrentTime=0x4b4ff97c | out: CurrentTime=0x4b4ff97c*=132260136502213210) returned 0x0 [0093.057] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0xed3da3c7 [0093.057] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0x354e765a [0093.057] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0x9605dc8f [0093.057] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0x1400a5e9 [0093.057] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0xa51134fe [0093.057] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0xa07d8486 [0093.057] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0x1c8b2b40 [0093.057] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0x2ace87b8 [0093.057] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0x7bed96e7 [0093.057] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0x65079abc [0093.057] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0x18f85924 [0093.057] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0x66dc728c [0093.057] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0xc8ea5c86 [0093.057] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0x2f991560 [0093.057] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0xbe009076 [0093.058] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0x21779ae2 [0093.058] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0xf3967bbf [0093.058] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0xe75dd620 [0093.058] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0x6d0697a6 [0093.058] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0xc2690655 [0093.058] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0x19ce801f [0093.058] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0x47e5e0fc [0093.058] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0x35c70e3 [0093.058] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0x7812e226 [0093.058] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0x554ab53 [0093.058] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0xf9859809 [0093.058] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0xea595ff6 [0093.058] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0xdf47ce64 [0093.058] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0x8eb6cb8e [0093.058] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0x15d0a928 [0093.058] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0x550b345f [0093.058] RtlRandom (in: Seed=0x4b4ff988 | out: Seed=0x4b4ff988) returned 0xe4ff2069 Thread: id = 2233 os_tid = 0x16f8 [0093.067] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\215f9712-9fca-a3f8-5b11-660eefc73b96.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\215f9712-9fca-a3f8-5b11-660eefc73b96.xml")) returned 0x20 [0093.067] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\215f9712-9fca-a3f8-5b11-660eefc73b96.xml", dwFileAttributes=0x20) returned 1 [0093.068] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\215f9712-9fca-a3f8-5b11-660eefc73b96.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\215f9712-9fca-a3f8-5b11-660eefc73b96.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1874 [0093.068] GetFileSizeEx (in: hFile=0x1874, lpFileSize=0x4b57fcd8 | out: lpFileSize=0x4b57fcd8*=2782) returned 1 [0093.068] SetFilePointerEx (in: hFile=0x1874, liDistanceToMove=0xada, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.068] ReadFile (in: hFile=0x1874, lpBuffer=0x4b57fc5c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4b57fc58, lpOverlapped=0x0 | out: lpBuffer=0x4b57fc5c*, lpNumberOfBytesRead=0x4b57fc58*=0x4, lpOverlapped=0x0) returned 1 [0093.070] SetFilePointerEx (in: hFile=0x1874, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.070] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe0661d8 [0093.070] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066e08 [0093.070] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20) returned 0xe066ef8 [0093.070] NtQuerySystemTime (in: CurrentTime=0x4b57fc38 | out: CurrentTime=0x4b57fc38*=132260136502213210) returned 0x0 [0093.070] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0xa078293f [0093.070] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0xd1acabd5 [0093.070] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0xf06bd27c [0093.070] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0xb798a216 [0093.070] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0x8e47c8a1 [0093.070] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0xa4b6261e [0093.070] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0xa835fc24 [0093.070] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0x64c1ea11 [0093.070] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0xca028853 [0093.070] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0x94e48191 [0093.070] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0xf21cb0ef [0093.070] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0x6da8d0bb [0093.070] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0x2a69615e [0093.070] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0x83394667 [0093.070] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0xc5cc4e32 [0093.070] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0x777b570e [0093.070] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0x1654651f [0093.070] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0xaeae73b6 [0093.070] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0xe9d679e3 [0093.071] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0x1acbf138 [0093.071] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0x7ef6b97b [0093.071] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0xac93dd62 [0093.071] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0x9009eb16 [0093.071] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0x3ca0c8b0 [0093.071] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0xf3b334fd [0093.071] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0x79f5af2f [0093.071] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0x68816890 [0093.071] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0xb491c63d [0093.071] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0xf1fd54ca [0093.071] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0xd805e4ad [0093.071] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0x54effe51 [0093.071] RtlRandom (in: Seed=0x4b57fc44 | out: Seed=0x4b57fc44) returned 0xdb30e510 Thread: id = 2234 os_tid = 0xc30 [0093.070] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2657f7c0-8294-58c3-f394-15fe18ba174a.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\2657f7c0-8294-58c3-f394-15fe18ba174a.xml")) returned 0x20 [0093.080] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2657f7c0-8294-58c3-f394-15fe18ba174a.xml", dwFileAttributes=0x20) returned 1 [0093.080] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2657f7c0-8294-58c3-f394-15fe18ba174a.xml" (normalized: "c:\\programdata\\microsoft\\windows\\clipsvc\\archive\\apps\\2657f7c0-8294-58c3-f394-15fe18ba174a.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f8c [0093.080] GetFileSizeEx (in: hFile=0x1f8c, lpFileSize=0x4b5ff774 | out: lpFileSize=0x4b5ff774*=3196) returned 1 [0093.080] SetFilePointerEx (in: hFile=0x1f8c, liDistanceToMove=0xc78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.080] ReadFile (hFile=0x1f8c, lpBuffer=0x4b5ff6f8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4b5ff6f4, lpOverlapped=0x0) Process: id = "3" image_name = "explorer.exe" filename = "c:\\windows\\syswow64\\explorer.exe" page_root = "0xd57b000" os_pid = "0x4c4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x10dc" cmd_line = "\"C:\\WINDOWS\\system32\\explorer.exe\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 6 os_tid = 0x374 [0058.584] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x254) returned 0x34ac850 [0058.774] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x6) returned 0x34b66e0 [0058.774] RtlInitAnsiString (in: DestinationString=0x98f2d0, SourceString="NTDLL" | out: DestinationString="NTDLL") [0058.774] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f2d8, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0058.774] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0xc) returned 0x34b1ce0 [0058.774] RtlFreeAnsiString (AnsiString="N") [0058.774] RtlInitUnicodeString (in: DestinationString=0x98f2dc, SourceString="NTDLL" | out: DestinationString="NTDLL") [0058.774] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x98f2e8 | out: BaseAddress=0x98f2e8*=0x77850000) returned 0x0 [0058.776] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34b1ce0) returned 1 [0058.776] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34b66e0) returned 1 [0058.777] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x6) returned 0x34b6790 [0058.777] RtlInitAnsiString (in: DestinationString=0x98f2d0, SourceString="NTDLL" | out: DestinationString="NTDLL") [0058.777] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f2d8, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0058.777] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0xc) returned 0x34b1b90 [0058.777] RtlFreeAnsiString (AnsiString="N") [0058.777] RtlInitUnicodeString (in: DestinationString=0x98f2dc, SourceString="NTDLL" | out: DestinationString="NTDLL") [0058.777] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x98f2e8 | out: BaseAddress=0x98f2e8*=0x77850000) returned 0x0 [0058.777] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34b1b90) returned 1 [0058.778] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34b6790) returned 1 [0058.778] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x6) returned 0x34b6790 [0058.778] RtlInitAnsiString (in: DestinationString=0x98f2d0, SourceString="NTDLL" | out: DestinationString="NTDLL") [0058.778] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f2d8, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0058.778] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0xc) returned 0x34b1cc8 [0058.779] RtlFreeAnsiString (AnsiString="N") [0058.779] RtlInitUnicodeString (in: DestinationString=0x98f2dc, SourceString="NTDLL" | out: DestinationString="NTDLL") [0058.779] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x98f2e8 | out: BaseAddress=0x98f2e8*=0x77850000) returned 0x0 [0058.779] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34b1cc8) returned 1 [0058.780] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34b6790) returned 1 [0058.791] RtlInitUnicodeString (in: DestinationString=0x98f348, SourceString="mpr.dll" | out: DestinationString="mpr.dll") [0058.791] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="mpr.dll", BaseAddress=0x98f354 | out: BaseAddress=0x98f354*=0x74160000) returned 0x0 [0058.794] RtlInitUnicodeString (in: DestinationString=0x98f348, SourceString="netapi32.dll" | out: DestinationString="netapi32.dll") [0058.794] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="netapi32.dll", BaseAddress=0x98f354 | out: BaseAddress=0x98f354*=0x73750000) returned 0x0 [0058.797] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x7) returned 0x34b66a0 [0058.797] RtlInitAnsiString (in: DestinationString=0x98f2d0, SourceString="SRVCLI" | out: DestinationString="SRVCLI") [0058.797] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f2d8, SourceString="SRVCLI", AllocateDestinationString=1 | out: DestinationString="SRVCLI") returned 0x0 [0058.797] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0xe) returned 0x34b1b18 [0058.797] RtlFreeAnsiString (AnsiString="S") [0058.797] RtlInitUnicodeString (in: DestinationString=0x98f2dc, SourceString="SRVCLI" | out: DestinationString="SRVCLI") [0058.797] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="SRVCLI", BaseAddress=0x98f2e8 | out: BaseAddress=0x98f2e8*=0x73730000) returned 0x0 [0058.803] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34b1b18) returned 1 [0058.803] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34b66a0) returned 1 [0058.803] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x9) returned 0x34b1cc8 [0058.803] RtlInitAnsiString (in: DestinationString=0x98f2d0, SourceString="NETUTILS" | out: DestinationString="NETUTILS") [0058.803] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f2d8, SourceString="NETUTILS", AllocateDestinationString=1 | out: DestinationString="NETUTILS") returned 0x0 [0058.803] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x12) returned 0x34b8668 [0058.803] RtlFreeAnsiString (AnsiString="N") [0058.803] RtlInitUnicodeString (in: DestinationString=0x98f2dc, SourceString="NETUTILS" | out: DestinationString="NETUTILS") [0058.803] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NETUTILS", BaseAddress=0x98f2e8 | out: BaseAddress=0x98f2e8*=0x74150000) returned 0x0 [0058.815] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34b8668) returned 1 [0058.815] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34b1cc8) returned 1 [0058.815] RtlInitUnicodeString (in: DestinationString=0x98f348, SourceString="ole32.dll" | out: DestinationString="ole32.dll") [0058.815] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="ole32.dll", BaseAddress=0x98f354 | out: BaseAddress=0x98f354*=0x76470000) returned 0x0 [0058.819] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1b) returned 0x34bc1c0 [0058.819] RtlInitAnsiString (in: DestinationString=0x98f2d0, SourceString="api-ms-win-core-com-l1-1-0" | out: DestinationString="api-ms-win-core-com-l1-1-0") [0058.819] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f2d8, SourceString="api-ms-win-core-com-l1-1-0", AllocateDestinationString=1 | out: DestinationString="api-ms-win-core-com-l1-1-0") returned 0x0 [0058.819] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x36) returned 0x34be538 [0058.819] RtlFreeAnsiString (AnsiString="a") [0058.820] RtlInitUnicodeString (in: DestinationString=0x98f2dc, SourceString="api-ms-win-core-com-l1-1-0" | out: DestinationString="api-ms-win-core-com-l1-1-0") [0058.820] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="api-ms-win-core-com-l1-1-0", BaseAddress=0x98f2e8 | out: BaseAddress=0x98f2e8*=0x77130000) returned 0x0 [0058.820] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34be538) returned 1 [0058.820] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34bc1c0) returned 1 [0058.820] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1b) returned 0x34bbf40 [0058.820] RtlInitAnsiString (in: DestinationString=0x98f2d0, SourceString="api-ms-win-core-com-l1-1-0" | out: DestinationString="api-ms-win-core-com-l1-1-0") [0058.820] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f2d8, SourceString="api-ms-win-core-com-l1-1-0", AllocateDestinationString=1 | out: DestinationString="api-ms-win-core-com-l1-1-0") returned 0x0 [0058.820] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x36) returned 0x34becb8 [0058.820] RtlFreeAnsiString (AnsiString="a") [0058.820] RtlInitUnicodeString (in: DestinationString=0x98f2dc, SourceString="api-ms-win-core-com-l1-1-0" | out: DestinationString="api-ms-win-core-com-l1-1-0") [0058.820] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="api-ms-win-core-com-l1-1-0", BaseAddress=0x98f2e8 | out: BaseAddress=0x98f2e8*=0x77130000) returned 0x0 [0058.820] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34becb8) returned 1 [0058.820] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34bbf40) returned 1 [0058.820] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1b) returned 0x34bbfb8 [0058.820] RtlInitAnsiString (in: DestinationString=0x98f2d0, SourceString="api-ms-win-core-com-l1-1-0" | out: DestinationString="api-ms-win-core-com-l1-1-0") [0058.820] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f2d8, SourceString="api-ms-win-core-com-l1-1-0", AllocateDestinationString=1 | out: DestinationString="api-ms-win-core-com-l1-1-0") returned 0x0 [0058.820] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x36) returned 0x34be8f8 [0058.821] RtlFreeAnsiString (AnsiString="a") [0058.821] RtlInitUnicodeString (in: DestinationString=0x98f2dc, SourceString="api-ms-win-core-com-l1-1-0" | out: DestinationString="api-ms-win-core-com-l1-1-0") [0058.821] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="api-ms-win-core-com-l1-1-0", BaseAddress=0x98f2e8 | out: BaseAddress=0x98f2e8*=0x77130000) returned 0x0 [0058.821] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34be8f8) returned 1 [0058.821] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34bbfb8) returned 1 [0058.821] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1b) returned 0x34bc1c0 [0058.821] RtlInitAnsiString (in: DestinationString=0x98f2d0, SourceString="api-ms-win-core-com-l1-1-0" | out: DestinationString="api-ms-win-core-com-l1-1-0") [0058.821] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f2d8, SourceString="api-ms-win-core-com-l1-1-0", AllocateDestinationString=1 | out: DestinationString="api-ms-win-core-com-l1-1-0") returned 0x0 [0058.821] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x36) returned 0x34be778 [0058.821] RtlFreeAnsiString (AnsiString="a") [0058.821] RtlInitUnicodeString (in: DestinationString=0x98f2dc, SourceString="api-ms-win-core-com-l1-1-0" | out: DestinationString="api-ms-win-core-com-l1-1-0") [0058.821] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="api-ms-win-core-com-l1-1-0", BaseAddress=0x98f2e8 | out: BaseAddress=0x98f2e8*=0x77130000) returned 0x0 [0058.821] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34be778) returned 1 [0058.821] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34bc1c0) returned 1 [0058.822] RtlInitUnicodeString (in: DestinationString=0x98f348, SourceString="psapi.dll" | out: DestinationString="psapi.dll") [0058.822] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="psapi.dll", BaseAddress=0x98f354 | out: BaseAddress=0x98f354*=0x77830000) returned 0x0 [0058.824] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x98f2ac | out: lpLuid=0x98f2ac*(LowPart=0x14, HighPart=0)) returned 1 [0058.828] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x98f288 | out: TokenHandle=0x98f288*=0x2f4) returned 0x0 [0058.828] AdjustTokenPrivileges (in: TokenHandle=0x2f4, DisableAllPrivileges=0, NewState=0x98f29c*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0058.828] GetLastError () returned 0x0 [0058.831] FindResourceA (hModule=0x9c0000, lpName=0x7a69, lpType=0x539) returned 0x9d8048 [0058.831] LoadResource (hModule=0x9c0000, hResInfo=0x9d8048) returned 0x9d8058 [0058.831] LockResource (hResData=0x9d8058) returned 0x9d8058 [0058.831] SizeofResource (hModule=0x9c0000, hResInfo=0x9d8048) returned 0x14fb [0058.831] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14fb) returned 0x34c0a00 [0058.831] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x5) returned 0x34b66b0 [0058.833] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x100) returned 0x34a9bb8 [0058.833] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x100) returned 0x34a8960 [0058.833] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34a8960) returned 1 [0058.833] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34a9bb8) returned 1 [0058.834] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34b8828 [0058.834] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x4) returned 0x34b66f0 [0058.834] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34b8548 [0058.834] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x4) returned 0x34b6790 [0058.834] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34b8528 [0058.834] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b6790, Size=0x8) returned 0x34bf900 [0058.834] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34b87e8 [0058.834] strtol (in: _Str="0,\"thr\":1500,\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"knoocknoo@cock.li\",\"eeeooppaaaxxx@tuta.io\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\", \"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\", \"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft\\\\provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\x09\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\x09\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\x09\"*\\\\program file*\\\\windowspowershell\",\x09\"*\\\\program file*\\\\cuass*\", \x09\"*\\\\program file*\\\\microsoft games\", \"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\x09\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\", \"*media player\",\x09\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\x09\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"]}\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}", _EndPtr=0x98f260, _Radix=0 | out: _EndPtr=0x98f260*=",\"thr\":1500,\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"knoocknoo@cock.li\",\"eeeooppaaaxxx@tuta.io\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\", \"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\", \"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft\\\\provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\x09\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\x09\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\x09\"*\\\\program file*\\\\windowspowershell\",\x09\"*\\\\program file*\\\\cuass*\", \x09\"*\\\\program file*\\\\microsoft games\", \"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\x09\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\", \"*media player\",\x09\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\x09\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"]}\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}") returned 0 [0058.834] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bf900, Size=0xc) returned 0x34b1bf0 [0058.834] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34b8608 [0058.834] strtol (in: _Str="1500,\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"knoocknoo@cock.li\",\"eeeooppaaaxxx@tuta.io\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\", \"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\", \"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft\\\\provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\x09\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\x09\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\x09\"*\\\\program file*\\\\windowspowershell\",\x09\"*\\\\program file*\\\\cuass*\", \x09\"*\\\\program file*\\\\microsoft games\", \"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\x09\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\", \"*media player\",\x09\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\x09\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"]}\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}", _EndPtr=0x98f260, _Radix=0 | out: _EndPtr=0x98f260*=",\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"knoocknoo@cock.li\",\"eeeooppaaaxxx@tuta.io\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\", \"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\", \"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft\\\\provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\x09\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\x09\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\x09\"*\\\\program file*\\\\windowspowershell\",\x09\"*\\\\program file*\\\\cuass*\", \x09\"*\\\\program file*\\\\microsoft games\", \"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\x09\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\", \"*media player\",\x09\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\x09\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"]}\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}") returned 1500 [0058.834] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1bf0, Size=0x10) returned 0x34b1cf8 [0058.834] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34b8568 [0058.835] strtol (in: _Str="51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"knoocknoo@cock.li\",\"eeeooppaaaxxx@tuta.io\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\", \"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\", \"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft\\\\provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\x09\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\x09\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\x09\"*\\\\program file*\\\\windowspowershell\",\x09\"*\\\\program file*\\\\cuass*\", \x09\"*\\\\program file*\\\\microsoft games\", \"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\x09\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\", \"*media player\",\x09\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\x09\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"]}\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}", _EndPtr=0x98f260, _Radix=0 | out: _EndPtr=0x98f260*=",\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"knoocknoo@cock.li\",\"eeeooppaaaxxx@tuta.io\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\", \"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\", \"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft\\\\provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\x09\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\x09\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\x09\"*\\\\program file*\\\\windowspowershell\",\x09\"*\\\\program file*\\\\cuass*\", \x09\"*\\\\program file*\\\\microsoft games\", \"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\x09\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\", \"*media player\",\x09\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\x09\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"]}\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}") returned 51200 [0058.835] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1cf8, Size=0x14) returned 0x34b8668 [0058.835] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34b8768 [0058.835] strtol (in: _Str="8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"knoocknoo@cock.li\",\"eeeooppaaaxxx@tuta.io\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\", \"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\", \"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft\\\\provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\x09\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\x09\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\x09\"*\\\\program file*\\\\windowspowershell\",\x09\"*\\\\program file*\\\\cuass*\", \x09\"*\\\\program file*\\\\microsoft games\", \"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\x09\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\", \"*media player\",\x09\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\x09\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"]}\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}", _EndPtr=0x98f260, _Radix=0 | out: _EndPtr=0x98f260*=",\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"knoocknoo@cock.li\",\"eeeooppaaaxxx@tuta.io\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\", \"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\", \"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft\\\\provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\x09\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\x09\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\x09\"*\\\\program file*\\\\windowspowershell\",\x09\"*\\\\program file*\\\\cuass*\", \x09\"*\\\\program file*\\\\microsoft games\", \"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\x09\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\", \"*media player\",\x09\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\x09\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"]}\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}") returned 8 [0058.835] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b8668, Size=0x18) returned 0x34b8708 [0058.835] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34b8788 [0058.835] strtol (in: _Str="5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"knoocknoo@cock.li\",\"eeeooppaaaxxx@tuta.io\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\", \"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\", \"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft\\\\provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\x09\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\x09\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\x09\"*\\\\program file*\\\\windowspowershell\",\x09\"*\\\\program file*\\\\cuass*\", \x09\"*\\\\program file*\\\\microsoft games\", \"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\x09\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\", \"*media player\",\x09\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\x09\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"]}\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}", _EndPtr=0x98f260, _Radix=0 | out: _EndPtr=0x98f260*=", \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"knoocknoo@cock.li\",\"eeeooppaaaxxx@tuta.io\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:\\\\users\\\\*\\\\*temp\",\"*msocache\",\"*:\\\\winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:\\\\windows\", \"*:\\\\program file*\\\\vmware\",\"\\\\\\\\*\\\\users\\\\*\\\\*temp\", \"\\\\\\\\*\\\\winnt\",\"\\\\\\\\*\\\\windows\",\"*\\\\program file*\\\\vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft\\\\provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*\\\\program file*\\\\windows media*\",\"*\\\\program file*\\\\windows portable*\",\x09\"*windows defender\",\"*\\\\program file*\\\\windows nt\",\x09\"*\\\\program file*\\\\windows photo*\",\"*\\\\program file*\\\\windows side*\",\x09\"*\\\\program file*\\\\windowspowershell\",\x09\"*\\\\program file*\\\\cuass*\", \x09\"*\\\\program file*\\\\microsoft games\", \"*\\\\program file*\\\\common files\\\\system\",\"*\\\\program file*\\\\common files\\\\*shared\",\x09\"*\\\\program file*\\\\common files\\\\reference ass*\",\"*\\\\windows\\\\cache*\",\"*temporary internet*\", \"*media player\",\x09\"*:\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\",\x09\"\\\\\\\\*\\\\users\\\\*\\\\appdata\\\\*\\\\microsoft\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"]}\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}") returned 5 [0058.835] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b8708, Size=0x1c) returned 0x34bbfb8 [0058.835] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34b85a8 [0058.835] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bbfb8, Size=0x20) returned 0x34bc238 [0058.835] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34b85c8 [0058.835] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x4) returned 0x34b6790 [0058.835] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34b8628 [0058.835] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b6790, Size=0x8) returned 0x34bf840 [0058.835] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34b8708 [0058.835] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bc238, Size=0x24) returned 0x34b2360 [0058.835] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34b84a8 [0058.835] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b2360, Size=0x28) returned 0x34b23c0 [0058.835] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34b8668 [0058.835] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b23c0, Size=0x2c) returned 0x34abb40 [0058.835] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34b8808 [0058.835] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x4) returned 0x34bf740 [0058.835] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34b8468 [0058.835] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x4) returned 0x34bf7f0 [0058.835] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34b8488 [0058.835] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bf7f0, Size=0x8) returned 0x34bf8e0 [0058.835] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34b8688 [0058.835] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bf8e0, Size=0xc) returned 0x34b1d70 [0058.835] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34b86a8 [0058.835] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1d70, Size=0x10) returned 0x34b1bf0 [0058.835] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34b87a8 [0058.836] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1bf0, Size=0x14) returned 0x34b8748 [0058.836] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34b84e8 [0058.836] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b8748, Size=0x18) returned 0x34b86c8 [0058.836] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34b86e8 [0058.836] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b86c8, Size=0x1c) returned 0x34bbfb8 [0058.836] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34b86c8 [0058.836] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bbfb8, Size=0x20) returned 0x34bc030 [0058.836] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34b8748 [0058.836] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bc030, Size=0x24) returned 0x34b2270 [0058.836] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2198 [0058.836] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b2270, Size=0x28) returned 0x34b22d0 [0058.836] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c21b8 [0058.836] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b22d0, Size=0x2c) returned 0x34abb78 [0058.836] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c20d8 [0058.836] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34abb78, Size=0x30) returned 0x34ab670 [0058.836] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2018 [0058.836] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34ab670, Size=0x34) returned 0x34be5f8 [0058.836] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2278 [0058.836] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34be5f8, Size=0x38) returned 0x34beab8 [0058.836] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2298 [0058.836] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34beab8, Size=0x3c) returned 0x34c3550 [0058.837] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c21d8 [0058.837] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34c3550, Size=0x40) returned 0x34c31a8 [0058.837] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c22b8 [0058.837] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34c31a8, Size=0x44) returned 0x34b2ae8 [0058.837] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2178 [0058.837] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b2ae8, Size=0x48) returned 0x34b28b8 [0058.837] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c1f78 [0058.837] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b28b8, Size=0x4c) returned 0x34acd38 [0058.837] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c21f8 [0058.837] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34acd38, Size=0x50) returned 0x34acd38 [0058.837] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2218 [0058.837] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34acd38, Size=0x54) returned 0x34acd38 [0058.838] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2238 [0058.838] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34acd38, Size=0x58) returned 0x34acd38 [0058.838] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2258 [0058.838] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34acd38, Size=0x5c) returned 0x34acd38 [0058.838] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c22d8 [0058.838] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34acd38, Size=0x60) returned 0x34acd38 [0058.838] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c22f8 [0058.838] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34acd38, Size=0x64) returned 0x34a3eb8 [0058.838] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2158 [0058.838] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a3eb8, Size=0x68) returned 0x34a3eb8 [0058.838] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2318 [0058.838] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a3eb8, Size=0x6c) returned 0x34a49b8 [0058.838] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c1f58 [0058.838] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a49b8, Size=0x70) returned 0x34a49b8 [0058.838] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c1f38 [0058.838] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a49b8, Size=0x74) returned 0x34af378 [0058.838] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c1f98 [0058.838] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34af378, Size=0x78) returned 0x34af378 [0058.838] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2138 [0058.838] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34af378, Size=0x7c) returned 0x34a45b8 [0058.838] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c1fb8 [0058.838] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a45b8, Size=0x80) returned 0x34a45b8 [0058.838] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2078 [0058.838] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a45b8, Size=0x84) returned 0x34a45b8 [0058.838] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c1fd8 [0058.838] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a45b8, Size=0x88) returned 0x34a45b8 [0058.838] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2098 [0058.838] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a45b8, Size=0x8c) returned 0x34ac508 [0058.838] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c1ff8 [0058.838] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34ac508, Size=0x90) returned 0x34ac508 [0058.838] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2038 [0058.838] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34ac508, Size=0x94) returned 0x34af440 [0058.838] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2058 [0058.838] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34af440, Size=0x98) returned 0x34af440 [0058.838] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c20b8 [0058.838] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34af440, Size=0x9c) returned 0x34bf918 [0058.838] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c20f8 [0058.838] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bf740, Size=0x8) returned 0x34bf750 [0058.838] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2118 [0058.838] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x4) returned 0x34bf850 [0058.839] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2398 [0058.839] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bf850, Size=0x8) returned 0x34bf8d0 [0058.839] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2478 [0058.839] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bf8d0, Size=0xc) returned 0x34b1a88 [0058.839] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2638 [0058.839] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1a88, Size=0x10) returned 0x34b1aa0 [0058.839] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2538 [0058.839] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1aa0, Size=0x14) returned 0x34c2338 [0058.839] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c26d8 [0058.839] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34c2338, Size=0x18) returned 0x34c24b8 [0058.839] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2598 [0058.839] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34c24b8, Size=0x1c) returned 0x34bbfb8 [0058.839] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2358 [0058.839] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bbfb8, Size=0x20) returned 0x34bc030 [0058.839] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2378 [0058.839] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bc030, Size=0x24) returned 0x34b22d0 [0058.839] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c26b8 [0058.839] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b22d0, Size=0x28) returned 0x34b2270 [0058.839] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c23b8 [0058.839] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b2270, Size=0x2c) returned 0x34abb78 [0058.839] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c25b8 [0058.839] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34abb78, Size=0x30) returned 0x34abbb0 [0058.839] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2498 [0058.839] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34abbb0, Size=0x34) returned 0x34be578 [0058.839] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c23d8 [0058.839] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34be578, Size=0x38) returned 0x34be678 [0058.839] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2418 [0058.839] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34be678, Size=0x3c) returned 0x34c3628 [0058.839] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c24b8 [0058.839] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34c3628, Size=0x40) returned 0x34c3670 [0058.839] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c23f8 [0058.839] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bf750, Size=0xc) returned 0x34b1b90 [0058.839] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c24d8 [0058.839] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x4) returned 0x34bf8c0 [0058.839] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c25d8 [0058.839] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bf8c0, Size=0x8) returned 0x34bf8d0 [0058.839] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2518 [0058.839] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bf8d0, Size=0xc) returned 0x34b1c20 [0058.839] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2438 [0058.839] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1c20, Size=0x10) returned 0x34b1c38 [0058.839] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2618 [0058.840] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1c38, Size=0x14) returned 0x34c2458 [0058.840] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c24f8 [0058.840] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34c2458, Size=0x18) returned 0x34c2338 [0058.840] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2698 [0058.840] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34c2338, Size=0x1c) returned 0x34bc238 [0058.840] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2458 [0058.840] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bc238, Size=0x20) returned 0x34bbfb8 [0058.840] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2558 [0058.840] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bbfb8, Size=0x24) returned 0x34b2360 [0058.840] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2578 [0058.840] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b2360, Size=0x28) returned 0x34b2270 [0058.840] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2338 [0058.840] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b2270, Size=0x2c) returned 0x34abb78 [0058.840] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c25f8 [0058.840] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34abb78, Size=0x30) returned 0x34abbb0 [0058.840] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2678 [0058.840] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34abbb0, Size=0x34) returned 0x34be978 [0058.840] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c2658 [0058.840] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34be978, Size=0x38) returned 0x34be678 [0058.840] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c41e8 [0058.840] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34be678, Size=0x3c) returned 0x34c3280 [0058.840] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3f68 [0058.840] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34c3280, Size=0x40) returned 0x34c31a8 [0058.840] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c41c8 [0058.840] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34c31a8, Size=0x44) returned 0x34b28b8 [0058.840] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3fc8 [0058.840] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b28b8, Size=0x48) returned 0x34b2958 [0058.840] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4168 [0058.840] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b2958, Size=0x4c) returned 0x34acd38 [0058.840] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4188 [0058.840] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34acd38, Size=0x50) returned 0x34acd38 [0058.840] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c42c8 [0058.840] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34acd38, Size=0x54) returned 0x34acd38 [0058.840] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4208 [0058.840] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34acd38, Size=0x58) returned 0x34acd38 [0058.840] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3f48 [0058.840] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34acd38, Size=0x5c) returned 0x34acd38 [0058.840] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4248 [0058.841] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34acd38, Size=0x60) returned 0x34acd38 [0058.841] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4068 [0058.841] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34acd38, Size=0x64) returned 0x34a3eb8 [0058.841] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3fe8 [0058.841] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a3eb8, Size=0x68) returned 0x34a3eb8 [0058.841] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4268 [0058.841] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a3eb8, Size=0x6c) returned 0x34a49b8 [0058.841] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4008 [0058.841] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a49b8, Size=0x70) returned 0x34a49b8 [0058.841] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4228 [0058.841] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a49b8, Size=0x74) returned 0x34af378 [0058.841] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4028 [0058.841] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34af378, Size=0x78) returned 0x34af378 [0058.841] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3f88 [0058.841] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34af378, Size=0x7c) returned 0x34a45b8 [0058.841] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3fa8 [0058.841] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a45b8, Size=0x80) returned 0x34a45b8 [0058.841] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4288 [0058.841] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a45b8, Size=0x84) returned 0x34a45b8 [0058.841] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4088 [0058.841] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a45b8, Size=0x88) returned 0x34a45b8 [0058.841] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c40c8 [0058.841] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a45b8, Size=0x8c) returned 0x34ac508 [0058.841] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c41a8 [0058.841] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34ac508, Size=0x90) returned 0x34ac508 [0058.841] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4048 [0058.841] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34ac508, Size=0x94) returned 0x34af440 [0058.841] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c40a8 [0058.841] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34af440, Size=0x98) returned 0x34af440 [0058.841] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c40e8 [0058.841] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34af440, Size=0x9c) returned 0x34aa508 [0058.841] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4128 [0058.841] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34aa508, Size=0xa0) returned 0x34aa508 [0058.841] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c42a8 [0058.841] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34aa508, Size=0xa4) returned 0x34a3c10 [0058.841] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c42e8 [0058.841] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a3c10, Size=0xa8) returned 0x34a3c10 [0058.841] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4108 [0058.841] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a3c10, Size=0xac) returned 0x34b0cf0 [0058.841] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4148 [0058.842] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b0cf0, Size=0xb0) returned 0x34b0cf0 [0058.842] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3ea8 [0058.842] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b0cf0, Size=0xb4) returned 0x34a3a00 [0058.842] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3b48 [0058.842] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a3a00, Size=0xb8) returned 0x34a3a00 [0058.842] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3f08 [0058.842] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a3a00, Size=0xbc) returned 0x34a3a00 [0058.842] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3b88 [0058.842] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a3a00, Size=0xc0) returned 0x34a3a00 [0058.842] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3ba8 [0058.842] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a3a00, Size=0xc4) returned 0x34a3a00 [0058.842] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3d28 [0058.842] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a3a00, Size=0xc8) returned 0x34a3a00 [0058.842] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3d08 [0058.842] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a3a00, Size=0xcc) returned 0x34a3a00 [0058.842] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3bc8 [0058.842] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a3a00, Size=0xd0) returned 0x34a3a00 [0058.842] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3c68 [0058.842] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34abb40, Size=0x30) returned 0x34ab670 [0058.842] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3ce8 [0058.842] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x4) returned 0x34bf820 [0058.842] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3cc8 [0058.842] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bf820, Size=0x8) returned 0x34bf7a0 [0058.842] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3c88 [0058.842] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x4) returned 0x34bf890 [0058.842] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3d88 [0058.842] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bf890, Size=0x8) returned 0x34bf900 [0058.842] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3c48 [0058.842] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bf900, Size=0xc) returned 0x34b1cf8 [0058.842] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3d68 [0058.842] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1cf8, Size=0x10) returned 0x34b1d28 [0058.842] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3de8 [0058.842] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1d28, Size=0x14) returned 0x34c3d48 [0058.842] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3da8 [0058.842] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34c3d48, Size=0x18) returned 0x34c3e28 [0058.842] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3d48 [0058.842] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34c3e28, Size=0x1c) returned 0x34bc238 [0058.843] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3be8 [0058.843] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bc238, Size=0x20) returned 0x34bc058 [0058.843] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3ec8 [0058.843] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bc058, Size=0x24) returned 0x34b23c0 [0058.843] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3ee8 [0058.843] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b23c0, Size=0x28) returned 0x34b23f0 [0058.843] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3b68 [0058.843] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b23f0, Size=0x2c) returned 0x34abb40 [0058.843] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3dc8 [0058.843] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34abb40, Size=0x30) returned 0x34abb78 [0058.843] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3e48 [0058.843] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34abb78, Size=0x34) returned 0x34bebf8 [0058.843] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3e08 [0058.843] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bebf8, Size=0x38) returned 0x34be878 [0058.843] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3ca8 [0058.843] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34be878, Size=0x3c) returned 0x34c35e0 [0058.843] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3e28 [0058.843] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34c35e0, Size=0x40) returned 0x34c3550 [0058.843] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3c08 [0058.843] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34c3550, Size=0x44) returned 0x34b27c8 [0058.843] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3f28 [0058.843] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b27c8, Size=0x48) returned 0x34b2958 [0058.843] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3e68 [0058.843] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b2958, Size=0x4c) returned 0x34acd38 [0058.843] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3e88 [0058.843] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34acd38, Size=0x50) returned 0x34acd38 [0058.843] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c3c28 [0058.843] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34acd38, Size=0x54) returned 0x34acd38 [0058.843] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4ab0 [0058.843] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34acd38, Size=0x58) returned 0x34acd38 [0058.843] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4830 [0058.843] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34acd38, Size=0x5c) returned 0x34acd38 [0058.843] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4850 [0058.843] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34acd38, Size=0x60) returned 0x34acd38 [0058.843] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4950 [0058.843] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34acd38, Size=0x64) returned 0x34a3eb8 [0058.843] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4870 [0058.843] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a3eb8, Size=0x68) returned 0x34a3eb8 [0058.844] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4a50 [0058.844] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a3eb8, Size=0x6c) returned 0x34a49b8 [0058.844] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c48b0 [0058.844] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a49b8, Size=0x70) returned 0x34a49b8 [0058.844] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4990 [0058.844] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a49b8, Size=0x74) returned 0x34af378 [0058.844] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4a90 [0058.844] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34af378, Size=0x78) returned 0x34af378 [0058.844] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c47b0 [0058.844] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34af378, Size=0x7c) returned 0x34a45b8 [0058.844] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4af0 [0058.844] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a45b8, Size=0x80) returned 0x34a45b8 [0058.844] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4750 [0058.844] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a45b8, Size=0x84) returned 0x34a45b8 [0058.844] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4ad0 [0058.844] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a45b8, Size=0x88) returned 0x34a45b8 [0058.844] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4910 [0058.844] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a45b8, Size=0x8c) returned 0x34ac508 [0058.844] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4930 [0058.844] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34ac508, Size=0x90) returned 0x34ac508 [0058.844] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c49d0 [0058.844] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34ac508, Size=0x94) returned 0x34af440 [0058.844] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4890 [0058.844] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34af440, Size=0x98) returned 0x34af440 [0058.844] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4970 [0058.844] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34af440, Size=0x9c) returned 0x34aa508 [0058.844] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4a70 [0058.844] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34aa508, Size=0xa0) returned 0x34aa508 [0058.844] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4a10 [0058.844] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34aa508, Size=0xa4) returned 0x34a3c10 [0058.844] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4770 [0058.844] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a3c10, Size=0xa8) returned 0x34a3c10 [0058.844] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4790 [0058.844] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a3c10, Size=0xac) returned 0x34b0cf0 [0058.844] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c48f0 [0058.844] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b0cf0, Size=0xb0) returned 0x34b0cf0 [0058.844] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c49b0 [0058.845] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b0cf0, Size=0xb4) returned 0x34b1960 [0058.845] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c49f0 [0058.845] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1960, Size=0xb8) returned 0x34b1960 [0058.845] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4a30 [0058.845] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1960, Size=0xbc) returned 0x34b1960 [0058.845] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c47d0 [0058.845] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1960, Size=0xc0) returned 0x34b1960 [0058.845] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c47f0 [0058.845] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1960, Size=0xc4) returned 0x34b1960 [0058.845] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4810 [0058.845] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1960, Size=0xc8) returned 0x34b1960 [0058.845] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c48d0 [0058.845] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1960, Size=0xcc) returned 0x34b1960 [0058.845] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c45f0 [0058.845] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1960, Size=0xd0) returned 0x34b1960 [0058.845] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4470 [0058.845] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1960, Size=0xd4) returned 0x34b1960 [0058.845] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4390 [0058.845] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1960, Size=0xd8) returned 0x34b1960 [0058.845] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4490 [0058.845] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1960, Size=0xdc) returned 0x34b1960 [0058.845] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4570 [0058.845] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1960, Size=0xe0) returned 0x34b1960 [0058.845] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4370 [0058.845] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1960, Size=0xe4) returned 0x34b1960 [0058.845] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c46f0 [0058.845] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1960, Size=0xe8) returned 0x34b1960 [0058.845] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c43b0 [0058.845] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1960, Size=0xec) returned 0x34b1960 [0058.845] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c46d0 [0058.845] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1960, Size=0xf0) returned 0x34b1960 [0058.845] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c44b0 [0058.845] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1960, Size=0xf4) returned 0x34a9bb8 [0058.845] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4730 [0058.845] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a9bb8, Size=0xf8) returned 0x34a9bb8 [0058.845] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4710 [0058.845] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a9bb8, Size=0xfc) returned 0x34a9bb8 [0058.846] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4450 [0058.846] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a9bb8, Size=0x100) returned 0x34a9bb8 [0058.846] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4350 [0058.846] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a9bb8, Size=0x104) returned 0x34a9bb8 [0058.846] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c43d0 [0058.846] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a9bb8, Size=0x108) returned 0x34a9bb8 [0058.846] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4510 [0058.846] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bf7a0, Size=0xc) returned 0x34b1cf8 [0058.846] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4590 [0058.846] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x4) returned 0x34bf8b0 [0058.846] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c45b0 [0058.846] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bf8b0, Size=0x8) returned 0x34bf800 [0058.846] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c43f0 [0058.846] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bf800, Size=0xc) returned 0x34b1b60 [0058.846] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c45d0 [0058.846] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1b60, Size=0x10) returned 0x34b1ad0 [0058.846] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4410 [0058.846] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1ad0, Size=0x14) returned 0x34c4430 [0058.846] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4630 [0058.846] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34c4430, Size=0x18) returned 0x34c4610 [0058.846] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4650 [0058.846] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34c4610, Size=0x1c) returned 0x34bc238 [0058.846] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c44d0 [0058.846] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bc238, Size=0x20) returned 0x34bbfb8 [0058.846] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4430 [0058.846] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bbfb8, Size=0x24) returned 0x34b2330 [0058.846] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c44f0 [0058.846] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b2330, Size=0x28) returned 0x34b2270 [0058.846] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4610 [0058.846] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b2270, Size=0x2c) returned 0x34abb40 [0058.846] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4530 [0058.846] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34abb40, Size=0x30) returned 0x34abb78 [0058.846] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4670 [0058.846] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34abb78, Size=0x34) returned 0x34bea38 [0058.846] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4550 [0058.846] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bea38, Size=0x38) returned 0x34bebb8 [0058.847] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4690 [0058.847] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bebb8, Size=0x3c) returned 0x34c3430 [0058.847] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c46b0 [0058.847] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34c3430, Size=0x40) returned 0x34c3088 [0058.847] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4fb8 [0058.847] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34c3088, Size=0x44) returned 0x34b28b8 [0058.847] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4f58 [0058.847] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b28b8, Size=0x48) returned 0x34b2688 [0058.847] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4f98 [0058.847] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b2688, Size=0x4c) returned 0x34acd38 [0058.847] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c5278 [0058.847] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34acd38, Size=0x50) returned 0x34acd38 [0058.847] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4fd8 [0058.847] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34acd38, Size=0x54) returned 0x34acd38 [0058.847] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4f78 [0058.847] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34acd38, Size=0x58) returned 0x34acd38 [0058.847] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c5038 [0058.847] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34acd38, Size=0x5c) returned 0x34acd38 [0058.847] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c51d8 [0058.847] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34acd38, Size=0x60) returned 0x34acd38 [0058.847] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c4ff8 [0058.847] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34acd38, Size=0x64) returned 0x34a3eb8 [0058.847] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c5138 [0058.847] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a3eb8, Size=0x68) returned 0x34a3eb8 [0058.847] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c51f8 [0058.847] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a3eb8, Size=0x6c) returned 0x34a49b8 [0058.847] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c5158 [0058.847] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a49b8, Size=0x70) returned 0x34a49b8 [0058.848] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c5078 [0058.848] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a49b8, Size=0x74) returned 0x34af378 [0058.848] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c50d8 [0058.848] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34af378, Size=0x78) returned 0x34af378 [0058.848] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c5098 [0058.848] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34af378, Size=0x7c) returned 0x34a45b8 [0058.848] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c5058 [0058.848] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a45b8, Size=0x80) returned 0x34a45b8 [0058.848] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c5018 [0058.848] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a45b8, Size=0x84) returned 0x34a45b8 [0058.848] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c50b8 [0058.848] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a45b8, Size=0x88) returned 0x34a45b8 [0058.848] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c50f8 [0058.848] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34a45b8, Size=0x8c) returned 0x34ac508 [0058.848] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c5118 [0058.848] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34ac508, Size=0x90) returned 0x34ac508 [0058.848] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c5218 [0058.848] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1cf8, Size=0x10) returned 0x34b1d28 [0058.848] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c52b8 [0058.848] strtol (in: _Str="30,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}", _EndPtr=0x98f23c, _Radix=0 | out: _EndPtr=0x98f23c*=",\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\"back\"]}\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"] }}\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:\\\\windows*\",\"*:\\\\winnt*\",\"*:\\\\program file*\\\\vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"] }}}") returned 30 [0058.848] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1d28, Size=0x14) returned 0x34c5178 [0058.848] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c5198 [0058.848] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x4) returned 0x34bf740 [0058.848] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34c51b8 [0058.848] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bf740, Size=0x8) returned 0x34bf750 [0058.848] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bf750, Size=0xc) returned 0x34b1bf0 [0058.848] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1bf0, Size=0x10) returned 0x34b1cf8 [0058.848] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34b1cf8, Size=0x14) returned 0x34c5298 [0058.848] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34ab670, Size=0x34) returned 0x34be5f8 [0058.848] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bf900, Size=0x8) returned 0x34bf760 [0058.848] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bf870, Size=0x8) returned 0x34bf750 [0058.848] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bf750, Size=0xc) returned 0x34b1bf0 [0058.848] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bf850, Size=0x8) returned 0x34bf8d0 [0058.849] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34be5f8, Size=0x38) returned 0x34bec38 [0058.849] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bf7e0, Size=0x8) returned 0x34bf8c0 [0058.849] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bf8e0, Size=0x8) returned 0x34bf820 [0058.849] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bf830, Size=0x8) returned 0x34bf790 [0058.849] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bf790, Size=0xc) returned 0x34b1d70 [0058.849] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bf820, Size=0xc) returned 0x34b1c20 [0058.849] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34bf890, Size=0x8) returned 0x34bf7b0 [0058.849] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34b66f0) returned 1 [0058.849] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34b8828) returned 1 [0058.851] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="ntuser.dat*" | out: DestinationString="ntuser.dat*") [0058.851] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="ntuser.dat*", AllocateDestinationString=1 | out: DestinationString="ntuser.dat*") returned 0x0 [0058.851] RtlFreeAnsiString (AnsiString="n") [0058.851] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="iconcache.db" | out: DestinationString="iconcache.db") [0058.852] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="iconcache.db", AllocateDestinationString=1 | out: DestinationString="iconcache.db") returned 0x0 [0058.852] RtlFreeAnsiString (AnsiString="i") [0058.852] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="gdipfont*.dat" | out: DestinationString="gdipfont*.dat") [0058.852] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="gdipfont*.dat", AllocateDestinationString=1 | out: DestinationString="gdipfont*.dat") returned 0x0 [0058.852] RtlFreeAnsiString (AnsiString="g") [0058.852] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="ntuser.ini" | out: DestinationString="ntuser.ini") [0058.852] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="ntuser.ini", AllocateDestinationString=1 | out: DestinationString="ntuser.ini") returned 0x0 [0058.852] RtlFreeAnsiString (AnsiString="n") [0058.852] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="usrclass.dat" | out: DestinationString="usrclass.dat") [0058.852] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="usrclass.dat", AllocateDestinationString=1 | out: DestinationString="usrclass.dat") returned 0x0 [0058.852] RtlFreeAnsiString (AnsiString="u") [0058.852] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="usrclass.dat*" | out: DestinationString="usrclass.dat*") [0058.852] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="usrclass.dat*", AllocateDestinationString=1 | out: DestinationString="usrclass.dat*") returned 0x0 [0058.852] RtlFreeAnsiString (AnsiString="u") [0058.852] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="boot.ini" | out: DestinationString="boot.ini") [0058.852] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="boot.ini", AllocateDestinationString=1 | out: DestinationString="boot.ini") returned 0x0 [0058.852] RtlFreeAnsiString (AnsiString="b") [0058.852] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="bootmgr" | out: DestinationString="bootmgr") [0058.852] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="bootmgr", AllocateDestinationString=1 | out: DestinationString="bootmgr") returned 0x0 [0058.852] RtlFreeAnsiString (AnsiString="b") [0058.852] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="bootnxt" | out: DestinationString="bootnxt") [0058.852] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="bootnxt", AllocateDestinationString=1 | out: DestinationString="bootnxt") returned 0x0 [0058.852] RtlFreeAnsiString (AnsiString="b") [0058.852] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="desktop.ini" | out: DestinationString="desktop.ini") [0058.852] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="desktop.ini", AllocateDestinationString=1 | out: DestinationString="desktop.ini") returned 0x0 [0058.852] RtlFreeAnsiString (AnsiString="d") [0058.852] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="ntuser.dat" | out: DestinationString="ntuser.dat") [0058.853] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="ntuser.dat", AllocateDestinationString=1 | out: DestinationString="ntuser.dat") returned 0x0 [0058.853] RtlFreeAnsiString (AnsiString="n") [0058.853] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="autorun.inf" | out: DestinationString="autorun.inf") [0058.853] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="autorun.inf", AllocateDestinationString=1 | out: DestinationString="autorun.inf") returned 0x0 [0058.853] RtlFreeAnsiString (AnsiString="a") [0058.853] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="ntldr" | out: DestinationString="ntldr") [0058.853] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="ntldr", AllocateDestinationString=1 | out: DestinationString="ntldr") returned 0x0 [0058.853] RtlFreeAnsiString (AnsiString="n") [0058.853] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="thumbs.db" | out: DestinationString="thumbs.db") [0058.853] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="thumbs.db", AllocateDestinationString=1 | out: DestinationString="thumbs.db") returned 0x0 [0058.853] RtlFreeAnsiString (AnsiString="t") [0058.853] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="bootsect.bak" | out: DestinationString="bootsect.bak") [0058.853] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="bootsect.bak", AllocateDestinationString=1 | out: DestinationString="bootsect.bak") returned 0x0 [0058.853] RtlFreeAnsiString (AnsiString="b") [0058.853] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="bootfont.bin" | out: DestinationString="bootfont.bin") [0058.853] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="bootfont.bin", AllocateDestinationString=1 | out: DestinationString="bootfont.bin") returned 0x0 [0058.853] RtlFreeAnsiString (AnsiString="b") [0058.853] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*system volume information" | out: DestinationString="*system volume information") [0058.853] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*system volume information", AllocateDestinationString=1 | out: DestinationString="*system volume information") returned 0x0 [0058.854] RtlFreeAnsiString (AnsiString="*") [0058.854] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*windows.old" | out: DestinationString="*windows.old") [0058.854] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*windows.old", AllocateDestinationString=1 | out: DestinationString="*windows.old") returned 0x0 [0058.854] RtlFreeAnsiString (AnsiString="*") [0058.854] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*:\\users\\*\\*temp" | out: DestinationString="*:\\users\\*\\*temp") [0058.854] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*:\\users\\*\\*temp", AllocateDestinationString=1 | out: DestinationString="*:\\users\\*\\*temp") returned 0x0 [0058.854] RtlFreeAnsiString (AnsiString="*") [0058.854] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*msocache" | out: DestinationString="*msocache") [0058.854] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*msocache", AllocateDestinationString=1 | out: DestinationString="*msocache") returned 0x0 [0058.854] RtlFreeAnsiString (AnsiString="*") [0058.854] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*:\\winnt" | out: DestinationString="*:\\winnt") [0058.854] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*:\\winnt", AllocateDestinationString=1 | out: DestinationString="*:\\winnt") returned 0x0 [0058.854] RtlFreeAnsiString (AnsiString="*") [0058.854] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*$windows.~ws" | out: DestinationString="*$windows.~ws") [0058.854] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*$windows.~ws", AllocateDestinationString=1 | out: DestinationString="*$windows.~ws") returned 0x0 [0058.854] RtlFreeAnsiString (AnsiString="*") [0058.854] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*perflogs" | out: DestinationString="*perflogs") [0058.854] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*perflogs", AllocateDestinationString=1 | out: DestinationString="*perflogs") returned 0x0 [0058.854] RtlFreeAnsiString (AnsiString="*") [0058.854] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*boot" | out: DestinationString="*boot") [0058.854] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*boot", AllocateDestinationString=1 | out: DestinationString="*boot") returned 0x0 [0058.854] RtlFreeAnsiString (AnsiString="*") [0058.854] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*:\\windows" | out: DestinationString="*:\\windows") [0058.854] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*:\\windows", AllocateDestinationString=1 | out: DestinationString="*:\\windows") returned 0x0 [0058.854] RtlFreeAnsiString (AnsiString="*") [0058.854] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*:\\program file*\\vmware" | out: DestinationString="*:\\program file*\\vmware") [0058.854] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*:\\program file*\\vmware", AllocateDestinationString=1 | out: DestinationString="*:\\program file*\\vmware") returned 0x0 [0058.854] RtlFreeAnsiString (AnsiString="*") [0058.854] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="\\\\*\\users\\*\\*temp" | out: DestinationString="\\\\*\\users\\*\\*temp") [0058.854] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="\\\\*\\users\\*\\*temp", AllocateDestinationString=1 | out: DestinationString="\\\\*\\users\\*\\*temp") returned 0x0 [0058.855] RtlFreeAnsiString (AnsiString="\\") [0058.855] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="\\\\*\\winnt" | out: DestinationString="\\\\*\\winnt") [0058.855] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="\\\\*\\winnt", AllocateDestinationString=1 | out: DestinationString="\\\\*\\winnt") returned 0x0 [0058.855] RtlFreeAnsiString (AnsiString="\\") [0058.855] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="\\\\*\\windows" | out: DestinationString="\\\\*\\windows") [0058.855] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="\\\\*\\windows", AllocateDestinationString=1 | out: DestinationString="\\\\*\\windows") returned 0x0 [0058.855] RtlFreeAnsiString (AnsiString="\\") [0058.855] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*\\program file*\\vmware" | out: DestinationString="*\\program file*\\vmware") [0058.855] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*\\program file*\\vmware", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\vmware") returned 0x0 [0058.855] RtlFreeAnsiString (AnsiString="*") [0058.855] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*appdata*microsoft" | out: DestinationString="*appdata*microsoft") [0058.855] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*appdata*microsoft", AllocateDestinationString=1 | out: DestinationString="*appdata*microsoft") returned 0x0 [0058.855] RtlFreeAnsiString (AnsiString="*") [0058.855] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*appdata*packages" | out: DestinationString="*appdata*packages") [0058.855] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*appdata*packages", AllocateDestinationString=1 | out: DestinationString="*appdata*packages") returned 0x0 [0058.855] RtlFreeAnsiString (AnsiString="*") [0058.855] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*microsoft\\provisioning" | out: DestinationString="*microsoft\\provisioning") [0058.855] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*microsoft\\provisioning", AllocateDestinationString=1 | out: DestinationString="*microsoft\\provisioning") returned 0x0 [0058.855] RtlFreeAnsiString (AnsiString="*") [0058.855] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*dvd maker" | out: DestinationString="*dvd maker") [0058.855] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*dvd maker", AllocateDestinationString=1 | out: DestinationString="*dvd maker") returned 0x0 [0058.855] RtlFreeAnsiString (AnsiString="*") [0058.855] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*Internet Explorer" | out: DestinationString="*Internet Explorer") [0058.855] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*Internet Explorer", AllocateDestinationString=1 | out: DestinationString="*Internet Explorer") returned 0x0 [0058.855] RtlFreeAnsiString (AnsiString="*") [0058.855] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*Mozilla" | out: DestinationString="*Mozilla") [0058.855] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*Mozilla", AllocateDestinationString=1 | out: DestinationString="*Mozilla") returned 0x0 [0058.855] RtlFreeAnsiString (AnsiString="*") [0058.855] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*Mozilla*" | out: DestinationString="*Mozilla*") [0058.855] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*Mozilla*", AllocateDestinationString=1 | out: DestinationString="*Mozilla*") returned 0x0 [0058.855] RtlFreeAnsiString (AnsiString="*") [0058.855] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*Old Firefox data" | out: DestinationString="*Old Firefox data") [0058.856] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*Old Firefox data", AllocateDestinationString=1 | out: DestinationString="*Old Firefox data") returned 0x0 [0058.856] RtlFreeAnsiString (AnsiString="*") [0058.856] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*\\program file*\\windows media*" | out: DestinationString="*\\program file*\\windows media*") [0058.856] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*\\program file*\\windows media*", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\windows media*") returned 0x0 [0058.856] RtlFreeAnsiString (AnsiString="*") [0058.856] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*\\program file*\\windows portable*" | out: DestinationString="*\\program file*\\windows portable*") [0058.856] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*\\program file*\\windows portable*", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\windows portable*") returned 0x0 [0058.856] RtlFreeAnsiString (AnsiString="*") [0058.856] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*windows defender" | out: DestinationString="*windows defender") [0058.856] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*windows defender", AllocateDestinationString=1 | out: DestinationString="*windows defender") returned 0x0 [0058.856] RtlFreeAnsiString (AnsiString="*") [0058.856] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*\\program file*\\windows nt" | out: DestinationString="*\\program file*\\windows nt") [0058.856] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*\\program file*\\windows nt", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\windows nt") returned 0x0 [0058.856] RtlFreeAnsiString (AnsiString="*") [0058.856] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*\\program file*\\windows photo*" | out: DestinationString="*\\program file*\\windows photo*") [0058.856] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*\\program file*\\windows photo*", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\windows photo*") returned 0x0 [0058.856] RtlFreeAnsiString (AnsiString="*") [0058.856] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*\\program file*\\windows side*" | out: DestinationString="*\\program file*\\windows side*") [0058.856] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*\\program file*\\windows side*", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\windows side*") returned 0x0 [0058.856] RtlFreeAnsiString (AnsiString="*") [0058.856] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*\\program file*\\windowspowershell" | out: DestinationString="*\\program file*\\windowspowershell") [0058.856] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*\\program file*\\windowspowershell", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\windowspowershell") returned 0x0 [0058.856] RtlFreeAnsiString (AnsiString="*") [0058.856] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*\\program file*\\cuass*" | out: DestinationString="*\\program file*\\cuass*") [0058.856] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*\\program file*\\cuass*", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\cuass*") returned 0x0 [0058.856] RtlFreeAnsiString (AnsiString="*") [0058.856] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*\\program file*\\microsoft games" | out: DestinationString="*\\program file*\\microsoft games") [0058.856] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*\\program file*\\microsoft games", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\microsoft games") returned 0x0 [0058.857] RtlFreeAnsiString (AnsiString="*") [0058.857] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*\\program file*\\common files\\system" | out: DestinationString="*\\program file*\\common files\\system") [0058.857] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*\\program file*\\common files\\system", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\common files\\system") returned 0x0 [0058.857] RtlFreeAnsiString (AnsiString="*") [0058.857] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*\\program file*\\common files\\*shared" | out: DestinationString="*\\program file*\\common files\\*shared") [0058.857] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*\\program file*\\common files\\*shared", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\common files\\*shared") returned 0x0 [0058.857] RtlFreeAnsiString (AnsiString="*") [0058.857] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*\\program file*\\common files\\reference ass*" | out: DestinationString="*\\program file*\\common files\\reference ass*") [0058.857] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*\\program file*\\common files\\reference ass*", AllocateDestinationString=1 | out: DestinationString="*\\program file*\\common files\\reference ass*") returned 0x0 [0058.857] RtlFreeAnsiString (AnsiString="*") [0058.857] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*\\windows\\cache*" | out: DestinationString="*\\windows\\cache*") [0058.857] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*\\windows\\cache*", AllocateDestinationString=1 | out: DestinationString="*\\windows\\cache*") returned 0x0 [0058.857] RtlFreeAnsiString (AnsiString="*") [0058.857] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*temporary internet*" | out: DestinationString="*temporary internet*") [0058.857] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*temporary internet*", AllocateDestinationString=1 | out: DestinationString="*temporary internet*") returned 0x0 [0058.857] RtlFreeAnsiString (AnsiString="*") [0058.857] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*media player" | out: DestinationString="*media player") [0058.857] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*media player", AllocateDestinationString=1 | out: DestinationString="*media player") returned 0x0 [0058.857] RtlFreeAnsiString (AnsiString="*") [0058.857] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*:\\users\\*\\appdata\\*\\microsoft" | out: DestinationString="*:\\users\\*\\appdata\\*\\microsoft") [0058.857] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*:\\users\\*\\appdata\\*\\microsoft", AllocateDestinationString=1 | out: DestinationString="*:\\users\\*\\appdata\\*\\microsoft") returned 0x0 [0058.857] RtlFreeAnsiString (AnsiString="*") [0058.857] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="\\\\*\\users\\*\\appdata\\*\\microsoft" | out: DestinationString="\\\\*\\users\\*\\appdata\\*\\microsoft") [0058.857] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="\\\\*\\users\\*\\appdata\\*\\microsoft", AllocateDestinationString=1 | out: DestinationString="\\\\*\\users\\*\\appdata\\*\\microsoft") returned 0x0 [0058.857] RtlFreeAnsiString (AnsiString="\\") [0058.857] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="msp" | out: DestinationString="msp") [0058.857] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="msp", AllocateDestinationString=1 | out: DestinationString="msp") returned 0x0 [0058.857] RtlFreeAnsiString (AnsiString="m") [0058.857] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="exe" | out: DestinationString="exe") [0058.857] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="exe", AllocateDestinationString=1 | out: DestinationString="exe") returned 0x0 [0058.857] RtlFreeAnsiString (AnsiString="e") [0058.858] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="sys" | out: DestinationString="sys") [0058.858] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="sys", AllocateDestinationString=1 | out: DestinationString="sys") returned 0x0 [0058.858] RtlFreeAnsiString (AnsiString="s") [0058.858] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="msc" | out: DestinationString="msc") [0058.858] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="msc", AllocateDestinationString=1 | out: DestinationString="msc") returned 0x0 [0058.858] RtlFreeAnsiString (AnsiString="m") [0058.858] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="mod" | out: DestinationString="mod") [0058.858] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="mod", AllocateDestinationString=1 | out: DestinationString="mod") returned 0x0 [0058.858] RtlFreeAnsiString (AnsiString="m") [0058.858] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="clb" | out: DestinationString="clb") [0058.858] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="clb", AllocateDestinationString=1 | out: DestinationString="clb") returned 0x0 [0058.858] RtlFreeAnsiString (AnsiString="c") [0058.858] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="mui" | out: DestinationString="mui") [0058.858] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="mui", AllocateDestinationString=1 | out: DestinationString="mui") returned 0x0 [0058.858] RtlFreeAnsiString (AnsiString="m") [0058.858] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="regtrans-ms" | out: DestinationString="regtrans-ms") [0058.858] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="regtrans-ms", AllocateDestinationString=1 | out: DestinationString="regtrans-ms") returned 0x0 [0058.858] RtlFreeAnsiString (AnsiString="r") [0058.858] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="theme" | out: DestinationString="theme") [0058.858] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="theme", AllocateDestinationString=1 | out: DestinationString="theme") returned 0x0 [0058.858] RtlFreeAnsiString (AnsiString="t") [0058.858] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="hta" | out: DestinationString="hta") [0058.858] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="hta", AllocateDestinationString=1 | out: DestinationString="hta") returned 0x0 [0058.858] RtlFreeAnsiString (AnsiString="h") [0058.858] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="shs" | out: DestinationString="shs") [0058.858] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="shs", AllocateDestinationString=1 | out: DestinationString="shs") returned 0x0 [0058.858] RtlFreeAnsiString (AnsiString="s") [0058.858] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="nomedia" | out: DestinationString="nomedia") [0058.858] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="nomedia", AllocateDestinationString=1 | out: DestinationString="nomedia") returned 0x0 [0058.858] RtlFreeAnsiString (AnsiString="n") [0058.858] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="diagpkg" | out: DestinationString="diagpkg") [0058.858] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="diagpkg", AllocateDestinationString=1 | out: DestinationString="diagpkg") returned 0x0 [0058.859] RtlFreeAnsiString (AnsiString="d") [0058.859] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="cab" | out: DestinationString="cab") [0058.859] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="cab", AllocateDestinationString=1 | out: DestinationString="cab") returned 0x0 [0058.859] RtlFreeAnsiString (AnsiString="c") [0058.859] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="ics" | out: DestinationString="ics") [0058.859] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="ics", AllocateDestinationString=1 | out: DestinationString="ics") returned 0x0 [0058.859] RtlFreeAnsiString (AnsiString="i") [0058.859] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="msstyles" | out: DestinationString="msstyles") [0058.859] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="msstyles", AllocateDestinationString=1 | out: DestinationString="msstyles") returned 0x0 [0058.859] RtlFreeAnsiString (AnsiString="m") [0058.859] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="cur" | out: DestinationString="cur") [0058.859] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="cur", AllocateDestinationString=1 | out: DestinationString="cur") returned 0x0 [0058.859] RtlFreeAnsiString (AnsiString="c") [0058.859] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="drv" | out: DestinationString="drv") [0058.859] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="drv", AllocateDestinationString=1 | out: DestinationString="drv") returned 0x0 [0058.859] RtlFreeAnsiString (AnsiString="d") [0058.859] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="icns" | out: DestinationString="icns") [0058.859] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="icns", AllocateDestinationString=1 | out: DestinationString="icns") returned 0x0 [0058.859] RtlFreeAnsiString (AnsiString="i") [0058.859] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="diagcfg" | out: DestinationString="diagcfg") [0058.859] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="diagcfg", AllocateDestinationString=1 | out: DestinationString="diagcfg") returned 0x0 [0058.859] RtlFreeAnsiString (AnsiString="d") [0058.859] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="dll" | out: DestinationString="dll") [0058.859] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="dll", AllocateDestinationString=1 | out: DestinationString="dll") returned 0x0 [0058.859] RtlFreeAnsiString (AnsiString="d") [0058.859] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="ocx" | out: DestinationString="ocx") [0058.859] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="ocx", AllocateDestinationString=1 | out: DestinationString="ocx") returned 0x0 [0058.859] RtlFreeAnsiString (AnsiString="o") [0058.859] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="lnk" | out: DestinationString="lnk") [0058.859] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="lnk", AllocateDestinationString=1 | out: DestinationString="lnk") returned 0x0 [0058.859] RtlFreeAnsiString (AnsiString="l") [0058.859] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="ico" | out: DestinationString="ico") [0058.859] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="ico", AllocateDestinationString=1 | out: DestinationString="ico") returned 0x0 [0058.860] RtlFreeAnsiString (AnsiString="i") [0058.860] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="idx" | out: DestinationString="idx") [0058.860] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="idx", AllocateDestinationString=1 | out: DestinationString="idx") returned 0x0 [0058.860] RtlFreeAnsiString (AnsiString="i") [0058.860] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="ps1" | out: DestinationString="ps1") [0058.860] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="ps1", AllocateDestinationString=1 | out: DestinationString="ps1") returned 0x0 [0058.860] RtlFreeAnsiString (AnsiString="p") [0058.860] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="mpa" | out: DestinationString="mpa") [0058.860] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="mpa", AllocateDestinationString=1 | out: DestinationString="mpa") returned 0x0 [0058.860] RtlFreeAnsiString (AnsiString="m") [0058.860] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="cpl" | out: DestinationString="cpl") [0058.860] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="cpl", AllocateDestinationString=1 | out: DestinationString="cpl") returned 0x0 [0058.860] RtlFreeAnsiString (AnsiString="c") [0058.860] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="icl" | out: DestinationString="icl") [0058.860] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="icl", AllocateDestinationString=1 | out: DestinationString="icl") returned 0x0 [0058.860] RtlFreeAnsiString (AnsiString="i") [0058.860] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="msu" | out: DestinationString="msu") [0058.860] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="msu", AllocateDestinationString=1 | out: DestinationString="msu") returned 0x0 [0058.860] RtlFreeAnsiString (AnsiString="m") [0058.860] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="msi" | out: DestinationString="msi") [0058.860] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="msi", AllocateDestinationString=1 | out: DestinationString="msi") returned 0x0 [0058.860] RtlFreeAnsiString (AnsiString="m") [0058.860] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="nls" | out: DestinationString="nls") [0058.860] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="nls", AllocateDestinationString=1 | out: DestinationString="nls") returned 0x0 [0058.860] RtlFreeAnsiString (AnsiString="n") [0058.860] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="scr" | out: DestinationString="scr") [0058.860] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="scr", AllocateDestinationString=1 | out: DestinationString="scr") returned 0x0 [0058.860] RtlFreeAnsiString (AnsiString="s") [0058.860] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="adv" | out: DestinationString="adv") [0058.860] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="adv", AllocateDestinationString=1 | out: DestinationString="adv") returned 0x0 [0058.860] RtlFreeAnsiString (AnsiString="a") [0058.860] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="386" | out: DestinationString="386") [0058.861] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="386", AllocateDestinationString=1 | out: DestinationString="386") returned 0x0 [0058.861] RtlFreeAnsiString (AnsiString="3") [0058.861] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="com" | out: DestinationString="com") [0058.861] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="com", AllocateDestinationString=1 | out: DestinationString="com") returned 0x0 [0058.861] RtlFreeAnsiString (AnsiString="c") [0058.861] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="hlp" | out: DestinationString="hlp") [0058.861] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="hlp", AllocateDestinationString=1 | out: DestinationString="hlp") returned 0x0 [0058.861] RtlFreeAnsiString (AnsiString="h") [0058.861] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="rom" | out: DestinationString="rom") [0058.861] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="rom", AllocateDestinationString=1 | out: DestinationString="rom") returned 0x0 [0058.861] RtlFreeAnsiString (AnsiString="r") [0058.861] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="lock" | out: DestinationString="lock") [0058.861] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="lock", AllocateDestinationString=1 | out: DestinationString="lock") returned 0x0 [0058.861] RtlFreeAnsiString (AnsiString="l") [0058.861] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="386" | out: DestinationString="386") [0058.861] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="386", AllocateDestinationString=1 | out: DestinationString="386") returned 0x0 [0058.861] RtlFreeAnsiString (AnsiString="3") [0058.861] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="wpx" | out: DestinationString="wpx") [0058.861] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="wpx", AllocateDestinationString=1 | out: DestinationString="wpx") returned 0x0 [0058.861] RtlFreeAnsiString (AnsiString="w") [0058.861] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="ani" | out: DestinationString="ani") [0058.861] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="ani", AllocateDestinationString=1 | out: DestinationString="ani") returned 0x0 [0058.861] RtlFreeAnsiString (AnsiString="a") [0058.861] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="prf" | out: DestinationString="prf") [0058.861] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="prf", AllocateDestinationString=1 | out: DestinationString="prf") returned 0x0 [0058.861] RtlFreeAnsiString (AnsiString="p") [0058.861] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="rtp" | out: DestinationString="rtp") [0058.861] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="rtp", AllocateDestinationString=1 | out: DestinationString="rtp") returned 0x0 [0058.861] RtlFreeAnsiString (AnsiString="r") [0058.861] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="ldf" | out: DestinationString="ldf") [0058.861] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="ldf", AllocateDestinationString=1 | out: DestinationString="ldf") returned 0x0 [0058.861] RtlFreeAnsiString (AnsiString="l") [0058.861] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="key" | out: DestinationString="key") [0058.862] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="key", AllocateDestinationString=1 | out: DestinationString="key") returned 0x0 [0058.862] RtlFreeAnsiString (AnsiString="k") [0058.862] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="diagcab" | out: DestinationString="diagcab") [0058.862] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="diagcab", AllocateDestinationString=1 | out: DestinationString="diagcab") returned 0x0 [0058.862] RtlFreeAnsiString (AnsiString="d") [0058.862] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="cmd" | out: DestinationString="cmd") [0058.862] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="cmd", AllocateDestinationString=1 | out: DestinationString="cmd") returned 0x0 [0058.862] RtlFreeAnsiString (AnsiString="c") [0058.862] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="spl" | out: DestinationString="spl") [0058.862] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="spl", AllocateDestinationString=1 | out: DestinationString="spl") returned 0x0 [0058.862] RtlFreeAnsiString (AnsiString="s") [0058.862] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="deskthemepack" | out: DestinationString="deskthemepack") [0058.862] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="deskthemepack", AllocateDestinationString=1 | out: DestinationString="deskthemepack") returned 0x0 [0058.862] RtlFreeAnsiString (AnsiString="d") [0058.862] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="bat" | out: DestinationString="bat") [0058.862] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="bat", AllocateDestinationString=1 | out: DestinationString="bat") returned 0x0 [0058.862] RtlFreeAnsiString (AnsiString="b") [0058.862] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="themepack" | out: DestinationString="themepack") [0058.862] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="themepack", AllocateDestinationString=1 | out: DestinationString="themepack") returned 0x0 [0058.862] RtlFreeAnsiString (AnsiString="t") [0058.862] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="nslsvice.exe" | out: DestinationString="nslsvice.exe") [0058.862] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="nslsvice.exe", AllocateDestinationString=1 | out: DestinationString="nslsvice.exe") returned 0x0 [0058.862] RtlFreeAnsiString (AnsiString="n") [0058.863] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="pg*" | out: DestinationString="pg*") [0058.863] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="pg*", AllocateDestinationString=1 | out: DestinationString="pg*") returned 0x0 [0058.863] RtlFreeAnsiString (AnsiString="p") [0058.863] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="nservice.exe" | out: DestinationString="nservice.exe") [0058.863] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="nservice.exe", AllocateDestinationString=1 | out: DestinationString="nservice.exe") returned 0x0 [0058.863] RtlFreeAnsiString (AnsiString="n") [0058.863] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="cbvscserv*" | out: DestinationString="cbvscserv*") [0058.863] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="cbvscserv*", AllocateDestinationString=1 | out: DestinationString="cbvscserv*") returned 0x0 [0058.863] RtlFreeAnsiString (AnsiString="c") [0058.863] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="ntrtscan.exe" | out: DestinationString="ntrtscan.exe") [0058.863] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="ntrtscan.exe", AllocateDestinationString=1 | out: DestinationString="ntrtscan.exe") returned 0x0 [0058.863] RtlFreeAnsiString (AnsiString="n") [0058.863] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="cbservi*" | out: DestinationString="cbservi*") [0058.863] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="cbservi*", AllocateDestinationString=1 | out: DestinationString="cbservi*") returned 0x0 [0058.863] RtlFreeAnsiString (AnsiString="c") [0058.863] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="hMailServer*" | out: DestinationString="hMailServer*") [0058.863] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="hMailServer*", AllocateDestinationString=1 | out: DestinationString="hMailServer*") returned 0x0 [0058.863] RtlFreeAnsiString (AnsiString="h") [0058.863] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="IBM*" | out: DestinationString="IBM*") [0058.863] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="IBM*", AllocateDestinationString=1 | out: DestinationString="IBM*") returned 0x0 [0058.863] RtlFreeAnsiString (AnsiString="I") [0058.863] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="bes10*" | out: DestinationString="bes10*") [0058.863] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="bes10*", AllocateDestinationString=1 | out: DestinationString="bes10*") returned 0x0 [0058.863] RtlFreeAnsiString (AnsiString="b") [0058.863] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="black*" | out: DestinationString="black*") [0058.863] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="black*", AllocateDestinationString=1 | out: DestinationString="black*") returned 0x0 [0058.863] RtlFreeAnsiString (AnsiString="b") [0058.863] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="apach*" | out: DestinationString="apach*") [0058.863] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="apach*", AllocateDestinationString=1 | out: DestinationString="apach*") returned 0x0 [0058.863] RtlFreeAnsiString (AnsiString="a") [0058.863] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="bd2*" | out: DestinationString="bd2*") [0058.863] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="bd2*", AllocateDestinationString=1 | out: DestinationString="bd2*") returned 0x0 [0058.863] RtlFreeAnsiString (AnsiString="b") [0058.864] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="db*" | out: DestinationString="db*") [0058.864] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="db*", AllocateDestinationString=1 | out: DestinationString="db*") returned 0x0 [0058.864] RtlFreeAnsiString (AnsiString="d") [0058.864] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="ba*" | out: DestinationString="ba*") [0058.864] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="ba*", AllocateDestinationString=1 | out: DestinationString="ba*") returned 0x0 [0058.864] RtlFreeAnsiString (AnsiString="b") [0058.864] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="be*" | out: DestinationString="be*") [0058.864] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="be*", AllocateDestinationString=1 | out: DestinationString="be*") returned 0x0 [0058.864] RtlFreeAnsiString (AnsiString="b") [0058.864] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="QB*" | out: DestinationString="QB*") [0058.864] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="QB*", AllocateDestinationString=1 | out: DestinationString="QB*") returned 0x0 [0058.864] RtlFreeAnsiString (AnsiString="Q") [0058.864] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="oracle*" | out: DestinationString="oracle*") [0058.864] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="oracle*", AllocateDestinationString=1 | out: DestinationString="oracle*") returned 0x0 [0058.864] RtlFreeAnsiString (AnsiString="o") [0058.864] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="wbengine*" | out: DestinationString="wbengine*") [0058.864] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="wbengine*", AllocateDestinationString=1 | out: DestinationString="wbengine*") returned 0x0 [0058.864] RtlFreeAnsiString (AnsiString="w") [0058.864] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="vee*" | out: DestinationString="vee*") [0058.864] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="vee*", AllocateDestinationString=1 | out: DestinationString="vee*") returned 0x0 [0058.864] RtlFreeAnsiString (AnsiString="v") [0058.864] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="postg*" | out: DestinationString="postg*") [0058.864] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="postg*", AllocateDestinationString=1 | out: DestinationString="postg*") returned 0x0 [0058.864] RtlFreeAnsiString (AnsiString="p") [0058.864] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="sage*" | out: DestinationString="sage*") [0058.864] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="sage*", AllocateDestinationString=1 | out: DestinationString="sage*") returned 0x0 [0058.864] RtlFreeAnsiString (AnsiString="s") [0058.864] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="sap*" | out: DestinationString="sap*") [0058.864] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="sap*", AllocateDestinationString=1 | out: DestinationString="sap*") returned 0x0 [0058.864] RtlFreeAnsiString (AnsiString="s") [0058.864] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="b1*" | out: DestinationString="b1*") [0058.864] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="b1*", AllocateDestinationString=1 | out: DestinationString="b1*") returned 0x0 [0058.865] RtlFreeAnsiString (AnsiString="b") [0058.865] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="fdlaunch*" | out: DestinationString="fdlaunch*") [0058.865] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="fdlaunch*", AllocateDestinationString=1 | out: DestinationString="fdlaunch*") returned 0x0 [0058.865] RtlFreeAnsiString (AnsiString="f") [0058.865] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="msmdsrv*" | out: DestinationString="msmdsrv*") [0058.865] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="msmdsrv*", AllocateDestinationString=1 | out: DestinationString="msmdsrv*") returned 0x0 [0058.865] RtlFreeAnsiString (AnsiString="m") [0058.865] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="report*" | out: DestinationString="report*") [0058.865] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="report*", AllocateDestinationString=1 | out: DestinationString="report*") returned 0x0 [0058.865] RtlFreeAnsiString (AnsiString="r") [0058.865] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="msdtssr*" | out: DestinationString="msdtssr*") [0058.865] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="msdtssr*", AllocateDestinationString=1 | out: DestinationString="msdtssr*") returned 0x0 [0058.865] RtlFreeAnsiString (AnsiString="m") [0058.865] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="coldfus*" | out: DestinationString="coldfus*") [0058.865] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="coldfus*", AllocateDestinationString=1 | out: DestinationString="coldfus*") returned 0x0 [0058.865] RtlFreeAnsiString (AnsiString="c") [0058.865] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="cfdot*" | out: DestinationString="cfdot*") [0058.865] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="cfdot*", AllocateDestinationString=1 | out: DestinationString="cfdot*") returned 0x0 [0058.865] RtlFreeAnsiString (AnsiString="c") [0058.865] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="swag*" | out: DestinationString="swag*") [0058.865] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="swag*", AllocateDestinationString=1 | out: DestinationString="swag*") returned 0x0 [0058.865] RtlFreeAnsiString (AnsiString="s") [0058.865] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="swstrtr*" | out: DestinationString="swstrtr*") [0058.865] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="swstrtr*", AllocateDestinationString=1 | out: DestinationString="swstrtr*") returned 0x0 [0058.865] RtlFreeAnsiString (AnsiString="s") [0058.865] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="jetty.exe" | out: DestinationString="jetty.exe") [0058.865] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="jetty.exe", AllocateDestinationString=1 | out: DestinationString="jetty.exe") returned 0x0 [0058.865] RtlFreeAnsiString (AnsiString="j") [0058.865] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="wrsa.exe" | out: DestinationString="wrsa.exe") [0058.865] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="wrsa.exe", AllocateDestinationString=1 | out: DestinationString="wrsa.exe") returned 0x0 [0058.865] RtlFreeAnsiString (AnsiString="w") [0058.865] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="team*" | out: DestinationString="team*") [0058.866] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="team*", AllocateDestinationString=1 | out: DestinationString="team*") returned 0x0 [0058.866] RtlFreeAnsiString (AnsiString="t") [0058.866] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="agent*" | out: DestinationString="agent*") [0058.866] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="agent*", AllocateDestinationString=1 | out: DestinationString="agent*") returned 0x0 [0058.866] RtlFreeAnsiString (AnsiString="a") [0058.866] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="store.exe" | out: DestinationString="store.exe") [0058.866] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="store.exe", AllocateDestinationString=1 | out: DestinationString="store.exe") returned 0x0 [0058.866] RtlFreeAnsiString (AnsiString="s") [0058.866] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="sql*" | out: DestinationString="sql*") [0058.866] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="sql*", AllocateDestinationString=1 | out: DestinationString="sql*") returned 0x0 [0058.866] RtlFreeAnsiString (AnsiString="s") [0058.866] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="sqbcoreservice.exe" | out: DestinationString="sqbcoreservice.exe") [0058.866] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="sqbcoreservice.exe", AllocateDestinationString=1 | out: DestinationString="sqbcoreservice.exe") returned 0x0 [0058.866] RtlFreeAnsiString (AnsiString="s") [0058.866] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="thunderbird.exe" | out: DestinationString="thunderbird.exe") [0058.866] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="thunderbird.exe", AllocateDestinationString=1 | out: DestinationString="thunderbird.exe") returned 0x0 [0058.866] RtlFreeAnsiString (AnsiString="t") [0058.866] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="ocssd.exe" | out: DestinationString="ocssd.exe") [0058.866] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="ocssd.exe", AllocateDestinationString=1 | out: DestinationString="ocssd.exe") returned 0x0 [0058.866] RtlFreeAnsiString (AnsiString="o") [0058.866] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="encsvc.exe" | out: DestinationString="encsvc.exe") [0058.866] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="encsvc.exe", AllocateDestinationString=1 | out: DestinationString="encsvc.exe") returned 0x0 [0058.866] RtlFreeAnsiString (AnsiString="e") [0058.866] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="excel.exe" | out: DestinationString="excel.exe") [0058.866] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="excel.exe", AllocateDestinationString=1 | out: DestinationString="excel.exe") returned 0x0 [0058.866] RtlFreeAnsiString (AnsiString="e") [0058.866] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="synctime.exe" | out: DestinationString="synctime.exe") [0058.866] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="synctime.exe", AllocateDestinationString=1 | out: DestinationString="synctime.exe") returned 0x0 [0058.866] RtlFreeAnsiString (AnsiString="s") [0058.866] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="mspub.exe" | out: DestinationString="mspub.exe") [0058.866] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="mspub.exe", AllocateDestinationString=1 | out: DestinationString="mspub.exe") returned 0x0 [0058.866] RtlFreeAnsiString (AnsiString="m") [0058.867] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="ocautoupds.exe" | out: DestinationString="ocautoupds.exe") [0058.867] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="ocautoupds.exe", AllocateDestinationString=1 | out: DestinationString="ocautoupds.exe") returned 0x0 [0058.867] RtlFreeAnsiString (AnsiString="o") [0058.867] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="thebat.exe" | out: DestinationString="thebat.exe") [0058.867] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="thebat.exe", AllocateDestinationString=1 | out: DestinationString="thebat.exe") returned 0x0 [0058.867] RtlFreeAnsiString (AnsiString="t") [0058.867] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="dbeng50.exe" | out: DestinationString="dbeng50.exe") [0058.867] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="dbeng50.exe", AllocateDestinationString=1 | out: DestinationString="dbeng50.exe") returned 0x0 [0058.867] RtlFreeAnsiString (AnsiString="d") [0058.867] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*sql*" | out: DestinationString="*sql*") [0058.867] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*sql*", AllocateDestinationString=1 | out: DestinationString="*sql*") returned 0x0 [0058.867] RtlFreeAnsiString (AnsiString="*") [0058.867] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="mydesktopservice.exe" | out: DestinationString="mydesktopservice.exe") [0058.867] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="mydesktopservice.exe", AllocateDestinationString=1 | out: DestinationString="mydesktopservice.exe") returned 0x0 [0058.867] RtlFreeAnsiString (AnsiString="m") [0058.867] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="onenote.exe" | out: DestinationString="onenote.exe") [0058.867] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="onenote.exe", AllocateDestinationString=1 | out: DestinationString="onenote.exe") returned 0x0 [0058.867] RtlFreeAnsiString (AnsiString="o") [0058.867] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="outlook.exe" | out: DestinationString="outlook.exe") [0058.867] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="outlook.exe", AllocateDestinationString=1 | out: DestinationString="outlook.exe") returned 0x0 [0058.867] RtlFreeAnsiString (AnsiString="o") [0058.867] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="powerpnt.exe" | out: DestinationString="powerpnt.exe") [0058.867] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="powerpnt.exe", AllocateDestinationString=1 | out: DestinationString="powerpnt.exe") returned 0x0 [0058.867] RtlFreeAnsiString (AnsiString="p") [0058.867] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="msaccess.exe" | out: DestinationString="msaccess.exe") [0058.867] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="msaccess.exe", AllocateDestinationString=1 | out: DestinationString="msaccess.exe") returned 0x0 [0058.867] RtlFreeAnsiString (AnsiString="m") [0058.867] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="tbirdconfig.exe" | out: DestinationString="tbirdconfig.exe") [0058.867] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="tbirdconfig.exe", AllocateDestinationString=1 | out: DestinationString="tbirdconfig.exe") returned 0x0 [0058.867] RtlFreeAnsiString (AnsiString="t") [0058.867] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="wordpad.exe" | out: DestinationString="wordpad.exe") [0058.867] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="wordpad.exe", AllocateDestinationString=1 | out: DestinationString="wordpad.exe") returned 0x0 [0058.867] RtlFreeAnsiString (AnsiString="w") [0058.868] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="ocomm.exe" | out: DestinationString="ocomm.exe") [0058.868] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="ocomm.exe", AllocateDestinationString=1 | out: DestinationString="ocomm.exe") returned 0x0 [0058.868] RtlFreeAnsiString (AnsiString="o") [0058.868] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="dbsnmp.exe" | out: DestinationString="dbsnmp.exe") [0058.868] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="dbsnmp.exe", AllocateDestinationString=1 | out: DestinationString="dbsnmp.exe") returned 0x0 [0058.868] RtlFreeAnsiString (AnsiString="d") [0058.868] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="thebat64.exe" | out: DestinationString="thebat64.exe") [0058.868] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="thebat64.exe", AllocateDestinationString=1 | out: DestinationString="thebat64.exe") returned 0x0 [0058.868] RtlFreeAnsiString (AnsiString="t") [0058.868] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="winword.exe" | out: DestinationString="winword.exe") [0058.868] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="winword.exe", AllocateDestinationString=1 | out: DestinationString="winword.exe") returned 0x0 [0058.868] RtlFreeAnsiString (AnsiString="w") [0058.868] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="oracle.exe" | out: DestinationString="oracle.exe") [0058.868] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="oracle.exe", AllocateDestinationString=1 | out: DestinationString="oracle.exe") returned 0x0 [0058.868] RtlFreeAnsiString (AnsiString="o") [0058.878] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="xfssvccon.exe" | out: DestinationString="xfssvccon.exe") [0058.878] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="xfssvccon.exe", AllocateDestinationString=1 | out: DestinationString="xfssvccon.exe") returned 0x0 [0058.879] RtlFreeAnsiString (AnsiString="x") [0058.879] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="firefoxconfig.exe" | out: DestinationString="firefoxconfig.exe") [0058.879] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="firefoxconfig.exe", AllocateDestinationString=1 | out: DestinationString="firefoxconfig.exe") returned 0x0 [0058.879] RtlFreeAnsiString (AnsiString="f") [0058.879] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="visio.exe" | out: DestinationString="visio.exe") [0058.879] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="visio.exe", AllocateDestinationString=1 | out: DestinationString="visio.exe") returned 0x0 [0058.879] RtlFreeAnsiString (AnsiString="v") [0058.879] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="mydesktopqos.exe" | out: DestinationString="mydesktopqos.exe") [0058.879] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="mydesktopqos.exe", AllocateDestinationString=1 | out: DestinationString="mydesktopqos.exe") returned 0x0 [0058.879] RtlFreeAnsiString (AnsiString="m") [0058.879] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="infopath.exe" | out: DestinationString="infopath.exe") [0058.879] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="infopath.exe", AllocateDestinationString=1 | out: DestinationString="infopath.exe") returned 0x0 [0058.879] RtlFreeAnsiString (AnsiString="i") [0058.879] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="agntsvc.exe" | out: DestinationString="agntsvc.exe") [0058.879] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="agntsvc.exe", AllocateDestinationString=1 | out: DestinationString="agntsvc.exe") returned 0x0 [0058.879] RtlFreeAnsiString (AnsiString="a") [0058.879] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="Lotus*" | out: DestinationString="Lotus*") [0058.879] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="Lotus*", AllocateDestinationString=1 | out: DestinationString="Lotus*") returned 0x0 [0058.879] RtlFreeAnsiString (AnsiString="L") [0058.879] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="veeam*" | out: DestinationString="veeam*") [0058.879] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="veeam*", AllocateDestinationString=1 | out: DestinationString="veeam*") returned 0x0 [0058.879] RtlFreeAnsiString (AnsiString="v") [0058.879] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="cbvscserv*" | out: DestinationString="cbvscserv*") [0058.879] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="cbvscserv*", AllocateDestinationString=1 | out: DestinationString="cbvscserv*") returned 0x0 [0058.880] RtlFreeAnsiString (AnsiString="c") [0058.880] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="hMailServer" | out: DestinationString="hMailServer") [0058.880] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="hMailServer", AllocateDestinationString=1 | out: DestinationString="hMailServer") returned 0x0 [0058.880] RtlFreeAnsiString (AnsiString="h") [0058.880] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="backup*" | out: DestinationString="backup*") [0058.880] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="backup*", AllocateDestinationString=1 | out: DestinationString="backup*") returned 0x0 [0058.880] RtlFreeAnsiString (AnsiString="b") [0058.880] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*backup*" | out: DestinationString="*backup*") [0058.880] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*backup*", AllocateDestinationString=1 | out: DestinationString="*backup*") returned 0x0 [0058.880] RtlFreeAnsiString (AnsiString="*") [0058.880] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="apach*" | out: DestinationString="apach*") [0058.880] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="apach*", AllocateDestinationString=1 | out: DestinationString="apach*") returned 0x0 [0058.880] RtlFreeAnsiString (AnsiString="a") [0058.880] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="firebird*" | out: DestinationString="firebird*") [0058.880] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="firebird*", AllocateDestinationString=1 | out: DestinationString="firebird*") returned 0x0 [0058.880] RtlFreeAnsiString (AnsiString="f") [0058.880] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="ibmiasrw" | out: DestinationString="ibmiasrw") [0058.880] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="ibmiasrw", AllocateDestinationString=1 | out: DestinationString="ibmiasrw") returned 0x0 [0058.880] RtlFreeAnsiString (AnsiString="i") [0058.880] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="IBM Domino*" | out: DestinationString="IBM Domino*") [0058.880] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="IBM Domino*", AllocateDestinationString=1 | out: DestinationString="IBM Domino*") returned 0x0 [0058.880] RtlFreeAnsiString (AnsiString="I") [0058.880] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="Simply Accounting Database Connection Manager" | out: DestinationString="Simply Accounting Database Connection Manager") [0058.880] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="Simply Accounting Database Connection Manager", AllocateDestinationString=1 | out: DestinationString="Simply Accounting Database Connection Manager") returned 0x0 [0058.880] RtlFreeAnsiString (AnsiString="S") [0058.880] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="IASJet" | out: DestinationString="IASJet") [0058.880] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="IASJet", AllocateDestinationString=1 | out: DestinationString="IASJet") returned 0x0 [0058.880] RtlFreeAnsiString (AnsiString="I") [0058.880] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="QB*" | out: DestinationString="QB*") [0058.880] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="QB*", AllocateDestinationString=1 | out: DestinationString="QB*") returned 0x0 [0058.880] RtlFreeAnsiString (AnsiString="Q") [0058.881] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*sql*" | out: DestinationString="*sql*") [0058.881] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*sql*", AllocateDestinationString=1 | out: DestinationString="*sql*") returned 0x0 [0058.881] RtlFreeAnsiString (AnsiString="*") [0058.881] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="sql*" | out: DestinationString="sql*") [0058.881] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="sql*", AllocateDestinationString=1 | out: DestinationString="sql*") returned 0x0 [0058.881] RtlFreeAnsiString (AnsiString="s") [0058.881] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="QuickBooksDB*" | out: DestinationString="QuickBooksDB*") [0058.881] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="QuickBooksDB*", AllocateDestinationString=1 | out: DestinationString="QuickBooksDB*") returned 0x0 [0058.881] RtlFreeAnsiString (AnsiString="Q") [0058.881] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="IISADMIN" | out: DestinationString="IISADMIN") [0058.881] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="IISADMIN", AllocateDestinationString=1 | out: DestinationString="IISADMIN") returned 0x0 [0058.881] RtlFreeAnsiString (AnsiString="I") [0058.881] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="omsad" | out: DestinationString="omsad") [0058.881] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="omsad", AllocateDestinationString=1 | out: DestinationString="omsad") returned 0x0 [0058.881] RtlFreeAnsiString (AnsiString="o") [0058.881] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="dc*32" | out: DestinationString="dc*32") [0058.881] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="dc*32", AllocateDestinationString=1 | out: DestinationString="dc*32") returned 0x0 [0058.881] RtlFreeAnsiString (AnsiString="d") [0058.881] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="server Administrator" | out: DestinationString="server Administrator") [0058.881] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="server Administrator", AllocateDestinationString=1 | out: DestinationString="server Administrator") returned 0x0 [0058.881] RtlFreeAnsiString (AnsiString="s") [0058.881] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="wbengine" | out: DestinationString="wbengine") [0058.881] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="wbengine", AllocateDestinationString=1 | out: DestinationString="wbengine") returned 0x0 [0058.881] RtlFreeAnsiString (AnsiString="w") [0058.881] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="mr2kserv" | out: DestinationString="mr2kserv") [0058.881] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="mr2kserv", AllocateDestinationString=1 | out: DestinationString="mr2kserv") returned 0x0 [0058.881] RtlFreeAnsiString (AnsiString="m") [0058.881] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="MSExchange*" | out: DestinationString="MSExchange*") [0058.881] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="MSExchange*", AllocateDestinationString=1 | out: DestinationString="MSExchange*") returned 0x0 [0058.881] RtlFreeAnsiString (AnsiString="M") [0058.881] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="ShadowProtectSvc" | out: DestinationString="ShadowProtectSvc") [0058.881] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="ShadowProtectSvc", AllocateDestinationString=1 | out: DestinationString="ShadowProtectSvc") returned 0x0 [0058.882] RtlFreeAnsiString (AnsiString="S") [0058.882] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="SP*4" | out: DestinationString="SP*4") [0058.882] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="SP*4", AllocateDestinationString=1 | out: DestinationString="SP*4") returned 0x0 [0058.882] RtlFreeAnsiString (AnsiString="S") [0058.882] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="teamviewer" | out: DestinationString="teamviewer") [0058.882] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="teamviewer", AllocateDestinationString=1 | out: DestinationString="teamviewer") returned 0x0 [0058.882] RtlFreeAnsiString (AnsiString="t") [0058.882] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="MMS" | out: DestinationString="MMS") [0058.882] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="MMS", AllocateDestinationString=1 | out: DestinationString="MMS") returned 0x0 [0058.882] RtlFreeAnsiString (AnsiString="M") [0058.882] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="AcronisAgent" | out: DestinationString="AcronisAgent") [0058.882] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="AcronisAgent", AllocateDestinationString=1 | out: DestinationString="AcronisAgent") returned 0x0 [0058.882] RtlFreeAnsiString (AnsiString="A") [0058.882] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="ARSM" | out: DestinationString="ARSM") [0058.882] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="ARSM", AllocateDestinationString=1 | out: DestinationString="ARSM") returned 0x0 [0058.882] RtlFreeAnsiString (AnsiString="A") [0058.882] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="AcrSch2Svc" | out: DestinationString="AcrSch2Svc") [0058.882] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="AcrSch2Svc", AllocateDestinationString=1 | out: DestinationString="AcrSch2Svc") returned 0x0 [0058.882] RtlFreeAnsiString (AnsiString="A") [0058.882] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="vsnapvss" | out: DestinationString="vsnapvss") [0058.882] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="vsnapvss", AllocateDestinationString=1 | out: DestinationString="vsnapvss") returned 0x0 [0058.882] RtlFreeAnsiString (AnsiString="v") [0058.882] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="SPXService" | out: DestinationString="SPXService") [0058.882] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="SPXService", AllocateDestinationString=1 | out: DestinationString="SPXService") returned 0x0 [0058.882] RtlFreeAnsiString (AnsiString="S") [0058.882] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="StorageCraft ImageManager" | out: DestinationString="StorageCraft ImageManager") [0058.882] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="StorageCraft ImageManager", AllocateDestinationString=1 | out: DestinationString="StorageCraft ImageManager") returned 0x0 [0058.882] RtlFreeAnsiString (AnsiString="S") [0058.882] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="wrsvc" | out: DestinationString="wrsvc") [0058.882] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="wrsvc", AllocateDestinationString=1 | out: DestinationString="wrsvc") returned 0x0 [0058.882] RtlFreeAnsiString (AnsiString="w") [0058.882] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="stc_endpt_svc" | out: DestinationString="stc_endpt_svc") [0058.883] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="stc_endpt_svc", AllocateDestinationString=1 | out: DestinationString="stc_endpt_svc") returned 0x0 [0058.883] RtlFreeAnsiString (AnsiString="s") [0058.883] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="acrsch2svc" | out: DestinationString="acrsch2svc") [0058.883] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="acrsch2svc", AllocateDestinationString=1 | out: DestinationString="acrsch2svc") returned 0x0 [0058.883] RtlFreeAnsiString (AnsiString="a") [0058.883] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="reboot" | out: DestinationString="reboot") [0058.883] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="reboot", AllocateDestinationString=1 | out: DestinationString="reboot") returned 0x0 [0058.883] RtlFreeAnsiString (AnsiString="r") [0058.883] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="restart" | out: DestinationString="restart") [0058.883] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="restart", AllocateDestinationString=1 | out: DestinationString="restart") returned 0x0 [0058.883] RtlFreeAnsiString (AnsiString="r") [0058.883] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="shutdown" | out: DestinationString="shutdown") [0058.883] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="shutdown", AllocateDestinationString=1 | out: DestinationString="shutdown") returned 0x0 [0058.883] RtlFreeAnsiString (AnsiString="s") [0058.883] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="logoff" | out: DestinationString="logoff") [0058.883] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="logoff", AllocateDestinationString=1 | out: DestinationString="logoff") returned 0x0 [0058.883] RtlFreeAnsiString (AnsiString="l") [0058.883] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="back" | out: DestinationString="back") [0058.883] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="back", AllocateDestinationString=1 | out: DestinationString="back") returned 0x0 [0058.883] RtlFreeAnsiString (AnsiString="b") [0058.885] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="ipc$" | out: DestinationString="ipc$") [0058.885] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="ipc$", AllocateDestinationString=1 | out: DestinationString="ipc$") returned 0x0 [0058.885] RtlFreeAnsiString (AnsiString="i") [0058.885] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="admin$" | out: DestinationString="admin$") [0058.885] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="admin$", AllocateDestinationString=1 | out: DestinationString="admin$") returned 0x0 [0058.885] RtlFreeAnsiString (AnsiString="a") [0058.885] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="psexec.exe" | out: DestinationString="psexec.exe") [0058.885] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="psexec.exe", AllocateDestinationString=1 | out: DestinationString="psexec.exe") returned 0x0 [0058.885] RtlFreeAnsiString (AnsiString="p") [0058.885] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="system" | out: DestinationString="system") [0058.885] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="system", AllocateDestinationString=1 | out: DestinationString="system") returned 0x0 [0058.885] RtlFreeAnsiString (AnsiString="s") [0058.886] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*:\\windows*" | out: DestinationString="*:\\windows*") [0058.886] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*:\\windows*", AllocateDestinationString=1 | out: DestinationString="*:\\windows*") returned 0x0 [0058.886] RtlFreeAnsiString (AnsiString="*") [0058.886] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*:\\winnt*" | out: DestinationString="*:\\winnt*") [0058.886] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*:\\winnt*", AllocateDestinationString=1 | out: DestinationString="*:\\winnt*") returned 0x0 [0058.886] RtlFreeAnsiString (AnsiString="*") [0058.886] RtlInitAnsiString (in: DestinationString=0x98f264, SourceString="*:\\program file*\\vmwar*" | out: DestinationString="*:\\program file*\\vmwar*") [0058.886] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f26c, SourceString="*:\\program file*\\vmwar*", AllocateDestinationString=1 | out: DestinationString="*:\\program file*\\vmwar*") returned 0x0 [0058.886] RtlFreeAnsiString (AnsiString="*") [0058.886] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34b66b0) returned 1 [0058.888] GetVersion () returned 0x3ad7000a [0058.888] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x34a45c0 | out: Wow64Process=0x34a45c0) returned 1 [0058.888] GetCurrentProcessId () returned 0x4c4 [0058.888] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x98f2e0 | out: TokenHandle=0x98f2e0*=0x2f8) returned 0x0 [0058.888] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x100) returned 0x34b1180 [0058.888] GetTokenInformation (in: TokenHandle=0x2f8, TokenInformationClass=0x1, TokenInformation=0x34b1180, TokenInformationLength=0x100, ReturnLength=0x98f318 | out: TokenInformation=0x34b1180, ReturnLength=0x98f318) returned 1 [0058.888] IsWellKnownSid (pSid=0x34b1188*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xb4)), WellKnownSidType=0x16) returned 0 [0058.888] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34b1180) returned 1 [0058.888] GetTokenInformation (in: TokenHandle=0x2f8, TokenInformationClass=0x12, TokenInformation=0x98f2f4, TokenInformationLength=0x4, ReturnLength=0x98f318 | out: TokenInformation=0x98f2f4, ReturnLength=0x98f318) returned 1 [0058.888] NtClose (Handle=0x2f8) returned 0x0 [0058.888] GetComputerNameExW (in: NameType=0x0, lpBuffer=0x0, nSize=0x98f2dc | out: lpBuffer=0x0, nSize=0x98f2dc) returned 0 [0058.888] GetLastError () returned 0xea [0058.888] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x10) returned 0x34c9348 [0058.888] GetComputerNameExW (in: NameType=0x0, lpBuffer=0x34c9348, nSize=0x98f2dc | out: lpBuffer="NQDPDE", nSize=0x98f2dc) returned 1 [0058.889] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0xf4) returned 0x34b1180 [0058.889] GetCurrentHwProfileW (in: lpHwProfileInfo=0x34b1180 | out: lpHwProfileInfo=0x34b1180) returned 1 [0058.889] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x70) returned 0x34b2050 [0058.889] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x20) returned 0x34c6cb0 [0058.889] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6cb0) returned 1 [0058.889] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x20) returned 0x34c6aa8 [0058.889] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x20) returned 0x34c6d78 [0058.891] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6d78) returned 1 [0058.891] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x41) returned 0x34b2958 [0058.891] sprintf (in: _Dest=0x34b2958, _Format="%0.2x" | out: _Dest="a0") returned 2 [0058.891] sprintf (in: _Dest=0x34b295a, _Format="%0.2x" | out: _Dest="a7") returned 2 [0058.891] sprintf (in: _Dest=0x34b295c, _Format="%0.2x" | out: _Dest="02") returned 2 [0058.891] sprintf (in: _Dest=0x34b295e, _Format="%0.2x" | out: _Dest="90") returned 2 [0058.891] sprintf (in: _Dest=0x34b2960, _Format="%0.2x" | out: _Dest="71") returned 2 [0058.891] sprintf (in: _Dest=0x34b2962, _Format="%0.2x" | out: _Dest="28") returned 2 [0058.891] sprintf (in: _Dest=0x34b2964, _Format="%0.2x" | out: _Dest="eb") returned 2 [0058.891] sprintf (in: _Dest=0x34b2966, _Format="%0.2x" | out: _Dest="03") returned 2 [0058.891] sprintf (in: _Dest=0x34b2968, _Format="%0.2x" | out: _Dest="0e") returned 2 [0058.891] sprintf (in: _Dest=0x34b296a, _Format="%0.2x" | out: _Dest="de") returned 2 [0058.891] sprintf (in: _Dest=0x34b296c, _Format="%0.2x" | out: _Dest="23") returned 2 [0058.891] sprintf (in: _Dest=0x34b296e, _Format="%0.2x" | out: _Dest="a3") returned 2 [0058.891] sprintf (in: _Dest=0x34b2970, _Format="%0.2x" | out: _Dest="fb") returned 2 [0058.891] sprintf (in: _Dest=0x34b2972, _Format="%0.2x" | out: _Dest="75") returned 2 [0058.891] sprintf (in: _Dest=0x34b2974, _Format="%0.2x" | out: _Dest="38") returned 2 [0058.891] sprintf (in: _Dest=0x34b2976, _Format="%0.2x" | out: _Dest="23") returned 2 [0058.892] sprintf (in: _Dest=0x34b2978, _Format="%0.2x" | out: _Dest="a7") returned 2 [0058.892] sprintf (in: _Dest=0x34b297a, _Format="%0.2x" | out: _Dest="54") returned 2 [0058.892] sprintf (in: _Dest=0x34b297c, _Format="%0.2x" | out: _Dest="3f") returned 2 [0058.892] sprintf (in: _Dest=0x34b297e, _Format="%0.2x" | out: _Dest="21") returned 2 [0058.892] sprintf (in: _Dest=0x34b2980, _Format="%0.2x" | out: _Dest="9d") returned 2 [0058.892] sprintf (in: _Dest=0x34b2982, _Format="%0.2x" | out: _Dest="cb") returned 2 [0058.892] sprintf (in: _Dest=0x34b2984, _Format="%0.2x" | out: _Dest="b5") returned 2 [0058.892] sprintf (in: _Dest=0x34b2986, _Format="%0.2x" | out: _Dest="8a") returned 2 [0058.892] sprintf (in: _Dest=0x34b2988, _Format="%0.2x" | out: _Dest="fe") returned 2 [0058.892] sprintf (in: _Dest=0x34b298a, _Format="%0.2x" | out: _Dest="a5") returned 2 [0058.892] sprintf (in: _Dest=0x34b298c, _Format="%0.2x" | out: _Dest="56") returned 2 [0058.892] sprintf (in: _Dest=0x34b298e, _Format="%0.2x" | out: _Dest="c2") returned 2 [0058.892] sprintf (in: _Dest=0x34b2990, _Format="%0.2x" | out: _Dest="4f") returned 2 [0058.892] sprintf (in: _Dest=0x34b2992, _Format="%0.2x" | out: _Dest="58") returned 2 [0058.892] sprintf (in: _Dest=0x34b2994, _Format="%0.2x" | out: _Dest="4f") returned 2 [0058.892] sprintf (in: _Dest=0x34b2996, _Format="%0.2x" | out: _Dest="2d") returned 2 [0058.892] RtlInitAnsiString (in: DestinationString=0x98f28c, SourceString="a0a702907128eb030ede23a3fb753823a7543f219dcbb58afea556c24f584f2d" | out: DestinationString="a0a702907128eb030ede23a3fb753823a7543f219dcbb58afea556c24f584f2d") [0058.892] RtlAnsiStringToUnicodeString (in: DestinationString=0x98f294, SourceString="a0a702907128eb030ede23a3fb753823a7543f219dcbb58afea556c24f584f2d", AllocateDestinationString=1 | out: DestinationString="a0a702907128eb030ede23a3fb753823a7543f219dcbb58afea556c24f584f2d") returned 0x0 [0058.892] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x82) returned 0x34aa068 [0058.892] RtlFreeAnsiString (AnsiString="a") [0058.892] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x12) returned 0x34c7120 [0058.892] wcscpy (in: _Dest=0x34c7120, _Source="\\\\" | out: _Dest="\\\\") returned="\\\\" [0058.892] wcscat (in: _Dest=0x34c7120, _Source="NQDPDE" | out: _Dest="\\\\NQDPDE") returned="\\\\NQDPDE" [0058.892] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x4) returned 0x34bf6f0 [0058.892] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x12) returned 0x34c7140 [0058.892] wcscpy (in: _Dest=0x34c7140, _Source="\\\\NQDPDE" | out: _Dest="\\\\NQDPDE") returned="\\\\NQDPDE" [0058.892] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7120) returned 1 [0058.892] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6aa8) returned 1 [0058.892] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34b2050) returned 1 [0058.892] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34b1180) returned 1 [0058.892] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x12) returned 0x34c7360 [0058.892] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0xc) returned 0x34c9138 [0058.893] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x20a) returned 0x34c9510 [0058.893] Wow64DisableWow64FsRedirection (in: OldValue=0x98f380 | out: OldValue=0x98f380*=0x0) returned 1 [0058.893] GetSystemDirectoryW (in: lpBuffer=0x34c9510, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0058.893] wcscat (in: _Dest=0x34c9510, _Source="\\vssadmin.exe" | out: _Dest="C:\\WINDOWS\\system32\\vssadmin.exe") returned="C:\\WINDOWS\\system32\\vssadmin.exe" [0058.893] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x240) returned 0x34c9728 [0058.893] wcscpy (in: _Dest=0x34c9728, _Source="C:\\WINDOWS\\system32\\vssadmin.exe" | out: _Dest="C:\\WINDOWS\\system32\\vssadmin.exe") returned="C:\\WINDOWS\\system32\\vssadmin.exe" [0058.893] wcscat (in: _Dest=0x34c9728, _Source=" delete shadows /all /quiet" | out: _Dest="C:\\WINDOWS\\system32\\vssadmin.exe delete shadows /all /quiet") returned="C:\\WINDOWS\\system32\\vssadmin.exe delete shadows /all /quiet" [0058.893] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="C:\\WINDOWS\\system32\\vssadmin.exe delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x98f2d8*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x98f31c | out: lpCommandLine="C:\\WINDOWS\\system32\\vssadmin.exe delete shadows /all /quiet", lpProcessInformation=0x98f31c*(hProcess=0x2fc, hThread=0x300, dwProcessId=0x370, dwThreadId=0x454)) returned 1 [0059.109] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c9728) returned 1 [0059.109] Wow64RevertWow64FsRedirection (OlValue=0x98f380) returned 1 [0059.109] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c9510) returned 1 [0059.109] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x9c5c90, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x304 [0059.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x9c5e90, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f8 [0059.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x9c6840, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x310 [0059.111] WaitForMultipleObjects (nCount=0x3, lpHandles=0x34c9138*=0x304, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 7 os_tid = 0x4d4 Thread: id = 9 os_tid = 0xd18 [0060.323] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1024) returned 0x34c9df0 [0060.323] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34c9df0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34c9df0, ResultLength=0x0) returned 0xc0000004 [0062.371] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34c9df0, Size=0x2048) returned 0x34d3a08 [0062.373] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d3a08, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34d3a08, ResultLength=0x0) returned 0xc0000004 [0062.373] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d3a08, Size=0x306c) returned 0x34d3a08 [0062.373] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d3a08, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x34d3a08, ResultLength=0x0) returned 0xc0000004 [0062.373] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d3a08, Size=0x4090) returned 0x34d6a80 [0062.374] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6a80, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x34d6a80, ResultLength=0x0) returned 0xc0000004 [0062.374] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6a80, Size=0x50b4) returned 0x34d6a80 [0062.374] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6a80, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x34d6a80, ResultLength=0x0) returned 0xc0000004 [0062.375] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6a80, Size=0x60d8) returned 0x34dbb40 [0062.375] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dbb40, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x34dbb40, ResultLength=0x0) returned 0xc0000004 [0062.375] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dbb40, Size=0x70fc) returned 0x34dbb40 [0062.375] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dbb40, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x34dbb40, ResultLength=0x0) returned 0xc0000004 [0062.376] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dbb40, Size=0x8120) returned 0x34d3a08 [0062.376] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d3a08, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x34d3a08, ResultLength=0x0) returned 0xc0000004 [0062.376] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d3a08, Size=0x9144) returned 0x34d3a08 [0062.376] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d3a08, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x34d3a08, ResultLength=0x0) returned 0xc0000004 [0062.378] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d3a08, Size=0xa168) returned 0x34d3a08 [0062.378] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d3a08, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x34d3a08, ResultLength=0x0) returned 0xc0000004 [0062.379] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d3a08, Size=0xb18c) returned 0x34d3a08 [0062.379] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d3a08, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x34d3a08, ResultLength=0x0) returned 0xc0000004 [0062.380] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d3a08, Size=0xc1b0) returned 0x34d3a08 [0062.380] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d3a08, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x34d3a08, ResultLength=0x0) returned 0xc0000004 [0062.380] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d3a08, Size=0xd1d4) returned 0x34d3a08 [0062.380] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d3a08, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x34d3a08, ResultLength=0x0) returned 0xc0000004 [0062.380] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d3a08, Size=0xe1f8) returned 0x34d3a08 [0062.380] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d3a08, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x34d3a08, ResultLength=0x0) returned 0xc0000004 [0062.381] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d3a08, Size=0xf21c) returned 0x34d3a08 [0062.381] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d3a08, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x34d3a08, ResultLength=0x0) returned 0xc0000004 [0062.381] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d3a08, Size=0x10240) returned 0x34e2c30 [0063.745] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e2c30, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x34e2c30, ResultLength=0x0) returned 0xc0000004 [0063.748] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e2c30, Size=0x11264) returned 0x34e2c30 [0063.748] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e2c30, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x34e2c30, ResultLength=0x0) returned 0xc0000004 [0063.748] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e2c30, Size=0x12288) returned 0x34f3ea0 [0063.750] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34f3ea0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x34f3ea0, ResultLength=0x0) returned 0xc0000004 [0063.751] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34f3ea0, Size=0x132ac) returned 0x34d3a08 [0063.751] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d3a08, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x34d3a08, ResultLength=0x0) returned 0xc0000004 [0063.752] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d3a08, Size=0x142d0) returned 0x34d3a08 [0063.752] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d3a08, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x34d3a08, ResultLength=0x0) returned 0xc0000004 [0063.752] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d3a08, Size=0x152f4) returned 0x34d3a08 [0063.752] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d3a08, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x34d3a08, ResultLength=0x0) returned 0xc0000004 [0063.753] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d3a08, Size=0x16318) returned 0x34d3a08 [0063.753] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d3a08, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x34d3a08, ResultLength=0x0) returned 0xc0000004 [0063.753] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d3a08, Size=0x1733c) returned 0x34d3a08 [0063.753] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d3a08, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x34d3a08, ResultLength=0x0) returned 0xc0000004 [0063.754] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d3a08, Size=0x18360) returned 0x34d3a08 [0063.754] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d3a08, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x34d3a08, ResultLength=0x0) returned 0xc0000004 [0063.755] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d3a08, Size=0x19384) returned 0x34d3a08 [0063.755] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d3a08, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x34d3a08, ResultLength=0x0) returned 0xc0000004 [0063.755] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d3a08, Size=0x1a3a8) returned 0x34d3a08 [0063.755] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d3a08, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x34d3a08, ResultLength=0x0) returned 0xc0000004 [0063.756] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d3a08, Size=0x1b3cc) returned 0x34d3a08 [0063.756] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d3a08, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x34d3a08, ResultLength=0x0) returned 0xc0000004 [0063.756] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d3a08, Size=0x1c3f0) returned 0x34d3a08 [0063.756] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d3a08, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x34d3a08, ResultLength=0x0) returned 0xc0000004 [0063.757] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d3a08, Size=0x1d414) returned 0x34d3a08 [0063.757] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d3a08, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x34d3a08, ResultLength=0x0) returned 0xc0000004 [0063.757] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d3a08, Size=0x1e438) returned 0x34d3a08 [0063.757] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d3a08, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x34d3a08, ResultLength=0x0) returned 0xc0000004 [0063.758] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d3a08, Size=0x1f45c) returned 0x34d3a08 [0063.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d3a08, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x34d3a08, ResultLength=0x0) returned 0xc0000004 [0063.759] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d3a08, Size=0x20480) returned 0x34d3a08 [0063.759] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d3a08, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x34d3a08, ResultLength=0x0) returned 0xc0000004 [0063.759] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d3a08, Size=0x214a4) returned 0x34d3a08 [0063.759] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d3a08, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x34d3a08, ResultLength=0x0) returned 0xc0000004 [0063.760] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d3a08, Size=0x224c8) returned 0x34d3a08 [0063.760] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d3a08, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x34d3a08, ResultLength=0x0) returned 0xc0000004 [0063.760] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d3a08, Size=0x234ec) returned 0x34d3a08 [0063.760] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d3a08, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x34d3a08, ResultLength=0x0) returned 0xc0000004 [0063.761] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d3a08, Size=0x24510) returned 0x34d3a08 [0063.761] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d3a08, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x34d3a08, ResultLength=0x0) returned 0xc0000004 [0063.761] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d3a08, Size=0x25534) returned 0x34d3a08 [0063.761] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d3a08, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x34d3a08, ResultLength=0x0) returned 0x0 [0063.762] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2) returned 0x34d1020 [0063.763] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1020) returned 1 [0063.763] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0xe) returned 0x34d0490 [0063.763] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0490) returned 1 [0063.763] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x12) returned 0x34d1640 [0063.763] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0063.763] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1720 [0063.763] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1720) returned 1 [0063.763] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1880 [0063.763] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1880) returned 1 [0063.763] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1940 [0063.763] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0063.763] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c6eb8 [0063.763] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6eb8) returned 1 [0063.763] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c6f58 [0063.763] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6f58) returned 1 [0063.763] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1600 [0063.763] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1600) returned 1 [0063.763] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1880 [0063.763] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1880) returned 1 [0063.763] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x20) returned 0x34c6fa8 [0063.763] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6fa8) returned 1 [0063.763] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x20) returned 0x34c6e18 [0063.763] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6e18) returned 1 [0063.763] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1600 [0063.764] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1600) returned 1 [0063.764] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x10) returned 0x34d0550 [0063.764] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0550) returned 1 [0063.764] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1680 [0063.764] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1680) returned 1 [0063.764] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d17e0 [0063.764] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17e0) returned 1 [0063.764] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1780 [0063.764] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1780) returned 1 [0063.764] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1980 [0063.764] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1980) returned 1 [0063.764] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0063.764] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0063.764] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1680 [0063.764] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1680) returned 1 [0063.764] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1640 [0063.764] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0063.764] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1880 [0063.764] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1880) returned 1 [0063.764] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1680 [0063.764] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1680) returned 1 [0063.764] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d19a0 [0063.764] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d19a0) returned 1 [0063.764] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1600 [0063.764] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1600) returned 1 [0063.764] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0063.765] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0063.765] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1720 [0063.765] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1720) returned 1 [0063.765] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x16) returned 0x34d1740 [0063.765] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1740) returned 1 [0063.765] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1980 [0063.765] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1980) returned 1 [0063.765] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34c6eb8 [0063.765] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6eb8) returned 1 [0063.765] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c7070 [0063.765] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7070) returned 1 [0063.765] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2a) returned 0x34cfcb8 [0063.765] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cfcb8) returned 1 [0063.765] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x34) returned 0x34be778 [0063.765] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34be778) returned 1 [0063.765] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x26) returned 0x34c7d18 [0063.765] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7d18) returned 1 [0063.765] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x30) returned 0x34cfcb8 [0063.765] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cfcb8) returned 1 [0063.765] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c6fa8 [0063.765] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6fa8) returned 1 [0063.765] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x24) returned 0x34c7ce8 [0063.765] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7ce8) returned 1 [0063.765] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c7020 [0063.765] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7020) returned 1 [0063.766] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x10) returned 0x34d05e0 [0063.766] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d05e0) returned 1 [0063.766] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x28) returned 0x34c7a18 [0063.766] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7a18) returned 1 [0063.766] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c6eb8 [0063.766] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6eb8) returned 1 [0063.766] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x20) returned 0x34c6f08 [0063.766] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6f08) returned 1 [0063.766] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1e) returned 0x34c70c0 [0063.766] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c70c0) returned 1 [0063.766] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x20) returned 0x34c7020 [0063.766] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7020) returned 1 [0063.766] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x3e) returned 0x34c3550 [0063.766] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c3550) returned 1 [0063.766] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34c7020 [0063.766] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7020) returned 1 [0063.766] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x32) returned 0x34be5f8 [0063.766] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34be5f8) returned 1 [0063.766] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x10) returned 0x34d0640 [0063.766] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0640) returned 1 [0063.766] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x34) returned 0x34becf8 [0063.766] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34becf8) returned 1 [0063.766] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x22) returned 0x34c7ce8 [0063.766] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7ce8) returned 1 [0063.766] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1640 [0063.766] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0063.767] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x10) returned 0x34d0400 [0063.767] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0400) returned 1 [0063.767] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1980 [0063.767] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1980) returned 1 [0063.767] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2c) returned 0x34cf9e0 [0063.767] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cf9e0) returned 1 [0063.767] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1880 [0063.767] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1880) returned 1 [0063.767] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x26) returned 0x34c7a18 [0063.767] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7a18) returned 1 [0063.767] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1640 [0063.767] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0063.767] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1940 [0063.768] NtOpenProcess (in: ProcessHandle=0xe6fe50, DesiredAccess=0x1, ObjectAttributes=0xe6fe30*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xe6fe48*(UniqueProcess=0xdec, UniqueThread=0x0) | out: ProcessHandle=0xe6fe50*=0x360) returned 0x0 [0063.768] NtTerminateProcess (ProcessHandle=0x360, ExitStatus=0x0) returned 0x0 [0063.772] NtClose (Handle=0x360) returned 0x0 [0063.772] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0063.772] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c6e40 [0063.772] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6e40) returned 1 [0063.772] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1680 [0063.772] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1680) returned 1 [0063.772] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x10) returned 0x34d0370 [0063.772] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0370) returned 1 [0063.772] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34c7070 [0063.772] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7070) returned 1 [0063.772] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c6e18 [0063.772] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6e18) returned 1 [0063.772] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d19a0 [0063.772] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d19a0) returned 1 [0063.772] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x26) returned 0x34c7a18 [0063.772] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7a18) returned 1 [0063.772] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2a) returned 0x34cf938 [0063.772] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cf938) returned 1 [0063.772] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x10) returned 0x34d04d8 [0063.772] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d04d8) returned 1 [0063.772] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c6f58 [0063.772] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6f58) returned 1 [0063.772] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1640 [0063.773] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0063.773] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1720 [0063.773] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1720) returned 1 [0063.773] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34c7098 [0063.773] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7098) returned 1 [0063.773] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d17c0 [0063.773] NtOpenProcess (in: ProcessHandle=0xe6fe50, DesiredAccess=0x1, ObjectAttributes=0xe6fe30*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xe6fe48*(UniqueProcess=0x8d8, UniqueThread=0x0) | out: ProcessHandle=0xe6fe50*=0x360) returned 0x0 [0063.773] NtTerminateProcess (ProcessHandle=0x360, ExitStatus=0x0) returned 0x0 [0063.775] NtClose (Handle=0x360) returned 0x0 [0063.776] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17c0) returned 1 [0063.776] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x16) returned 0x34d17e0 [0063.776] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17e0) returned 1 [0063.776] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34c6f30 [0063.776] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6f30) returned 1 [0063.776] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d16c0 [0063.776] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d16c0) returned 1 [0063.776] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c6eb8 [0063.776] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6eb8) returned 1 [0063.776] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x20) returned 0x34c6f08 [0063.776] NtOpenProcess (in: ProcessHandle=0xe6fe50, DesiredAccess=0x1, ObjectAttributes=0xe6fe30*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xe6fe48*(UniqueProcess=0x184, UniqueThread=0x0) | out: ProcessHandle=0xe6fe50*=0x360) returned 0x0 [0063.776] NtTerminateProcess (ProcessHandle=0x360, ExitStatus=0x0) returned 0x0 [0063.778] NtClose (Handle=0x360) returned 0x0 [0063.778] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6f08) returned 1 [0063.778] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c70c0 [0063.778] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c70c0) returned 1 [0063.778] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c6fd0 [0063.778] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6fd0) returned 1 [0063.778] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c6fa8 [0063.779] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6fa8) returned 1 [0063.779] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c7098 [0063.779] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7098) returned 1 [0063.779] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x16) returned 0x34d17c0 [0063.779] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17c0) returned 1 [0063.779] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x26) returned 0x34c7b68 [0063.779] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7b68) returned 1 [0063.779] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x24) returned 0x34c7c88 [0063.779] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7c88) returned 1 [0063.779] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1640 [0063.779] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0063.779] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1740 [0063.779] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1740) returned 1 [0063.779] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x16) returned 0x34d1740 [0063.779] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1740) returned 1 [0063.779] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1e) returned 0x34c6e18 [0063.779] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6e18) returned 1 [0063.779] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2c) returned 0x34cf970 [0063.779] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cf970) returned 1 [0063.779] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x24) returned 0x34c7c88 [0063.779] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7c88) returned 1 [0063.779] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x16) returned 0x34d1940 [0063.779] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0063.779] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x12) returned 0x34d1880 [0063.779] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1880) returned 1 [0063.779] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x16) returned 0x34d1940 [0063.780] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0063.780] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x22) returned 0x34c7ce8 [0063.780] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7ce8) returned 1 [0063.780] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1720 [0063.780] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1720) returned 1 [0063.780] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x16) returned 0x34d1880 [0063.780] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1880) returned 1 [0063.780] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x28) returned 0x34c7d78 [0063.780] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7d78) returned 1 [0063.780] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x12) returned 0x34d1940 [0063.780] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0063.780] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2c) returned 0x34cfac0 [0063.780] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cfac0) returned 1 [0063.780] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x38) returned 0x34be778 [0063.780] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34be778) returned 1 [0063.780] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c6e18 [0063.780] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6e18) returned 1 [0063.780] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34c6f08 [0063.780] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6f08) returned 1 [0063.780] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34c6f58 [0063.780] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6f58) returned 1 [0063.780] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2e) returned 0x34cfeb0 [0063.780] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cfeb0) returned 1 [0063.780] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x22) returned 0x34c7928 [0063.781] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7928) returned 1 [0063.781] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0xe) returned 0x34d05b0 [0063.781] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d05b0) returned 1 [0063.781] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34c7070 [0063.781] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7070) returned 1 [0063.781] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x40) returned 0x34c3550 [0063.781] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c3550) returned 1 [0063.781] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1880 [0063.781] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1880) returned 1 [0063.781] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1740 [0063.781] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1740) returned 1 [0063.781] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0063.781] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0063.781] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d17e0 [0063.781] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17e0) returned 1 [0063.781] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c6f58 [0063.781] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6f58) returned 1 [0063.781] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1680 [0063.781] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1680) returned 1 [0063.781] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2a) returned 0x34cf8c8 [0063.781] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cf8c8) returned 1 [0063.781] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c7020 [0063.781] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7020) returned 1 [0063.781] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c70c0 [0063.781] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c70c0) returned 1 [0063.781] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1640 [0063.782] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0063.782] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d3a08) returned 1 [0063.782] Sleep (dwMilliseconds=0x64) [0063.925] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1024) returned 0x34d6130 [0063.925] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.926] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x2048) returned 0x34d6130 [0063.926] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.926] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x306c) returned 0x34d6130 [0063.926] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.926] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x4090) returned 0x34d6130 [0063.926] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.927] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x50b4) returned 0x34d6130 [0063.927] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.927] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x60d8) returned 0x34d6130 [0063.927] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.927] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x70fc) returned 0x34d6130 [0063.927] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.928] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x8120) returned 0x34d6130 [0063.928] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.928] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x9144) returned 0x34d6130 [0063.928] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.929] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0xa168) returned 0x34d6130 [0063.929] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.930] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0xb18c) returned 0x34d6130 [0063.930] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.930] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0xc1b0) returned 0x34d6130 [0063.930] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.930] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0xd1d4) returned 0x34d6130 [0063.930] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.931] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0xe1f8) returned 0x34d6130 [0063.931] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.931] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0xf21c) returned 0x34d6130 [0063.931] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.932] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x10240) returned 0x34d6130 [0063.932] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.932] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x11264) returned 0x34d6130 [0063.932] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.933] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x12288) returned 0x34d6130 [0063.933] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.933] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x132ac) returned 0x34d6130 [0063.933] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.933] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x142d0) returned 0x34d6130 [0063.933] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.934] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x152f4) returned 0x34d6130 [0063.934] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.934] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x16318) returned 0x34d6130 [0063.934] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.935] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1733c) returned 0x34d6130 [0063.935] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.936] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x18360) returned 0x34d6130 [0063.936] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.936] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x19384) returned 0x34d6130 [0063.936] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.937] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1a3a8) returned 0x34d6130 [0063.937] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.937] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1b3cc) returned 0x34d6130 [0063.937] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.938] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1c3f0) returned 0x34d6130 [0063.938] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.938] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1d414) returned 0x34d6130 [0063.938] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.939] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1e438) returned 0x34d6130 [0063.939] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.939] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1f45c) returned 0x34d6130 [0063.939] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.940] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x20480) returned 0x34d6130 [0063.940] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.940] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x214a4) returned 0x34d6130 [0063.940] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.941] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x224c8) returned 0x34d6130 [0063.941] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.941] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x234ec) returned 0x34d6130 [0063.941] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0063.942] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x24510) returned 0x34d6130 [0063.942] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0x0 [0063.942] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2) returned 0x34d0d40 [0063.942] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0d40) returned 1 [0063.942] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0xe) returned 0x34d0460 [0063.942] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0460) returned 1 [0063.942] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x12) returned 0x34d17e0 [0063.943] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17e0) returned 1 [0063.943] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1940 [0063.943] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0063.943] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d17e0 [0063.943] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17e0) returned 1 [0063.943] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d17e0 [0063.943] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17e0) returned 1 [0063.943] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c7070 [0063.943] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7070) returned 1 [0063.943] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c6eb8 [0063.943] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6eb8) returned 1 [0063.943] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1640 [0063.943] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0063.943] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1640 [0063.943] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0063.943] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x20) returned 0x34c7070 [0063.943] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7070) returned 1 [0063.943] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x20) returned 0x34c6ff8 [0063.943] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6ff8) returned 1 [0063.943] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d16a0 [0063.943] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d16a0) returned 1 [0063.943] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x10) returned 0x34d0400 [0063.943] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0400) returned 1 [0063.943] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1640 [0063.943] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0063.943] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d17e0 [0063.944] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17e0) returned 1 [0063.944] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1960 [0063.944] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1960) returned 1 [0063.944] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d17e0 [0063.944] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17e0) returned 1 [0063.944] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1740 [0063.944] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1740) returned 1 [0063.944] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d17e0 [0063.944] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17e0) returned 1 [0063.944] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1640 [0063.944] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0063.944] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d17e0 [0063.944] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17e0) returned 1 [0063.944] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1640 [0063.944] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0063.944] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1640 [0063.944] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0063.944] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0063.944] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0063.944] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1980 [0063.944] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1980) returned 1 [0063.944] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d17e0 [0063.944] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17e0) returned 1 [0063.944] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x16) returned 0x34d1940 [0063.944] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0063.944] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1740 [0063.945] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1740) returned 1 [0063.945] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34c7020 [0063.945] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7020) returned 1 [0063.945] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c7020 [0063.945] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7020) returned 1 [0063.945] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2a) returned 0x34cfc10 [0063.945] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cfc10) returned 1 [0063.945] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x34) returned 0x34be7b8 [0063.945] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34be7b8) returned 1 [0063.945] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x26) returned 0x34c7ec8 [0063.945] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7ec8) returned 1 [0063.945] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x30) returned 0x34cf970 [0063.945] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cf970) returned 1 [0063.945] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c7020 [0063.945] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7020) returned 1 [0063.945] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x24) returned 0x34c7e38 [0063.945] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7e38) returned 1 [0063.945] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c6ee0 [0063.945] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6ee0) returned 1 [0063.945] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x10) returned 0x34d0400 [0063.945] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0400) returned 1 [0063.945] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x28) returned 0x34c7928 [0063.945] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7928) returned 1 [0063.945] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c6ff8 [0063.945] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6ff8) returned 1 [0063.945] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x20) returned 0x34c6ff8 [0063.945] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6ff8) returned 1 [0063.945] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1e) returned 0x34c6ff8 [0063.946] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6ff8) returned 1 [0063.946] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x20) returned 0x34c7020 [0063.946] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7020) returned 1 [0063.946] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x3e) returned 0x34c35e0 [0063.946] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c35e0) returned 1 [0063.946] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34c7048 [0063.946] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7048) returned 1 [0063.946] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x32) returned 0x34be838 [0063.946] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34be838) returned 1 [0063.946] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x10) returned 0x34d05e0 [0063.946] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d05e0) returned 1 [0063.946] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x34) returned 0x34be8b8 [0063.946] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34be8b8) returned 1 [0063.946] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x22) returned 0x34c7d18 [0063.946] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7d18) returned 1 [0063.946] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1640 [0063.946] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0063.946] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x10) returned 0x34d0400 [0063.946] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0400) returned 1 [0063.946] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d17e0 [0063.946] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17e0) returned 1 [0063.946] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2c) returned 0x34cfac0 [0063.946] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cfac0) returned 1 [0063.946] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d17e0 [0063.946] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17e0) returned 1 [0063.946] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x26) returned 0x34c7ad8 [0063.947] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7ad8) returned 1 [0063.947] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1720 [0063.947] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1720) returned 1 [0063.947] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c6ff8 [0063.947] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6ff8) returned 1 [0063.947] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0063.947] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0063.947] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x10) returned 0x34d05e0 [0063.947] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d05e0) returned 1 [0063.947] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34c7098 [0063.947] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7098) returned 1 [0063.947] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c6ff8 [0063.947] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6ff8) returned 1 [0063.947] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1640 [0063.947] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0063.947] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x26) returned 0x34c7bc8 [0063.947] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7bc8) returned 1 [0063.947] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2a) returned 0x34cfc80 [0063.947] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cfc80) returned 1 [0063.947] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x10) returned 0x34d05e0 [0063.947] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d05e0) returned 1 [0063.947] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c6ff8 [0063.947] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6ff8) returned 1 [0063.947] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1940 [0063.947] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0063.947] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0063.947] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0063.948] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34c6ff8 [0063.948] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6ff8) returned 1 [0063.948] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x16) returned 0x34d16c0 [0063.948] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d16c0) returned 1 [0063.948] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34c6ff8 [0063.948] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6ff8) returned 1 [0063.948] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1640 [0063.948] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0063.948] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c6ff8 [0063.948] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6ff8) returned 1 [0063.948] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c6ff8 [0063.948] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6ff8) returned 1 [0063.948] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c7048 [0063.948] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7048) returned 1 [0063.948] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c6e40 [0063.948] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6e40) returned 1 [0063.948] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c6ee0 [0063.948] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6ee0) returned 1 [0063.948] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x16) returned 0x34d1720 [0063.948] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1720) returned 1 [0063.948] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x26) returned 0x34c7a18 [0063.948] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7a18) returned 1 [0063.948] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x24) returned 0x34c7ad8 [0063.948] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7ad8) returned 1 [0063.948] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1640 [0063.948] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0063.948] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1680 [0063.949] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1680) returned 1 [0063.949] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x16) returned 0x34d1680 [0063.949] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1680) returned 1 [0063.949] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1e) returned 0x34c7070 [0063.949] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7070) returned 1 [0063.949] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2c) returned 0x34cf900 [0063.949] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cf900) returned 1 [0063.949] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x24) returned 0x34c7ef8 [0063.949] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7ef8) returned 1 [0063.949] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x16) returned 0x34d1680 [0063.949] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1680) returned 1 [0063.949] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x12) returned 0x34d1940 [0063.949] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0063.949] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x16) returned 0x34d1640 [0063.949] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0063.949] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x22) returned 0x34c7b08 [0063.949] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7b08) returned 1 [0063.949] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0063.949] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0063.949] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x16) returned 0x34d17e0 [0063.949] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17e0) returned 1 [0063.949] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x28) returned 0x34c7a18 [0063.949] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7a18) returned 1 [0063.949] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x12) returned 0x34d1720 [0063.949] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1720) returned 1 [0063.949] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2c) returned 0x34cf9a8 [0063.950] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cf9a8) returned 1 [0063.950] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x38) returned 0x34be5f8 [0063.950] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34be5f8) returned 1 [0063.950] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c7070 [0063.950] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7070) returned 1 [0063.950] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34c6e40 [0063.950] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6e40) returned 1 [0063.950] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34c7020 [0063.950] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7020) returned 1 [0063.950] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2e) returned 0x34cfcb8 [0063.950] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cfcb8) returned 1 [0063.950] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x22) returned 0x34c7a18 [0063.950] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7a18) returned 1 [0063.950] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0xe) returned 0x34d0538 [0063.950] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0538) returned 1 [0063.950] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34c7070 [0063.950] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7070) returned 1 [0063.950] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x40) returned 0x34c35e0 [0063.950] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c35e0) returned 1 [0063.950] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0063.950] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0063.950] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0063.950] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0063.950] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d16a0 [0063.950] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d16a0) returned 1 [0063.950] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0063.951] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0063.951] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c6e40 [0063.951] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6e40) returned 1 [0063.951] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d17e0 [0063.951] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17e0) returned 1 [0063.951] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2a) returned 0x34cfdd0 [0063.951] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cfdd0) returned 1 [0063.951] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c7048 [0063.951] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7048) returned 1 [0063.951] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c6e40 [0063.951] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6e40) returned 1 [0063.951] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1980 [0063.952] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1980) returned 1 [0063.952] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d6130) returned 1 [0063.953] Sleep (dwMilliseconds=0x64) [0064.245] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1024) returned 0x34d6130 [0064.245] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.246] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x2048) returned 0x34d6130 [0064.246] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.246] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x306c) returned 0x34d6130 [0064.246] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.247] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x4090) returned 0x34d6130 [0064.247] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.247] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x50b4) returned 0x34d6130 [0064.247] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.247] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x60d8) returned 0x34d6130 [0064.247] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.248] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x70fc) returned 0x34d6130 [0064.248] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.248] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x8120) returned 0x34d6130 [0064.248] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.248] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x9144) returned 0x34d6130 [0064.248] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.249] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0xa168) returned 0x34d6130 [0064.249] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.249] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0xb18c) returned 0x34d6130 [0064.249] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.249] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0xc1b0) returned 0x34d6130 [0064.250] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.250] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0xd1d4) returned 0x34d6130 [0064.250] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.250] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0xe1f8) returned 0x34d6130 [0064.250] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.251] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0xf21c) returned 0x34d6130 [0064.251] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.251] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x10240) returned 0x34d6130 [0064.251] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.251] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x11264) returned 0x34d6130 [0064.252] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.252] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x12288) returned 0x34d6130 [0064.252] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.252] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x132ac) returned 0x34d6130 [0064.252] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.253] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x142d0) returned 0x34d6130 [0064.253] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.253] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x152f4) returned 0x34d6130 [0064.253] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.254] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x16318) returned 0x34d6130 [0064.254] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.254] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1733c) returned 0x34d6130 [0064.254] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.255] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x18360) returned 0x34d6130 [0064.255] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.255] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x19384) returned 0x34d6130 [0064.255] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.256] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1a3a8) returned 0x34d6130 [0064.256] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.256] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1b3cc) returned 0x34d6130 [0064.256] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.257] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1c3f0) returned 0x34d6130 [0064.257] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.257] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1d414) returned 0x34d6130 [0064.257] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.258] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1e438) returned 0x34d6130 [0064.258] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.258] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1f45c) returned 0x34d6130 [0064.258] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.259] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x20480) returned 0x34d6130 [0064.259] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.259] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x214a4) returned 0x34d6130 [0064.259] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.260] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x224c8) returned 0x34d6130 [0064.260] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.260] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x234ec) returned 0x34d6130 [0064.260] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.261] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x24510) returned 0x34d6130 [0064.261] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0x0 [0064.261] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2) returned 0x34d0d30 [0064.261] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0d30) returned 1 [0064.261] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0xe) returned 0x34d0418 [0064.262] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0418) returned 1 [0064.262] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x12) returned 0x34d19a0 [0064.262] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d19a0) returned 1 [0064.262] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1740 [0064.262] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1740) returned 1 [0064.262] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0064.262] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0064.262] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1940 [0064.262] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0064.262] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c6ff8 [0064.262] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6ff8) returned 1 [0064.262] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34c6ff8 [0064.262] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6ff8) returned 1 [0064.262] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1720 [0064.262] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1720) returned 1 [0064.262] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0064.262] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0064.262] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x20) returned 0x34c6ff8 [0064.262] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6ff8) returned 1 [0064.262] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x20) returned 0x34c6e40 [0064.262] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c6e40) returned 1 [0064.262] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1680 [0064.262] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1680) returned 1 [0064.262] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x10) returned 0x34d0460 [0064.262] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0460) returned 1 [0064.263] Sleep (dwMilliseconds=0x64) [0064.417] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.418] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x2048) returned 0x34d6130 [0064.418] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.418] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x306c) returned 0x34d6130 [0064.418] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.418] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x4090) returned 0x34d6130 [0064.418] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.419] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x50b4) returned 0x34d6130 [0064.419] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.419] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x60d8) returned 0x34d6130 [0064.419] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.419] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x70fc) returned 0x34d6130 [0064.419] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.419] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x8120) returned 0x34d6130 [0064.419] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.420] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x9144) returned 0x34d6130 [0064.420] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.420] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0xa168) returned 0x34d6130 [0064.420] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.420] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0xb18c) returned 0x34d6130 [0064.420] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.421] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0xc1b0) returned 0x34d6130 [0064.421] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.421] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0xd1d4) returned 0x34d6130 [0064.421] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.421] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0xe1f8) returned 0x34d6130 [0064.421] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.422] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0xf21c) returned 0x34d6130 [0064.422] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.422] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x10240) returned 0x34d6130 [0064.422] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.422] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x11264) returned 0x34d6130 [0064.422] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.423] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x12288) returned 0x34d6130 [0064.423] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.423] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x132ac) returned 0x34d6130 [0064.423] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.424] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x142d0) returned 0x34d6130 [0064.424] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.424] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x152f4) returned 0x34d6130 [0064.424] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.424] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x16318) returned 0x34d6130 [0064.424] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.425] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1733c) returned 0x34d6130 [0064.425] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.425] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x18360) returned 0x34d6130 [0064.425] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.426] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x19384) returned 0x34d6130 [0064.426] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.426] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1a3a8) returned 0x34d6130 [0064.426] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.427] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1b3cc) returned 0x34d6130 [0064.427] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.427] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1c3f0) returned 0x34d6130 [0064.427] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.427] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1d414) returned 0x34d6130 [0064.427] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.428] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1e438) returned 0x34d6130 [0064.428] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.428] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1f45c) returned 0x34d6130 [0064.428] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.429] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x20480) returned 0x34d6130 [0064.429] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.429] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x214a4) returned 0x34d6130 [0064.429] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.430] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x224c8) returned 0x34d6130 [0064.430] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.430] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x234ec) returned 0x34d6130 [0064.430] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.431] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x24510) returned 0x34d6130 [0064.431] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0x0 [0064.431] Sleep (dwMilliseconds=0x64) [0064.564] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.565] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x2048) returned 0x34d6130 [0064.565] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.565] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x306c) returned 0x34d6130 [0064.565] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.565] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x4090) returned 0x34d6130 [0064.565] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.566] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x50b4) returned 0x34d6130 [0064.566] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.566] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x60d8) returned 0x34d6130 [0064.566] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.566] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x70fc) returned 0x34d6130 [0064.566] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.566] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x8120) returned 0x34d6130 [0064.566] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.567] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x9144) returned 0x34d6130 [0064.567] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.567] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0xa168) returned 0x34d6130 [0064.567] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.567] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0xb18c) returned 0x34d6130 [0064.567] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.568] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0xc1b0) returned 0x34d6130 [0064.568] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.568] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0xd1d4) returned 0x34d6130 [0064.568] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.568] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0xe1f8) returned 0x34d6130 [0064.568] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.569] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0xf21c) returned 0x34d6130 [0064.569] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.569] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x10240) returned 0x34d6130 [0064.569] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.569] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x11264) returned 0x34d6130 [0064.569] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.570] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x12288) returned 0x34d6130 [0064.570] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.570] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x132ac) returned 0x34d6130 [0064.570] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.570] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x142d0) returned 0x34d6130 [0064.570] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.571] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x152f4) returned 0x34d6130 [0064.571] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.571] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x16318) returned 0x34d6130 [0064.571] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.572] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1733c) returned 0x34d6130 [0064.572] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.572] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x18360) returned 0x34d6130 [0064.572] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.572] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x19384) returned 0x34d6130 [0064.572] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.573] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1a3a8) returned 0x34d6130 [0064.573] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.573] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1b3cc) returned 0x34d6130 [0064.573] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.574] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1c3f0) returned 0x34d6130 [0064.574] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.574] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1d414) returned 0x34d6130 [0064.574] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.574] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1e438) returned 0x34d6130 [0064.574] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.575] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1f45c) returned 0x34d6130 [0064.575] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.575] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x20480) returned 0x34d6130 [0064.575] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.576] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x214a4) returned 0x34d6130 [0064.576] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.577] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x224c8) returned 0x34d6130 [0064.577] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.577] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x234ec) returned 0x34d6130 [0064.577] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.578] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x24510) returned 0x34d6130 [0064.578] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0x0 [0064.578] Sleep (dwMilliseconds=0x64) [0064.725] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.726] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x2048) returned 0x34d6130 [0064.726] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.726] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x306c) returned 0x34d6130 [0064.726] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.726] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x4090) returned 0x34d6130 [0064.726] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.727] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x50b4) returned 0x34d6130 [0064.727] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.727] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x60d8) returned 0x34d6130 [0064.727] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.727] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x70fc) returned 0x34d6130 [0064.727] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.728] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x8120) returned 0x34d6130 [0064.728] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.728] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x9144) returned 0x34d6130 [0064.728] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.729] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0xa168) returned 0x34d6130 [0064.729] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.729] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0xb18c) returned 0x34d6130 [0064.730] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.730] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0xc1b0) returned 0x34d6130 [0064.730] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.730] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0xd1d4) returned 0x34d6130 [0064.730] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.731] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0xe1f8) returned 0x34d6130 [0064.731] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.731] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0xf21c) returned 0x34d6130 [0064.731] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.731] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x10240) returned 0x34d6130 [0064.731] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.732] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x11264) returned 0x34d6130 [0064.732] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.733] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x12288) returned 0x34d6130 [0064.733] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.733] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x132ac) returned 0x34d6130 [0064.733] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.734] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x142d0) returned 0x34d6130 [0064.734] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.734] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x152f4) returned 0x34d6130 [0064.734] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.735] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x16318) returned 0x34d6130 [0064.735] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.735] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1733c) returned 0x34d6130 [0064.735] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.736] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x18360) returned 0x34d6130 [0064.736] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.736] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x19384) returned 0x34d6130 [0064.736] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.737] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1a3a8) returned 0x34d6130 [0064.737] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.737] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1b3cc) returned 0x34d6130 [0064.737] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.737] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1c3f0) returned 0x34d6130 [0064.738] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.738] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1d414) returned 0x34d6130 [0064.738] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.738] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1e438) returned 0x34d6130 [0064.739] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.739] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x1f45c) returned 0x34d6130 [0064.739] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.739] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x20480) returned 0x34d6130 [0064.740] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.740] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x214a4) returned 0x34d6130 [0064.740] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.741] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x224c8) returned 0x34d6130 [0064.741] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.741] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x234ec) returned 0x34d6130 [0064.741] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0xc0000004 [0064.742] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d6130, Size=0x24510) returned 0x34d6130 [0064.742] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d6130, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x34d6130, ResultLength=0x0) returned 0x0 [0064.742] Sleep (dwMilliseconds=0x64) [0064.922] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.923] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0x2048) returned 0x34dd050 [0064.923] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.925] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0x306c) returned 0x34dd050 [0064.925] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.925] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0x4090) returned 0x34dd050 [0064.925] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.925] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0x50b4) returned 0x34dd050 [0064.925] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.925] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0x60d8) returned 0x34dd050 [0064.925] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.926] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0x70fc) returned 0x34dd050 [0064.926] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.926] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0x8120) returned 0x34dd050 [0064.926] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.926] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0x9144) returned 0x34dd050 [0064.926] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.926] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0xa168) returned 0x34dd050 [0064.926] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.927] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0xb18c) returned 0x34dd050 [0064.927] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.927] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0xc1b0) returned 0x34dd050 [0064.927] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.927] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0xd1d4) returned 0x34dd050 [0064.927] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.928] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0xe1f8) returned 0x34dd050 [0064.929] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.929] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0xf21c) returned 0x34dd050 [0064.929] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.929] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0x10240) returned 0x34dd050 [0064.929] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.930] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0x11264) returned 0x34dd050 [0064.930] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.930] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0x12288) returned 0x34dd050 [0064.930] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.930] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0x132ac) returned 0x34dd050 [0064.930] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.931] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0x142d0) returned 0x34dd050 [0064.931] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.931] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0x152f4) returned 0x34dd050 [0064.931] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.932] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0x16318) returned 0x34dd050 [0064.932] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.932] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0x1733c) returned 0x34dd050 [0064.932] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.932] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0x18360) returned 0x34dd050 [0064.932] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.933] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0x19384) returned 0x34dd050 [0064.933] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.933] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0x1a3a8) returned 0x34dd050 [0064.933] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.934] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0x1b3cc) returned 0x34dd050 [0064.934] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.934] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0x1c3f0) returned 0x34dd050 [0064.934] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.935] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0x1d414) returned 0x34dd050 [0064.935] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.936] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0x1e438) returned 0x34dd050 [0064.936] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.936] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0x1f45c) returned 0x34dd050 [0064.936] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.937] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0x20480) returned 0x34dd050 [0064.937] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.937] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0x214a4) returned 0x34dd050 [0064.937] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.938] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0x224c8) returned 0x34dd050 [0064.938] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.938] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0x234ec) returned 0x34dd050 [0064.939] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.939] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0x24510) returned 0x34dd050 [0064.939] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0064.940] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0x25534) returned 0x34dd050 [0064.940] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0x0 [0064.940] Sleep (dwMilliseconds=0x64) [0065.142] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dd050, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34dd050, ResultLength=0x0) returned 0xc0000004 [0065.146] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dd050, Size=0x2048) returned 0x34df2e0 [0065.146] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.146] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0x306c) returned 0x34df2e0 [0065.146] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.146] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0x4090) returned 0x34df2e0 [0065.146] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.146] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0x50b4) returned 0x34df2e0 [0065.146] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.147] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0x60d8) returned 0x34df2e0 [0065.147] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.147] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0x70fc) returned 0x34df2e0 [0065.147] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.147] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0x8120) returned 0x34df2e0 [0065.147] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.148] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0x9144) returned 0x34df2e0 [0065.148] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.148] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0xa168) returned 0x34df2e0 [0065.148] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.148] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0xb18c) returned 0x34df2e0 [0065.148] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.148] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0xc1b0) returned 0x34df2e0 [0065.149] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.149] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0xd1d4) returned 0x34df2e0 [0065.149] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.149] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0xe1f8) returned 0x34df2e0 [0065.149] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.149] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0xf21c) returned 0x34df2e0 [0065.150] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.150] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0x10240) returned 0x34df2e0 [0065.150] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.150] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0x11264) returned 0x34df2e0 [0065.150] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.151] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0x12288) returned 0x34df2e0 [0065.151] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.151] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0x132ac) returned 0x34df2e0 [0065.151] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.151] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0x142d0) returned 0x34df2e0 [0065.151] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.152] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0x152f4) returned 0x34df2e0 [0065.152] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.152] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0x16318) returned 0x34df2e0 [0065.152] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.153] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0x1733c) returned 0x34df2e0 [0065.153] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.153] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0x18360) returned 0x34df2e0 [0065.153] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.153] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0x19384) returned 0x34df2e0 [0065.153] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.154] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0x1a3a8) returned 0x34df2e0 [0065.154] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.154] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0x1b3cc) returned 0x34df2e0 [0065.155] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.155] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0x1c3f0) returned 0x34df2e0 [0065.155] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.155] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0x1d414) returned 0x34df2e0 [0065.155] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.156] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0x1e438) returned 0x34df2e0 [0065.156] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.156] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0x1f45c) returned 0x34df2e0 [0065.156] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.157] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0x20480) returned 0x34df2e0 [0065.157] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.157] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0x214a4) returned 0x34df2e0 [0065.157] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.158] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0x224c8) returned 0x34df2e0 [0065.158] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.158] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0x234ec) returned 0x34df2e0 [0065.158] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.159] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0x24510) returned 0x34df2e0 [0065.159] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0xc0000004 [0065.159] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34df2e0, Size=0x25534) returned 0x34df2e0 [0065.159] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34df2e0, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x34df2e0, ResultLength=0x0) returned 0x0 [0065.160] Sleep (dwMilliseconds=0x64) [0065.269] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34d8de8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34d8de8, ResultLength=0x0) returned 0xc0000004 [0065.270] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34d8de8, Size=0x2048) returned 0x34dbf28 [0065.270] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34dbf28, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34dbf28, ResultLength=0x0) returned 0xc0000004 [0065.270] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34dbf28, Size=0x306c) returned 0x34e52c0 [0065.270] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0xc0000004 [0065.270] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52c0, Size=0x4090) returned 0x34e52c0 [0065.270] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0xc0000004 [0065.271] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52c0, Size=0x50b4) returned 0x34e52c0 [0065.271] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0xc0000004 [0065.271] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52c0, Size=0x60d8) returned 0x34e52c0 [0065.271] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0xc0000004 [0065.271] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52c0, Size=0x70fc) returned 0x34e52c0 [0065.271] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0xc0000004 [0065.272] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52c0, Size=0x8120) returned 0x34e52c0 [0065.272] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0xc0000004 [0065.272] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52c0, Size=0x9144) returned 0x34e52c0 [0065.272] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0xc0000004 [0065.273] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52c0, Size=0xa168) returned 0x34e52c0 [0065.273] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0xc0000004 [0065.274] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52c0, Size=0xb18c) returned 0x34e52c0 [0065.274] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0xc0000004 [0065.274] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52c0, Size=0xc1b0) returned 0x34e52c0 [0065.274] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0xc0000004 [0065.274] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52c0, Size=0xd1d4) returned 0x34e52c0 [0065.275] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0xc0000004 [0065.275] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52c0, Size=0xe1f8) returned 0x34e52c0 [0065.275] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0xc0000004 [0065.275] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52c0, Size=0xf21c) returned 0x34e52c0 [0065.275] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0xc0000004 [0065.276] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52c0, Size=0x10240) returned 0x34e52c0 [0065.276] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0xc0000004 [0065.276] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52c0, Size=0x11264) returned 0x34e52c0 [0065.276] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0xc0000004 [0065.277] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52c0, Size=0x12288) returned 0x34e52c0 [0065.277] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0xc0000004 [0065.277] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52c0, Size=0x132ac) returned 0x34e52c0 [0065.277] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0xc0000004 [0065.277] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52c0, Size=0x142d0) returned 0x34e52c0 [0065.277] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0xc0000004 [0065.278] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52c0, Size=0x152f4) returned 0x34e52c0 [0065.278] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0xc0000004 [0065.278] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52c0, Size=0x16318) returned 0x34e52c0 [0065.278] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0xc0000004 [0065.279] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52c0, Size=0x1733c) returned 0x34e52c0 [0065.279] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0xc0000004 [0065.280] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52c0, Size=0x18360) returned 0x34e52c0 [0065.280] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0xc0000004 [0065.280] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52c0, Size=0x19384) returned 0x34e52c0 [0065.280] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0xc0000004 [0065.281] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52c0, Size=0x1a3a8) returned 0x34e52c0 [0065.281] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0xc0000004 [0065.281] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52c0, Size=0x1b3cc) returned 0x34e52c0 [0065.281] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0xc0000004 [0065.282] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52c0, Size=0x1c3f0) returned 0x34e52c0 [0065.282] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0xc0000004 [0065.282] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52c0, Size=0x1d414) returned 0x34e52c0 [0065.282] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0xc0000004 [0065.283] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52c0, Size=0x1e438) returned 0x34e52c0 [0065.283] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0xc0000004 [0065.283] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52c0, Size=0x1f45c) returned 0x34e52c0 [0065.283] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0xc0000004 [0065.284] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52c0, Size=0x20480) returned 0x34e52c0 [0065.284] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0xc0000004 [0065.284] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52c0, Size=0x214a4) returned 0x34e52c0 [0065.285] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0xc0000004 [0065.285] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52c0, Size=0x224c8) returned 0x3506770 [0065.287] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3506770, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x3506770, ResultLength=0x0) returned 0xc0000004 [0065.288] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3506770, Size=0x234ec) returned 0x3506770 [0065.288] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3506770, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x3506770, ResultLength=0x0) returned 0xc0000004 [0065.288] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3506770, Size=0x24510) returned 0x3529c68 [0065.291] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3529c68, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x3529c68, ResultLength=0x0) returned 0xc0000004 [0065.291] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3529c68, Size=0x25534) returned 0x34e52c0 [0065.291] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52c0, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x34e52c0, ResultLength=0x0) returned 0x0 [0065.292] Sleep (dwMilliseconds=0x64) [0065.463] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e74f8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34e74f8, ResultLength=0x0) returned 0xc0000004 [0065.464] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e74f8, Size=0x2048) returned 0x34f52f0 [0065.464] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34f52f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34f52f0, ResultLength=0x0) returned 0xc0000004 [0065.464] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34f52f0, Size=0x306c) returned 0x35152d0 [0065.464] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.464] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0x4090) returned 0x35152d0 [0065.464] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.464] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0x50b4) returned 0x35152d0 [0065.464] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.465] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0x60d8) returned 0x35152d0 [0065.465] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.465] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0x70fc) returned 0x35152d0 [0065.465] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.465] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0x8120) returned 0x35152d0 [0065.465] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.465] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0x9144) returned 0x35152d0 [0065.465] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.466] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0xa168) returned 0x35152d0 [0065.466] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.466] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0xb18c) returned 0x35152d0 [0065.466] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.467] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0xc1b0) returned 0x35152d0 [0065.467] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.467] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0xd1d4) returned 0x35152d0 [0065.467] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.467] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0xe1f8) returned 0x35152d0 [0065.467] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.468] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0xf21c) returned 0x35152d0 [0065.468] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.468] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0x10240) returned 0x35152d0 [0065.468] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.468] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0x11264) returned 0x35152d0 [0065.468] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.469] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0x12288) returned 0x35152d0 [0065.469] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.469] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0x132ac) returned 0x35152d0 [0065.469] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.469] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0x142d0) returned 0x35152d0 [0065.469] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.470] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0x152f4) returned 0x35152d0 [0065.470] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.470] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0x16318) returned 0x35152d0 [0065.470] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.471] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0x1733c) returned 0x35152d0 [0065.471] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.471] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0x18360) returned 0x35152d0 [0065.471] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.471] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0x19384) returned 0x35152d0 [0065.471] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.472] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0x1a3a8) returned 0x35152d0 [0065.472] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.472] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0x1b3cc) returned 0x35152d0 [0065.472] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.473] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0x1c3f0) returned 0x35152d0 [0065.473] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.473] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0x1d414) returned 0x35152d0 [0065.473] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.473] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0x1e438) returned 0x35152d0 [0065.474] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.474] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0x1f45c) returned 0x35152d0 [0065.474] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.474] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0x20480) returned 0x35152d0 [0065.474] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.475] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0x214a4) returned 0x35152d0 [0065.475] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.475] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0x224c8) returned 0x35152d0 [0065.475] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.476] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0x234ec) returned 0x35152d0 [0065.476] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.476] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0x24510) returned 0x35152d0 [0065.476] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0xc0000004 [0065.477] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x35152d0, Size=0x25534) returned 0x35152d0 [0065.477] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35152d0, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x35152d0, ResultLength=0x0) returned 0x0 [0065.477] Sleep (dwMilliseconds=0x64) [0065.617] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e63f0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34e63f0, ResultLength=0x0) returned 0xc0000004 [0065.617] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e63f0, Size=0x2048) returned 0x34f52f0 [0065.617] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34f52f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34f52f0, ResultLength=0x0) returned 0xc0000004 [0065.617] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34f52f0, Size=0x306c) returned 0x3519850 [0065.617] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.618] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0x4090) returned 0x3519850 [0065.618] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.618] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0x50b4) returned 0x3519850 [0065.618] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.618] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0x60d8) returned 0x3519850 [0065.618] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.618] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0x70fc) returned 0x3519850 [0065.618] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.619] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0x8120) returned 0x3519850 [0065.619] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.619] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0x9144) returned 0x3519850 [0065.619] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.619] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0xa168) returned 0x3519850 [0065.619] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.620] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0xb18c) returned 0x3519850 [0065.620] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.620] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0xc1b0) returned 0x3519850 [0065.620] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.620] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0xd1d4) returned 0x3519850 [0065.620] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.621] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0xe1f8) returned 0x3519850 [0065.621] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.621] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0xf21c) returned 0x3519850 [0065.621] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.621] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0x10240) returned 0x3519850 [0065.621] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.622] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0x11264) returned 0x3519850 [0065.622] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.622] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0x12288) returned 0x3519850 [0065.622] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.625] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0x132ac) returned 0x3519850 [0065.625] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.626] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0x142d0) returned 0x3519850 [0065.626] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.626] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0x152f4) returned 0x3519850 [0065.626] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.627] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0x16318) returned 0x3519850 [0065.627] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.627] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0x1733c) returned 0x3519850 [0065.627] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.627] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0x18360) returned 0x3519850 [0065.627] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.628] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0x19384) returned 0x3519850 [0065.628] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.628] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0x1a3a8) returned 0x3519850 [0065.628] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.629] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0x1b3cc) returned 0x3519850 [0065.629] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.629] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0x1c3f0) returned 0x3519850 [0065.629] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.630] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0x1d414) returned 0x3519850 [0065.630] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.630] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0x1e438) returned 0x3519850 [0065.630] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.630] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0x1f45c) returned 0x3519850 [0065.630] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.631] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0x20480) returned 0x3519850 [0065.631] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.631] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0x214a4) returned 0x3519850 [0065.631] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.632] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0x224c8) returned 0x3519850 [0065.632] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.632] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0x234ec) returned 0x3519850 [0065.632] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.633] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0x24510) returned 0x3519850 [0065.633] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0xc0000004 [0065.633] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3519850, Size=0x25534) returned 0x3519850 [0065.633] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3519850, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x3519850, ResultLength=0x0) returned 0x0 [0065.634] Sleep (dwMilliseconds=0x64) [0065.833] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34e52e8, ResultLength=0x0) returned 0xc0000004 [0065.840] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52e8, Size=0x2048) returned 0x3504128 [0065.840] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3504128, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x3504128, ResultLength=0x0) returned 0xc0000004 [0065.840] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3504128, Size=0x306c) returned 0x351d3e8 [0065.840] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.841] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0065.841] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.841] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0065.841] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.841] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0065.841] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.842] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0065.842] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.842] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0065.842] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.842] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0065.842] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.844] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0065.844] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.844] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0065.844] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.845] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0065.845] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.845] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0065.845] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.845] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0065.845] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.846] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0065.846] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.846] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0065.846] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.847] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0065.847] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.847] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0065.847] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.847] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0065.847] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.848] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0065.848] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.848] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0065.848] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.849] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0065.849] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.849] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0065.849] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.850] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0065.850] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.850] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0065.850] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.851] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0065.851] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.851] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0065.851] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.852] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0065.852] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.852] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0065.852] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.853] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0065.853] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.853] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0065.853] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.854] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0065.854] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.854] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0065.854] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.855] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0065.855] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.855] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0065.855] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.856] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0065.856] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0065.857] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x25534) returned 0x351d3e8 [0065.857] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0065.859] Sleep (dwMilliseconds=0x64) [0066.045] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34eca20, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34eca20, ResultLength=0x0) returned 0xc0000004 [0066.046] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34eca20, Size=0x2048) returned 0x34f74f8 [0066.046] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34f74f8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34f74f8, ResultLength=0x0) returned 0xc0000004 [0066.046] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34f74f8, Size=0x306c) returned 0x351d3e8 [0066.047] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.047] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0066.047] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.047] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0066.047] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.048] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0066.048] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.048] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0066.048] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.048] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0066.049] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.049] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0066.049] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.050] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0066.050] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.051] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0066.051] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.051] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0066.051] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.051] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0066.052] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.052] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0066.052] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.052] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0066.052] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.053] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0066.053] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.053] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0066.053] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.054] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0066.054] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.054] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0066.054] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.055] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0066.055] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.055] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0066.055] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.056] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0066.056] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.056] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0066.056] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.057] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0066.057] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.057] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0066.057] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.058] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0066.058] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.058] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0066.058] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.059] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0066.059] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.059] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0066.059] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.063] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0066.063] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.063] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0066.063] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.064] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0066.064] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.064] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0066.064] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.065] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0066.065] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.065] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0066.066] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.066] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0066.066] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.067] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x25534) returned 0x351d3e8 [0066.067] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0066.067] Sleep (dwMilliseconds=0x64) [0066.252] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e74f8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34e74f8, ResultLength=0x0) returned 0xc0000004 [0066.252] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e74f8, Size=0x2048) returned 0x34fdb10 [0066.252] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34fdb10, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34fdb10, ResultLength=0x0) returned 0xc0000004 [0066.253] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34fdb10, Size=0x306c) returned 0x351d3e8 [0066.253] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.253] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0066.253] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.253] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0066.253] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.253] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0066.253] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.254] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0066.254] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.254] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0066.254] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.254] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0066.254] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.254] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0066.254] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.255] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0066.255] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.255] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0066.255] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.255] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0066.255] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.256] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0066.256] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.256] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0066.256] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.256] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0066.256] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.257] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0066.257] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.257] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0066.257] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.257] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0066.258] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.258] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0066.258] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.258] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0066.258] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.259] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0066.259] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.259] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0066.259] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.259] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0066.260] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.260] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0066.260] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.260] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0066.260] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.261] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0066.261] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.261] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0066.261] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.262] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0066.262] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.262] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0066.262] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.262] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0066.262] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.263] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0066.263] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.264] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0066.264] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.264] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0066.264] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.265] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0066.265] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.265] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0066.265] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.266] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x25534) returned 0x351d3e8 [0066.266] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0066.266] Sleep (dwMilliseconds=0x64) [0066.389] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e74f8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34e74f8, ResultLength=0x0) returned 0xc0000004 [0066.389] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e74f8, Size=0x2048) returned 0x34f52f0 [0066.389] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34f52f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34f52f0, ResultLength=0x0) returned 0xc0000004 [0066.389] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34f52f0, Size=0x306c) returned 0x351d3e8 [0066.390] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.390] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0066.390] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.390] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0066.390] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.390] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0066.390] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.390] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0066.390] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.391] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0066.391] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.391] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0066.391] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.391] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0066.391] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.392] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0066.392] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.392] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0066.392] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.392] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0066.392] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.393] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0066.393] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.393] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0066.393] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.393] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0066.393] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.394] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0066.394] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.394] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0066.394] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.394] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0066.394] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.395] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0066.395] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.395] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0066.395] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.396] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0066.396] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.396] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0066.396] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.396] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0066.396] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.397] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0066.397] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.397] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0066.397] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.398] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0066.398] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.398] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0066.398] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.398] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0066.398] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.399] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0066.399] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.399] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0066.399] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.400] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0066.400] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.400] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0066.400] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.401] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0066.401] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.401] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0066.401] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.402] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0066.402] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.402] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x25534) returned 0x351d3e8 [0066.402] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0066.403] Sleep (dwMilliseconds=0x64) [0066.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34e52e8, ResultLength=0x0) returned 0xc0000004 [0066.596] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52e8, Size=0x2048) returned 0x34ffd18 [0066.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34ffd18, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34ffd18, ResultLength=0x0) returned 0xc0000004 [0066.597] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34ffd18, Size=0x306c) returned 0x351d3e8 [0066.597] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.597] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0066.597] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.597] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0066.597] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.597] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0066.597] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.598] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0066.598] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.598] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0066.598] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.598] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0066.598] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.598] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0066.598] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.599] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0066.599] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.599] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0066.599] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.599] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0066.599] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.600] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0066.600] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.600] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0066.600] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.600] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0066.600] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.601] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0066.601] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.601] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0066.601] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.602] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0066.602] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.602] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0066.602] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.602] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0066.602] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.603] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0066.603] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.603] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0066.603] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.603] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0066.603] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.604] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0066.604] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.604] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0066.604] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.605] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0066.605] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.605] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0066.605] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.606] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0066.606] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.606] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0066.606] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.606] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0066.606] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.607] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0066.607] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.608] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0066.608] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.608] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0066.608] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.609] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0066.609] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.609] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0066.609] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.610] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x25534) returned 0x351d3e8 [0066.610] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0066.610] Sleep (dwMilliseconds=0x64) [0066.742] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34eb918, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34eb918, ResultLength=0x0) returned 0xc0000004 [0066.742] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34eb918, Size=0x2048) returned 0x3504128 [0066.742] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3504128, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x3504128, ResultLength=0x0) returned 0xc0000004 [0066.743] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3504128, Size=0x306c) returned 0x351d3e8 [0066.743] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.743] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0066.743] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.743] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0066.743] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.743] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0066.743] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.744] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0066.744] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.744] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0066.744] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.744] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0066.744] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.745] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0066.745] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.745] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0066.745] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.745] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0066.745] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.746] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0066.746] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.746] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0066.746] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.746] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0066.746] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.747] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0066.747] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.747] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0066.747] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.747] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0066.747] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.748] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0066.748] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.748] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0066.748] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.749] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0066.749] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.749] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0066.749] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.749] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0066.750] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.750] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0066.750] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.750] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0066.750] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.751] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0066.751] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.751] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0066.751] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.751] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0066.752] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.752] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0066.752] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.752] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0066.752] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.753] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0066.753] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.753] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0066.753] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.754] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0066.754] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.754] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0066.754] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.755] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0066.755] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.755] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0066.755] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.755] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x25534) returned 0x351d3e8 [0066.756] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0066.756] Sleep (dwMilliseconds=0x64) [0066.907] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34eca20, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34eca20, ResultLength=0x0) returned 0xc0000004 [0066.910] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34eca20, Size=0x2048) returned 0x3504128 [0066.910] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3504128, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x3504128, ResultLength=0x0) returned 0xc0000004 [0066.915] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3504128, Size=0x306c) returned 0x351d3e8 [0066.915] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.915] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0066.915] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.915] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0066.915] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.916] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0066.916] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.916] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0066.916] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.916] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0066.916] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.916] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0066.916] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.917] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0066.917] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.917] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0066.917] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.917] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0066.917] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.918] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0066.918] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.918] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0066.918] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.918] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0066.918] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.919] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0066.919] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.919] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0066.919] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.920] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0066.920] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.920] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0066.920] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.920] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0066.920] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.921] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0066.921] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.921] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0066.921] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.922] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0066.922] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.922] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0066.922] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.922] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0066.922] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.923] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0066.923] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.924] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0066.924] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.925] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0066.925] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.925] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0066.925] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.925] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0066.925] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.926] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0066.926] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.926] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0066.926] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.927] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0066.927] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.927] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0066.927] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.928] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0066.928] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.928] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0066.928] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0066.929] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x25534) returned 0x351d3e8 [0066.929] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0066.929] Sleep (dwMilliseconds=0x64) [0067.181] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34ea810, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34ea810, ResultLength=0x0) returned 0xc0000004 [0067.181] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34ea810, Size=0x2048) returned 0x3504128 [0067.181] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3504128, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x3504128, ResultLength=0x0) returned 0xc0000004 [0067.182] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3504128, Size=0x306c) returned 0x351d3e8 [0067.182] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.182] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0067.182] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.182] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0067.182] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.182] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0067.182] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.183] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0067.183] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.183] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0067.183] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.183] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0067.183] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.184] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0067.184] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.184] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0067.184] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.184] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0067.184] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.185] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0067.185] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.187] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0067.187] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.188] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0067.188] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.188] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0067.188] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.189] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0067.189] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.189] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0067.189] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.189] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0067.189] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.190] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0067.190] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.190] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0067.190] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.190] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0067.191] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.191] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0067.191] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.191] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0067.191] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.192] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0067.192] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.192] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0067.192] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.193] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0067.193] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.193] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0067.193] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.193] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0067.193] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.194] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0067.194] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.194] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0067.194] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.195] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0067.195] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.195] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0067.195] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.196] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0067.196] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.196] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0067.196] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.197] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0067.197] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0067.197] Sleep (dwMilliseconds=0x64) [0067.324] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e63f0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34e63f0, ResultLength=0x0) returned 0xc0000004 [0067.324] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e63f0, Size=0x2048) returned 0x34fdb10 [0067.324] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34fdb10, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34fdb10, ResultLength=0x0) returned 0xc0000004 [0067.324] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34fdb10, Size=0x306c) returned 0x351d3e8 [0067.325] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.325] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0067.325] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.325] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0067.325] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.325] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0067.325] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.325] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0067.326] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.326] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0067.326] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.326] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0067.326] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.327] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0067.327] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.327] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0067.327] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.327] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0067.327] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.327] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0067.328] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.328] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0067.328] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.328] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0067.328] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.329] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0067.329] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.329] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0067.329] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.329] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0067.329] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.330] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0067.330] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.330] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0067.330] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.330] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0067.330] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.331] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0067.331] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.331] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0067.331] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.332] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0067.332] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.332] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0067.332] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.332] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0067.332] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.333] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0067.333] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.333] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0067.333] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.334] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0067.334] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.334] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0067.334] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.335] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0067.335] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.335] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0067.335] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.335] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0067.335] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.336] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0067.336] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.336] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0067.336] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.337] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0067.337] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0067.337] Sleep (dwMilliseconds=0x64) [0067.501] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e74f8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34e74f8, ResultLength=0x0) returned 0xc0000004 [0067.501] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e74f8, Size=0x2048) returned 0x34f9700 [0067.501] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34f9700, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34f9700, ResultLength=0x0) returned 0xc0000004 [0067.502] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34f9700, Size=0x306c) returned 0x351d3e8 [0067.502] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.502] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0067.502] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.502] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0067.502] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.502] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0067.502] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.503] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0067.503] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.503] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0067.503] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.503] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0067.503] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.504] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0067.504] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.504] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0067.504] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.504] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0067.504] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.504] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0067.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.505] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0067.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.505] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0067.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.505] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0067.506] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.506] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0067.506] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.506] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0067.506] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.507] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0067.507] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.507] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0067.507] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.507] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0067.507] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.508] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0067.508] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.508] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0067.508] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.509] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0067.509] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.509] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0067.509] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.509] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0067.509] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.510] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0067.510] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.510] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0067.510] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.511] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0067.511] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.511] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0067.511] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.511] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0067.511] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.512] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0067.512] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.512] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0067.512] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.513] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0067.513] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.516] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0067.516] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.517] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0067.517] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0067.517] Sleep (dwMilliseconds=0x64) [0067.695] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34ea810, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34ea810, ResultLength=0x0) returned 0xc0000004 [0067.696] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34ea810, Size=0x2048) returned 0x3504128 [0067.696] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3504128, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x3504128, ResultLength=0x0) returned 0xc0000004 [0067.696] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3504128, Size=0x306c) returned 0x351d3e8 [0067.696] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.696] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0067.696] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.697] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0067.697] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.697] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0067.697] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.697] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0067.697] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.697] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0067.697] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.698] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0067.698] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.698] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0067.698] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.698] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0067.698] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.699] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0067.699] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.699] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0067.699] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.699] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0067.699] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.699] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0067.700] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.700] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0067.700] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.700] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0067.700] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.701] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0067.701] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.701] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0067.701] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.702] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0067.702] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.702] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0067.702] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.702] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0067.702] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.703] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0067.703] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.703] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0067.703] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.704] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0067.704] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.704] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0067.704] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.704] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0067.704] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.705] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0067.705] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.705] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0067.705] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.706] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0067.706] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.706] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0067.706] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.706] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0067.707] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.707] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0067.707] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.707] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0067.707] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.708] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0067.708] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.708] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0067.708] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0067.709] Sleep (dwMilliseconds=0x64) [0067.866] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e9708, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34e9708, ResultLength=0x0) returned 0xc0000004 [0067.866] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e9708, Size=0x2048) returned 0x3501f20 [0067.866] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3501f20, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x3501f20, ResultLength=0x0) returned 0xc0000004 [0067.867] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3501f20, Size=0x306c) returned 0x351d3e8 [0067.867] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.867] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0067.867] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.867] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0067.867] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.867] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0067.867] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.868] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0067.868] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.868] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0067.868] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.868] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0067.868] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.868] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0067.868] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.869] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0067.869] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.869] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0067.869] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.869] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0067.869] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.870] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0067.870] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.870] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0067.870] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.870] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0067.870] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.871] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0067.871] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.871] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0067.871] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.871] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0067.872] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.872] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0067.872] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.872] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0067.872] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.873] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0067.873] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.874] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0067.874] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.874] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0067.874] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.874] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0067.874] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.875] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0067.875] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.875] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0067.875] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.876] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0067.876] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.876] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0067.876] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.876] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0067.876] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.877] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0067.877] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.877] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0067.877] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.878] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0067.878] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.878] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0067.878] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.879] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0067.879] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0067.879] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0067.879] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0067.880] Sleep (dwMilliseconds=0x64) [0068.013] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e9708, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34e9708, ResultLength=0x0) returned 0xc0000004 [0068.014] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e9708, Size=0x2048) returned 0x34fb908 [0068.014] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34fb908, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34fb908, ResultLength=0x0) returned 0xc0000004 [0068.014] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34fb908, Size=0x306c) returned 0x351d3e8 [0068.014] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.014] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0068.015] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.015] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0068.015] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.015] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0068.015] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.015] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0068.015] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.015] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0068.016] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.016] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0068.016] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.016] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0068.016] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.016] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0068.016] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.017] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0068.017] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.017] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0068.017] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.017] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0068.017] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.018] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0068.018] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.018] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0068.018] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.018] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0068.018] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.019] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0068.019] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.019] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0068.019] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.019] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0068.019] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.020] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0068.020] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.020] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0068.020] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.021] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0068.021] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.021] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0068.021] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.021] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0068.021] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.022] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0068.022] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.022] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0068.022] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.023] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0068.023] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.023] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0068.023] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.023] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0068.023] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.024] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0068.024] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.024] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0068.024] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.025] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0068.025] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.025] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0068.025] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.026] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0068.026] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.026] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0068.026] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0068.027] Sleep (dwMilliseconds=0x64) [0068.193] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e8600, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34e8600, ResultLength=0x0) returned 0xc0000004 [0068.194] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e8600, Size=0x2048) returned 0x3501f20 [0068.194] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3501f20, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x3501f20, ResultLength=0x0) returned 0xc0000004 [0068.200] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3501f20, Size=0x306c) returned 0x351d3e8 [0068.200] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.201] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0068.201] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.201] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0068.201] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.201] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0068.201] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.202] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0068.202] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.202] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0068.202] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.202] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0068.202] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.202] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0068.203] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.203] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0068.203] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.203] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0068.203] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.204] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0068.204] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.204] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0068.204] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.204] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0068.204] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.205] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0068.205] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.205] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0068.205] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.205] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0068.205] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.206] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0068.206] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.206] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0068.206] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.207] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0068.207] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.207] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0068.207] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.208] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0068.208] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.208] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0068.208] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.208] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0068.208] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.209] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0068.209] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.209] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0068.209] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.210] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0068.210] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.210] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0068.210] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.211] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0068.211] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.211] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0068.211] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.212] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0068.212] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.212] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0068.212] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.213] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0068.213] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.213] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0068.213] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.213] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0068.213] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0068.214] Sleep (dwMilliseconds=0x64) [0068.595] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34eb918, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34eb918, ResultLength=0x0) returned 0xc0000004 [0068.596] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34eb918, Size=0x2048) returned 0x3504128 [0068.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3504128, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x3504128, ResultLength=0x0) returned 0xc0000004 [0068.596] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3504128, Size=0x306c) returned 0x351d3e8 [0068.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.596] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0068.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.597] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0068.597] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.598] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0068.598] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.598] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0068.598] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.599] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0068.599] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.599] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0068.599] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.599] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0068.599] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.599] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0068.600] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.601] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0068.601] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.601] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0068.601] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.601] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0068.601] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.601] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0068.602] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.602] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0068.602] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.603] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0068.603] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.604] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0068.604] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.604] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0068.604] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.604] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0068.604] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.605] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0068.605] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.608] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0068.608] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.608] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0068.608] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.609] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0068.609] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.609] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0068.609] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.609] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0068.609] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.610] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0068.610] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.610] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0068.610] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.611] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0068.611] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.611] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0068.611] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.612] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0068.612] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.612] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0068.612] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.612] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0068.612] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.613] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0068.613] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.614] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0068.614] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.614] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0068.614] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0068.615] Sleep (dwMilliseconds=0x64) [0068.832] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34eb918, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34eb918, ResultLength=0x0) returned 0xc0000004 [0068.833] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34eb918, Size=0x2048) returned 0x3501f20 [0068.833] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3501f20, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x3501f20, ResultLength=0x0) returned 0xc0000004 [0068.833] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3501f20, Size=0x306c) returned 0x351d3e8 [0068.833] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.833] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0068.833] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.834] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0068.834] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.834] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0068.834] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.834] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0068.834] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.834] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0068.834] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.835] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0068.835] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.835] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0068.835] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.835] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0068.835] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.836] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0068.836] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.836] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0068.836] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.836] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0068.836] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.837] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0068.837] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.837] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0068.837] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.837] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0068.837] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.838] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0068.838] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.838] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0068.838] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.838] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0068.838] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.839] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0068.839] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.839] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0068.839] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.839] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0068.840] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.840] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0068.840] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.840] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0068.840] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.841] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0068.841] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.841] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0068.841] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.842] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0068.842] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.842] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0068.842] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.842] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0068.842] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.843] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0068.843] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.843] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0068.843] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.844] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0068.844] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.844] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0068.844] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.845] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0068.845] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0068.845] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0068.845] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0068.846] Sleep (dwMilliseconds=0x64) [0069.036] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34ea810, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34ea810, ResultLength=0x0) returned 0xc0000004 [0069.037] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34ea810, Size=0x2048) returned 0x3501f20 [0069.037] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3501f20, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x3501f20, ResultLength=0x0) returned 0xc0000004 [0069.037] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3501f20, Size=0x306c) returned 0x351d3e8 [0069.037] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.037] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0069.037] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.038] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0069.038] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.038] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0069.038] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.038] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0069.038] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.038] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0069.038] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.039] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0069.039] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.039] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0069.039] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.039] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0069.039] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.040] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0069.040] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.040] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0069.040] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.040] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0069.040] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.041] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0069.041] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.041] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0069.041] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.041] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0069.041] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.042] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0069.042] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.042] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0069.042] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.042] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0069.042] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.043] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0069.043] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.043] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0069.043] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.044] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0069.044] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.044] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0069.044] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.044] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0069.044] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.045] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0069.045] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.045] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0069.045] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.046] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0069.046] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.046] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0069.046] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.046] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0069.046] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.047] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0069.047] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.047] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0069.047] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.048] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0069.048] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.048] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0069.048] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.049] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0069.049] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.049] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0069.049] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0069.050] Sleep (dwMilliseconds=0x64) [0069.242] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e8600, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34e8600, ResultLength=0x0) returned 0xc0000004 [0069.246] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e8600, Size=0x2048) returned 0x34ffd18 [0069.246] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34ffd18, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34ffd18, ResultLength=0x0) returned 0xc0000004 [0069.246] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34ffd18, Size=0x306c) returned 0x351d3e8 [0069.246] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.247] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0069.247] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.247] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0069.247] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.247] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0069.247] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.248] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0069.248] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.248] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0069.248] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.248] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0069.248] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.250] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0069.250] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.250] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0069.250] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.250] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0069.250] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.251] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0069.251] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.251] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0069.251] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.251] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0069.251] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.252] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0069.252] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.252] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0069.252] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.253] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0069.253] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.253] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0069.253] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.253] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0069.254] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.254] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0069.254] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.254] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0069.254] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.255] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0069.255] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.255] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0069.255] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.256] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0069.256] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.256] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0069.256] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.257] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0069.257] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.257] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0069.257] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.258] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0069.258] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.258] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0069.258] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.259] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0069.259] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.259] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0069.259] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.260] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0069.260] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.260] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0069.260] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.261] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0069.261] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.262] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0069.262] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0069.263] Sleep (dwMilliseconds=0x64) [0069.458] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34eb918, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34eb918, ResultLength=0x0) returned 0xc0000004 [0069.458] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34eb918, Size=0x2048) returned 0x34f74f8 [0069.458] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34f74f8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34f74f8, ResultLength=0x0) returned 0xc0000004 [0069.459] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34f74f8, Size=0x306c) returned 0x351d3e8 [0069.459] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.459] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0069.459] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.459] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0069.459] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.459] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0069.459] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.460] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0069.460] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.460] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0069.460] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.460] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0069.460] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.460] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0069.460] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.461] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0069.461] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.461] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0069.461] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.461] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0069.461] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.462] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0069.462] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.462] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0069.462] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.462] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0069.462] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.463] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0069.463] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.463] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0069.463] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.463] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0069.463] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.464] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0069.464] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.464] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0069.464] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.465] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0069.465] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.465] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0069.465] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.465] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0069.465] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.466] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0069.466] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.466] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0069.466] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.467] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0069.467] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.467] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0069.467] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.467] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0069.467] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.468] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0069.468] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.468] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0069.468] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.469] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0069.469] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.469] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0069.469] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.470] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0069.470] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.470] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0069.470] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.470] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0069.471] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0069.471] Sleep (dwMilliseconds=0x64) [0069.684] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e9708, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34e9708, ResultLength=0x0) returned 0xc0000004 [0069.685] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e9708, Size=0x2048) returned 0x34fb908 [0069.685] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34fb908, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34fb908, ResultLength=0x0) returned 0xc0000004 [0069.685] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34fb908, Size=0x306c) returned 0x351d3e8 [0069.685] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.685] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0069.685] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.685] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0069.685] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.686] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0069.686] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.686] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0069.686] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.686] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0069.686] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.686] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0069.686] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.687] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0069.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.687] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0069.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.687] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0069.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.688] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0069.688] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.688] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0069.688] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.688] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0069.688] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.689] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0069.689] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.689] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0069.689] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.689] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0069.689] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.690] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0069.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.690] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0069.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.690] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0069.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.691] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0069.691] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.691] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0069.691] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.693] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0069.693] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.693] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0069.693] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.694] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0069.694] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.694] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0069.694] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.695] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0069.695] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.695] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0069.695] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.695] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0069.695] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.696] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0069.696] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.696] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0069.696] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.697] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0069.697] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.697] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0069.697] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.698] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0069.698] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.698] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0069.698] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0069.699] Sleep (dwMilliseconds=0x64) [0069.921] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e63f0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34e63f0, ResultLength=0x0) returned 0xc0000004 [0069.922] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e63f0, Size=0x2048) returned 0x34fb908 [0069.922] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34fb908, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34fb908, ResultLength=0x0) returned 0xc0000004 [0069.922] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34fb908, Size=0x306c) returned 0x351d3e8 [0069.922] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.922] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0069.922] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.923] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0069.923] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.923] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0069.923] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.923] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0069.923] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.924] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0069.924] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.925] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0069.925] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.925] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0069.925] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.925] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0069.925] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.926] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0069.926] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.926] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0069.926] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.926] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0069.927] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.927] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0069.927] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.927] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0069.927] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.928] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0069.928] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.928] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0069.928] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.928] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0069.928] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.929] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0069.929] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.929] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0069.929] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.929] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0069.929] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.930] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0069.930] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.930] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0069.930] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.931] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0069.931] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.931] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0069.931] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.931] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0069.931] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.932] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0069.932] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.932] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0069.932] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.933] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0069.933] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.933] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0069.933] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.933] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0069.934] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.934] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0069.934] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.934] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0069.934] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.935] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0069.935] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0069.935] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0069.935] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0069.936] Sleep (dwMilliseconds=0x64) [0070.161] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e9708, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34e9708, ResultLength=0x0) returned 0xc0000004 [0070.161] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e9708, Size=0x2048) returned 0x34fb908 [0070.161] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34fb908, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34fb908, ResultLength=0x0) returned 0xc0000004 [0070.161] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34fb908, Size=0x306c) returned 0x351d3e8 [0070.161] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.162] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0070.162] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.162] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0070.162] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.162] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0070.162] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.162] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0070.162] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.163] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0070.163] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.163] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0070.163] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.163] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0070.163] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.163] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0070.163] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.164] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0070.164] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.164] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0070.164] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.164] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0070.164] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.165] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0070.165] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.165] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0070.165] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.165] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0070.165] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.166] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0070.166] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.166] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0070.166] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.166] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0070.166] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.167] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0070.167] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.167] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0070.167] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.168] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0070.168] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.168] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0070.168] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.168] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0070.168] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.169] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0070.169] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.169] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0070.169] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.170] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0070.170] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.170] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0070.170] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.170] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0070.170] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.171] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0070.171] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.171] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0070.171] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.172] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0070.172] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.172] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0070.172] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.173] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0070.173] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.173] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0070.173] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0070.174] Sleep (dwMilliseconds=0x64) [0070.349] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e63f0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34e63f0, ResultLength=0x0) returned 0xc0000004 [0070.350] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e63f0, Size=0x2048) returned 0x34f52f0 [0070.350] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34f52f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34f52f0, ResultLength=0x0) returned 0xc0000004 [0070.350] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34f52f0, Size=0x306c) returned 0x351d3e8 [0070.350] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.350] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0070.350] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.351] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0070.351] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.351] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0070.351] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.351] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0070.351] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.351] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0070.351] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.352] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0070.352] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.352] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0070.352] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.352] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0070.352] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.353] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0070.353] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.353] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0070.353] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.353] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0070.353] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.354] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0070.354] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.354] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0070.354] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.354] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0070.354] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.355] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0070.355] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.355] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0070.355] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.355] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0070.355] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.356] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0070.356] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.356] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0070.356] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.357] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0070.357] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.357] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0070.357] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.357] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0070.357] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.358] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0070.358] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.358] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0070.358] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.359] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0070.359] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.359] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0070.359] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.360] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0070.360] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.360] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0070.360] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.360] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0070.361] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.361] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0070.361] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.361] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0070.361] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.362] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0070.362] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.362] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0070.362] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0070.363] Sleep (dwMilliseconds=0x64) [0070.567] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34e52e8, ResultLength=0x0) returned 0xc0000004 [0070.568] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52e8, Size=0x2048) returned 0x3501f20 [0070.568] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3501f20, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x3501f20, ResultLength=0x0) returned 0xc0000004 [0070.568] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3501f20, Size=0x306c) returned 0x351d3e8 [0070.568] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.568] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0070.568] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.568] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0070.568] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.569] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0070.569] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.569] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0070.569] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.569] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0070.569] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.569] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0070.569] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.570] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0070.570] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.570] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0070.570] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.570] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0070.570] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.571] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0070.571] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.571] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0070.571] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.571] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0070.571] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.572] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0070.572] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.572] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0070.572] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.572] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0070.572] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.573] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0070.573] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.573] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0070.573] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.574] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0070.574] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.574] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0070.574] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.574] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0070.574] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.575] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0070.575] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.575] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0070.575] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.575] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0070.576] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.576] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0070.576] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.576] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0070.576] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.577] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0070.577] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.577] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0070.577] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.578] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0070.578] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.578] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0070.578] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.578] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0070.578] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.579] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0070.579] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.579] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0070.579] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.580] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0070.580] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0070.581] Sleep (dwMilliseconds=0x64) [0070.772] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34eca20, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34eca20, ResultLength=0x0) returned 0xc0000004 [0070.773] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34eca20, Size=0x2048) returned 0x3501f20 [0070.773] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3501f20, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x3501f20, ResultLength=0x0) returned 0xc0000004 [0070.773] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3501f20, Size=0x306c) returned 0x351d3e8 [0070.773] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.774] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0070.774] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.774] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0070.774] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.774] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0070.774] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.774] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0070.774] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.775] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0070.775] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.775] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0070.775] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.775] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0070.775] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.775] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0070.775] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.776] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0070.776] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.776] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0070.776] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.776] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0070.776] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.777] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0070.777] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.777] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0070.777] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.777] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0070.777] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.778] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0070.778] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.778] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0070.778] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.779] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0070.779] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.779] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0070.779] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.779] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0070.779] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.780] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0070.780] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.780] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0070.780] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.781] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0070.781] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.781] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0070.781] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.781] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0070.781] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.782] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0070.782] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.782] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0070.782] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.783] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0070.783] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.783] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0070.783] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.783] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0070.783] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.784] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0070.784] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.784] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0070.784] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.785] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0070.785] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0070.786] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0070.786] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0070.787] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2) returned 0x34d0d40 [0070.787] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0d40) returned 1 [0070.787] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0xe) returned 0x34d0520 [0070.787] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0520) returned 1 [0070.787] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x12) returned 0x34d17e0 [0070.787] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17e0) returned 1 [0070.787] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1740 [0070.787] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1740) returned 1 [0070.787] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d19a0 [0070.787] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d19a0) returned 1 [0070.787] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1940 [0070.787] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0070.787] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34dedb0 [0070.787] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dedb0) returned 1 [0070.787] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34decc0 [0070.787] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34decc0) returned 1 [0070.787] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d17e0 [0070.787] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17e0) returned 1 [0070.787] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1680 [0070.787] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1680) returned 1 [0070.787] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x20) returned 0x34dee78 [0070.787] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dee78) returned 1 [0070.788] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x20) returned 0x34defb8 [0070.788] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34defb8) returned 1 [0070.788] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1960 [0070.788] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1960) returned 1 [0070.788] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x10) returned 0x34d0658 [0070.788] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0658) returned 1 [0070.788] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0070.788] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0070.788] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0070.788] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0070.788] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1640 [0070.788] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0070.788] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0070.788] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0070.788] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0070.788] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0070.788] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d16c0 [0070.788] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d16c0) returned 1 [0070.788] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0070.788] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0070.788] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0070.788] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0070.788] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1640 [0070.788] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0070.788] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1680 [0070.788] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1680) returned 1 [0070.788] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d17e0 [0070.788] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17e0) returned 1 [0070.788] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0070.788] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0070.788] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1720 [0070.789] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1720) returned 1 [0070.789] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x16) returned 0x34d1640 [0070.789] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0070.789] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0070.789] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0070.789] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34decc0 [0070.789] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34decc0) returned 1 [0070.789] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34dee00 [0070.789] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dee00) returned 1 [0070.789] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2a) returned 0x34cf9a8 [0070.789] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cf9a8) returned 1 [0070.789] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x34) returned 0x34be738 [0070.789] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34be738) returned 1 [0070.789] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x26) returned 0x34c7928 [0070.789] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7928) returned 1 [0070.789] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x30) returned 0x34cfdd0 [0070.789] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cfdd0) returned 1 [0070.789] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34dee78 [0070.789] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dee78) returned 1 [0070.789] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x24) returned 0x34c7a78 [0070.789] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7a78) returned 1 [0070.789] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34def40 [0070.789] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34def40) returned 1 [0070.789] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x10) returned 0x34d0388 [0070.789] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0388) returned 1 [0070.789] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x28) returned 0x34c7958 [0070.789] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7958) returned 1 [0070.789] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34dedb0 [0070.789] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dedb0) returned 1 [0070.789] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x20) returned 0x34deb30 [0070.790] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34deb30) returned 1 [0070.790] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1e) returned 0x34dee00 [0070.790] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dee00) returned 1 [0070.790] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x20) returned 0x34debf8 [0070.790] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34debf8) returned 1 [0070.790] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x3e) returned 0x34c2740 [0070.790] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c2740) returned 1 [0070.790] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34deef0 [0070.790] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34deef0) returned 1 [0070.790] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x32) returned 0x34be678 [0070.790] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34be678) returned 1 [0070.790] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x10) returned 0x34d0418 [0070.790] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0418) returned 1 [0070.790] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x34) returned 0x34bec78 [0070.790] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34bec78) returned 1 [0070.790] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x22) returned 0x34c7b08 [0070.790] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7b08) returned 1 [0070.790] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1640 [0070.790] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0070.790] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x10) returned 0x34d0448 [0070.790] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0448) returned 1 [0070.790] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0070.790] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0070.790] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2c) returned 0x34cfe78 [0070.790] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cfe78) returned 1 [0070.790] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1720 [0070.790] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1720) returned 1 [0070.790] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x26) returned 0x34c7bf8 [0070.790] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7bf8) returned 1 [0070.790] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1640 [0070.791] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0070.791] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34dee00 [0070.791] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dee00) returned 1 [0070.791] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0070.791] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0070.791] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x10) returned 0x34d05e0 [0070.791] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d05e0) returned 1 [0070.791] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34deba8 [0070.791] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34deba8) returned 1 [0070.791] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34dee00 [0070.791] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dee00) returned 1 [0070.791] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1940 [0070.791] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0070.791] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x26) returned 0x34c7e68 [0070.791] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7e68) returned 1 [0070.791] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2a) returned 0x34cfcb8 [0070.791] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cfcb8) returned 1 [0070.791] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x10) returned 0x34d04d8 [0070.791] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d04d8) returned 1 [0070.791] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34deb30 [0070.791] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34deb30) returned 1 [0070.791] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d19a0 [0070.791] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d19a0) returned 1 [0070.791] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0070.791] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0070.791] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34dee00 [0070.791] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dee00) returned 1 [0070.791] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x16) returned 0x34d1940 [0070.791] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0070.791] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34deb80 [0070.791] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34deb80) returned 1 [0070.792] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1640 [0070.792] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0070.792] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34def90 [0070.792] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34def90) returned 1 [0070.792] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34deba8 [0070.792] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34deba8) returned 1 [0070.792] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34dee00 [0070.792] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dee00) returned 1 [0070.792] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34dec98 [0070.792] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dec98) returned 1 [0070.792] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34def90 [0070.792] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34def90) returned 1 [0070.792] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x16) returned 0x34d1940 [0070.792] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0070.792] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x26) returned 0x34c7e08 [0070.792] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7e08) returned 1 [0070.792] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x24) returned 0x34c7aa8 [0070.792] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7aa8) returned 1 [0070.792] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1740 [0070.792] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1740) returned 1 [0070.792] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1940 [0070.792] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0070.792] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x16) returned 0x34d16c0 [0070.792] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d16c0) returned 1 [0070.792] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1e) returned 0x34ded60 [0070.792] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34ded60) returned 1 [0070.792] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2c) returned 0x34cfb68 [0070.792] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cfb68) returned 1 [0070.792] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x24) returned 0x34c7e38 [0070.792] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7e38) returned 1 [0070.793] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x16) returned 0x34d1980 [0070.793] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1980) returned 1 [0070.793] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x12) returned 0x34d1640 [0070.793] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0070.793] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x16) returned 0x34d19a0 [0070.793] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d19a0) returned 1 [0070.793] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x22) returned 0x34c7a48 [0070.793] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7a48) returned 1 [0070.793] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d19a0 [0070.793] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d19a0) returned 1 [0070.793] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x16) returned 0x34d1720 [0070.793] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1720) returned 1 [0070.793] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x28) returned 0x34c7ef8 [0070.793] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7ef8) returned 1 [0070.793] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x12) returned 0x34d1640 [0070.793] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0070.793] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2c) returned 0x34cfc10 [0070.793] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cfc10) returned 1 [0070.793] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x38) returned 0x34be538 [0070.793] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34be538) returned 1 [0070.793] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34dee00 [0070.793] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dee00) returned 1 [0070.793] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34dee78 [0070.793] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dee78) returned 1 [0070.793] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34defe0 [0070.793] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34defe0) returned 1 [0070.793] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2e) returned 0x34cf900 [0070.793] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cf900) returned 1 [0070.793] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x22) returned 0x34c7a48 [0070.793] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7a48) returned 1 [0070.794] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34def90 [0070.794] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34def90) returned 1 [0070.794] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x40) returned 0x34c2bc0 [0070.794] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c2bc0) returned 1 [0070.794] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0070.794] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0070.794] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0070.794] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0070.794] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0070.794] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0070.794] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34dee78 [0070.794] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dee78) returned 1 [0070.794] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d19a0 [0070.794] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d19a0) returned 1 [0070.794] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2a) returned 0x34cf9a8 [0070.794] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cf9a8) returned 1 [0070.794] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34dee78 [0070.794] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dee78) returned 1 [0070.794] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34deef0 [0070.794] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34deef0) returned 1 [0070.794] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x351d3e8) returned 1 [0070.794] Sleep (dwMilliseconds=0x64) [0071.013] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1024) returned 0x34e52e8 [0071.013] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34e52e8, ResultLength=0x0) returned 0xc0000004 [0071.013] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52e8, Size=0x2048) returned 0x34f52f0 [0071.013] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34f52f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34f52f0, ResultLength=0x0) returned 0xc0000004 [0071.014] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34f52f0, Size=0x306c) returned 0x351d3e8 [0071.014] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.014] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0071.014] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.014] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0071.014] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.014] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0071.014] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.015] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0071.015] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.015] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0071.015] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.015] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0071.015] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.015] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0071.015] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.016] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0071.016] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.016] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0071.016] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.016] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0071.016] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.017] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0071.017] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.017] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0071.017] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.017] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0071.017] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.018] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0071.018] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.018] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0071.018] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.019] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0071.019] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.019] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0071.019] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.019] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0071.019] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.020] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0071.020] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.021] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0071.021] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.021] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0071.021] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.022] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0071.022] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.022] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0071.022] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.022] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0071.022] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.023] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0071.023] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.023] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0071.023] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.024] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0071.024] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.024] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0071.024] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.025] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0071.025] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.025] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0071.025] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.026] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0071.026] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.026] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0071.026] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.026] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0071.027] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.027] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x25534) returned 0x351d3e8 [0071.027] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0071.028] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2) returned 0x34d0de0 [0071.028] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0de0) returned 1 [0071.028] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0xe) returned 0x34d0418 [0071.028] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0418) returned 1 [0071.028] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x12) returned 0x34d1680 [0071.028] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1680) returned 1 [0071.028] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1980 [0071.028] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1980) returned 1 [0071.028] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d16c0 [0071.028] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d16c0) returned 1 [0071.028] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1940 [0071.028] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0071.028] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34dece8 [0071.028] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dece8) returned 1 [0071.028] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34dec20 [0071.028] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dec20) returned 1 [0071.028] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1940 [0071.028] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0071.028] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1980 [0071.028] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1980) returned 1 [0071.028] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x20) returned 0x34dec98 [0071.028] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dec98) returned 1 [0071.028] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x20) returned 0x34dee00 [0071.028] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dee00) returned 1 [0071.028] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0071.028] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0071.028] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x10) returned 0x34d0460 [0071.028] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0460) returned 1 [0071.028] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d17e0 [0071.028] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17e0) returned 1 [0071.029] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d16a0 [0071.029] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d16a0) returned 1 [0071.029] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0071.029] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0071.029] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1720 [0071.029] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1720) returned 1 [0071.029] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0071.029] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0071.029] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0071.029] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0071.029] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1640 [0071.029] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0071.029] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0071.029] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0071.029] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d17e0 [0071.029] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17e0) returned 1 [0071.029] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0071.029] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0071.029] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1680 [0071.029] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1680) returned 1 [0071.029] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1640 [0071.029] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0071.029] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1640 [0071.029] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0071.029] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x16) returned 0x34d1940 [0071.029] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0071.029] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0071.029] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0071.029] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34dee78 [0071.029] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dee78) returned 1 [0071.029] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34dee78 [0071.030] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dee78) returned 1 [0071.030] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2a) returned 0x34cfc80 [0071.030] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cfc80) returned 1 [0071.030] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x34) returned 0x34bec78 [0071.030] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34bec78) returned 1 [0071.030] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x26) returned 0x34c7da8 [0071.030] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7da8) returned 1 [0071.030] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x30) returned 0x34cfe78 [0071.030] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cfe78) returned 1 [0071.030] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34ded88 [0071.030] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34ded88) returned 1 [0071.030] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x24) returned 0x34c7b38 [0071.030] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7b38) returned 1 [0071.030] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34debd0 [0071.030] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34debd0) returned 1 [0071.030] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x10) returned 0x34d05e0 [0071.030] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d05e0) returned 1 [0071.030] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x28) returned 0x34c7ce8 [0071.030] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7ce8) returned 1 [0071.030] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34debd0 [0071.030] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34debd0) returned 1 [0071.030] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x20) returned 0x34ded10 [0071.030] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34ded10) returned 1 [0071.030] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1e) returned 0x34def18 [0071.030] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34def18) returned 1 [0071.030] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x20) returned 0x34ded10 [0071.030] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34ded10) returned 1 [0071.030] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x3e) returned 0x34c2ae8 [0071.030] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c2ae8) returned 1 [0071.030] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34ded10 [0071.031] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34ded10) returned 1 [0071.031] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x32) returned 0x34be8b8 [0071.031] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34be8b8) returned 1 [0071.031] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x10) returned 0x34d05e0 [0071.031] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d05e0) returned 1 [0071.031] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x34) returned 0x34be978 [0071.031] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34be978) returned 1 [0071.031] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x22) returned 0x34c7a48 [0071.031] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7a48) returned 1 [0071.031] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d17e0 [0071.031] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17e0) returned 1 [0071.031] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x10) returned 0x34d0418 [0071.031] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0418) returned 1 [0071.031] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1720 [0071.031] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1720) returned 1 [0071.031] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2c) returned 0x34cfac0 [0071.031] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cfac0) returned 1 [0071.031] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1940 [0071.031] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0071.031] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x26) returned 0x34c7b68 [0071.031] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7b68) returned 1 [0071.031] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1940 [0071.031] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0071.031] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34dec70 [0071.031] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dec70) returned 1 [0071.031] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1720 [0071.031] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1720) returned 1 [0071.031] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x10) returned 0x34d0520 [0071.031] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0520) returned 1 [0071.031] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34dec70 [0071.031] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dec70) returned 1 [0071.031] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34debd0 [0071.032] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34debd0) returned 1 [0071.032] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1940 [0071.032] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0071.032] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x26) returned 0x34c7b08 [0071.032] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7b08) returned 1 [0071.032] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2a) returned 0x34cfbd8 [0071.032] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cfbd8) returned 1 [0071.032] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x10) returned 0x34d05e0 [0071.032] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d05e0) returned 1 [0071.032] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34dee00 [0071.032] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dee00) returned 1 [0071.032] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1960 [0071.032] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1960) returned 1 [0071.032] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1640 [0071.032] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0071.032] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34ded88 [0071.032] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34ded88) returned 1 [0071.032] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x16) returned 0x34d1940 [0071.032] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0071.032] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34deb58 [0071.032] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34deb58) returned 1 [0071.032] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d17e0 [0071.032] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17e0) returned 1 [0071.032] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34debd0 [0071.032] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34debd0) returned 1 [0071.032] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34debd0 [0071.032] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34debd0) returned 1 [0071.032] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34dece8 [0071.032] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dece8) returned 1 [0071.032] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34defb8 [0071.033] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34defb8) returned 1 [0071.033] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34ded88 [0071.033] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34ded88) returned 1 [0071.033] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x16) returned 0x34d1680 [0071.033] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1680) returned 1 [0071.033] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x26) returned 0x34c7ef8 [0071.033] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7ef8) returned 1 [0071.033] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x24) returned 0x34c7ce8 [0071.033] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7ce8) returned 1 [0071.033] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1640 [0071.033] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0071.033] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1940 [0071.033] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0071.033] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x16) returned 0x34d17e0 [0071.033] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17e0) returned 1 [0071.033] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1e) returned 0x34dec98 [0071.033] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dec98) returned 1 [0071.033] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2c) returned 0x34cfac0 [0071.033] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cfac0) returned 1 [0071.033] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x24) returned 0x34c7ef8 [0071.033] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7ef8) returned 1 [0071.033] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x16) returned 0x34d1640 [0071.033] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0071.033] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x12) returned 0x34d1940 [0071.033] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0071.033] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x16) returned 0x34d17e0 [0071.033] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17e0) returned 1 [0071.033] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x22) returned 0x34c7e38 [0071.033] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7e38) returned 1 [0071.033] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0071.033] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0071.034] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x16) returned 0x34d1940 [0071.034] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0071.034] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x28) returned 0x34c7c88 [0071.034] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7c88) returned 1 [0071.034] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x12) returned 0x34d1740 [0071.034] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1740) returned 1 [0071.034] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2c) returned 0x34cfcb8 [0071.034] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cfcb8) returned 1 [0071.034] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x38) returned 0x34beab8 [0071.034] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34beab8) returned 1 [0071.034] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34debd0 [0071.034] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34debd0) returned 1 [0071.034] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34def90 [0071.034] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34def90) returned 1 [0071.034] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34def18 [0071.034] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34def18) returned 1 [0071.034] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2e) returned 0x34cfac0 [0071.034] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cfac0) returned 1 [0071.034] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x22) returned 0x34c7c88 [0071.034] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7c88) returned 1 [0071.034] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34dee00 [0071.034] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dee00) returned 1 [0071.034] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x40) returned 0x34c2818 [0071.034] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c2818) returned 1 [0071.034] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1680 [0071.034] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1680) returned 1 [0071.034] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d17e0 [0071.034] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17e0) returned 1 [0071.034] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d17e0 [0071.034] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17e0) returned 1 [0071.034] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34dee00 [0071.035] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dee00) returned 1 [0071.035] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1680 [0071.035] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1680) returned 1 [0071.035] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2a) returned 0x34cfac0 [0071.035] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cfac0) returned 1 [0071.035] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34dece8 [0071.035] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dece8) returned 1 [0071.035] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34dee78 [0071.035] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dee78) returned 1 [0071.035] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x351d3e8) returned 1 [0071.035] Sleep (dwMilliseconds=0x64) [0071.557] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1024) returned 0x34eb918 [0071.557] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34eb918, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34eb918, ResultLength=0x0) returned 0xc0000004 [0071.558] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34eb918, Size=0x2048) returned 0x3501f20 [0071.558] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3501f20, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x3501f20, ResultLength=0x0) returned 0xc0000004 [0071.558] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x3501f20, Size=0x306c) returned 0x351d3e8 [0071.558] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.559] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0071.559] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.559] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0071.559] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.559] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0071.559] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.559] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0071.559] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.560] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0071.560] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.560] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0071.560] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.560] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0071.560] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.561] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0071.561] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.561] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0071.561] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.561] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0071.561] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.562] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0071.562] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.562] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0071.562] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.562] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0071.562] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.563] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0071.563] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.563] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0071.563] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.563] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0071.563] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.564] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0071.564] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.564] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0071.564] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.565] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0071.565] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.565] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0071.565] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.566] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0071.566] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.566] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0071.566] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.567] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0071.567] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.567] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0071.567] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.568] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0071.568] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.568] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0071.568] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.569] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0071.569] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.569] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0071.569] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.570] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0071.570] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.570] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0071.570] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.571] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0071.571] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.571] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0071.571] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.572] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0071.572] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.572] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x25534) returned 0x351d3e8 [0071.572] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.573] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x26558) returned 0x351d3e8 [0071.573] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x26558, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.573] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x2757c) returned 0x351d3e8 [0071.573] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x2757c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.574] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x285a0) returned 0x351d3e8 [0071.574] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x285a0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0071.575] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x295c4) returned 0x351d3e8 [0071.575] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x295c4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0071.575] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2) returned 0x34d0e80 [0071.575] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0e80) returned 1 [0071.575] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0xe) returned 0x34d0388 [0071.575] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0388) returned 1 [0071.575] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x12) returned 0x34d1940 [0071.576] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0071.576] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d17e0 [0071.576] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17e0) returned 1 [0071.576] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0071.576] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0071.576] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1720 [0071.576] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1720) returned 1 [0071.576] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34dec48 [0071.576] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dec48) returned 1 [0071.576] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34defb8 [0071.576] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34defb8) returned 1 [0071.576] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1940 [0071.576] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0071.576] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0071.576] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0071.576] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x20) returned 0x34dee78 [0071.576] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dee78) returned 1 [0071.576] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x20) returned 0x34def18 [0071.576] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34def18) returned 1 [0071.576] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0071.576] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0071.576] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x10) returned 0x34d05e0 [0071.576] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d05e0) returned 1 [0071.576] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1720 [0071.576] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1720) returned 1 [0071.576] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0071.576] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0071.576] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1640 [0071.576] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0071.576] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1640 [0071.576] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0071.576] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1640 [0071.576] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0071.577] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d17e0 [0071.577] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17e0) returned 1 [0071.577] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d17e0 [0071.577] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17e0) returned 1 [0071.577] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1940 [0071.577] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1940) returned 1 [0071.577] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1980 [0071.577] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1980) returned 1 [0071.577] Sleep (dwMilliseconds=0x64) [0072.094] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e8600, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34e8600, ResultLength=0x0) returned 0xc0000004 [0072.095] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e8600, Size=0x2048) returned 0x34fb908 [0072.095] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34fb908, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34fb908, ResultLength=0x0) returned 0xc0000004 [0072.095] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34fb908, Size=0x306c) returned 0x351d3e8 [0072.095] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.096] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0072.096] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.096] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0072.096] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.096] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0072.096] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.096] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0072.096] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.097] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0072.097] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.097] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0072.097] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.097] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0072.097] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.098] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0072.098] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.098] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0072.098] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.098] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0072.099] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.099] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0072.099] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.099] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0072.099] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.100] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0072.100] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.100] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0072.100] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.100] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0072.100] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.101] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0072.101] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.101] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0072.101] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.102] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0072.102] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.102] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0072.102] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.102] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0072.102] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.103] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0072.103] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.103] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0072.103] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.104] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0072.104] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.104] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0072.104] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.105] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0072.105] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.105] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0072.105] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.106] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0072.106] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.106] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0072.106] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.107] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0072.107] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.107] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0072.107] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.107] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0072.107] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.108] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0072.108] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.109] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0072.109] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.109] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x25534) returned 0x351d3e8 [0072.109] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.110] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x26558) returned 0x351d3e8 [0072.110] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x26558, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.110] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x2757c) returned 0x351d3e8 [0072.110] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x2757c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.112] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x285a0) returned 0x351d3e8 [0072.112] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x285a0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.113] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x295c4) returned 0x351d3e8 [0072.113] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x295c4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.113] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x2a5e8) returned 0x351d3e8 [0072.113] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x2a5e8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0072.114] Sleep (dwMilliseconds=0x64) [0072.570] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e74f8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34e74f8, ResultLength=0x0) returned 0xc0000004 [0072.571] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e74f8, Size=0x2048) returned 0x34f9700 [0072.571] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34f9700, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34f9700, ResultLength=0x0) returned 0xc0000004 [0072.571] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34f9700, Size=0x306c) returned 0x351d3e8 [0072.571] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.571] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0072.571] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.572] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0072.572] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.572] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0072.572] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.572] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0072.572] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.572] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0072.572] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.573] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0072.573] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.573] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0072.573] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.573] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0072.573] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.574] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0072.574] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.574] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0072.574] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.575] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0072.575] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.575] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0072.575] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.575] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0072.575] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.576] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0072.576] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.576] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0072.576] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.576] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0072.577] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.577] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0072.577] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.577] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0072.577] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.578] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0072.578] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.578] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0072.578] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.579] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0072.579] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.579] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0072.579] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.580] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0072.580] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.580] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0072.580] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.580] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0072.581] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.581] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0072.581] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.581] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0072.581] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.582] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0072.582] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.583] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0072.583] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.583] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0072.583] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.584] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0072.584] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.584] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0072.584] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.585] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0072.585] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.585] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x25534) returned 0x351d3e8 [0072.585] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.586] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x26558) returned 0x351d3e8 [0072.586] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x26558, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.587] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x2757c) returned 0x351d3e8 [0072.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x2757c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.587] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x285a0) returned 0x351d3e8 [0072.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x285a0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.588] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x295c4) returned 0x351d3e8 [0072.588] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x295c4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.588] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x2a5e8) returned 0x351d3e8 [0072.588] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x2a5e8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.589] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x2b60c) returned 0x351d3e8 [0072.589] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x2b60c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.590] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x2c630) returned 0x351d3e8 [0072.590] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x2c630, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.590] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x2d654) returned 0x351d3e8 [0072.590] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x2d654, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0072.591] Sleep (dwMilliseconds=0x64) [0072.806] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34eca20, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34eca20, ResultLength=0x0) returned 0xc0000004 [0072.807] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34eca20, Size=0x2048) returned 0x34fdb10 [0072.807] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34fdb10, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34fdb10, ResultLength=0x0) returned 0xc0000004 [0072.807] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34fdb10, Size=0x306c) returned 0x351d3e8 [0072.807] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.807] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0072.807] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.808] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0072.808] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.808] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0072.808] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.808] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0072.808] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.809] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0072.809] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.809] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0072.809] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.809] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0072.809] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.810] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0072.810] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.810] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0072.810] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.810] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0072.811] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.811] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0072.811] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.811] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0072.811] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.812] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0072.812] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.812] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0072.812] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.813] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0072.813] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.813] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0072.813] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.813] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0072.813] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.814] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0072.814] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.814] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0072.814] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.815] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0072.815] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.815] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0072.815] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.816] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0072.816] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.816] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0072.816] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.817] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0072.817] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.817] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0072.817] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.818] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0072.818] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.818] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0072.818] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.819] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0072.819] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.819] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0072.819] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.820] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0072.820] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.820] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0072.820] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.821] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0072.821] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.822] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0072.822] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.822] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x25534) returned 0x351d3e8 [0072.822] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.823] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x26558) returned 0x351d3e8 [0072.823] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x26558, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.823] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x2757c) returned 0x351d3e8 [0072.823] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x2757c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.824] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x285a0) returned 0x351d3e8 [0072.824] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x285a0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.825] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x295c4) returned 0x351d3e8 [0072.825] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x295c4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.825] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x2a5e8) returned 0x351d3e8 [0072.825] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x2a5e8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.826] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x2b60c) returned 0x351d3e8 [0072.826] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x2b60c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.826] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x2c630) returned 0x351d3e8 [0072.826] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x2c630, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.827] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x2d654) returned 0x351d3e8 [0072.827] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x2d654, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0072.828] Sleep (dwMilliseconds=0x64) [0072.959] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e9708, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34e9708, ResultLength=0x0) returned 0xc0000004 [0072.959] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e9708, Size=0x2048) returned 0x34f9700 [0072.959] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34f9700, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34f9700, ResultLength=0x0) returned 0xc0000004 [0072.960] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34f9700, Size=0x306c) returned 0x351d3e8 [0072.960] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.960] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0072.960] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.960] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0072.960] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.960] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0072.961] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.961] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0072.961] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.961] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0072.961] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.961] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0072.961] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.962] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0072.962] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.962] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0072.962] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.963] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0072.963] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.963] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0072.963] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.963] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0072.963] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.964] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0072.964] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.964] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0072.964] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.965] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0072.965] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.965] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0072.965] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.965] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0072.965] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.966] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0072.966] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.966] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0072.966] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.967] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0072.967] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.967] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0072.967] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.968] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0072.968] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.968] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0072.968] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.969] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0072.969] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.969] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0072.969] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.970] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0072.970] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.970] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0072.970] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.971] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0072.971] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.971] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0072.971] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.972] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0072.972] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.972] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0072.972] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.973] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0072.973] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.974] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0072.974] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.974] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0072.975] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.975] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x25534) returned 0x351d3e8 [0072.975] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.976] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x26558) returned 0x351d3e8 [0072.976] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x26558, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.976] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x2757c) returned 0x351d3e8 [0072.976] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x2757c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.977] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x285a0) returned 0x351d3e8 [0072.977] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x285a0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.977] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x295c4) returned 0x351d3e8 [0072.978] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x295c4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.978] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x2a5e8) returned 0x351d3e8 [0072.978] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x2a5e8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.979] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x2b60c) returned 0x351d3e8 [0072.979] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x2b60c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.979] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x2c630) returned 0x351d3e8 [0072.979] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x2c630, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0072.980] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x2d654) returned 0x351d3e8 [0072.980] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x2d654, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0072.981] Sleep (dwMilliseconds=0x64) [0073.195] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e9708, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34e9708, ResultLength=0x0) returned 0xc0000004 [0073.196] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e9708, Size=0x2048) returned 0x34f9700 [0073.196] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34f9700, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34f9700, ResultLength=0x0) returned 0xc0000004 [0073.197] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34f9700, Size=0x306c) returned 0x351d3e8 [0073.197] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.197] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0073.197] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.197] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0073.197] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.198] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0073.198] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.198] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0073.198] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.198] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0073.198] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.199] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0073.199] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.199] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0073.199] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.199] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0073.199] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.200] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0073.200] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.200] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0073.200] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.200] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0073.200] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.201] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0073.201] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.201] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0073.201] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.201] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0073.202] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.202] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0073.202] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.202] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0073.202] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.203] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0073.203] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.203] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0073.203] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.204] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0073.204] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.204] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0073.204] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.205] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0073.205] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.205] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0073.205] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.205] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0073.205] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.206] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0073.206] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.206] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0073.206] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.207] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0073.207] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.207] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0073.207] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.208] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0073.208] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.208] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0073.208] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.209] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0073.209] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.209] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0073.209] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.210] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0073.210] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.211] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0073.211] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.211] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x25534) returned 0x351d3e8 [0073.211] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.212] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x26558) returned 0x351d3e8 [0073.212] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x26558, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.212] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x2757c) returned 0x351d3e8 [0073.212] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x2757c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.213] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x285a0) returned 0x351d3e8 [0073.213] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x285a0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.214] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x295c4) returned 0x351d3e8 [0073.214] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x295c4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.214] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x2a5e8) returned 0x351d3e8 [0073.214] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x2a5e8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.215] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x2b60c) returned 0x351d3e8 [0073.215] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x2b60c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.215] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x2c630) returned 0x351d3e8 [0073.215] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x2c630, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.216] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x2d654) returned 0x351d3e8 [0073.216] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x2d654, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0073.217] Sleep (dwMilliseconds=0x64) [0073.349] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e9708, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34e9708, ResultLength=0x0) returned 0xc0000004 [0073.350] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e9708, Size=0x2048) returned 0x34ffd18 [0073.350] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34ffd18, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34ffd18, ResultLength=0x0) returned 0xc0000004 [0073.350] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34ffd18, Size=0x306c) returned 0x351d3e8 [0073.350] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.351] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0073.351] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.351] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0073.351] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.351] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0073.351] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.352] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0073.352] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.352] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0073.352] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.352] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0073.352] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.353] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0073.353] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.353] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0073.353] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.353] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0073.353] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.354] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0073.354] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.354] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0073.354] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.354] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0073.354] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.355] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0073.355] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.355] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0073.355] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.356] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0073.356] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.356] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0073.356] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.356] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0073.356] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.357] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0073.357] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.357] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0073.357] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.358] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0073.358] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.358] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0073.358] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.359] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0073.359] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.359] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0073.359] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.360] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0073.360] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.360] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0073.360] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.360] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0073.361] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.361] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0073.361] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.361] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1f45c) returned 0x351d3e8 [0073.361] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.362] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x20480) returned 0x351d3e8 [0073.362] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.362] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x214a4) returned 0x351d3e8 [0073.362] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.363] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x224c8) returned 0x351d3e8 [0073.363] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x224c8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.364] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x234ec) returned 0x351d3e8 [0073.364] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x234ec, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.364] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x24510) returned 0x351d3e8 [0073.364] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x24510, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.365] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x25534) returned 0x351d3e8 [0073.365] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x25534, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.365] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x26558) returned 0x351d3e8 [0073.365] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x26558, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.366] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x2757c) returned 0x351d3e8 [0073.366] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x2757c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.367] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x285a0) returned 0x351d3e8 [0073.367] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x285a0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.367] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x295c4) returned 0x351d3e8 [0073.367] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x295c4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.368] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x2a5e8) returned 0x351d3e8 [0073.368] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x2a5e8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.368] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x2b60c) returned 0x351d3e8 [0073.368] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x2b60c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.369] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x2c630) returned 0x351d3e8 [0073.369] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x2c630, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.370] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x2d654) returned 0x351d3e8 [0073.370] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x2d654, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0x0 [0073.370] Sleep (dwMilliseconds=0x64) [0073.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e52e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x34e52e8, ResultLength=0x0) returned 0xc0000004 [0073.506] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34e52e8, Size=0x2048) returned 0x34fdb10 [0073.506] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34fdb10, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x34fdb10, ResultLength=0x0) returned 0xc0000004 [0073.506] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x34fdb10, Size=0x306c) returned 0x351d3e8 [0073.506] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.507] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x4090) returned 0x351d3e8 [0073.507] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.507] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x50b4) returned 0x351d3e8 [0073.507] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.507] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x60d8) returned 0x351d3e8 [0073.507] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.508] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x70fc) returned 0x351d3e8 [0073.508] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.508] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x8120) returned 0x351d3e8 [0073.508] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.508] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x9144) returned 0x351d3e8 [0073.508] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.509] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xa168) returned 0x351d3e8 [0073.509] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.509] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xb18c) returned 0x351d3e8 [0073.509] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.509] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xc1b0) returned 0x351d3e8 [0073.509] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.510] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xd1d4) returned 0x351d3e8 [0073.510] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.510] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xe1f8) returned 0x351d3e8 [0073.510] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.510] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0xf21c) returned 0x351d3e8 [0073.510] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.511] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x10240) returned 0x351d3e8 [0073.511] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.511] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x11264) returned 0x351d3e8 [0073.511] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.512] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x12288) returned 0x351d3e8 [0073.512] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.512] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x132ac) returned 0x351d3e8 [0073.512] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.513] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x142d0) returned 0x351d3e8 [0073.513] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.513] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x152f4) returned 0x351d3e8 [0073.513] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.513] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x16318) returned 0x351d3e8 [0073.513] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.514] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1733c) returned 0x351d3e8 [0073.514] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.514] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x18360) returned 0x351d3e8 [0073.514] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x351d3e8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x351d3e8, ResultLength=0x0) returned 0xc0000004 [0073.515] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x19384) returned 0x351d3e8 [0073.516] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1a3a8) returned 0x351d3e8 [0073.516] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1b3cc) returned 0x351d3e8 [0073.517] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1c3f0) returned 0x351d3e8 [0073.517] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1d414) returned 0x351d3e8 [0073.518] RtlReAllocateHeap (Heap=0x34a0000, Flags=0x8, Ptr=0x351d3e8, Size=0x1e438) returned 0x351d3e8 [0073.527] Sleep (dwMilliseconds=0x64) [0073.800] Sleep (dwMilliseconds=0x64) [0073.947] Sleep (dwMilliseconds=0x64) [0074.111] Sleep (dwMilliseconds=0x64) [0074.413] Sleep (dwMilliseconds=0x64) [0081.364] Sleep (dwMilliseconds=0x64) [0092.319] Sleep (dwMilliseconds=0x64) Thread: id = 10 os_tid = 0xd2c Thread: id = 11 os_tid = 0xa38 [0060.357] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0060.709] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0062.110] CoCreateInstance (in: rclsid=0x9d6058*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x9d6048*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x33cf784 | out: ppv=0x33cf784*=0xdba488) returned 0x0 [0063.809] TaskScheduler:ITaskService:Connect (This=0xdba488, serverName=0x33cf72c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x33cf73c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0x33cf74c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x33cf75c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0064.599] TaskScheduler:ITaskService:GetFolder (in: This=0xdba488, Path="\\", ppFolder=0x33cf780 | out: ppFolder=0x33cf780*=0xdba5a8) returned 0x0 [0064.600] ITaskFolder:GetTasks (in: This=0xdba5a8, flags=0, ppTasks=0x33cf720 | out: ppTasks=0x33cf720*=0xdba5f8) returned 0x0 [0064.602] IRegisteredTaskCollection:get_Count (in: This=0xdba5f8, pCount=0x33cf6fc | out: pCount=0x33cf6fc*=4) returned 0x0 [0064.602] IRegisteredTaskCollection:get_Item (in: This=0xdba5f8, index=0x33cf6d0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf730 | out: ppRegisteredTask=0x33cf730*=0xdba6a0) returned 0x0 [0064.605] IRegisteredTask:get_Name (in: This=0xdba6a0, pName=0x33cf708 | out: pName=0x33cf708*="Adobe Acrobat Update Task") returned 0x0 [0064.610] IRegisteredTask:get_State (in: This=0xdba6a0, pState=0x33cf70c | out: pState=0x33cf70c*=1) returned 0x0 [0064.612] IUnknown:Release (This=0xdba6a0) returned 0x0 [0064.612] IRegisteredTaskCollection:get_Item (in: This=0xdba5f8, index=0x33cf6d0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x33cf730 | out: ppRegisteredTask=0x33cf730*=0xdba6a0) returned 0x0 [0064.612] IRegisteredTask:get_Name (in: This=0xdba6a0, pName=0x33cf708 | out: pName=0x33cf708*="GoogleUpdateTaskMachineCore") returned 0x0 [0064.612] IRegisteredTask:get_State (in: This=0xdba6a0, pState=0x33cf70c | out: pState=0x33cf70c*=1) returned 0x0 [0064.613] IUnknown:Release (This=0xdba6a0) returned 0x0 [0064.613] IRegisteredTaskCollection:get_Item (in: This=0xdba5f8, index=0x33cf6d0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), ppRegisteredTask=0x33cf730 | out: ppRegisteredTask=0x33cf730*=0xdba6a0) returned 0x0 [0064.613] IRegisteredTask:get_Name (in: This=0xdba6a0, pName=0x33cf708 | out: pName=0x33cf708*="GoogleUpdateTaskMachineUA") returned 0x0 [0064.613] IRegisteredTask:get_State (in: This=0xdba6a0, pState=0x33cf70c | out: pState=0x33cf70c*=1) returned 0x0 [0064.614] IUnknown:Release (This=0xdba6a0) returned 0x0 [0064.614] IRegisteredTaskCollection:get_Item (in: This=0xdba5f8, index=0x33cf6d0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), ppRegisteredTask=0x33cf730 | out: ppRegisteredTask=0x33cf730*=0xdba6a0) returned 0x0 [0064.614] IRegisteredTask:get_Name (in: This=0xdba6a0, pName=0x33cf708 | out: pName=0x33cf708*="OneDrive Standalone Update Task-S-1-5-21-1051304884-625712362-2192934891-1000") returned 0x0 [0064.614] IRegisteredTask:get_State (in: This=0xdba6a0, pState=0x33cf70c | out: pState=0x33cf70c*=1) returned 0x0 [0064.614] IUnknown:Release (This=0xdba6a0) returned 0x0 [0064.614] IUnknown:Release (This=0xdba5f8) returned 0x0 [0064.615] ITaskFolder:GetFolders (in: This=0xdba5a8, flags=0, ppFolders=0x33cf75c | out: ppFolders=0x33cf75c*=0xdba5f8) returned 0x0 [0064.616] ITaskFolderCollection:get_Count (in: This=0xdba5f8, pCount=0x33cf750 | out: pCount=0x33cf750*=1) returned 0x0 [0064.616] ITaskFolderCollection:get_Item (in: This=0xdba5f8, index=0x33cf72c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x33cf754 | out: ppFolder=0x33cf754*=0xdba6a0) returned 0x0 [0064.616] ITaskFolder:GetTasks (in: This=0xdba6a0, flags=0, ppTasks=0x33cf6f4 | out: ppTasks=0x33cf6f4*=0xdba710) returned 0x0 [0064.617] IRegisteredTaskCollection:get_Count (in: This=0xdba710, pCount=0x33cf6d0 | out: pCount=0x33cf6d0*=0) returned 0x0 [0064.617] IUnknown:Release (This=0xdba710) returned 0x0 [0064.617] ITaskFolder:GetFolders (in: This=0xdba6a0, flags=0, ppFolders=0x33cf730 | out: ppFolders=0x33cf730*=0xdba710) returned 0x0 [0064.618] ITaskFolderCollection:get_Count (in: This=0xdba710, pCount=0x33cf724 | out: pCount=0x33cf724*=3) returned 0x0 [0064.618] ITaskFolderCollection:get_Item (in: This=0xdba710, index=0x33cf700*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x33cf728 | out: ppFolder=0x33cf728*=0xdba7e0) returned 0x0 [0064.618] ITaskFolder:GetTasks (in: This=0xdba7e0, flags=0, ppTasks=0x33cf6c8 | out: ppTasks=0x33cf6c8*=0xdba860) returned 0x0 [0064.624] IRegisteredTaskCollection:get_Count (in: This=0xdba860, pCount=0x33cf6a4 | out: pCount=0x33cf6a4*=4) returned 0x0 [0064.624] IRegisteredTaskCollection:get_Item (in: This=0xdba860, index=0x33cf678*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6d8 | out: ppRegisteredTask=0x33cf6d8*=0xdba940) returned 0x0 [0064.624] IRegisteredTask:get_Name (in: This=0xdba940, pName=0x33cf6b0 | out: pName=0x33cf6b0*="Office Automatic Updates") returned 0x0 [0064.624] IRegisteredTask:get_State (in: This=0xdba940, pState=0x33cf6b4 | out: pState=0x33cf6b4*=1) returned 0x0 [0064.716] IUnknown:Release (This=0xdba940) returned 0x0 [0064.716] IRegisteredTaskCollection:get_Item (in: This=0xdba860, index=0x33cf678*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x33cf6d8 | out: ppRegisteredTask=0x33cf6d8*=0xdba940) returned 0x0 [0064.716] IRegisteredTask:get_Name (in: This=0xdba940, pName=0x33cf6b0 | out: pName=0x33cf6b0*="Office ClickToRun Service Monitor") returned 0x0 [0064.716] IRegisteredTask:get_State (in: This=0xdba940, pState=0x33cf6b4 | out: pState=0x33cf6b4*=1) returned 0x0 [0064.717] IUnknown:Release (This=0xdba940) returned 0x0 [0064.717] IRegisteredTaskCollection:get_Item (in: This=0xdba860, index=0x33cf678*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), ppRegisteredTask=0x33cf6d8 | out: ppRegisteredTask=0x33cf6d8*=0xdba940) returned 0x0 [0064.717] IRegisteredTask:get_Name (in: This=0xdba940, pName=0x33cf6b0 | out: pName=0x33cf6b0*="OfficeTelemetryAgentFallBack2016") returned 0x0 [0064.717] IRegisteredTask:get_State (in: This=0xdba940, pState=0x33cf6b4 | out: pState=0x33cf6b4*=1) returned 0x0 [0064.720] IUnknown:Release (This=0xdba940) returned 0x0 [0064.720] IRegisteredTaskCollection:get_Item (in: This=0xdba860, index=0x33cf678*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), ppRegisteredTask=0x33cf6d8 | out: ppRegisteredTask=0x33cf6d8*=0xdba940) returned 0x0 [0064.720] IRegisteredTask:get_Name (in: This=0xdba940, pName=0x33cf6b0 | out: pName=0x33cf6b0*="OfficeTelemetryAgentLogOn2016") returned 0x0 [0064.720] IRegisteredTask:get_State (in: This=0xdba940, pState=0x33cf6b4 | out: pState=0x33cf6b4*=1) returned 0x0 [0064.723] IUnknown:Release (This=0xdba940) returned 0x0 [0064.723] IUnknown:Release (This=0xdba860) returned 0x0 [0064.723] ITaskFolder:GetFolders (in: This=0xdba7e0, flags=0, ppFolders=0x33cf704 | out: ppFolders=0x33cf704*=0xdba860) returned 0x0 [0064.751] ITaskFolderCollection:get_Count (in: This=0xdba860, pCount=0x33cf6f8 | out: pCount=0x33cf6f8*=0) returned 0x0 [0064.751] IUnknown:Release (This=0xdba860) returned 0x0 [0064.751] TaskScheduler:IUnknown:Release (This=0xdba7e0) returned 0x0 [0064.751] ITaskFolderCollection:get_Item (in: This=0xdba710, index=0x33cf700*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppFolder=0x33cf728 | out: ppFolder=0x33cf728*=0xdba7e0) returned 0x0 [0064.751] ITaskFolder:GetTasks (in: This=0xdba7e0, flags=0, ppTasks=0x33cf6c8 | out: ppTasks=0x33cf6c8*=0xdba860) returned 0x0 [0064.753] IRegisteredTaskCollection:get_Count (in: This=0xdba860, pCount=0x33cf6a4 | out: pCount=0x33cf6a4*=0) returned 0x0 [0064.753] IUnknown:Release (This=0xdba860) returned 0x0 [0064.753] ITaskFolder:GetFolders (in: This=0xdba7e0, flags=0, ppFolders=0x33cf704 | out: ppFolders=0x33cf704*=0xdba860) returned 0x0 [0064.765] ITaskFolderCollection:get_Count (in: This=0xdba860, pCount=0x33cf6f8 | out: pCount=0x33cf6f8*=94) returned 0x0 [0064.765] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdba940) returned 0x0 [0064.765] ITaskFolder:GetTasks (in: This=0xdba940, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdba9e0) returned 0x0 [0064.768] IRegisteredTaskCollection:get_Count (in: This=0xdba9e0, pCount=0x33cf678 | out: pCount=0x33cf678*=0) returned 0x0 [0064.768] IUnknown:Release (This=0xdba9e0) returned 0x0 [0064.768] ITaskFolder:GetFolders (in: This=0xdba940, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdba9e0) returned 0x0 [0064.769] ITaskFolderCollection:get_Count (in: This=0xdba9e0, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0064.769] IUnknown:Release (This=0xdba9e0) returned 0x0 [0064.769] TaskScheduler:IUnknown:Release (This=0xdba940) returned 0x0 [0064.769] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdba940) returned 0x0 [0064.769] ITaskFolder:GetTasks (in: This=0xdba940, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbaa28) returned 0x0 [0064.777] IRegisteredTaskCollection:get_Count (in: This=0xdbaa28, pCount=0x33cf678 | out: pCount=0x33cf678*=2) returned 0x0 [0064.777] IRegisteredTaskCollection:get_Item (in: This=0xdbaa28, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbab68) returned 0x0 [0064.777] IRegisteredTask:get_Name (in: This=0xdbab68, pName=0x33cf684 | out: pName=0x33cf684*="AD RMS Rights Policy Template Management (Automated)") returned 0x0 [0064.777] IRegisteredTask:get_State (in: This=0xdbab68, pState=0x33cf688 | out: pState=0x33cf688*=1) returned 0x0 [0064.780] IUnknown:Release (This=0xdbab68) returned 0x0 [0064.780] IRegisteredTaskCollection:get_Item (in: This=0xdbaa28, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbab68) returned 0x0 [0064.780] IRegisteredTask:get_Name (in: This=0xdbab68, pName=0x33cf684 | out: pName=0x33cf684*="AD RMS Rights Policy Template Management (Manual)") returned 0x0 [0064.780] IRegisteredTask:get_State (in: This=0xdbab68, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0064.783] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x64) returned 0x34a83d8 [0064.783] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="reboot") returned 0x0 [0064.783] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="restart") returned 0x0 [0064.783] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="shutdown") returned 0x0 [0064.783] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="logoff") returned 0x0 [0064.783] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="back") returned 0x0 [0064.783] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34a83d8) returned 1 [0064.783] IRegisteredTask:get_Definition (in: This=0xdbab68, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbacd0) returned 0x0 [0064.918] ITaskDefinition:get_Actions (in: This=0xdbacd0, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbad20) returned 0x0 [0064.918] IActionCollection:get_Count (in: This=0xdbad20, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0064.918] IActionCollection:get_Item (in: This=0xdbad20, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbb9c8) returned 0x0 [0064.918] IAction:get_Type (in: This=0xdbb9c8, pType=0x33cf670 | out: pType=0x33cf670*=5) returned 0x0 [0064.918] IUnknown:Release (This=0xdbb9c8) returned 0x1 [0064.918] IUnknown:Release (This=0xdbad20) returned 0x1 [0064.918] IUnknown:Release (This=0xdbacd0) returned 0x0 [0064.918] IUnknown:Release (This=0xdbab68) returned 0x0 [0064.918] IUnknown:Release (This=0xdbaa28) returned 0x0 [0064.918] ITaskFolder:GetFolders (in: This=0xdba940, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb910) returned 0x0 [0064.919] ITaskFolderCollection:get_Count (in: This=0xdbb910, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0064.919] IUnknown:Release (This=0xdbb910) returned 0x0 [0064.919] TaskScheduler:IUnknown:Release (This=0xdba940) returned 0x0 [0064.919] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb910) returned 0x0 [0064.920] ITaskFolder:GetTasks (in: This=0xdbb910, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb9a0) returned 0x0 [0064.922] IRegisteredTaskCollection:get_Count (in: This=0xdbb9a0, pCount=0x33cf678 | out: pCount=0x33cf678*=4) returned 0x0 [0064.922] IRegisteredTaskCollection:get_Item (in: This=0xdbb9a0, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba9d0) returned 0x0 [0064.922] IRegisteredTask:get_Name (in: This=0xdba9d0, pName=0x33cf684 | out: pName=0x33cf684*="EDP Policy Manager") returned 0x0 [0064.922] IRegisteredTask:get_State (in: This=0xdba9d0, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0065.135] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x26) returned 0x34c7a48 [0065.135] wcsstr (_Str="edp policy manager", _SubStr="reboot") returned 0x0 [0065.135] wcsstr (_Str="edp policy manager", _SubStr="restart") returned 0x0 [0065.136] wcsstr (_Str="edp policy manager", _SubStr="shutdown") returned 0x0 [0065.136] wcsstr (_Str="edp policy manager", _SubStr="logoff") returned 0x0 [0065.136] wcsstr (_Str="edp policy manager", _SubStr="back") returned 0x0 [0065.136] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7a48) returned 1 [0065.136] IRegisteredTask:get_Definition (in: This=0xdba9d0, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbaaa8) returned 0x0 [0065.190] ITaskDefinition:get_Actions (in: This=0xdbaaa8, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbaaf8) returned 0x0 [0065.190] IActionCollection:get_Count (in: This=0xdbaaf8, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0065.190] IActionCollection:get_Item (in: This=0xdbaaf8, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbae68) returned 0x0 [0065.191] IAction:get_Type (in: This=0xdbae68, pType=0x33cf670 | out: pType=0x33cf670*=5) returned 0x0 [0065.191] IUnknown:Release (This=0xdbae68) returned 0x1 [0065.191] IUnknown:Release (This=0xdbaaf8) returned 0x1 [0065.191] IUnknown:Release (This=0xdbaaa8) returned 0x0 [0065.191] IUnknown:Release (This=0xdba9d0) returned 0x0 [0065.191] IRegisteredTaskCollection:get_Item (in: This=0xdbb9a0, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba9d0) returned 0x0 [0065.191] IRegisteredTask:get_Name (in: This=0xdba9d0, pName=0x33cf684 | out: pName=0x33cf684*="PolicyConverter") returned 0x0 [0065.191] IRegisteredTask:get_State (in: This=0xdba9d0, pState=0x33cf688 | out: pState=0x33cf688*=1) returned 0x0 [0065.192] IUnknown:Release (This=0xdba9d0) returned 0x0 [0065.192] IRegisteredTaskCollection:get_Item (in: This=0xdbb9a0, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba9d0) returned 0x0 [0065.192] IRegisteredTask:get_Name (in: This=0xdba9d0, pName=0x33cf684 | out: pName=0x33cf684*="SmartScreenSpecific") returned 0x0 [0065.192] IRegisteredTask:get_State (in: This=0xdba9d0, pState=0x33cf688 | out: pState=0x33cf688*=1) returned 0x0 [0065.192] IUnknown:Release (This=0xdba9d0) returned 0x0 [0065.192] IRegisteredTaskCollection:get_Item (in: This=0xdbb9a0, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba9d0) returned 0x0 [0065.192] IRegisteredTask:get_Name (in: This=0xdba9d0, pName=0x33cf684 | out: pName=0x33cf684*="VerifiedPublisherCertStoreCheck") returned 0x0 [0065.192] IRegisteredTask:get_State (in: This=0xdba9d0, pState=0x33cf688 | out: pState=0x33cf688*=1) returned 0x0 [0065.193] IUnknown:Release (This=0xdba9d0) returned 0x0 [0065.193] IUnknown:Release (This=0xdbb9a0) returned 0x0 [0065.193] ITaskFolder:GetFolders (in: This=0xdbb910, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb9a0) returned 0x0 [0065.194] ITaskFolderCollection:get_Count (in: This=0xdbb9a0, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0065.194] IUnknown:Release (This=0xdbb9a0) returned 0x0 [0065.194] TaskScheduler:IUnknown:Release (This=0xdbb910) returned 0x0 [0065.194] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb910) returned 0x0 [0065.194] ITaskFolder:GetTasks (in: This=0xdbb910, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdba940) returned 0x0 [0065.195] IRegisteredTaskCollection:get_Count (in: This=0xdba940, pCount=0x33cf678 | out: pCount=0x33cf678*=3) returned 0x0 [0065.195] IRegisteredTaskCollection:get_Item (in: This=0xdba940, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbaa08) returned 0x0 [0065.195] IRegisteredTask:get_Name (in: This=0xdbaa08, pName=0x33cf684 | out: pName=0x33cf684*="Microsoft Compatibility Appraiser") returned 0x0 [0065.195] IRegisteredTask:get_State (in: This=0xdbaa08, pState=0x33cf688 | out: pState=0x33cf688*=1) returned 0x0 [0065.196] IUnknown:Release (This=0xdbaa08) returned 0x0 [0065.196] IRegisteredTaskCollection:get_Item (in: This=0xdba940, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbaa08) returned 0x0 [0065.196] IRegisteredTask:get_Name (in: This=0xdbaa08, pName=0x33cf684 | out: pName=0x33cf684*="ProgramDataUpdater") returned 0x0 [0065.196] IRegisteredTask:get_State (in: This=0xdbaa08, pState=0x33cf688 | out: pState=0x33cf688*=1) returned 0x0 [0065.197] IUnknown:Release (This=0xdbaa08) returned 0x0 [0065.197] IRegisteredTaskCollection:get_Item (in: This=0xdba940, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbaa08) returned 0x0 [0065.197] IRegisteredTask:get_Name (in: This=0xdbaa08, pName=0x33cf684 | out: pName=0x33cf684*="StartupAppTask") returned 0x0 [0065.197] IRegisteredTask:get_State (in: This=0xdbaa08, pState=0x33cf688 | out: pState=0x33cf688*=1) returned 0x0 [0065.201] IUnknown:Release (This=0xdbaa08) returned 0x0 [0065.201] IUnknown:Release (This=0xdba940) returned 0x0 [0065.201] ITaskFolder:GetFolders (in: This=0xdbb910, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdba940) returned 0x0 [0065.207] ITaskFolderCollection:get_Count (in: This=0xdba940, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0065.207] IUnknown:Release (This=0xdba940) returned 0x0 [0065.207] TaskScheduler:IUnknown:Release (This=0xdbb910) returned 0x0 [0065.207] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb910) returned 0x0 [0065.207] ITaskFolder:GetTasks (in: This=0xdbb910, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb9b0) returned 0x0 [0065.215] IRegisteredTaskCollection:get_Count (in: This=0xdbb9b0, pCount=0x33cf678 | out: pCount=0x33cf678*=4) returned 0x0 [0065.215] IRegisteredTaskCollection:get_Item (in: This=0xdbb9b0, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba9e0) returned 0x0 [0065.216] IRegisteredTask:get_Name (in: This=0xdba9e0, pName=0x33cf684 | out: pName=0x33cf684*="appuriverifierdaily") returned 0x0 [0065.216] IRegisteredTask:get_State (in: This=0xdba9e0, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0065.217] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x28) returned 0x34c7dd8 [0065.217] wcsstr (_Str="appuriverifierdaily", _SubStr="reboot") returned 0x0 [0065.217] wcsstr (_Str="appuriverifierdaily", _SubStr="restart") returned 0x0 [0065.217] wcsstr (_Str="appuriverifierdaily", _SubStr="shutdown") returned 0x0 [0065.217] wcsstr (_Str="appuriverifierdaily", _SubStr="logoff") returned 0x0 [0065.217] wcsstr (_Str="appuriverifierdaily", _SubStr="back") returned 0x0 [0065.217] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7dd8) returned 1 [0065.217] IRegisteredTask:get_Definition (in: This=0xdba9e0, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbaac8) returned 0x0 [0065.231] ITaskDefinition:get_Actions (in: This=0xdbaac8, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbab18) returned 0x0 [0065.231] IActionCollection:get_Count (in: This=0xdbab18, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0065.231] IActionCollection:get_Item (in: This=0xdbab18, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbb358) returned 0x0 [0065.232] IAction:get_Type (in: This=0xdbb358, pType=0x33cf670 | out: pType=0x33cf670*=0) returned 0x0 [0065.232] IUnknown:QueryInterface (in: This=0xdbb358, riid=0x9d606c*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x33cf6a8 | out: ppvObject=0x33cf6a8*=0xdbb358) returned 0x0 [0065.232] IExecAction:get_Path (in: This=0xdbb358, pPath=0x33cf680 | out: pPath=0x33cf680*="%windir%\\system32\\AppHostRegistrationVerifier.exe") returned 0x0 [0065.232] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x64) returned 0x34a83d8 [0065.232] wcsstr (_Str="%windir%\\system32\\apphostregistrationverifier.exe", _SubStr="reboot") returned 0x0 [0065.232] wcsstr (_Str="%windir%\\system32\\apphostregistrationverifier.exe", _SubStr="restart") returned 0x0 [0065.232] wcsstr (_Str="%windir%\\system32\\apphostregistrationverifier.exe", _SubStr="shutdown") returned 0x0 [0065.232] wcsstr (_Str="%windir%\\system32\\apphostregistrationverifier.exe", _SubStr="logoff") returned 0x0 [0065.232] wcsstr (_Str="%windir%\\system32\\apphostregistrationverifier.exe", _SubStr="back") returned 0x0 [0065.232] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34a83d8) returned 1 [0065.232] IExecAction:get_Arguments (in: This=0xdbb358, pArgument=0x33cf67c | out: pArgument=0x33cf67c*=0x0) returned 0x0 [0065.232] IUnknown:Release (This=0xdbb358) returned 0x2 [0065.232] IUnknown:Release (This=0xdbb358) returned 0x1 [0065.232] IUnknown:Release (This=0xdbab18) returned 0x1 [0065.233] IUnknown:Release (This=0xdbaac8) returned 0x0 [0065.233] IUnknown:Release (This=0xdba9e0) returned 0x0 [0065.233] IRegisteredTaskCollection:get_Item (in: This=0xdbb9b0, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba9e0) returned 0x0 [0065.233] IRegisteredTask:get_Name (in: This=0xdba9e0, pName=0x33cf684 | out: pName=0x33cf684*="appuriverifierinstall") returned 0x0 [0065.233] IRegisteredTask:get_State (in: This=0xdba9e0, pState=0x33cf688 | out: pState=0x33cf688*=4) returned 0x0 [0065.233] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2c) returned 0x34cfe78 [0065.233] wcsstr (_Str="appuriverifierinstall", _SubStr="reboot") returned 0x0 [0065.233] wcsstr (_Str="appuriverifierinstall", _SubStr="restart") returned 0x0 [0065.233] wcsstr (_Str="appuriverifierinstall", _SubStr="shutdown") returned 0x0 [0065.233] wcsstr (_Str="appuriverifierinstall", _SubStr="logoff") returned 0x0 [0065.233] wcsstr (_Str="appuriverifierinstall", _SubStr="back") returned 0x0 [0065.233] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cfe78) returned 1 [0065.234] IRegisteredTask:get_Definition (in: This=0xdba9e0, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbaa50) returned 0x0 [0065.258] ITaskDefinition:get_Actions (in: This=0xdbaa50, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbaaa0) returned 0x0 [0065.258] IActionCollection:get_Count (in: This=0xdbaaa0, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0065.258] IActionCollection:get_Item (in: This=0xdbaaa0, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbb360) returned 0x0 [0065.258] IAction:get_Type (in: This=0xdbb360, pType=0x33cf670 | out: pType=0x33cf670*=0) returned 0x0 [0065.258] IUnknown:QueryInterface (in: This=0xdbb360, riid=0x9d606c*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x33cf6a8 | out: ppvObject=0x33cf6a8*=0xdbb360) returned 0x0 [0065.258] IExecAction:get_Path (in: This=0xdbb360, pPath=0x33cf680 | out: pPath=0x33cf680*="%windir%\\system32\\AppHostRegistrationVerifier.exe") returned 0x0 [0065.258] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x64) returned 0x34e0218 [0065.258] wcsstr (_Str="%windir%\\system32\\apphostregistrationverifier.exe", _SubStr="reboot") returned 0x0 [0065.258] wcsstr (_Str="%windir%\\system32\\apphostregistrationverifier.exe", _SubStr="restart") returned 0x0 [0065.258] wcsstr (_Str="%windir%\\system32\\apphostregistrationverifier.exe", _SubStr="shutdown") returned 0x0 [0065.258] wcsstr (_Str="%windir%\\system32\\apphostregistrationverifier.exe", _SubStr="logoff") returned 0x0 [0065.258] wcsstr (_Str="%windir%\\system32\\apphostregistrationverifier.exe", _SubStr="back") returned 0x0 [0065.259] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34e0218) returned 1 [0065.259] IExecAction:get_Arguments (in: This=0xdbb360, pArgument=0x33cf67c | out: pArgument=0x33cf67c*=0x0) returned 0x0 [0065.259] IUnknown:Release (This=0xdbb360) returned 0x2 [0065.259] IUnknown:Release (This=0xdbb360) returned 0x1 [0065.259] IUnknown:Release (This=0xdbaaa0) returned 0x1 [0065.259] IUnknown:Release (This=0xdbaa50) returned 0x0 [0065.259] IUnknown:Release (This=0xdba9e0) returned 0x0 [0065.259] IRegisteredTaskCollection:get_Item (in: This=0xdbb9b0, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba9e0) returned 0x0 [0065.259] IRegisteredTask:get_Name (in: This=0xdba9e0, pName=0x33cf684 | out: pName=0x33cf684*="CleanupTemporaryState") returned 0x0 [0065.259] IRegisteredTask:get_State (in: This=0xdba9e0, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0065.260] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2c) returned 0x34cfe78 [0065.260] wcsstr (_Str="cleanuptemporarystate", _SubStr="reboot") returned 0x0 [0065.260] wcsstr (_Str="cleanuptemporarystate", _SubStr="restart") returned 0x0 [0065.260] wcsstr (_Str="cleanuptemporarystate", _SubStr="shutdown") returned 0x0 [0065.260] wcsstr (_Str="cleanuptemporarystate", _SubStr="logoff") returned 0x0 [0065.260] wcsstr (_Str="cleanuptemporarystate", _SubStr="back") returned 0x0 [0065.260] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cfe78) returned 1 [0065.260] IRegisteredTask:get_Definition (in: This=0xdba9e0, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbaa50) returned 0x0 [0065.298] ITaskDefinition:get_Actions (in: This=0xdbaa50, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbaaa0) returned 0x0 [0065.298] IActionCollection:get_Count (in: This=0xdbaaa0, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0065.298] IActionCollection:get_Item (in: This=0xdbaaa0, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbae10) returned 0x0 [0065.298] IAction:get_Type (in: This=0xdbae10, pType=0x33cf670 | out: pType=0x33cf670*=0) returned 0x0 [0065.298] IUnknown:QueryInterface (in: This=0xdbae10, riid=0x9d606c*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x33cf6a8 | out: ppvObject=0x33cf6a8*=0xdbae10) returned 0x0 [0065.298] IExecAction:get_Path (in: This=0xdbae10, pPath=0x33cf680 | out: pPath=0x33cf680*="%windir%\\system32\\rundll32.exe") returned 0x0 [0065.298] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x3e) returned 0x34c28a8 [0065.298] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="reboot") returned 0x0 [0065.298] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="restart") returned 0x0 [0065.298] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="shutdown") returned 0x0 [0065.298] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="logoff") returned 0x0 [0065.298] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="back") returned 0x0 [0065.298] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c28a8) returned 1 [0065.299] IExecAction:get_Arguments (in: This=0xdbae10, pArgument=0x33cf67c | out: pArgument=0x33cf67c*="Windows.Storage.ApplicationData.dll,CleanupTemporaryState") returned 0x0 [0065.299] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x74) returned 0x34d3128 [0065.299] wcsstr (_Str="windows.storage.applicationdata.dll,cleanuptemporarystate", _SubStr="reboot") returned 0x0 [0065.299] wcsstr (_Str="windows.storage.applicationdata.dll,cleanuptemporarystate", _SubStr="restart") returned 0x0 [0065.299] wcsstr (_Str="windows.storage.applicationdata.dll,cleanuptemporarystate", _SubStr="shutdown") returned 0x0 [0065.299] wcsstr (_Str="windows.storage.applicationdata.dll,cleanuptemporarystate", _SubStr="logoff") returned 0x0 [0065.299] wcsstr (_Str="windows.storage.applicationdata.dll,cleanuptemporarystate", _SubStr="back") returned 0x0 [0065.299] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d3128) returned 1 [0065.299] IUnknown:Release (This=0xdbae10) returned 0x2 [0065.299] IUnknown:Release (This=0xdbae10) returned 0x1 [0065.299] IUnknown:Release (This=0xdbaaa0) returned 0x1 [0065.299] IUnknown:Release (This=0xdbaa50) returned 0x0 [0065.299] IUnknown:Release (This=0xdba9e0) returned 0x0 [0065.299] IRegisteredTaskCollection:get_Item (in: This=0xdbb9b0, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbaec0) returned 0x0 [0065.299] IRegisteredTask:get_Name (in: This=0xdbaec0, pName=0x33cf684 | out: pName=0x33cf684*="DsSvcCleanup") returned 0x0 [0065.299] IRegisteredTask:get_State (in: This=0xdbaec0, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0065.316] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34ded38 [0065.316] wcsstr (_Str="dssvccleanup", _SubStr="reboot") returned 0x0 [0065.316] wcsstr (_Str="dssvccleanup", _SubStr="restart") returned 0x0 [0065.316] wcsstr (_Str="dssvccleanup", _SubStr="shutdown") returned 0x0 [0065.316] wcsstr (_Str="dssvccleanup", _SubStr="logoff") returned 0x0 [0065.316] wcsstr (_Str="dssvccleanup", _SubStr="back") returned 0x0 [0065.316] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34ded38) returned 1 [0065.316] IRegisteredTask:get_Definition (in: This=0xdbaec0, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbaf98) returned 0x0 [0065.332] ITaskDefinition:get_Actions (in: This=0xdbaf98, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbafe8) returned 0x0 [0065.332] IActionCollection:get_Count (in: This=0xdbafe8, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0065.332] IActionCollection:get_Item (in: This=0xdbafe8, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbbe20) returned 0x0 [0065.332] IAction:get_Type (in: This=0xdbbe20, pType=0x33cf670 | out: pType=0x33cf670*=0) returned 0x0 [0065.332] IUnknown:QueryInterface (in: This=0xdbbe20, riid=0x9d606c*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x33cf6a8 | out: ppvObject=0x33cf6a8*=0xdbbe20) returned 0x0 [0065.332] IExecAction:get_Path (in: This=0xdbbe20, pPath=0x33cf680 | out: pPath=0x33cf680*="%windir%\\system32\\dstokenclean.exe") returned 0x0 [0065.332] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x46) returned 0x34d3d08 [0065.332] wcsstr (_Str="%windir%\\system32\\dstokenclean.exe", _SubStr="reboot") returned 0x0 [0065.332] wcsstr (_Str="%windir%\\system32\\dstokenclean.exe", _SubStr="restart") returned 0x0 [0065.332] wcsstr (_Str="%windir%\\system32\\dstokenclean.exe", _SubStr="shutdown") returned 0x0 [0065.332] wcsstr (_Str="%windir%\\system32\\dstokenclean.exe", _SubStr="logoff") returned 0x0 [0065.332] wcsstr (_Str="%windir%\\system32\\dstokenclean.exe", _SubStr="back") returned 0x0 [0065.332] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d3d08) returned 1 [0065.332] IExecAction:get_Arguments (in: This=0xdbbe20, pArgument=0x33cf67c | out: pArgument=0x33cf67c*=0x0) returned 0x0 [0065.332] IUnknown:Release (This=0xdbbe20) returned 0x2 [0065.332] IUnknown:Release (This=0xdbbe20) returned 0x1 [0065.332] IUnknown:Release (This=0xdbafe8) returned 0x1 [0065.332] IUnknown:Release (This=0xdbaf98) returned 0x0 [0065.332] IUnknown:Release (This=0xdbaec0) returned 0x0 [0065.332] IUnknown:Release (This=0xdbb9b0) returned 0x0 [0065.332] ITaskFolder:GetFolders (in: This=0xdbb910, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb508) returned 0x0 [0065.333] ITaskFolderCollection:get_Count (in: This=0xdbb508, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0065.333] IUnknown:Release (This=0xdbb508) returned 0x0 [0065.333] TaskScheduler:IUnknown:Release (This=0xdbb910) returned 0x0 [0065.333] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbaec0) returned 0x0 [0065.333] ITaskFolder:GetTasks (in: This=0xdbaec0, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbaf68) returned 0x0 [0065.334] IRegisteredTaskCollection:get_Count (in: This=0xdbaf68, pCount=0x33cf678 | out: pCount=0x33cf678*=0) returned 0x0 [0065.334] IUnknown:Release (This=0xdbaf68) returned 0x0 [0065.334] ITaskFolder:GetFolders (in: This=0xdbaec0, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbaf68) returned 0x0 [0065.335] ITaskFolderCollection:get_Count (in: This=0xdbaf68, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0065.335] IUnknown:Release (This=0xdbaf68) returned 0x0 [0065.335] TaskScheduler:IUnknown:Release (This=0xdbaec0) returned 0x0 [0065.335] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x7, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbaec0) returned 0x0 [0065.335] ITaskFolder:GetTasks (in: This=0xdbaec0, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbaf50) returned 0x0 [0065.336] IRegisteredTaskCollection:get_Count (in: This=0xdbaf50, pCount=0x33cf678 | out: pCount=0x33cf678*=1) returned 0x0 [0065.336] IRegisteredTaskCollection:get_Item (in: This=0xdbaf50, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbb040) returned 0x0 [0065.336] IRegisteredTask:get_Name (in: This=0xdbb040, pName=0x33cf684 | out: pName=0x33cf684*="Proxy") returned 0x0 [0065.336] IRegisteredTask:get_State (in: This=0xdbb040, pState=0x33cf688 | out: pState=0x33cf688*=1) returned 0x0 [0065.336] IUnknown:Release (This=0xdbb040) returned 0x0 [0065.336] IUnknown:Release (This=0xdbaf50) returned 0x0 [0065.336] ITaskFolder:GetFolders (in: This=0xdbaec0, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbaf50) returned 0x0 [0065.337] ITaskFolderCollection:get_Count (in: This=0xdbaf50, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0065.337] IUnknown:Release (This=0xdbaf50) returned 0x0 [0065.337] TaskScheduler:IUnknown:Release (This=0xdbaec0) returned 0x0 [0065.337] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbaec0) returned 0x0 [0065.337] ITaskFolder:GetTasks (in: This=0xdbaec0, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbaf58) returned 0x0 [0065.338] IRegisteredTaskCollection:get_Count (in: This=0xdbaf58, pCount=0x33cf678 | out: pCount=0x33cf678*=1) returned 0x0 [0065.338] IRegisteredTaskCollection:get_Item (in: This=0xdbaf58, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbb048) returned 0x0 [0065.338] IRegisteredTask:get_Name (in: This=0xdbb048, pName=0x33cf684 | out: pName=0x33cf684*="BitLocker MDM policy Refresh") returned 0x0 [0065.338] IRegisteredTask:get_State (in: This=0xdbb048, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0065.339] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x3a) returned 0x34c28a8 [0065.339] wcsstr (_Str="bitlocker mdm policy refresh", _SubStr="reboot") returned 0x0 [0065.339] wcsstr (_Str="bitlocker mdm policy refresh", _SubStr="restart") returned 0x0 [0065.339] wcsstr (_Str="bitlocker mdm policy refresh", _SubStr="shutdown") returned 0x0 [0065.339] wcsstr (_Str="bitlocker mdm policy refresh", _SubStr="logoff") returned 0x0 [0065.339] wcsstr (_Str="bitlocker mdm policy refresh", _SubStr="back") returned 0x0 [0065.339] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c28a8) returned 1 [0065.339] IRegisteredTask:get_Definition (in: This=0xdbb048, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbb0b8) returned 0x0 [0065.359] ITaskDefinition:get_Actions (in: This=0xdbb0b8, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbb108) returned 0x0 [0065.359] IActionCollection:get_Count (in: This=0xdbb108, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0065.359] IActionCollection:get_Item (in: This=0xdbb108, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbb2b8) returned 0x0 [0065.359] IAction:get_Type (in: This=0xdbb2b8, pType=0x33cf670 | out: pType=0x33cf670*=5) returned 0x0 [0065.359] IUnknown:Release (This=0xdbb2b8) returned 0x1 [0065.359] IUnknown:Release (This=0xdbb108) returned 0x1 [0065.359] IUnknown:Release (This=0xdbb0b8) returned 0x0 [0065.359] IUnknown:Release (This=0xdbb048) returned 0x0 [0065.359] IUnknown:Release (This=0xdbaf58) returned 0x0 [0065.359] ITaskFolder:GetFolders (in: This=0xdbaec0, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbad48) returned 0x0 [0065.360] ITaskFolderCollection:get_Count (in: This=0xdbad48, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0065.360] IUnknown:Release (This=0xdbad48) returned 0x0 [0065.360] TaskScheduler:IUnknown:Release (This=0xdbaec0) returned 0x0 [0065.360] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x9, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbad48) returned 0x0 [0065.360] ITaskFolder:GetTasks (in: This=0xdbad48, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbade0) returned 0x0 [0065.361] IRegisteredTaskCollection:get_Count (in: This=0xdbade0, pCount=0x33cf678 | out: pCount=0x33cf678*=1) returned 0x0 [0065.361] IRegisteredTaskCollection:get_Item (in: This=0xdbade0, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbaee8) returned 0x0 [0065.361] IRegisteredTask:get_Name (in: This=0xdbaee8, pName=0x33cf684 | out: pName=0x33cf684*="UninstallDeviceTask") returned 0x0 [0065.361] IRegisteredTask:get_State (in: This=0xdbaee8, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0065.362] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x28) returned 0x34c7ce8 [0065.362] wcsstr (_Str="uninstalldevicetask", _SubStr="reboot") returned 0x0 [0065.362] wcsstr (_Str="uninstalldevicetask", _SubStr="restart") returned 0x0 [0065.362] wcsstr (_Str="uninstalldevicetask", _SubStr="shutdown") returned 0x0 [0065.362] wcsstr (_Str="uninstalldevicetask", _SubStr="logoff") returned 0x0 [0065.362] wcsstr (_Str="uninstalldevicetask", _SubStr="back") returned 0x0 [0065.362] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7ce8) returned 1 [0065.362] IRegisteredTask:get_Definition (in: This=0xdbaee8, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbafd0) returned 0x0 [0065.382] ITaskDefinition:get_Actions (in: This=0xdbafd0, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbb020) returned 0x0 [0065.382] IActionCollection:get_Count (in: This=0xdbb020, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0065.382] IActionCollection:get_Item (in: This=0xdbb020, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbb2a0) returned 0x0 [0065.382] IAction:get_Type (in: This=0xdbb2a0, pType=0x33cf670 | out: pType=0x33cf670*=0) returned 0x0 [0065.382] IUnknown:QueryInterface (in: This=0xdbb2a0, riid=0x9d606c*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x33cf6a8 | out: ppvObject=0x33cf6a8*=0xdbb2a0) returned 0x0 [0065.382] IExecAction:get_Path (in: This=0xdbb2a0, pPath=0x33cf680 | out: pPath=0x33cf680*="BthUdTask.exe") returned 0x0 [0065.382] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34dee50 [0065.382] wcsstr (_Str="bthudtask.exe", _SubStr="reboot") returned 0x0 [0065.382] wcsstr (_Str="bthudtask.exe", _SubStr="restart") returned 0x0 [0065.382] wcsstr (_Str="bthudtask.exe", _SubStr="shutdown") returned 0x0 [0065.382] wcsstr (_Str="bthudtask.exe", _SubStr="logoff") returned 0x0 [0065.382] wcsstr (_Str="bthudtask.exe", _SubStr="back") returned 0x0 [0065.382] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dee50) returned 1 [0065.382] IExecAction:get_Arguments (in: This=0xdbb2a0, pArgument=0x33cf67c | out: pArgument=0x33cf67c*="$(Arg0)") returned 0x0 [0065.382] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x10) returned 0x34d05e0 [0065.382] wcsstr (_Str="$(arg0)", _SubStr="reboot") returned 0x0 [0065.382] wcsstr (_Str="$(arg0)", _SubStr="restart") returned 0x0 [0065.382] wcsstr (_Str="$(arg0)", _SubStr="shutdown") returned 0x0 [0065.383] wcsstr (_Str="$(arg0)", _SubStr="logoff") returned 0x0 [0065.383] wcsstr (_Str="$(arg0)", _SubStr="back") returned 0x0 [0065.383] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d05e0) returned 1 [0065.383] IUnknown:Release (This=0xdbb2a0) returned 0x2 [0065.383] IUnknown:Release (This=0xdbb2a0) returned 0x1 [0065.383] IUnknown:Release (This=0xdbb020) returned 0x1 [0065.383] IUnknown:Release (This=0xdbafd0) returned 0x0 [0065.383] IUnknown:Release (This=0xdbaee8) returned 0x0 [0065.383] IUnknown:Release (This=0xdbade0) returned 0x0 [0065.383] ITaskFolder:GetFolders (in: This=0xdbad48, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbade0) returned 0x0 [0065.383] ITaskFolderCollection:get_Count (in: This=0xdbade0, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0065.384] IUnknown:Release (This=0xdbade0) returned 0x0 [0065.384] TaskScheduler:IUnknown:Release (This=0xdbad48) returned 0x0 [0065.384] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xa, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbad48) returned 0x0 [0065.384] ITaskFolder:GetTasks (in: This=0xdbad48, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbadf0) returned 0x0 [0065.385] IRegisteredTaskCollection:get_Count (in: This=0xdbadf0, pCount=0x33cf678 | out: pCount=0x33cf678*=1) returned 0x0 [0065.385] IRegisteredTaskCollection:get_Item (in: This=0xdbadf0, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbaf08) returned 0x0 [0065.385] IRegisteredTask:get_Name (in: This=0xdbaf08, pName=0x33cf684 | out: pName=0x33cf684*="BgTaskRegistrationMaintenanceTask") returned 0x0 [0065.385] IRegisteredTask:get_State (in: This=0xdbaf08, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0065.446] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x44) returned 0x34d3c18 [0065.446] wcsstr (_Str="bgtaskregistrationmaintenancetask", _SubStr="reboot") returned 0x0 [0065.446] wcsstr (_Str="bgtaskregistrationmaintenancetask", _SubStr="restart") returned 0x0 [0065.446] wcsstr (_Str="bgtaskregistrationmaintenancetask", _SubStr="shutdown") returned 0x0 [0065.446] wcsstr (_Str="bgtaskregistrationmaintenancetask", _SubStr="logoff") returned 0x0 [0065.446] wcsstr (_Str="bgtaskregistrationmaintenancetask", _SubStr="back") returned 0x0 [0065.446] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d3c18) returned 1 [0065.446] IRegisteredTask:get_Definition (in: This=0xdbaf08, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbb020) returned 0x0 [0065.461] ITaskDefinition:get_Actions (in: This=0xdbb020, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbb070) returned 0x0 [0065.461] IActionCollection:get_Count (in: This=0xdbb070, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0065.461] IActionCollection:get_Item (in: This=0xdbb070, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbba38) returned 0x0 [0065.461] IAction:get_Type (in: This=0xdbba38, pType=0x33cf670 | out: pType=0x33cf670*=5) returned 0x0 [0065.461] IUnknown:Release (This=0xdbba38) returned 0x1 [0065.461] IUnknown:Release (This=0xdbb070) returned 0x1 [0065.461] IUnknown:Release (This=0xdbb020) returned 0x0 [0065.462] IUnknown:Release (This=0xdbaf08) returned 0x0 [0065.462] IUnknown:Release (This=0xdbadf0) returned 0x0 [0065.462] ITaskFolder:GetFolders (in: This=0xdbad48, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbadf0) returned 0x0 [0065.462] ITaskFolderCollection:get_Count (in: This=0xdbadf0, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0065.462] IUnknown:Release (This=0xdbadf0) returned 0x0 [0065.462] TaskScheduler:IUnknown:Release (This=0xdbad48) returned 0x0 [0065.462] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xb, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbad48) returned 0x0 [0065.462] ITaskFolder:GetTasks (in: This=0xdbad48, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbae00) returned 0x0 [0065.490] IRegisteredTaskCollection:get_Count (in: This=0xdbae00, pCount=0x33cf678 | out: pCount=0x33cf678*=6) returned 0x0 [0065.490] IRegisteredTaskCollection:get_Item (in: This=0xdbae00, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbaf28) returned 0x0 [0065.490] IRegisteredTask:get_Name (in: This=0xdbaf28, pName=0x33cf684 | out: pName=0x33cf684*="AikCertEnrollTask") returned 0x0 [0065.490] IRegisteredTask:get_State (in: This=0xdbaf28, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0065.491] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x24) returned 0x34c7e38 [0065.491] wcsstr (_Str="aikcertenrolltask", _SubStr="reboot") returned 0x0 [0065.491] wcsstr (_Str="aikcertenrolltask", _SubStr="restart") returned 0x0 [0065.491] wcsstr (_Str="aikcertenrolltask", _SubStr="shutdown") returned 0x0 [0065.491] wcsstr (_Str="aikcertenrolltask", _SubStr="logoff") returned 0x0 [0065.491] wcsstr (_Str="aikcertenrolltask", _SubStr="back") returned 0x0 [0065.491] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7e38) returned 1 [0065.491] IRegisteredTask:get_Definition (in: This=0xdbaf28, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbaf98) returned 0x0 [0065.506] ITaskDefinition:get_Actions (in: This=0xdbaf98, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbafe8) returned 0x0 [0065.506] IActionCollection:get_Count (in: This=0xdbafe8, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0065.506] IActionCollection:get_Item (in: This=0xdbafe8, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbbdd8) returned 0x0 [0065.506] IAction:get_Type (in: This=0xdbbdd8, pType=0x33cf670 | out: pType=0x33cf670*=5) returned 0x0 [0065.506] IUnknown:Release (This=0xdbbdd8) returned 0x1 [0065.506] IUnknown:Release (This=0xdbafe8) returned 0x1 [0065.506] IUnknown:Release (This=0xdbaf98) returned 0x0 [0065.506] IUnknown:Release (This=0xdbaf28) returned 0x0 [0065.506] IRegisteredTaskCollection:get_Item (in: This=0xdbae00, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbaf28) returned 0x0 [0065.506] IRegisteredTask:get_Name (in: This=0xdbaf28, pName=0x33cf684 | out: pName=0x33cf684*="CryptoPolicyTask") returned 0x0 [0065.506] IRegisteredTask:get_State (in: This=0xdbaf28, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0065.507] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x22) returned 0x34c7a48 [0065.507] wcsstr (_Str="cryptopolicytask", _SubStr="reboot") returned 0x0 [0065.507] wcsstr (_Str="cryptopolicytask", _SubStr="restart") returned 0x0 [0065.507] wcsstr (_Str="cryptopolicytask", _SubStr="shutdown") returned 0x0 [0065.507] wcsstr (_Str="cryptopolicytask", _SubStr="logoff") returned 0x0 [0065.507] wcsstr (_Str="cryptopolicytask", _SubStr="back") returned 0x0 [0065.507] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7a48) returned 1 [0065.507] IRegisteredTask:get_Definition (in: This=0xdbaf28, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbaf98) returned 0x0 [0065.516] ITaskDefinition:get_Actions (in: This=0xdbaf98, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbafe8) returned 0x0 [0065.516] IActionCollection:get_Count (in: This=0xdbafe8, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0065.516] IActionCollection:get_Item (in: This=0xdbafe8, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbb0c0) returned 0x0 [0065.516] IAction:get_Type (in: This=0xdbb0c0, pType=0x33cf670 | out: pType=0x33cf670*=5) returned 0x0 [0065.516] IUnknown:Release (This=0xdbb0c0) returned 0x1 [0065.516] IUnknown:Release (This=0xdbafe8) returned 0x1 [0065.516] IUnknown:Release (This=0xdbaf98) returned 0x0 [0065.516] IUnknown:Release (This=0xdbaf28) returned 0x0 [0065.516] IRegisteredTaskCollection:get_Item (in: This=0xdbae00, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbaf28) returned 0x0 [0065.517] IRegisteredTask:get_Name (in: This=0xdbaf28, pName=0x33cf684 | out: pName=0x33cf684*="KeyPreGenTask") returned 0x0 [0065.517] IRegisteredTask:get_State (in: This=0xdbaf28, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0065.517] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34dee00 [0065.517] wcsstr (_Str="keypregentask", _SubStr="reboot") returned 0x0 [0065.517] wcsstr (_Str="keypregentask", _SubStr="restart") returned 0x0 [0065.517] wcsstr (_Str="keypregentask", _SubStr="shutdown") returned 0x0 [0065.517] wcsstr (_Str="keypregentask", _SubStr="logoff") returned 0x0 [0065.517] wcsstr (_Str="keypregentask", _SubStr="back") returned 0x0 [0065.517] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dee00) returned 1 [0065.517] IRegisteredTask:get_Definition (in: This=0xdbaf28, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbaf98) returned 0x0 [0065.581] ITaskDefinition:get_Actions (in: This=0xdbaf98, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbafe8) returned 0x0 [0065.581] IActionCollection:get_Count (in: This=0xdbafe8, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0065.581] IActionCollection:get_Item (in: This=0xdbafe8, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbc6f8) returned 0x0 [0065.581] IAction:get_Type (in: This=0xdbc6f8, pType=0x33cf670 | out: pType=0x33cf670*=5) returned 0x0 [0065.581] IUnknown:Release (This=0xdbc6f8) returned 0x1 [0065.581] IUnknown:Release (This=0xdbafe8) returned 0x1 [0065.581] IUnknown:Release (This=0xdbaf98) returned 0x0 [0065.581] IUnknown:Release (This=0xdbaf28) returned 0x0 [0065.581] IRegisteredTaskCollection:get_Item (in: This=0xdbae00, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbaf28) returned 0x0 [0065.581] IRegisteredTask:get_Name (in: This=0xdbaf28, pName=0x33cf684 | out: pName=0x33cf684*="SystemTask") returned 0x0 [0065.581] IRegisteredTask:get_State (in: This=0xdbaf28, pState=0x33cf688 | out: pState=0x33cf688*=4) returned 0x0 [0065.582] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x16) returned 0x34d17e0 [0065.582] wcsstr (_Str="systemtask", _SubStr="reboot") returned 0x0 [0065.582] wcsstr (_Str="systemtask", _SubStr="restart") returned 0x0 [0065.582] wcsstr (_Str="systemtask", _SubStr="shutdown") returned 0x0 [0065.582] wcsstr (_Str="systemtask", _SubStr="logoff") returned 0x0 [0065.582] wcsstr (_Str="systemtask", _SubStr="back") returned 0x0 [0065.582] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d17e0) returned 1 [0065.582] IRegisteredTask:get_Definition (in: This=0xdbaf28, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbb010) returned 0x0 [0065.593] ITaskDefinition:get_Actions (in: This=0xdbb010, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbb060) returned 0x0 [0065.593] IActionCollection:get_Count (in: This=0xdbb060, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0065.593] IActionCollection:get_Item (in: This=0xdbb060, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbb2c0) returned 0x0 [0065.593] IAction:get_Type (in: This=0xdbb2c0, pType=0x33cf670 | out: pType=0x33cf670*=5) returned 0x0 [0065.593] IUnknown:Release (This=0xdbb2c0) returned 0x1 [0065.593] IUnknown:Release (This=0xdbb060) returned 0x1 [0065.593] IUnknown:Release (This=0xdbb010) returned 0x0 [0065.593] IUnknown:Release (This=0xdbaf28) returned 0x0 [0065.593] IRegisteredTaskCollection:get_Item (in: This=0xdbae00, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbaf28) returned 0x0 [0065.593] IRegisteredTask:get_Name (in: This=0xdbaf28, pName=0x33cf684 | out: pName=0x33cf684*="UserTask") returned 0x0 [0065.593] IRegisteredTask:get_State (in: This=0xdbaf28, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0065.594] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x12) returned 0x34d1640 [0065.594] wcsstr (_Str="usertask", _SubStr="reboot") returned 0x0 [0065.594] wcsstr (_Str="usertask", _SubStr="restart") returned 0x0 [0065.594] wcsstr (_Str="usertask", _SubStr="shutdown") returned 0x0 [0065.594] wcsstr (_Str="usertask", _SubStr="logoff") returned 0x0 [0065.594] wcsstr (_Str="usertask", _SubStr="back") returned 0x0 [0065.594] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0065.594] IRegisteredTask:get_Definition (in: This=0xdbaf28, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbb010) returned 0x0 [0065.642] ITaskDefinition:get_Actions (in: This=0xdbb010, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbb060) returned 0x0 [0065.642] IActionCollection:get_Count (in: This=0xdbb060, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0065.642] IActionCollection:get_Item (in: This=0xdbb060, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbc778) returned 0x0 [0065.642] IAction:get_Type (in: This=0xdbc778, pType=0x33cf670 | out: pType=0x33cf670*=5) returned 0x0 [0065.642] IUnknown:Release (This=0xdbc778) returned 0x1 [0065.642] IUnknown:Release (This=0xdbb060) returned 0x1 [0065.642] IUnknown:Release (This=0xdbb010) returned 0x0 [0065.642] IUnknown:Release (This=0xdbaf28) returned 0x0 [0065.642] IRegisteredTaskCollection:get_Item (in: This=0xdbae00, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbaf28) returned 0x0 [0065.642] IRegisteredTask:get_Name (in: This=0xdbaf28, pName=0x33cf684 | out: pName=0x33cf684*="UserTask-Roam") returned 0x0 [0065.642] IRegisteredTask:get_State (in: This=0xdbaf28, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0065.695] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34dee50 [0065.696] wcsstr (_Str="usertask-roam", _SubStr="reboot") returned 0x0 [0065.696] wcsstr (_Str="usertask-roam", _SubStr="restart") returned 0x0 [0065.696] wcsstr (_Str="usertask-roam", _SubStr="shutdown") returned 0x0 [0065.696] wcsstr (_Str="usertask-roam", _SubStr="logoff") returned 0x0 [0065.696] wcsstr (_Str="usertask-roam", _SubStr="back") returned 0x0 [0065.696] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dee50) returned 1 [0065.696] IRegisteredTask:get_Definition (in: This=0xdbaf28, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbaf98) returned 0x0 [0065.708] ITaskDefinition:get_Actions (in: This=0xdbaf98, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbafe8) returned 0x0 [0065.708] IActionCollection:get_Count (in: This=0xdbafe8, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0065.708] IActionCollection:get_Item (in: This=0xdbafe8, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbc638) returned 0x0 [0065.708] IAction:get_Type (in: This=0xdbc638, pType=0x33cf670 | out: pType=0x33cf670*=5) returned 0x0 [0065.708] IUnknown:Release (This=0xdbc638) returned 0x1 [0065.708] IUnknown:Release (This=0xdbafe8) returned 0x1 [0065.708] IUnknown:Release (This=0xdbaf98) returned 0x0 [0065.709] IUnknown:Release (This=0xdbaf28) returned 0x0 [0065.709] IUnknown:Release (This=0xdbae00) returned 0x0 [0065.709] ITaskFolder:GetFolders (in: This=0xdbad48, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbae00) returned 0x0 [0065.709] ITaskFolderCollection:get_Count (in: This=0xdbae00, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0065.709] IUnknown:Release (This=0xdbae00) returned 0x0 [0065.709] TaskScheduler:IUnknown:Release (This=0xdbad48) returned 0x0 [0065.709] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbad48) returned 0x0 [0065.709] ITaskFolder:GetTasks (in: This=0xdbad48, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbadd8) returned 0x0 [0065.710] IRegisteredTaskCollection:get_Count (in: This=0xdbadd8, pCount=0x33cf678 | out: pCount=0x33cf678*=1) returned 0x0 [0065.710] IRegisteredTaskCollection:get_Item (in: This=0xdbadd8, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbaec0) returned 0x0 [0065.711] IRegisteredTask:get_Name (in: This=0xdbaec0, pName=0x33cf684 | out: pName=0x33cf684*="ProactiveScan") returned 0x0 [0065.711] IRegisteredTask:get_State (in: This=0xdbaec0, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0065.711] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34deba8 [0065.711] wcsstr (_Str="proactivescan", _SubStr="reboot") returned 0x0 [0065.711] wcsstr (_Str="proactivescan", _SubStr="restart") returned 0x0 [0065.711] wcsstr (_Str="proactivescan", _SubStr="shutdown") returned 0x0 [0065.711] wcsstr (_Str="proactivescan", _SubStr="logoff") returned 0x0 [0065.711] wcsstr (_Str="proactivescan", _SubStr="back") returned 0x0 [0065.711] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34deba8) returned 1 [0065.711] IRegisteredTask:get_Definition (in: This=0xdbaec0, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbaf88) returned 0x0 [0065.721] ITaskDefinition:get_Actions (in: This=0xdbaf88, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbafd8) returned 0x0 [0065.721] IActionCollection:get_Count (in: This=0xdbafd8, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0065.721] IActionCollection:get_Item (in: This=0xdbafd8, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbc588) returned 0x0 [0065.721] IAction:get_Type (in: This=0xdbc588, pType=0x33cf670 | out: pType=0x33cf670*=5) returned 0x0 [0065.721] IUnknown:Release (This=0xdbc588) returned 0x1 [0065.721] IUnknown:Release (This=0xdbafd8) returned 0x1 [0065.721] IUnknown:Release (This=0xdbaf88) returned 0x0 [0065.721] IUnknown:Release (This=0xdbaec0) returned 0x0 [0065.721] IUnknown:Release (This=0xdbadd8) returned 0x0 [0065.721] ITaskFolder:GetFolders (in: This=0xdbad48, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbadd8) returned 0x0 [0065.726] ITaskFolderCollection:get_Count (in: This=0xdbadd8, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0065.726] IUnknown:Release (This=0xdbadd8) returned 0x0 [0065.726] TaskScheduler:IUnknown:Release (This=0xdbad48) returned 0x0 [0065.726] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbad48) returned 0x0 [0065.726] ITaskFolder:GetTasks (in: This=0xdbad48, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbad98) returned 0x0 [0065.817] IRegisteredTaskCollection:get_Count (in: This=0xdbad98, pCount=0x33cf678 | out: pCount=0x33cf678*=0) returned 0x0 [0065.817] IUnknown:Release (This=0xdbad98) returned 0x0 [0065.817] ITaskFolder:GetFolders (in: This=0xdbad48, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbad98) returned 0x0 [0065.818] ITaskFolderCollection:get_Count (in: This=0xdbad98, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0065.818] IUnknown:Release (This=0xdbad98) returned 0x0 [0065.818] TaskScheduler:IUnknown:Release (This=0xdbad48) returned 0x0 [0065.818] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbad48) returned 0x0 [0065.818] ITaskFolder:GetTasks (in: This=0xdbad48, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbadf0) returned 0x0 [0065.819] IRegisteredTaskCollection:get_Count (in: This=0xdbadf0, pCount=0x33cf678 | out: pCount=0x33cf678*=0) returned 0x0 [0065.819] IUnknown:Release (This=0xdbadf0) returned 0x0 [0065.819] ITaskFolder:GetFolders (in: This=0xdbad48, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbadf0) returned 0x0 [0065.819] ITaskFolderCollection:get_Count (in: This=0xdbadf0, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0065.819] IUnknown:Release (This=0xdbadf0) returned 0x0 [0065.819] TaskScheduler:IUnknown:Release (This=0xdbad48) returned 0x0 [0065.819] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbad48) returned 0x0 [0065.819] ITaskFolder:GetTasks (in: This=0xdbad48, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbae18) returned 0x0 [0065.821] IRegisteredTaskCollection:get_Count (in: This=0xdbae18, pCount=0x33cf678 | out: pCount=0x33cf678*=1) returned 0x0 [0065.821] IRegisteredTaskCollection:get_Item (in: This=0xdbae18, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbaec0) returned 0x0 [0065.821] IRegisteredTask:get_Name (in: This=0xdbaec0, pName=0x33cf684 | out: pName=0x33cf684*="Consolidator") returned 0x0 [0065.821] IRegisteredTask:get_State (in: This=0xdbaec0, pState=0x33cf688 | out: pState=0x33cf688*=1) returned 0x0 [0065.821] IUnknown:Release (This=0xdbaec0) returned 0x0 [0065.821] IUnknown:Release (This=0xdbae18) returned 0x0 [0065.821] ITaskFolder:GetFolders (in: This=0xdbad48, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbae18) returned 0x0 [0065.822] ITaskFolderCollection:get_Count (in: This=0xdbae18, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0065.822] IUnknown:Release (This=0xdbae18) returned 0x0 [0065.822] TaskScheduler:IUnknown:Release (This=0xdbad48) returned 0x0 [0065.822] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x10, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbad48) returned 0x0 [0065.823] ITaskFolder:GetTasks (in: This=0xdbad48, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbadf0) returned 0x0 [0065.824] IRegisteredTaskCollection:get_Count (in: This=0xdbadf0, pCount=0x33cf678 | out: pCount=0x33cf678*=1) returned 0x0 [0065.824] IRegisteredTaskCollection:get_Item (in: This=0xdbadf0, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbaec0) returned 0x0 [0065.824] IRegisteredTask:get_Name (in: This=0xdbaec0, pName=0x33cf684 | out: pName=0x33cf684*="Data Integrity Scan") returned 0x0 [0065.824] IRegisteredTask:get_State (in: This=0xdbaec0, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0065.824] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x28) returned 0x34c7b68 [0065.824] wcsstr (_Str="data integrity scan", _SubStr="reboot") returned 0x0 [0065.824] wcsstr (_Str="data integrity scan", _SubStr="restart") returned 0x0 [0065.824] wcsstr (_Str="data integrity scan", _SubStr="shutdown") returned 0x0 [0065.825] wcsstr (_Str="data integrity scan", _SubStr="logoff") returned 0x0 [0065.825] wcsstr (_Str="data integrity scan", _SubStr="back") returned 0x0 [0065.825] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7b68) returned 1 [0065.825] IRegisteredTask:get_Definition (in: This=0xdbaec0, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbaf30) returned 0x0 [0065.839] ITaskDefinition:get_Actions (in: This=0xdbaf30, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbaf80) returned 0x0 [0065.839] IActionCollection:get_Count (in: This=0xdbaf80, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0065.839] IActionCollection:get_Item (in: This=0xdbaf80, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbc5d8) returned 0x0 [0065.839] IAction:get_Type (in: This=0xdbc5d8, pType=0x33cf670 | out: pType=0x33cf670*=5) returned 0x0 [0065.839] IUnknown:Release (This=0xdbc5d8) returned 0x1 [0065.839] IUnknown:Release (This=0xdbaf80) returned 0x1 [0065.839] IUnknown:Release (This=0xdbaf30) returned 0x0 [0065.839] IUnknown:Release (This=0xdbaec0) returned 0x0 [0065.839] IUnknown:Release (This=0xdbadf0) returned 0x0 [0065.839] ITaskFolder:GetFolders (in: This=0xdbad48, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbadf0) returned 0x0 [0065.912] ITaskFolderCollection:get_Count (in: This=0xdbadf0, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0065.912] IUnknown:Release (This=0xdbadf0) returned 0x0 [0065.912] TaskScheduler:IUnknown:Release (This=0xdbad48) returned 0x0 [0065.912] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbaec0) returned 0x0 [0065.912] ITaskFolder:GetTasks (in: This=0xdbaec0, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbaf50) returned 0x0 [0065.913] IRegisteredTaskCollection:get_Count (in: This=0xdbaf50, pCount=0x33cf678 | out: pCount=0x33cf678*=1) returned 0x0 [0065.913] IRegisteredTaskCollection:get_Item (in: This=0xdbaf50, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbaff8) returned 0x0 [0065.913] IRegisteredTask:get_Name (in: This=0xdbaff8, pName=0x33cf684 | out: pName=0x33cf684*="ScheduledDefrag") returned 0x0 [0065.913] IRegisteredTask:get_State (in: This=0xdbaff8, pState=0x33cf688 | out: pState=0x33cf688*=1) returned 0x0 [0065.914] IUnknown:Release (This=0xdbaff8) returned 0x0 [0065.914] IUnknown:Release (This=0xdbaf50) returned 0x0 [0065.914] ITaskFolder:GetFolders (in: This=0xdbaec0, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbaf50) returned 0x0 [0065.915] ITaskFolderCollection:get_Count (in: This=0xdbaf50, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0065.915] IUnknown:Release (This=0xdbaf50) returned 0x0 [0065.915] TaskScheduler:IUnknown:Release (This=0xdbaec0) returned 0x0 [0065.915] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbaec0) returned 0x0 [0065.915] ITaskFolder:GetTasks (in: This=0xdbaec0, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbaf68) returned 0x0 [0065.916] IRegisteredTaskCollection:get_Count (in: This=0xdbaf68, pCount=0x33cf678 | out: pCount=0x33cf678*=1) returned 0x0 [0065.916] IRegisteredTaskCollection:get_Item (in: This=0xdbaf68, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbb020) returned 0x0 [0065.916] IRegisteredTask:get_Name (in: This=0xdbb020, pName=0x33cf684 | out: pName=0x33cf684*="Device") returned 0x0 [0065.916] IRegisteredTask:get_State (in: This=0xdbb020, pState=0x33cf688 | out: pState=0x33cf688*=4) returned 0x0 [0065.916] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0xe) returned 0x34d0418 [0065.916] wcsstr (_Str="device", _SubStr="reboot") returned 0x0 [0065.916] wcsstr (_Str="device", _SubStr="restart") returned 0x0 [0065.916] wcsstr (_Str="device", _SubStr="shutdown") returned 0x0 [0065.916] wcsstr (_Str="device", _SubStr="logoff") returned 0x0 [0065.916] wcsstr (_Str="device", _SubStr="back") returned 0x0 [0065.916] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0418) returned 1 [0065.917] IRegisteredTask:get_Definition (in: This=0xdbb020, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbb0f8) returned 0x0 [0066.004] ITaskDefinition:get_Actions (in: This=0xdbb0f8, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbb148) returned 0x0 [0066.004] IActionCollection:get_Count (in: This=0xdbb148, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0066.004] IActionCollection:get_Item (in: This=0xdbb148, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbae60) returned 0x0 [0066.004] IAction:get_Type (in: This=0xdbae60, pType=0x33cf670 | out: pType=0x33cf670*=0) returned 0x0 [0066.004] IUnknown:QueryInterface (in: This=0xdbae60, riid=0x9d606c*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x33cf6a8 | out: ppvObject=0x33cf6a8*=0xdbae60) returned 0x0 [0066.004] IExecAction:get_Path (in: This=0xdbae60, pPath=0x33cf680 | out: pPath=0x33cf680*="%windir%\\system32\\devicecensus.exe") returned 0x0 [0066.005] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x46) returned 0x34d3cb8 [0066.005] wcsstr (_Str="%windir%\\system32\\devicecensus.exe", _SubStr="reboot") returned 0x0 [0066.005] wcsstr (_Str="%windir%\\system32\\devicecensus.exe", _SubStr="restart") returned 0x0 [0066.005] wcsstr (_Str="%windir%\\system32\\devicecensus.exe", _SubStr="shutdown") returned 0x0 [0066.005] wcsstr (_Str="%windir%\\system32\\devicecensus.exe", _SubStr="logoff") returned 0x0 [0066.005] wcsstr (_Str="%windir%\\system32\\devicecensus.exe", _SubStr="back") returned 0x0 [0066.005] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d3cb8) returned 1 [0066.005] IExecAction:get_Arguments (in: This=0xdbae60, pArgument=0x33cf67c | out: pArgument=0x33cf67c*=0x0) returned 0x0 [0066.005] IUnknown:Release (This=0xdbae60) returned 0x2 [0066.005] IUnknown:Release (This=0xdbae60) returned 0x1 [0066.005] IUnknown:Release (This=0xdbb148) returned 0x1 [0066.005] IUnknown:Release (This=0xdbb0f8) returned 0x0 [0066.005] IUnknown:Release (This=0xdbb020) returned 0x0 [0066.005] IUnknown:Release (This=0xdbaf68) returned 0x0 [0066.005] ITaskFolder:GetFolders (in: This=0xdbaec0, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb508) returned 0x0 [0066.006] ITaskFolderCollection:get_Count (in: This=0xdbb508, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0066.006] IUnknown:Release (This=0xdbb508) returned 0x0 [0066.006] TaskScheduler:IUnknown:Release (This=0xdbaec0) returned 0x0 [0066.006] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x13, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0066.006] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb800) returned 0x0 [0066.007] IRegisteredTaskCollection:get_Count (in: This=0xdbb800, pCount=0x33cf678 | out: pCount=0x33cf678*=0) returned 0x0 [0066.007] IUnknown:Release (This=0xdbb800) returned 0x0 [0066.007] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb800) returned 0x0 [0066.007] ITaskFolderCollection:get_Count (in: This=0xdbb800, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0066.007] IUnknown:Release (This=0xdbb800) returned 0x0 [0066.007] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0066.007] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x14, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0066.007] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb800) returned 0x0 [0066.011] IRegisteredTaskCollection:get_Count (in: This=0xdbb800, pCount=0x33cf678 | out: pCount=0x33cf678*=0) returned 0x0 [0066.011] IUnknown:Release (This=0xdbb800) returned 0x0 [0066.011] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb800) returned 0x0 [0066.094] ITaskFolderCollection:get_Count (in: This=0xdbb800, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0066.094] IUnknown:Release (This=0xdbb800) returned 0x0 [0066.094] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0066.095] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x15, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0066.095] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb800) returned 0x0 [0066.095] IRegisteredTaskCollection:get_Count (in: This=0xdbb800, pCount=0x33cf678 | out: pCount=0x33cf678*=0) returned 0x0 [0066.096] IUnknown:Release (This=0xdbb800) returned 0x0 [0066.096] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb800) returned 0x0 [0066.096] ITaskFolderCollection:get_Count (in: This=0xdbb800, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0066.096] IUnknown:Release (This=0xdbb800) returned 0x0 [0066.096] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0066.096] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x16, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0066.096] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb800) returned 0x0 [0066.099] IRegisteredTaskCollection:get_Count (in: This=0xdbb800, pCount=0x33cf678 | out: pCount=0x33cf678*=1) returned 0x0 [0066.099] IRegisteredTaskCollection:get_Item (in: This=0xdbb800, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbb860) returned 0x0 [0066.099] IRegisteredTask:get_Name (in: This=0xdbb860, pName=0x33cf684 | out: pName=0x33cf684*="SilentCleanup") returned 0x0 [0066.099] IRegisteredTask:get_State (in: This=0xdbb860, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0066.102] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34deb08 [0066.102] wcsstr (_Str="silentcleanup", _SubStr="reboot") returned 0x0 [0066.102] wcsstr (_Str="silentcleanup", _SubStr="restart") returned 0x0 [0066.102] wcsstr (_Str="silentcleanup", _SubStr="shutdown") returned 0x0 [0066.102] wcsstr (_Str="silentcleanup", _SubStr="logoff") returned 0x0 [0066.102] wcsstr (_Str="silentcleanup", _SubStr="back") returned 0x0 [0066.102] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34deb08) returned 1 [0066.102] IRegisteredTask:get_Definition (in: This=0xdbb860, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbaec0) returned 0x0 [0066.149] ITaskDefinition:get_Actions (in: This=0xdbaec0, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbaf10) returned 0x0 [0066.149] IActionCollection:get_Count (in: This=0xdbaf10, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0066.149] IActionCollection:get_Item (in: This=0xdbaf10, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbae10) returned 0x0 [0066.149] IAction:get_Type (in: This=0xdbae10, pType=0x33cf670 | out: pType=0x33cf670*=0) returned 0x0 [0066.149] IUnknown:QueryInterface (in: This=0xdbae10, riid=0x9d606c*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x33cf6a8 | out: ppvObject=0x33cf6a8*=0xdbae10) returned 0x0 [0066.149] IExecAction:get_Path (in: This=0xdbae10, pPath=0x33cf680 | out: pPath=0x33cf680*="%windir%\\system32\\cleanmgr.exe") returned 0x0 [0066.149] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x3e) returned 0x34c2ce0 [0066.149] wcsstr (_Str="%windir%\\system32\\cleanmgr.exe", _SubStr="reboot") returned 0x0 [0066.149] wcsstr (_Str="%windir%\\system32\\cleanmgr.exe", _SubStr="restart") returned 0x0 [0066.149] wcsstr (_Str="%windir%\\system32\\cleanmgr.exe", _SubStr="shutdown") returned 0x0 [0066.149] wcsstr (_Str="%windir%\\system32\\cleanmgr.exe", _SubStr="logoff") returned 0x0 [0066.149] wcsstr (_Str="%windir%\\system32\\cleanmgr.exe", _SubStr="back") returned 0x0 [0066.149] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c2ce0) returned 1 [0066.149] IExecAction:get_Arguments (in: This=0xdbae10, pArgument=0x33cf67c | out: pArgument=0x33cf67c*="/autoclean /d %systemdrive%") returned 0x0 [0066.149] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x38) returned 0x34beb38 [0066.149] wcsstr (_Str="/autoclean /d %systemdrive%", _SubStr="reboot") returned 0x0 [0066.149] wcsstr (_Str="/autoclean /d %systemdrive%", _SubStr="restart") returned 0x0 [0066.149] wcsstr (_Str="/autoclean /d %systemdrive%", _SubStr="shutdown") returned 0x0 [0066.149] wcsstr (_Str="/autoclean /d %systemdrive%", _SubStr="logoff") returned 0x0 [0066.149] wcsstr (_Str="/autoclean /d %systemdrive%", _SubStr="back") returned 0x0 [0066.149] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34beb38) returned 1 [0066.149] IUnknown:Release (This=0xdbae10) returned 0x2 [0066.149] IUnknown:Release (This=0xdbae10) returned 0x1 [0066.150] IUnknown:Release (This=0xdbaf10) returned 0x1 [0066.150] IUnknown:Release (This=0xdbaec0) returned 0x0 [0066.150] IUnknown:Release (This=0xdbb860) returned 0x0 [0066.150] IUnknown:Release (This=0xdbb800) returned 0x0 [0066.150] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb800) returned 0x0 [0066.150] ITaskFolderCollection:get_Count (in: This=0xdbb800, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0066.150] IUnknown:Release (This=0xdbb800) returned 0x0 [0066.150] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0066.150] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x17, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0066.150] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb800) returned 0x0 [0066.153] IRegisteredTaskCollection:get_Count (in: This=0xdbb800, pCount=0x33cf678 | out: pCount=0x33cf678*=0) returned 0x0 [0066.153] IUnknown:Release (This=0xdbb800) returned 0x0 [0066.154] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb800) returned 0x0 [0066.156] ITaskFolderCollection:get_Count (in: This=0xdbb800, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0066.156] IUnknown:Release (This=0xdbb800) returned 0x0 [0066.156] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0066.156] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0066.156] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb800) returned 0x0 [0066.159] IRegisteredTaskCollection:get_Count (in: This=0xdbb800, pCount=0x33cf678 | out: pCount=0x33cf678*=2) returned 0x0 [0066.159] IRegisteredTaskCollection:get_Item (in: This=0xdbb800, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbb8b8) returned 0x0 [0066.159] IRegisteredTask:get_Name (in: This=0xdbb8b8, pName=0x33cf684 | out: pName=0x33cf684*="Diagnostics") returned 0x0 [0066.159] IRegisteredTask:get_State (in: This=0xdbb8b8, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0066.160] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x18) returned 0x34d1740 [0066.160] wcsstr (_Str="diagnostics", _SubStr="reboot") returned 0x0 [0066.160] wcsstr (_Str="diagnostics", _SubStr="restart") returned 0x0 [0066.160] wcsstr (_Str="diagnostics", _SubStr="shutdown") returned 0x0 [0066.160] wcsstr (_Str="diagnostics", _SubStr="logoff") returned 0x0 [0066.160] wcsstr (_Str="diagnostics", _SubStr="back") returned 0x0 [0066.160] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1740) returned 1 [0066.160] IRegisteredTask:get_Definition (in: This=0xdbb8b8, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbb5a8) returned 0x0 [0066.167] ITaskDefinition:get_Actions (in: This=0xdbb5a8, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbb928) returned 0x0 [0066.167] IActionCollection:get_Count (in: This=0xdbb928, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0066.167] IActionCollection:get_Item (in: This=0xdbb928, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbae10) returned 0x0 [0066.167] IAction:get_Type (in: This=0xdbae10, pType=0x33cf670 | out: pType=0x33cf670*=0) returned 0x0 [0066.167] IUnknown:QueryInterface (in: This=0xdbae10, riid=0x9d606c*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x33cf6a8 | out: ppvObject=0x33cf6a8*=0xdbae10) returned 0x0 [0066.167] IExecAction:get_Path (in: This=0xdbae10, pPath=0x33cf680 | out: pPath=0x33cf680*="%windir%\\system32\\disksnapshot.exe") returned 0x0 [0066.167] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x46) returned 0x34d4398 [0066.167] wcsstr (_Str="%windir%\\system32\\disksnapshot.exe", _SubStr="reboot") returned 0x0 [0066.167] wcsstr (_Str="%windir%\\system32\\disksnapshot.exe", _SubStr="restart") returned 0x0 [0066.167] wcsstr (_Str="%windir%\\system32\\disksnapshot.exe", _SubStr="shutdown") returned 0x0 [0066.167] wcsstr (_Str="%windir%\\system32\\disksnapshot.exe", _SubStr="logoff") returned 0x0 [0066.167] wcsstr (_Str="%windir%\\system32\\disksnapshot.exe", _SubStr="back") returned 0x0 [0066.167] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d4398) returned 1 [0066.167] IExecAction:get_Arguments (in: This=0xdbae10, pArgument=0x33cf67c | out: pArgument=0x33cf67c*="-z") returned 0x0 [0066.167] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x6) returned 0x34d0e10 [0066.167] wcsstr (_Str="-z", _SubStr="reboot") returned 0x0 [0066.167] wcsstr (_Str="-z", _SubStr="restart") returned 0x0 [0066.167] wcsstr (_Str="-z", _SubStr="shutdown") returned 0x0 [0066.167] wcsstr (_Str="-z", _SubStr="logoff") returned 0x0 [0066.167] wcsstr (_Str="-z", _SubStr="back") returned 0x0 [0066.167] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0e10) returned 1 [0066.167] IUnknown:Release (This=0xdbae10) returned 0x2 [0066.167] IUnknown:Release (This=0xdbae10) returned 0x1 [0066.167] IUnknown:Release (This=0xdbb928) returned 0x1 [0066.167] IUnknown:Release (This=0xdbb5a8) returned 0x0 [0066.167] IUnknown:Release (This=0xdbb8b8) returned 0x0 [0066.167] IRegisteredTaskCollection:get_Item (in: This=0xdbb800, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbb8b8) returned 0x0 [0066.167] IRegisteredTask:get_Name (in: This=0xdbb8b8, pName=0x33cf684 | out: pName=0x33cf684*="StorageSense") returned 0x0 [0066.167] IRegisteredTask:get_State (in: This=0xdbb8b8, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0066.241] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34deb80 [0066.242] wcsstr (_Str="storagesense", _SubStr="reboot") returned 0x0 [0066.242] wcsstr (_Str="storagesense", _SubStr="restart") returned 0x0 [0066.242] wcsstr (_Str="storagesense", _SubStr="shutdown") returned 0x0 [0066.242] wcsstr (_Str="storagesense", _SubStr="logoff") returned 0x0 [0066.242] wcsstr (_Str="storagesense", _SubStr="back") returned 0x0 [0066.242] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34deb80) returned 1 [0066.242] IRegisteredTask:get_Definition (in: This=0xdbb8b8, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbb5a8) returned 0x0 [0066.318] ITaskDefinition:get_Actions (in: This=0xdbb5a8, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbb928) returned 0x0 [0066.318] IActionCollection:get_Count (in: This=0xdbb928, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0066.318] IActionCollection:get_Item (in: This=0xdbb928, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbae10) returned 0x0 [0066.318] IAction:get_Type (in: This=0xdbae10, pType=0x33cf670 | out: pType=0x33cf670*=5) returned 0x0 [0066.318] IUnknown:Release (This=0xdbae10) returned 0x1 [0066.318] IUnknown:Release (This=0xdbb928) returned 0x1 [0066.318] IUnknown:Release (This=0xdbb5a8) returned 0x0 [0066.318] IUnknown:Release (This=0xdbb8b8) returned 0x0 [0066.318] IUnknown:Release (This=0xdbb800) returned 0x0 [0066.318] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb800) returned 0x0 [0066.383] ITaskFolderCollection:get_Count (in: This=0xdbb800, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0066.383] IUnknown:Release (This=0xdbb800) returned 0x0 [0066.383] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0066.383] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x19, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0066.383] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb558) returned 0x0 [0066.384] IRegisteredTaskCollection:get_Count (in: This=0xdbb558, pCount=0x33cf678 | out: pCount=0x33cf678*=1) returned 0x0 [0066.385] IRegisteredTaskCollection:get_Item (in: This=0xdbb558, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbb800) returned 0x0 [0066.385] IRegisteredTask:get_Name (in: This=0xdbb800, pName=0x33cf684 | out: pName=0x33cf684*="dusmtask") returned 0x0 [0066.385] IRegisteredTask:get_State (in: This=0xdbb800, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0066.385] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x12) returned 0x34d1720 [0066.385] wcsstr (_Str="dusmtask", _SubStr="reboot") returned 0x0 [0066.385] wcsstr (_Str="dusmtask", _SubStr="restart") returned 0x0 [0066.385] wcsstr (_Str="dusmtask", _SubStr="shutdown") returned 0x0 [0066.385] wcsstr (_Str="dusmtask", _SubStr="logoff") returned 0x0 [0066.385] wcsstr (_Str="dusmtask", _SubStr="back") returned 0x0 [0066.385] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1720) returned 1 [0066.385] IRegisteredTask:get_Definition (in: This=0xdbb800, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbb8c8) returned 0x0 [0066.462] ITaskDefinition:get_Actions (in: This=0xdbb8c8, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbb918) returned 0x0 [0066.462] IActionCollection:get_Count (in: This=0xdbb918, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0066.463] IActionCollection:get_Item (in: This=0xdbb918, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbae10) returned 0x0 [0066.463] IAction:get_Type (in: This=0xdbae10, pType=0x33cf670 | out: pType=0x33cf670*=0) returned 0x0 [0066.463] IUnknown:QueryInterface (in: This=0xdbae10, riid=0x9d606c*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x33cf6a8 | out: ppvObject=0x33cf6a8*=0xdbae10) returned 0x0 [0066.463] IExecAction:get_Path (in: This=0xdbae10, pPath=0x33cf680 | out: pPath=0x33cf680*="%SystemRoot%\\System32\\dusmtask.exe") returned 0x0 [0066.463] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x46) returned 0x34d3ad8 [0066.463] wcsstr (_Str="%systemroot%\\system32\\dusmtask.exe", _SubStr="reboot") returned 0x0 [0066.463] wcsstr (_Str="%systemroot%\\system32\\dusmtask.exe", _SubStr="restart") returned 0x0 [0066.463] wcsstr (_Str="%systemroot%\\system32\\dusmtask.exe", _SubStr="shutdown") returned 0x0 [0066.463] wcsstr (_Str="%systemroot%\\system32\\dusmtask.exe", _SubStr="logoff") returned 0x0 [0066.463] wcsstr (_Str="%systemroot%\\system32\\dusmtask.exe", _SubStr="back") returned 0x0 [0066.463] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d3ad8) returned 1 [0066.463] IExecAction:get_Arguments (in: This=0xdbae10, pArgument=0x33cf67c | out: pArgument=0x33cf67c*=0x0) returned 0x0 [0066.463] IUnknown:Release (This=0xdbae10) returned 0x2 [0066.463] IUnknown:Release (This=0xdbae10) returned 0x1 [0066.463] IUnknown:Release (This=0xdbb918) returned 0x1 [0066.463] IUnknown:Release (This=0xdbb8c8) returned 0x0 [0066.463] IUnknown:Release (This=0xdbb800) returned 0x0 [0066.463] IUnknown:Release (This=0xdbb558) returned 0x0 [0066.463] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb558) returned 0x0 [0066.464] ITaskFolderCollection:get_Count (in: This=0xdbb558, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0066.464] IUnknown:Release (This=0xdbb558) returned 0x0 [0066.464] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0066.464] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1a, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0066.464] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb558) returned 0x0 [0066.466] IRegisteredTaskCollection:get_Count (in: This=0xdbb558, pCount=0x33cf678 | out: pCount=0x33cf678*=4) returned 0x0 [0066.466] IRegisteredTaskCollection:get_Item (in: This=0xdbb558, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbb800) returned 0x0 [0066.466] IRegisteredTask:get_Name (in: This=0xdbb800, pName=0x33cf684 | out: pName=0x33cf684*="EDP App Launch Task") returned 0x0 [0066.466] IRegisteredTask:get_State (in: This=0xdbb800, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0066.466] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x28) returned 0x34c7a48 [0066.466] wcsstr (_Str="edp app launch task", _SubStr="reboot") returned 0x0 [0066.466] wcsstr (_Str="edp app launch task", _SubStr="restart") returned 0x0 [0066.466] wcsstr (_Str="edp app launch task", _SubStr="shutdown") returned 0x0 [0066.466] wcsstr (_Str="edp app launch task", _SubStr="logoff") returned 0x0 [0066.466] wcsstr (_Str="edp app launch task", _SubStr="back") returned 0x0 [0066.466] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7a48) returned 1 [0066.466] IRegisteredTask:get_Definition (in: This=0xdbb800, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbb8d8) returned 0x0 [0066.472] ITaskDefinition:get_Actions (in: This=0xdbb8d8, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbb928) returned 0x0 [0066.472] IActionCollection:get_Count (in: This=0xdbb928, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0066.472] IActionCollection:get_Item (in: This=0xdbb928, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbae10) returned 0x0 [0066.472] IAction:get_Type (in: This=0xdbae10, pType=0x33cf670 | out: pType=0x33cf670*=5) returned 0x0 [0066.472] IUnknown:Release (This=0xdbae10) returned 0x1 [0066.472] IUnknown:Release (This=0xdbb928) returned 0x1 [0066.472] IUnknown:Release (This=0xdbb8d8) returned 0x0 [0066.472] IUnknown:Release (This=0xdbb800) returned 0x0 [0066.472] IRegisteredTaskCollection:get_Item (in: This=0xdbb558, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbb800) returned 0x0 [0066.472] IRegisteredTask:get_Name (in: This=0xdbb800, pName=0x33cf684 | out: pName=0x33cf684*="EDP Auth Task") returned 0x0 [0066.472] IRegisteredTask:get_State (in: This=0xdbb800, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0066.583] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34deea0 [0066.583] wcsstr (_Str="edp auth task", _SubStr="reboot") returned 0x0 [0066.583] wcsstr (_Str="edp auth task", _SubStr="restart") returned 0x0 [0066.583] wcsstr (_Str="edp auth task", _SubStr="shutdown") returned 0x0 [0066.583] wcsstr (_Str="edp auth task", _SubStr="logoff") returned 0x0 [0066.583] wcsstr (_Str="edp auth task", _SubStr="back") returned 0x0 [0066.583] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34deea0) returned 1 [0066.583] IRegisteredTask:get_Definition (in: This=0xdbb800, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbb8c8) returned 0x0 [0066.588] ITaskDefinition:get_Actions (in: This=0xdbb8c8, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbb918) returned 0x0 [0066.588] IActionCollection:get_Count (in: This=0xdbb918, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0066.588] IActionCollection:get_Item (in: This=0xdbb918, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbae10) returned 0x0 [0066.588] IAction:get_Type (in: This=0xdbae10, pType=0x33cf670 | out: pType=0x33cf670*=5) returned 0x0 [0066.589] IUnknown:Release (This=0xdbae10) returned 0x1 [0066.589] IUnknown:Release (This=0xdbb918) returned 0x1 [0066.589] IUnknown:Release (This=0xdbb8c8) returned 0x0 [0066.589] IUnknown:Release (This=0xdbb800) returned 0x0 [0066.589] IRegisteredTaskCollection:get_Item (in: This=0xdbb558, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbb800) returned 0x0 [0066.589] IRegisteredTask:get_Name (in: This=0xdbb800, pName=0x33cf684 | out: pName=0x33cf684*="EDP Inaccessible Credentials Task") returned 0x0 [0066.589] IRegisteredTask:get_State (in: This=0xdbb800, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0066.589] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x44) returned 0x34d3c18 [0066.589] wcsstr (_Str="edp inaccessible credentials task", _SubStr="reboot") returned 0x0 [0066.589] wcsstr (_Str="edp inaccessible credentials task", _SubStr="restart") returned 0x0 [0066.589] wcsstr (_Str="edp inaccessible credentials task", _SubStr="shutdown") returned 0x0 [0066.589] wcsstr (_Str="edp inaccessible credentials task", _SubStr="logoff") returned 0x0 [0066.589] wcsstr (_Str="edp inaccessible credentials task", _SubStr="back") returned 0x0 [0066.589] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d3c18) returned 1 [0066.589] IRegisteredTask:get_Definition (in: This=0xdbb800, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbb870) returned 0x0 [0066.595] ITaskDefinition:get_Actions (in: This=0xdbb870, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbb8c0) returned 0x0 [0066.595] IActionCollection:get_Count (in: This=0xdbb8c0, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0066.595] IActionCollection:get_Item (in: This=0xdbb8c0, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbafa8) returned 0x0 [0066.595] IAction:get_Type (in: This=0xdbafa8, pType=0x33cf670 | out: pType=0x33cf670*=5) returned 0x0 [0066.595] IUnknown:Release (This=0xdbafa8) returned 0x1 [0066.595] IUnknown:Release (This=0xdbb8c0) returned 0x1 [0066.595] IUnknown:Release (This=0xdbb870) returned 0x0 [0066.595] IUnknown:Release (This=0xdbb800) returned 0x0 [0066.595] IRegisteredTaskCollection:get_Item (in: This=0xdbb558, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbb800) returned 0x0 [0066.596] IRegisteredTask:get_Name (in: This=0xdbb800, pName=0x33cf684 | out: pName=0x33cf684*="StorageCardEncryption Task") returned 0x0 [0066.596] IRegisteredTask:get_State (in: This=0xdbb800, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0066.672] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x36) returned 0x34beb78 [0066.672] wcsstr (_Str="storagecardencryption task", _SubStr="reboot") returned 0x0 [0066.672] wcsstr (_Str="storagecardencryption task", _SubStr="restart") returned 0x0 [0066.672] wcsstr (_Str="storagecardencryption task", _SubStr="shutdown") returned 0x0 [0066.672] wcsstr (_Str="storagecardencryption task", _SubStr="logoff") returned 0x0 [0066.672] wcsstr (_Str="storagecardencryption task", _SubStr="back") returned 0x0 [0066.672] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34beb78) returned 1 [0066.672] IRegisteredTask:get_Definition (in: This=0xdbb800, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbb8e8) returned 0x0 [0066.678] ITaskDefinition:get_Actions (in: This=0xdbb8e8, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbaec0) returned 0x0 [0066.678] IActionCollection:get_Count (in: This=0xdbaec0, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0066.678] IActionCollection:get_Item (in: This=0xdbaec0, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbae10) returned 0x0 [0066.678] IAction:get_Type (in: This=0xdbae10, pType=0x33cf670 | out: pType=0x33cf670*=5) returned 0x0 [0066.678] IUnknown:Release (This=0xdbae10) returned 0x1 [0066.678] IUnknown:Release (This=0xdbaec0) returned 0x1 [0066.678] IUnknown:Release (This=0xdbb8e8) returned 0x0 [0066.678] IUnknown:Release (This=0xdbb800) returned 0x0 [0066.678] IUnknown:Release (This=0xdbb558) returned 0x0 [0066.678] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb558) returned 0x0 [0066.679] ITaskFolderCollection:get_Count (in: This=0xdbb558, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0066.679] IUnknown:Release (This=0xdbb558) returned 0x0 [0066.679] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0066.679] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0066.679] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb800) returned 0x0 [0066.680] IRegisteredTaskCollection:get_Count (in: This=0xdbb800, pCount=0x33cf678 | out: pCount=0x33cf678*=1) returned 0x0 [0066.680] IRegisteredTaskCollection:get_Item (in: This=0xdbb800, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbb8b8) returned 0x0 [0066.680] IRegisteredTask:get_Name (in: This=0xdbb8b8, pName=0x33cf684 | out: pName=0x33cf684*="MDMMaintenenceTask") returned 0x0 [0066.680] IRegisteredTask:get_State (in: This=0xdbb8b8, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0066.681] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x26) returned 0x34c7a48 [0066.681] wcsstr (_Str="mdmmaintenencetask", _SubStr="reboot") returned 0x0 [0066.681] wcsstr (_Str="mdmmaintenencetask", _SubStr="restart") returned 0x0 [0066.681] wcsstr (_Str="mdmmaintenencetask", _SubStr="shutdown") returned 0x0 [0066.681] wcsstr (_Str="mdmmaintenencetask", _SubStr="logoff") returned 0x0 [0066.681] wcsstr (_Str="mdmmaintenencetask", _SubStr="back") returned 0x0 [0066.681] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7a48) returned 1 [0066.681] IRegisteredTask:get_Definition (in: This=0xdbb8b8, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbb5a8) returned 0x0 [0066.733] ITaskDefinition:get_Actions (in: This=0xdbb5a8, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbb928) returned 0x0 [0066.733] IActionCollection:get_Count (in: This=0xdbb928, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0066.733] IActionCollection:get_Item (in: This=0xdbb928, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbb150) returned 0x0 [0066.733] IAction:get_Type (in: This=0xdbb150, pType=0x33cf670 | out: pType=0x33cf670*=0) returned 0x0 [0066.733] IUnknown:QueryInterface (in: This=0xdbb150, riid=0x9d606c*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x33cf6a8 | out: ppvObject=0x33cf6a8*=0xdbb150) returned 0x0 [0066.733] IExecAction:get_Path (in: This=0xdbb150, pPath=0x33cf680 | out: pPath=0x33cf680*="%windir%\\system32\\MDMAgent.exe") returned 0x0 [0066.733] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x3e) returned 0x34c2ff8 [0066.733] wcsstr (_Str="%windir%\\system32\\mdmagent.exe", _SubStr="reboot") returned 0x0 [0066.733] wcsstr (_Str="%windir%\\system32\\mdmagent.exe", _SubStr="restart") returned 0x0 [0066.733] wcsstr (_Str="%windir%\\system32\\mdmagent.exe", _SubStr="shutdown") returned 0x0 [0066.733] wcsstr (_Str="%windir%\\system32\\mdmagent.exe", _SubStr="logoff") returned 0x0 [0066.734] wcsstr (_Str="%windir%\\system32\\mdmagent.exe", _SubStr="back") returned 0x0 [0066.734] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c2ff8) returned 1 [0066.734] IExecAction:get_Arguments (in: This=0xdbb150, pArgument=0x33cf67c | out: pArgument=0x33cf67c*=0x0) returned 0x0 [0066.734] IUnknown:Release (This=0xdbb150) returned 0x2 [0066.734] IUnknown:Release (This=0xdbb150) returned 0x1 [0066.734] IUnknown:Release (This=0xdbb928) returned 0x1 [0066.734] IUnknown:Release (This=0xdbb5a8) returned 0x0 [0066.734] IUnknown:Release (This=0xdbb8b8) returned 0x0 [0066.734] IUnknown:Release (This=0xdbb800) returned 0x0 [0066.734] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb800) returned 0x0 [0066.735] ITaskFolderCollection:get_Count (in: This=0xdbb800, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0066.735] IUnknown:Release (This=0xdbb800) returned 0x0 [0066.735] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0066.735] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1c, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0066.735] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb800) returned 0x0 [0066.736] IRegisteredTaskCollection:get_Count (in: This=0xdbb800, pCount=0x33cf678 | out: pCount=0x33cf678*=2) returned 0x0 [0066.736] IRegisteredTaskCollection:get_Item (in: This=0xdbb800, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbb860) returned 0x0 [0066.736] IRegisteredTask:get_Name (in: This=0xdbb860, pName=0x33cf684 | out: pName=0x33cf684*="EnableErrorDetailsUpdate") returned 0x0 [0066.736] IRegisteredTask:get_State (in: This=0xdbb860, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0066.737] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x32) returned 0x34bea38 [0066.737] wcsstr (_Str="enableerrordetailsupdate", _SubStr="reboot") returned 0x0 [0066.737] wcsstr (_Str="enableerrordetailsupdate", _SubStr="restart") returned 0x0 [0066.737] wcsstr (_Str="enableerrordetailsupdate", _SubStr="shutdown") returned 0x0 [0066.737] wcsstr (_Str="enableerrordetailsupdate", _SubStr="logoff") returned 0x0 [0066.737] wcsstr (_Str="enableerrordetailsupdate", _SubStr="back") returned 0x0 [0066.737] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34bea38) returned 1 [0066.737] IRegisteredTask:get_Definition (in: This=0xdbb860, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbb8d0) returned 0x0 [0066.835] ITaskDefinition:get_Actions (in: This=0xdbb8d0, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbb920) returned 0x0 [0066.836] IActionCollection:get_Count (in: This=0xdbb920, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0066.836] IActionCollection:get_Item (in: This=0xdbb920, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbb0d8) returned 0x0 [0066.836] IAction:get_Type (in: This=0xdbb0d8, pType=0x33cf670 | out: pType=0x33cf670*=5) returned 0x0 [0066.836] IUnknown:Release (This=0xdbb0d8) returned 0x1 [0066.836] IUnknown:Release (This=0xdbb920) returned 0x1 [0066.836] IUnknown:Release (This=0xdbb8d0) returned 0x0 [0066.836] IUnknown:Release (This=0xdbb860) returned 0x0 [0066.836] IRegisteredTaskCollection:get_Item (in: This=0xdbb800, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbb860) returned 0x0 [0066.836] IRegisteredTask:get_Name (in: This=0xdbb860, pName=0x33cf684 | out: pName=0x33cf684*="ErrorDetailsUpdate") returned 0x0 [0066.836] IRegisteredTask:get_State (in: This=0xdbb860, pState=0x33cf688 | out: pState=0x33cf688*=1) returned 0x0 [0066.837] IUnknown:Release (This=0xdbb860) returned 0x0 [0066.837] IUnknown:Release (This=0xdbb800) returned 0x0 [0066.837] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb800) returned 0x0 [0066.837] ITaskFolderCollection:get_Count (in: This=0xdbb800, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0066.837] IUnknown:Release (This=0xdbb800) returned 0x0 [0066.837] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0066.837] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1d, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0066.837] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb598) returned 0x0 [0066.838] IRegisteredTaskCollection:get_Count (in: This=0xdbb598, pCount=0x33cf678 | out: pCount=0x33cf678*=0) returned 0x0 [0066.838] IUnknown:Release (This=0xdbb598) returned 0x0 [0066.838] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb598) returned 0x0 [0066.895] ITaskFolderCollection:get_Count (in: This=0xdbb598, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=1) returned 0x0 [0066.895] ITaskFolderCollection:get_Item (in: This=0xdbb598, index=0x33cf6a8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x33cf6d0 | out: ppFolder=0x33cf6d0*=0xdbb848) returned 0x0 [0066.896] ITaskFolder:GetTasks (in: This=0xdbb848, flags=0, ppTasks=0x33cf670 | out: ppTasks=0x33cf670*=0xdbb8e8) returned 0x0 [0066.897] IRegisteredTaskCollection:get_Count (in: This=0xdbb8e8, pCount=0x33cf64c | out: pCount=0x33cf64c*=2) returned 0x0 [0066.897] IRegisteredTaskCollection:get_Item (in: This=0xdbb8e8, index=0x33cf620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf680 | out: ppRegisteredTask=0x33cf680*=0xdbaf18) returned 0x0 [0066.897] IRegisteredTask:get_Name (in: This=0xdbaf18, pName=0x33cf658 | out: pName=0x33cf658*="DmClient") returned 0x0 [0066.897] IRegisteredTask:get_State (in: This=0xdbaf18, pState=0x33cf65c | out: pState=0x33cf65c*=1) returned 0x0 [0066.898] IUnknown:Release (This=0xdbaf18) returned 0x0 [0066.898] IRegisteredTaskCollection:get_Item (in: This=0xdbb8e8, index=0x33cf620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x33cf680 | out: ppRegisteredTask=0x33cf680*=0xdbaf18) returned 0x0 [0066.898] IRegisteredTask:get_Name (in: This=0xdbaf18, pName=0x33cf658 | out: pName=0x33cf658*="DmClientOnScenarioDownload") returned 0x0 [0066.898] IRegisteredTask:get_State (in: This=0xdbaf18, pState=0x33cf65c | out: pState=0x33cf65c*=1) returned 0x0 [0066.898] IUnknown:Release (This=0xdbaf18) returned 0x0 [0066.898] IUnknown:Release (This=0xdbb8e8) returned 0x0 [0066.898] ITaskFolder:GetFolders (in: This=0xdbb848, flags=0, ppFolders=0x33cf6ac | out: ppFolders=0x33cf6ac*=0xdbb8e8) returned 0x0 [0066.899] ITaskFolderCollection:get_Count (in: This=0xdbb8e8, pCount=0x33cf6a0 | out: pCount=0x33cf6a0*=0) returned 0x0 [0066.899] IUnknown:Release (This=0xdbb8e8) returned 0x0 [0066.899] TaskScheduler:IUnknown:Release (This=0xdbb848) returned 0x0 [0066.899] IUnknown:Release (This=0xdbb598) returned 0x0 [0066.899] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0066.899] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1e, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0066.899] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb800) returned 0x0 [0066.900] IRegisteredTaskCollection:get_Count (in: This=0xdbb800, pCount=0x33cf678 | out: pCount=0x33cf678*=1) returned 0x0 [0066.900] IRegisteredTaskCollection:get_Item (in: This=0xdbb800, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbb8d8) returned 0x0 [0066.900] IRegisteredTask:get_Name (in: This=0xdbb8d8, pName=0x33cf684 | out: pName=0x33cf684*="Property Definition Sync") returned 0x0 [0066.900] IRegisteredTask:get_State (in: This=0xdbb8d8, pState=0x33cf688 | out: pState=0x33cf688*=1) returned 0x0 [0066.901] IUnknown:Release (This=0xdbb8d8) returned 0x0 [0066.901] IUnknown:Release (This=0xdbb800) returned 0x0 [0066.901] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb800) returned 0x0 [0066.901] ITaskFolderCollection:get_Count (in: This=0xdbb800, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0066.902] IUnknown:Release (This=0xdbb800) returned 0x0 [0066.902] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0066.902] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1f, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0066.902] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb800) returned 0x0 [0066.902] IRegisteredTaskCollection:get_Count (in: This=0xdbb800, pCount=0x33cf678 | out: pCount=0x33cf678*=1) returned 0x0 [0066.903] IRegisteredTaskCollection:get_Item (in: This=0xdbb800, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbb860) returned 0x0 [0066.903] IRegisteredTask:get_Name (in: This=0xdbb860, pName=0x33cf684 | out: pName=0x33cf684*="File History (maintenance mode)") returned 0x0 [0066.903] IRegisteredTask:get_State (in: This=0xdbb860, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0066.903] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x40) returned 0x34c27d0 [0066.903] wcsstr (_Str="file history (maintenance mode)", _SubStr="reboot") returned 0x0 [0066.903] wcsstr (_Str="file history (maintenance mode)", _SubStr="restart") returned 0x0 [0066.903] wcsstr (_Str="file history (maintenance mode)", _SubStr="shutdown") returned 0x0 [0066.903] wcsstr (_Str="file history (maintenance mode)", _SubStr="logoff") returned 0x0 [0066.903] wcsstr (_Str="file history (maintenance mode)", _SubStr="back") returned 0x0 [0066.903] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c27d0) returned 1 [0066.903] IRegisteredTask:get_Definition (in: This=0xdbb860, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbb8d0) returned 0x0 [0066.914] ITaskDefinition:get_Actions (in: This=0xdbb8d0, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbb920) returned 0x0 [0066.914] IActionCollection:get_Count (in: This=0xdbb920, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0066.914] IActionCollection:get_Item (in: This=0xdbb920, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbae10) returned 0x0 [0066.914] IAction:get_Type (in: This=0xdbae10, pType=0x33cf670 | out: pType=0x33cf670*=5) returned 0x0 [0066.914] IUnknown:Release (This=0xdbae10) returned 0x1 [0066.914] IUnknown:Release (This=0xdbb920) returned 0x1 [0066.914] IUnknown:Release (This=0xdbb8d0) returned 0x0 [0066.914] IUnknown:Release (This=0xdbb860) returned 0x0 [0066.914] IUnknown:Release (This=0xdbb800) returned 0x0 [0066.914] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb800) returned 0x0 [0066.975] ITaskFolderCollection:get_Count (in: This=0xdbb800, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0066.975] IUnknown:Release (This=0xdbb800) returned 0x0 [0066.976] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0066.976] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0066.976] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb558) returned 0x0 [0066.977] IRegisteredTaskCollection:get_Count (in: This=0xdbb558, pCount=0x33cf678 | out: pCount=0x33cf678*=2) returned 0x0 [0066.977] IRegisteredTaskCollection:get_Item (in: This=0xdbb558, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbb800) returned 0x0 [0066.977] IRegisteredTask:get_Name (in: This=0xdbb800, pName=0x33cf684 | out: pName=0x33cf684*="Installation") returned 0x0 [0066.977] IRegisteredTask:get_State (in: This=0xdbb800, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0066.978] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1a) returned 0x34dec20 [0066.978] wcsstr (_Str="installation", _SubStr="reboot") returned 0x0 [0066.978] wcsstr (_Str="installation", _SubStr="restart") returned 0x0 [0066.978] wcsstr (_Str="installation", _SubStr="shutdown") returned 0x0 [0066.978] wcsstr (_Str="installation", _SubStr="logoff") returned 0x0 [0066.978] wcsstr (_Str="installation", _SubStr="back") returned 0x0 [0066.978] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dec20) returned 1 [0066.978] IRegisteredTask:get_Definition (in: This=0xdbb800, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbb870) returned 0x0 [0067.046] ITaskDefinition:get_Actions (in: This=0xdbb870, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbb8c0) returned 0x0 [0067.046] IActionCollection:get_Count (in: This=0xdbb8c0, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0067.046] IActionCollection:get_Item (in: This=0xdbb8c0, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbae60) returned 0x0 [0067.046] IAction:get_Type (in: This=0xdbae60, pType=0x33cf670 | out: pType=0x33cf670*=5) returned 0x0 [0067.046] IUnknown:Release (This=0xdbae60) returned 0x1 [0067.046] IUnknown:Release (This=0xdbb8c0) returned 0x1 [0067.046] IUnknown:Release (This=0xdbb870) returned 0x0 [0067.046] IUnknown:Release (This=0xdbb800) returned 0x0 [0067.046] IRegisteredTaskCollection:get_Item (in: This=0xdbb558, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbb800) returned 0x0 [0067.046] IRegisteredTask:get_Name (in: This=0xdbb800, pName=0x33cf684 | out: pName=0x33cf684*="Uninstallation") returned 0x0 [0067.046] IRegisteredTask:get_State (in: This=0xdbb800, pState=0x33cf688 | out: pState=0x33cf688*=1) returned 0x0 [0067.046] IUnknown:Release (This=0xdbb800) returned 0x0 [0067.046] IUnknown:Release (This=0xdbb558) returned 0x0 [0067.047] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb558) returned 0x0 [0067.047] ITaskFolderCollection:get_Count (in: This=0xdbb558, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0067.047] IUnknown:Release (This=0xdbb558) returned 0x0 [0067.047] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0067.047] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x21, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0067.047] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdba940) returned 0x0 [0067.048] IRegisteredTaskCollection:get_Count (in: This=0xdba940, pCount=0x33cf678 | out: pCount=0x33cf678*=0) returned 0x0 [0067.048] IUnknown:Release (This=0xdba940) returned 0x0 [0067.048] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdba940) returned 0x0 [0067.049] ITaskFolderCollection:get_Count (in: This=0xdba940, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0067.049] IUnknown:Release (This=0xdba940) returned 0x0 [0067.049] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0067.049] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x22, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0067.049] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb558) returned 0x0 [0067.050] IRegisteredTaskCollection:get_Count (in: This=0xdbb558, pCount=0x33cf678 | out: pCount=0x33cf678*=0) returned 0x0 [0067.050] IUnknown:Release (This=0xdbb558) returned 0x0 [0067.050] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb558) returned 0x0 [0067.051] ITaskFolderCollection:get_Count (in: This=0xdbb558, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=1) returned 0x0 [0067.051] ITaskFolderCollection:get_Item (in: This=0xdbb558, index=0x33cf6a8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x33cf6d0 | out: ppFolder=0x33cf6d0*=0xdba940) returned 0x0 [0067.051] ITaskFolder:GetTasks (in: This=0xdba940, flags=0, ppTasks=0x33cf670 | out: ppTasks=0x33cf670*=0xdba9d8) returned 0x0 [0067.052] IRegisteredTaskCollection:get_Count (in: This=0xdba9d8, pCount=0x33cf64c | out: pCount=0x33cf64c*=0) returned 0x0 [0067.052] IUnknown:Release (This=0xdba9d8) returned 0x0 [0067.052] ITaskFolder:GetFolders (in: This=0xdba940, flags=0, ppFolders=0x33cf6ac | out: ppFolders=0x33cf6ac*=0xdba9d8) returned 0x0 [0067.052] ITaskFolderCollection:get_Count (in: This=0xdba9d8, pCount=0x33cf6a0 | out: pCount=0x33cf6a0*=0) returned 0x0 [0067.052] IUnknown:Release (This=0xdba9d8) returned 0x0 [0067.052] TaskScheduler:IUnknown:Release (This=0xdba940) returned 0x0 [0067.052] IUnknown:Release (This=0xdbb558) returned 0x0 [0067.052] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0067.052] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x23, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0067.052] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb598) returned 0x0 [0067.053] IRegisteredTaskCollection:get_Count (in: This=0xdbb598, pCount=0x33cf678 | out: pCount=0x33cf678*=2) returned 0x0 [0067.053] IRegisteredTaskCollection:get_Item (in: This=0xdbb598, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba988) returned 0x0 [0067.054] IRegisteredTask:get_Name (in: This=0xdba988, pName=0x33cf684 | out: pName=0x33cf684*="Notifications") returned 0x0 [0067.054] IRegisteredTask:get_State (in: This=0xdba988, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0067.054] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34ded88 [0067.054] wcsstr (_Str="notifications", _SubStr="reboot") returned 0x0 [0067.054] wcsstr (_Str="notifications", _SubStr="restart") returned 0x0 [0067.054] wcsstr (_Str="notifications", _SubStr="shutdown") returned 0x0 [0067.054] wcsstr (_Str="notifications", _SubStr="logoff") returned 0x0 [0067.054] wcsstr (_Str="notifications", _SubStr="back") returned 0x0 [0067.054] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34ded88) returned 1 [0067.054] IRegisteredTask:get_Definition (in: This=0xdba988, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdba9f8) returned 0x0 [0067.210] ITaskDefinition:get_Actions (in: This=0xdba9f8, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbaa48) returned 0x0 [0067.210] IActionCollection:get_Count (in: This=0xdbaa48, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0067.210] IActionCollection:get_Item (in: This=0xdbaa48, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbbd30) returned 0x0 [0067.210] IAction:get_Type (in: This=0xdbbd30, pType=0x33cf670 | out: pType=0x33cf670*=0) returned 0x0 [0067.210] IUnknown:QueryInterface (in: This=0xdbbd30, riid=0x9d606c*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x33cf6a8 | out: ppvObject=0x33cf6a8*=0xdbbd30) returned 0x0 [0067.210] IExecAction:get_Path (in: This=0xdbbd30, pPath=0x33cf680 | out: pPath=0x33cf680*="%windir%\\System32\\LocationNotificationWindows.exe") returned 0x0 [0067.211] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x64) returned 0x34a43c0 [0067.211] wcsstr (_Str="%windir%\\system32\\locationnotificationwindows.exe", _SubStr="reboot") returned 0x0 [0067.211] wcsstr (_Str="%windir%\\system32\\locationnotificationwindows.exe", _SubStr="restart") returned 0x0 [0067.211] wcsstr (_Str="%windir%\\system32\\locationnotificationwindows.exe", _SubStr="shutdown") returned 0x0 [0067.211] wcsstr (_Str="%windir%\\system32\\locationnotificationwindows.exe", _SubStr="logoff") returned 0x0 [0067.211] wcsstr (_Str="%windir%\\system32\\locationnotificationwindows.exe", _SubStr="back") returned 0x0 [0067.211] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34a43c0) returned 1 [0067.211] IExecAction:get_Arguments (in: This=0xdbbd30, pArgument=0x33cf67c | out: pArgument=0x33cf67c*=0x0) returned 0x0 [0067.211] IUnknown:Release (This=0xdbbd30) returned 0x2 [0067.211] IUnknown:Release (This=0xdbbd30) returned 0x1 [0067.211] IUnknown:Release (This=0xdbaa48) returned 0x1 [0067.211] IUnknown:Release (This=0xdba9f8) returned 0x0 [0067.211] IUnknown:Release (This=0xdba988) returned 0x0 [0067.211] IRegisteredTaskCollection:get_Item (in: This=0xdbb598, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba988) returned 0x0 [0067.211] IRegisteredTask:get_Name (in: This=0xdba988, pName=0x33cf684 | out: pName=0x33cf684*="WindowsActionDialog") returned 0x0 [0067.211] IRegisteredTask:get_State (in: This=0xdba988, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0067.212] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x28) returned 0x34c7e98 [0067.212] wcsstr (_Str="windowsactiondialog", _SubStr="reboot") returned 0x0 [0067.212] wcsstr (_Str="windowsactiondialog", _SubStr="restart") returned 0x0 [0067.212] wcsstr (_Str="windowsactiondialog", _SubStr="shutdown") returned 0x0 [0067.212] wcsstr (_Str="windowsactiondialog", _SubStr="logoff") returned 0x0 [0067.212] wcsstr (_Str="windowsactiondialog", _SubStr="back") returned 0x0 [0067.212] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7e98) returned 1 [0067.212] IRegisteredTask:get_Definition (in: This=0xdba988, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdba9f8) returned 0x0 [0067.274] ITaskDefinition:get_Actions (in: This=0xdba9f8, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbaa48) returned 0x0 [0067.274] IActionCollection:get_Count (in: This=0xdbaa48, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0067.274] IActionCollection:get_Item (in: This=0xdbaa48, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbbd30) returned 0x0 [0067.274] IAction:get_Type (in: This=0xdbbd30, pType=0x33cf670 | out: pType=0x33cf670*=0) returned 0x0 [0067.274] IUnknown:QueryInterface (in: This=0xdbbd30, riid=0x9d606c*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x33cf6a8 | out: ppvObject=0x33cf6a8*=0xdbbd30) returned 0x0 [0067.274] IExecAction:get_Path (in: This=0xdbbd30, pPath=0x33cf680 | out: pPath=0x33cf680*="%windir%\\System32\\WindowsActionDialog.exe") returned 0x0 [0067.274] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x54) returned 0x34a43c0 [0067.274] wcsstr (_Str="%windir%\\system32\\windowsactiondialog.exe", _SubStr="reboot") returned 0x0 [0067.274] wcsstr (_Str="%windir%\\system32\\windowsactiondialog.exe", _SubStr="restart") returned 0x0 [0067.274] wcsstr (_Str="%windir%\\system32\\windowsactiondialog.exe", _SubStr="shutdown") returned 0x0 [0067.274] wcsstr (_Str="%windir%\\system32\\windowsactiondialog.exe", _SubStr="logoff") returned 0x0 [0067.274] wcsstr (_Str="%windir%\\system32\\windowsactiondialog.exe", _SubStr="back") returned 0x0 [0067.274] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34a43c0) returned 1 [0067.274] IExecAction:get_Arguments (in: This=0xdbbd30, pArgument=0x33cf67c | out: pArgument=0x33cf67c*=0x0) returned 0x0 [0067.274] IUnknown:Release (This=0xdbbd30) returned 0x2 [0067.274] IUnknown:Release (This=0xdbbd30) returned 0x1 [0067.274] IUnknown:Release (This=0xdbaa48) returned 0x1 [0067.274] IUnknown:Release (This=0xdba9f8) returned 0x0 [0067.274] IUnknown:Release (This=0xdba988) returned 0x0 [0067.274] IUnknown:Release (This=0xdbb598) returned 0x0 [0067.274] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb598) returned 0x0 [0067.275] ITaskFolderCollection:get_Count (in: This=0xdbb598, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0067.275] IUnknown:Release (This=0xdbb598) returned 0x0 [0067.275] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0067.275] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x24, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0067.275] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdba940) returned 0x0 [0067.315] IRegisteredTaskCollection:get_Count (in: This=0xdba940, pCount=0x33cf678 | out: pCount=0x33cf678*=1) returned 0x0 [0067.315] IRegisteredTaskCollection:get_Item (in: This=0xdba940, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba9a0) returned 0x0 [0067.315] IRegisteredTask:get_Name (in: This=0xdba9a0, pName=0x33cf684 | out: pName=0x33cf684*="WinSAT") returned 0x0 [0067.315] IRegisteredTask:get_State (in: This=0xdba9a0, pState=0x33cf688 | out: pState=0x33cf688*=1) returned 0x0 [0067.316] IUnknown:Release (This=0xdba9a0) returned 0x0 [0067.316] IUnknown:Release (This=0xdba940) returned 0x0 [0067.316] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdba940) returned 0x0 [0067.316] ITaskFolderCollection:get_Count (in: This=0xdba940, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0067.316] IUnknown:Release (This=0xdba940) returned 0x0 [0067.316] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0067.316] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x25, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0067.316] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdba940) returned 0x0 [0067.317] IRegisteredTaskCollection:get_Count (in: This=0xdba940, pCount=0x33cf678 | out: pCount=0x33cf678*=0) returned 0x0 [0067.317] IUnknown:Release (This=0xdba940) returned 0x0 [0067.317] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdba940) returned 0x0 [0067.318] ITaskFolderCollection:get_Count (in: This=0xdba940, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=1) returned 0x0 [0067.318] ITaskFolderCollection:get_Item (in: This=0xdba940, index=0x33cf6a8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x33cf6d0 | out: ppFolder=0x33cf6d0*=0xdba9a0) returned 0x0 [0067.318] ITaskFolder:GetTasks (in: This=0xdba9a0, flags=0, ppTasks=0x33cf670 | out: ppTasks=0x33cf670*=0xdbaa50) returned 0x0 [0067.319] IRegisteredTaskCollection:get_Count (in: This=0xdbaa50, pCount=0x33cf64c | out: pCount=0x33cf64c*=0) returned 0x0 [0067.319] IUnknown:Release (This=0xdbaa50) returned 0x0 [0067.319] ITaskFolder:GetFolders (in: This=0xdba9a0, flags=0, ppFolders=0x33cf6ac | out: ppFolders=0x33cf6ac*=0xdbaa50) returned 0x0 [0067.320] ITaskFolderCollection:get_Count (in: This=0xdbaa50, pCount=0x33cf6a0 | out: pCount=0x33cf6a0*=0) returned 0x0 [0067.320] IUnknown:Release (This=0xdbaa50) returned 0x0 [0067.320] TaskScheduler:IUnknown:Release (This=0xdba9a0) returned 0x0 [0067.320] IUnknown:Release (This=0xdba940) returned 0x0 [0067.320] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0067.320] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x26, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0067.320] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb558) returned 0x0 [0067.321] IRegisteredTaskCollection:get_Count (in: This=0xdbb558, pCount=0x33cf678 | out: pCount=0x33cf678*=1) returned 0x0 [0067.321] IRegisteredTaskCollection:get_Item (in: This=0xdbb558, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba940) returned 0x0 [0067.321] IRegisteredTask:get_Name (in: This=0xdba940, pName=0x33cf684 | out: pName=0x33cf684*="MapsUpdateTask") returned 0x0 [0067.321] IRegisteredTask:get_State (in: This=0xdba940, pState=0x33cf688 | out: pState=0x33cf688*=1) returned 0x0 [0067.322] IUnknown:Release (This=0xdba940) returned 0x0 [0067.322] IUnknown:Release (This=0xdbb558) returned 0x0 [0067.322] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb558) returned 0x0 [0067.322] ITaskFolderCollection:get_Count (in: This=0xdbb558, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0067.322] IUnknown:Release (This=0xdbb558) returned 0x0 [0067.322] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0067.322] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x27, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0067.322] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdba940) returned 0x0 [0067.323] IRegisteredTaskCollection:get_Count (in: This=0xdba940, pCount=0x33cf678 | out: pCount=0x33cf678*=0) returned 0x0 [0067.323] IUnknown:Release (This=0xdba940) returned 0x0 [0067.323] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdba940) returned 0x0 [0067.391] ITaskFolderCollection:get_Count (in: This=0xdba940, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0067.391] IUnknown:Release (This=0xdba940) returned 0x0 [0067.391] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0067.391] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x28, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0067.391] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb558) returned 0x0 [0067.392] IRegisteredTaskCollection:get_Count (in: This=0xdbb558, pCount=0x33cf678 | out: pCount=0x33cf678*=1) returned 0x0 [0067.392] IRegisteredTaskCollection:get_Item (in: This=0xdbb558, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba940) returned 0x0 [0067.392] IRegisteredTask:get_Name (in: This=0xdba940, pName=0x33cf684 | out: pName=0x33cf684*="MNO Metadata Parser") returned 0x0 [0067.392] IRegisteredTask:get_State (in: This=0xdba940, pState=0x33cf688 | out: pState=0x33cf688*=1) returned 0x0 [0067.393] IUnknown:Release (This=0xdba940) returned 0x0 [0067.393] IUnknown:Release (This=0xdbb558) returned 0x0 [0067.393] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb558) returned 0x0 [0067.394] ITaskFolderCollection:get_Count (in: This=0xdbb558, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0067.394] IUnknown:Release (This=0xdbb558) returned 0x0 [0067.394] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0067.394] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x29, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0067.394] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb558) returned 0x0 [0067.395] IRegisteredTaskCollection:get_Count (in: This=0xdbb558, pCount=0x33cf678 | out: pCount=0x33cf678*=1) returned 0x0 [0067.395] IRegisteredTaskCollection:get_Item (in: This=0xdbb558, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba940) returned 0x0 [0067.395] IRegisteredTask:get_Name (in: This=0xdba940, pName=0x33cf684 | out: pName=0x33cf684*="LPRemove") returned 0x0 [0067.395] IRegisteredTask:get_State (in: This=0xdba940, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0067.395] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x12) returned 0x34d1640 [0067.395] wcsstr (_Str="lpremove", _SubStr="reboot") returned 0x0 [0067.395] wcsstr (_Str="lpremove", _SubStr="restart") returned 0x0 [0067.395] wcsstr (_Str="lpremove", _SubStr="shutdown") returned 0x0 [0067.395] wcsstr (_Str="lpremove", _SubStr="logoff") returned 0x0 [0067.395] wcsstr (_Str="lpremove", _SubStr="back") returned 0x0 [0067.395] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1640) returned 1 [0067.395] IRegisteredTask:get_Definition (in: This=0xdba940, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdba9f8) returned 0x0 [0067.494] ITaskDefinition:get_Actions (in: This=0xdba9f8, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbaa48) returned 0x0 [0067.494] IActionCollection:get_Count (in: This=0xdbaa48, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0067.494] IActionCollection:get_Item (in: This=0xdbaa48, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbbcd0) returned 0x0 [0067.494] IAction:get_Type (in: This=0xdbbcd0, pType=0x33cf670 | out: pType=0x33cf670*=0) returned 0x0 [0067.494] IUnknown:QueryInterface (in: This=0xdbbcd0, riid=0x9d606c*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x33cf6a8 | out: ppvObject=0x33cf6a8*=0xdbbcd0) returned 0x0 [0067.494] IExecAction:get_Path (in: This=0xdbbcd0, pPath=0x33cf680 | out: pPath=0x33cf680*="%windir%\\system32\\lpremove.exe") returned 0x0 [0067.495] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x3e) returned 0x34c2ae8 [0067.495] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="reboot") returned 0x0 [0067.495] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="restart") returned 0x0 [0067.495] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="shutdown") returned 0x0 [0067.495] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="logoff") returned 0x0 [0067.495] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="back") returned 0x0 [0067.495] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c2ae8) returned 1 [0067.495] IExecAction:get_Arguments (in: This=0xdbbcd0, pArgument=0x33cf67c | out: pArgument=0x33cf67c*=0x0) returned 0x0 [0067.495] IUnknown:Release (This=0xdbbcd0) returned 0x2 [0067.495] IUnknown:Release (This=0xdbbcd0) returned 0x1 [0067.495] IUnknown:Release (This=0xdbaa48) returned 0x1 [0067.495] IUnknown:Release (This=0xdba9f8) returned 0x0 [0067.495] IUnknown:Release (This=0xdba940) returned 0x0 [0067.495] IUnknown:Release (This=0xdbb558) returned 0x0 [0067.495] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb558) returned 0x0 [0067.496] ITaskFolderCollection:get_Count (in: This=0xdbb558, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0067.496] IUnknown:Release (This=0xdbb558) returned 0x0 [0067.496] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0067.496] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2a, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0067.496] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdba940) returned 0x0 [0067.500] IRegisteredTaskCollection:get_Count (in: This=0xdba940, pCount=0x33cf678 | out: pCount=0x33cf678*=1) returned 0x0 [0067.500] IRegisteredTaskCollection:get_Item (in: This=0xdba940, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba9a0) returned 0x0 [0067.501] IRegisteredTask:get_Name (in: This=0xdba9a0, pName=0x33cf684 | out: pName=0x33cf684*="SystemSoundsService") returned 0x0 [0067.501] IRegisteredTask:get_State (in: This=0xdba9a0, pState=0x33cf688 | out: pState=0x33cf688*=4) returned 0x0 [0067.615] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x28) returned 0x34c7a78 [0067.615] wcsstr (_Str="systemsoundsservice", _SubStr="reboot") returned 0x0 [0067.615] wcsstr (_Str="systemsoundsservice", _SubStr="restart") returned 0x0 [0067.615] wcsstr (_Str="systemsoundsservice", _SubStr="shutdown") returned 0x0 [0067.615] wcsstr (_Str="systemsoundsservice", _SubStr="logoff") returned 0x0 [0067.615] wcsstr (_Str="systemsoundsservice", _SubStr="back") returned 0x0 [0067.615] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7a78) returned 1 [0067.615] IRegisteredTask:get_Definition (in: This=0xdba9a0, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbaa88) returned 0x0 [0067.711] ITaskDefinition:get_Actions (in: This=0xdbaa88, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbaad8) returned 0x0 [0067.711] IActionCollection:get_Count (in: This=0xdbaad8, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0067.711] IActionCollection:get_Item (in: This=0xdbaad8, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbbd28) returned 0x0 [0067.711] IAction:get_Type (in: This=0xdbbd28, pType=0x33cf670 | out: pType=0x33cf670*=5) returned 0x0 [0067.711] IUnknown:Release (This=0xdbbd28) returned 0x1 [0067.711] IUnknown:Release (This=0xdbaad8) returned 0x1 [0067.711] IUnknown:Release (This=0xdbaa88) returned 0x0 [0067.711] IUnknown:Release (This=0xdba9a0) returned 0x0 [0067.711] IUnknown:Release (This=0xdba940) returned 0x0 [0067.711] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdba940) returned 0x0 [0067.750] ITaskFolderCollection:get_Count (in: This=0xdba940, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0067.750] IUnknown:Release (This=0xdba940) returned 0x0 [0067.750] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0067.750] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2b, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0067.750] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb598) returned 0x0 [0067.753] IRegisteredTaskCollection:get_Count (in: This=0xdbb598, pCount=0x33cf678 | out: pCount=0x33cf678*=1) returned 0x0 [0067.753] IRegisteredTaskCollection:get_Item (in: This=0xdbb598, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba988) returned 0x0 [0067.753] IRegisteredTask:get_Name (in: This=0xdba988, pName=0x33cf684 | out: pName=0x33cf684*="GatherNetworkInfo") returned 0x0 [0067.753] IRegisteredTask:get_State (in: This=0xdba988, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0067.756] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x24) returned 0x34c7c88 [0067.756] wcsstr (_Str="gathernetworkinfo", _SubStr="reboot") returned 0x0 [0067.756] wcsstr (_Str="gathernetworkinfo", _SubStr="restart") returned 0x0 [0067.756] wcsstr (_Str="gathernetworkinfo", _SubStr="shutdown") returned 0x0 [0067.756] wcsstr (_Str="gathernetworkinfo", _SubStr="logoff") returned 0x0 [0067.756] wcsstr (_Str="gathernetworkinfo", _SubStr="back") returned 0x0 [0067.756] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7c88) returned 1 [0067.756] IRegisteredTask:get_Definition (in: This=0xdba988, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdba9f8) returned 0x0 [0067.951] ITaskDefinition:get_Actions (in: This=0xdba9f8, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbaa48) returned 0x0 [0067.951] IActionCollection:get_Count (in: This=0xdbaa48, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0067.951] IActionCollection:get_Item (in: This=0xdbaa48, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbab00) returned 0x0 [0067.951] IAction:get_Type (in: This=0xdbab00, pType=0x33cf670 | out: pType=0x33cf670*=0) returned 0x0 [0067.951] IUnknown:QueryInterface (in: This=0xdbab00, riid=0x9d606c*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x33cf6a8 | out: ppvObject=0x33cf6a8*=0xdbab00) returned 0x0 [0067.951] IExecAction:get_Path (in: This=0xdbab00, pPath=0x33cf680 | out: pPath=0x33cf680*="%windir%\\system32\\gatherNetworkInfo.vbs") returned 0x0 [0067.951] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x50) returned 0x34a4a60 [0067.951] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="reboot") returned 0x0 [0067.951] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="restart") returned 0x0 [0067.951] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="shutdown") returned 0x0 [0067.951] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="logoff") returned 0x0 [0067.951] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="back") returned 0x0 [0067.951] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34a4a60) returned 1 [0067.951] IExecAction:get_Arguments (in: This=0xdbab00, pArgument=0x33cf67c | out: pArgument=0x33cf67c*=0x0) returned 0x0 [0067.951] IUnknown:Release (This=0xdbab00) returned 0x2 [0067.951] IUnknown:Release (This=0xdbab00) returned 0x1 [0067.951] IUnknown:Release (This=0xdbaa48) returned 0x1 [0067.951] IUnknown:Release (This=0xdba9f8) returned 0x0 [0067.952] IUnknown:Release (This=0xdba988) returned 0x0 [0067.952] IUnknown:Release (This=0xdbb598) returned 0x0 [0067.952] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb598) returned 0x0 [0067.952] ITaskFolderCollection:get_Count (in: This=0xdbb598, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0067.952] IUnknown:Release (This=0xdbb598) returned 0x0 [0067.952] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0067.952] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2c, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0067.952] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb598) returned 0x0 [0067.953] IRegisteredTaskCollection:get_Count (in: This=0xdbb598, pCount=0x33cf678 | out: pCount=0x33cf678*=0) returned 0x0 [0067.953] IUnknown:Release (This=0xdbb598) returned 0x0 [0067.953] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb598) returned 0x0 [0067.954] ITaskFolderCollection:get_Count (in: This=0xdbb598, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0067.954] IUnknown:Release (This=0xdbb598) returned 0x0 [0067.954] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0067.954] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2d, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0067.954] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdba940) returned 0x0 [0067.955] IRegisteredTaskCollection:get_Count (in: This=0xdba940, pCount=0x33cf678 | out: pCount=0x33cf678*=2) returned 0x0 [0067.955] IRegisteredTaskCollection:get_Item (in: This=0xdba940, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba9f8) returned 0x0 [0067.955] IRegisteredTask:get_Name (in: This=0xdba9f8, pName=0x33cf684 | out: pName=0x33cf684*="Background Synchronization") returned 0x0 [0067.955] IRegisteredTask:get_State (in: This=0xdba9f8, pState=0x33cf688 | out: pState=0x33cf688*=1) returned 0x0 [0067.956] IUnknown:Release (This=0xdba9f8) returned 0x0 [0067.956] IRegisteredTaskCollection:get_Item (in: This=0xdba940, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba9f8) returned 0x0 [0067.956] IRegisteredTask:get_Name (in: This=0xdba9f8, pName=0x33cf684 | out: pName=0x33cf684*="Logon Synchronization") returned 0x0 [0067.956] IRegisteredTask:get_State (in: This=0xdba9f8, pState=0x33cf688 | out: pState=0x33cf688*=1) returned 0x0 [0067.957] IUnknown:Release (This=0xdba9f8) returned 0x0 [0067.957] IUnknown:Release (This=0xdba940) returned 0x0 [0067.957] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdba940) returned 0x0 [0067.957] ITaskFolderCollection:get_Count (in: This=0xdba940, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0067.957] IUnknown:Release (This=0xdba940) returned 0x0 [0067.957] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0067.957] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2e, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0067.958] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb558) returned 0x0 [0067.959] IRegisteredTaskCollection:get_Count (in: This=0xdbb558, pCount=0x33cf678 | out: pCount=0x33cf678*=2) returned 0x0 [0067.959] IRegisteredTaskCollection:get_Item (in: This=0xdbb558, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba940) returned 0x0 [0067.959] IRegisteredTask:get_Name (in: This=0xdba940, pName=0x33cf684 | out: pName=0x33cf684*="Secure-Boot-Update") returned 0x0 [0067.959] IRegisteredTask:get_State (in: This=0xdba940, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0067.999] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x26) returned 0x34c7aa8 [0067.999] wcsstr (_Str="secure-boot-update", _SubStr="reboot") returned 0x0 [0067.999] wcsstr (_Str="secure-boot-update", _SubStr="restart") returned 0x0 [0067.999] wcsstr (_Str="secure-boot-update", _SubStr="shutdown") returned 0x0 [0067.999] wcsstr (_Str="secure-boot-update", _SubStr="logoff") returned 0x0 [0067.999] wcsstr (_Str="secure-boot-update", _SubStr="back") returned 0x0 [0067.999] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7aa8) returned 1 [0067.999] IRegisteredTask:get_Definition (in: This=0xdba940, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdba9b0) returned 0x0 [0068.009] ITaskDefinition:get_Actions (in: This=0xdba9b0, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbaa00) returned 0x0 [0068.009] IActionCollection:get_Count (in: This=0xdbaa00, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0068.009] IActionCollection:get_Item (in: This=0xdbaa00, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbbd30) returned 0x0 [0068.009] IAction:get_Type (in: This=0xdbbd30, pType=0x33cf670 | out: pType=0x33cf670*=5) returned 0x0 [0068.009] IUnknown:Release (This=0xdbbd30) returned 0x1 [0068.009] IUnknown:Release (This=0xdbaa00) returned 0x1 [0068.009] IUnknown:Release (This=0xdba9b0) returned 0x0 [0068.009] IUnknown:Release (This=0xdba940) returned 0x0 [0068.009] IRegisteredTaskCollection:get_Item (in: This=0xdbb558, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba940) returned 0x0 [0068.009] IRegisteredTask:get_Name (in: This=0xdba940, pName=0x33cf684 | out: pName=0x33cf684*="Sqm-Tasks") returned 0x0 [0068.010] IRegisteredTask:get_State (in: This=0xdba940, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0068.010] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x14) returned 0x34d1720 [0068.010] wcsstr (_Str="sqm-tasks", _SubStr="reboot") returned 0x0 [0068.010] wcsstr (_Str="sqm-tasks", _SubStr="restart") returned 0x0 [0068.010] wcsstr (_Str="sqm-tasks", _SubStr="shutdown") returned 0x0 [0068.010] wcsstr (_Str="sqm-tasks", _SubStr="logoff") returned 0x0 [0068.010] wcsstr (_Str="sqm-tasks", _SubStr="back") returned 0x0 [0068.010] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d1720) returned 1 [0068.010] IRegisteredTask:get_Definition (in: This=0xdba940, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdba9f8) returned 0x0 [0068.082] ITaskDefinition:get_Actions (in: This=0xdba9f8, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbaa48) returned 0x0 [0068.082] IActionCollection:get_Count (in: This=0xdbaa48, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0068.082] IActionCollection:get_Item (in: This=0xdbaa48, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbbcd0) returned 0x0 [0068.082] IAction:get_Type (in: This=0xdbbcd0, pType=0x33cf670 | out: pType=0x33cf670*=5) returned 0x0 [0068.082] IUnknown:Release (This=0xdbbcd0) returned 0x1 [0068.082] IUnknown:Release (This=0xdbaa48) returned 0x1 [0068.082] IUnknown:Release (This=0xdba9f8) returned 0x0 [0068.082] IUnknown:Release (This=0xdba940) returned 0x0 [0068.082] IUnknown:Release (This=0xdbb558) returned 0x0 [0068.082] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb558) returned 0x0 [0068.083] ITaskFolderCollection:get_Count (in: This=0xdbb558, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0068.083] IUnknown:Release (This=0xdbb558) returned 0x0 [0068.083] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0068.083] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2f, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0068.083] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb558) returned 0x0 [0068.084] IRegisteredTaskCollection:get_Count (in: This=0xdbb558, pCount=0x33cf678 | out: pCount=0x33cf678*=0) returned 0x0 [0068.084] IUnknown:Release (This=0xdbb558) returned 0x0 [0068.084] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb558) returned 0x0 [0068.085] ITaskFolderCollection:get_Count (in: This=0xdbb558, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=1) returned 0x0 [0068.085] ITaskFolderCollection:get_Item (in: This=0xdbb558, index=0x33cf6a8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x33cf6d0 | out: ppFolder=0x33cf6d0*=0xdba940) returned 0x0 [0068.085] ITaskFolder:GetTasks (in: This=0xdba940, flags=0, ppTasks=0x33cf670 | out: ppTasks=0x33cf670*=0xdba9d8) returned 0x0 [0068.085] IRegisteredTaskCollection:get_Count (in: This=0xdba9d8, pCount=0x33cf64c | out: pCount=0x33cf64c*=0) returned 0x0 [0068.085] IUnknown:Release (This=0xdba9d8) returned 0x0 [0068.086] ITaskFolder:GetFolders (in: This=0xdba940, flags=0, ppFolders=0x33cf6ac | out: ppFolders=0x33cf6ac*=0xdba9d8) returned 0x0 [0068.086] ITaskFolderCollection:get_Count (in: This=0xdba9d8, pCount=0x33cf6a0 | out: pCount=0x33cf6a0*=0) returned 0x0 [0068.086] IUnknown:Release (This=0xdba9d8) returned 0x0 [0068.086] TaskScheduler:IUnknown:Release (This=0xdba940) returned 0x0 [0068.086] IUnknown:Release (This=0xdbb558) returned 0x0 [0068.086] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0068.086] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x30, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0068.086] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdba940) returned 0x0 [0068.088] IRegisteredTaskCollection:get_Count (in: This=0xdba940, pCount=0x33cf678 | out: pCount=0x33cf678*=2) returned 0x0 [0068.088] IRegisteredTaskCollection:get_Item (in: This=0xdba940, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba9f8) returned 0x0 [0068.088] IRegisteredTask:get_Name (in: This=0xdba9f8, pName=0x33cf684 | out: pName=0x33cf684*="Plug and Play Cleanup") returned 0x0 [0068.088] IRegisteredTask:get_State (in: This=0xdba9f8, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0068.123] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2c) returned 0x34cf900 [0068.123] wcsstr (_Str="plug and play cleanup", _SubStr="reboot") returned 0x0 [0068.123] wcsstr (_Str="plug and play cleanup", _SubStr="restart") returned 0x0 [0068.123] wcsstr (_Str="plug and play cleanup", _SubStr="shutdown") returned 0x0 [0068.123] wcsstr (_Str="plug and play cleanup", _SubStr="logoff") returned 0x0 [0068.123] wcsstr (_Str="plug and play cleanup", _SubStr="back") returned 0x0 [0068.123] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cf900) returned 1 [0068.124] IRegisteredTask:get_Definition (in: This=0xdba9f8, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbb5a8) returned 0x0 [0068.187] ITaskDefinition:get_Actions (in: This=0xdbb5a8, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbaae0) returned 0x0 [0068.187] IActionCollection:get_Count (in: This=0xdbaae0, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0068.187] IActionCollection:get_Item (in: This=0xdbaae0, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbbcd0) returned 0x0 [0068.187] IAction:get_Type (in: This=0xdbbcd0, pType=0x33cf670 | out: pType=0x33cf670*=5) returned 0x0 [0068.187] IUnknown:Release (This=0xdbbcd0) returned 0x1 [0068.188] IUnknown:Release (This=0xdbaae0) returned 0x1 [0068.188] IUnknown:Release (This=0xdbb5a8) returned 0x0 [0068.188] IUnknown:Release (This=0xdba9f8) returned 0x0 [0068.188] IRegisteredTaskCollection:get_Item (in: This=0xdba940, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba9f8) returned 0x0 [0068.188] IRegisteredTask:get_Name (in: This=0xdba9f8, pName=0x33cf684 | out: pName=0x33cf684*="Sysprep Generalize Drivers") returned 0x0 [0068.188] IRegisteredTask:get_State (in: This=0xdba9f8, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0068.188] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x36) returned 0x34be878 [0068.188] wcsstr (_Str="sysprep generalize drivers", _SubStr="reboot") returned 0x0 [0068.189] wcsstr (_Str="sysprep generalize drivers", _SubStr="restart") returned 0x0 [0068.189] wcsstr (_Str="sysprep generalize drivers", _SubStr="shutdown") returned 0x0 [0068.189] wcsstr (_Str="sysprep generalize drivers", _SubStr="logoff") returned 0x0 [0068.189] wcsstr (_Str="sysprep generalize drivers", _SubStr="back") returned 0x0 [0068.189] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34be878) returned 1 [0068.189] IRegisteredTask:get_Definition (in: This=0xdba9f8, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbb5a8) returned 0x0 [0068.199] ITaskDefinition:get_Actions (in: This=0xdbb5a8, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbaa68) returned 0x0 [0068.199] IActionCollection:get_Count (in: This=0xdbaa68, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0068.199] IActionCollection:get_Item (in: This=0xdbaa68, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbab20) returned 0x0 [0068.199] IAction:get_Type (in: This=0xdbab20, pType=0x33cf670 | out: pType=0x33cf670*=0) returned 0x0 [0068.199] IUnknown:QueryInterface (in: This=0xdbab20, riid=0x9d606c*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x33cf6a8 | out: ppvObject=0x33cf6a8*=0xdbab20) returned 0x0 [0068.199] IExecAction:get_Path (in: This=0xdbab20, pPath=0x33cf680 | out: pPath=0x33cf680*="%SystemRoot%\\System32\\drvinst.exe") returned 0x0 [0068.199] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x44) returned 0x34d3f38 [0068.199] wcsstr (_Str="%systemroot%\\system32\\drvinst.exe", _SubStr="reboot") returned 0x0 [0068.199] wcsstr (_Str="%systemroot%\\system32\\drvinst.exe", _SubStr="restart") returned 0x0 [0068.199] wcsstr (_Str="%systemroot%\\system32\\drvinst.exe", _SubStr="shutdown") returned 0x0 [0068.199] wcsstr (_Str="%systemroot%\\system32\\drvinst.exe", _SubStr="logoff") returned 0x0 [0068.199] wcsstr (_Str="%systemroot%\\system32\\drvinst.exe", _SubStr="back") returned 0x0 [0068.199] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d3f38) returned 1 [0068.200] IExecAction:get_Arguments (in: This=0xdbab20, pArgument=0x33cf67c | out: pArgument=0x33cf67c*="6") returned 0x0 [0068.200] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x4) returned 0x34d0eb0 [0068.200] wcsstr (_Str="6", _SubStr="reboot") returned 0x0 [0068.200] wcsstr (_Str="6", _SubStr="restart") returned 0x0 [0068.200] wcsstr (_Str="6", _SubStr="shutdown") returned 0x0 [0068.200] wcsstr (_Str="6", _SubStr="logoff") returned 0x0 [0068.200] wcsstr (_Str="6", _SubStr="back") returned 0x0 [0068.200] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0eb0) returned 1 [0068.200] IUnknown:Release (This=0xdbab20) returned 0x2 [0068.200] IUnknown:Release (This=0xdbab20) returned 0x1 [0068.200] IUnknown:Release (This=0xdbaa68) returned 0x1 [0068.200] IUnknown:Release (This=0xdbb5a8) returned 0x0 [0068.200] IUnknown:Release (This=0xdba9f8) returned 0x0 [0068.200] IUnknown:Release (This=0xdba940) returned 0x0 [0068.200] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdba940) returned 0x0 [0068.249] ITaskFolderCollection:get_Count (in: This=0xdba940, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0068.249] IUnknown:Release (This=0xdba940) returned 0x0 [0068.249] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0068.249] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x31, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0068.249] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb558) returned 0x0 [0068.250] IRegisteredTaskCollection:get_Count (in: This=0xdbb558, pCount=0x33cf678 | out: pCount=0x33cf678*=1) returned 0x0 [0068.250] IRegisteredTaskCollection:get_Item (in: This=0xdbb558, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba940) returned 0x0 [0068.250] IRegisteredTask:get_Name (in: This=0xdba940, pName=0x33cf684 | out: pName=0x33cf684*="AnalyzeSystem") returned 0x0 [0068.250] IRegisteredTask:get_State (in: This=0xdba940, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0068.251] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1c) returned 0x34dece8 [0068.251] wcsstr (_Str="analyzesystem", _SubStr="reboot") returned 0x0 [0068.251] wcsstr (_Str="analyzesystem", _SubStr="restart") returned 0x0 [0068.251] wcsstr (_Str="analyzesystem", _SubStr="shutdown") returned 0x0 [0068.251] wcsstr (_Str="analyzesystem", _SubStr="logoff") returned 0x0 [0068.251] wcsstr (_Str="analyzesystem", _SubStr="back") returned 0x0 [0068.251] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dece8) returned 1 [0068.251] IRegisteredTask:get_Definition (in: This=0xdba940, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdba9b0) returned 0x0 [0068.485] ITaskDefinition:get_Actions (in: This=0xdba9b0, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbaa00) returned 0x0 [0068.485] IActionCollection:get_Count (in: This=0xdbaa00, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0068.485] IActionCollection:get_Item (in: This=0xdbaa00, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbbcd0) returned 0x0 [0068.485] IAction:get_Type (in: This=0xdbbcd0, pType=0x33cf670 | out: pType=0x33cf670*=5) returned 0x0 [0068.485] IUnknown:Release (This=0xdbbcd0) returned 0x1 [0068.485] IUnknown:Release (This=0xdbaa00) returned 0x1 [0068.485] IUnknown:Release (This=0xdba9b0) returned 0x0 [0068.486] IUnknown:Release (This=0xdba940) returned 0x0 [0068.486] IUnknown:Release (This=0xdbb558) returned 0x0 [0068.486] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb558) returned 0x0 [0068.486] ITaskFolderCollection:get_Count (in: This=0xdbb558, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0068.486] IUnknown:Release (This=0xdbb558) returned 0x0 [0068.486] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0068.486] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x32, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0068.486] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb558) returned 0x0 [0068.487] IRegisteredTaskCollection:get_Count (in: This=0xdbb558, pCount=0x33cf678 | out: pCount=0x33cf678*=1) returned 0x0 [0068.487] IRegisteredTaskCollection:get_Item (in: This=0xdbb558, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba940) returned 0x0 [0068.487] IRegisteredTask:get_Name (in: This=0xdba940, pName=0x33cf684 | out: pName=0x33cf684*="MobilityManager") returned 0x0 [0068.487] IRegisteredTask:get_State (in: This=0xdba940, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0068.488] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x20) returned 0x34dece8 [0068.488] wcsstr (_Str="mobilitymanager", _SubStr="reboot") returned 0x0 [0068.488] wcsstr (_Str="mobilitymanager", _SubStr="restart") returned 0x0 [0068.488] wcsstr (_Str="mobilitymanager", _SubStr="shutdown") returned 0x0 [0068.488] wcsstr (_Str="mobilitymanager", _SubStr="logoff") returned 0x0 [0068.488] wcsstr (_Str="mobilitymanager", _SubStr="back") returned 0x0 [0068.488] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34dece8) returned 1 [0068.488] IRegisteredTask:get_Definition (in: This=0xdba940, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbaa08) returned 0x0 [0068.498] ITaskDefinition:get_Actions (in: This=0xdbaa08, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbaa58) returned 0x0 [0068.498] IActionCollection:get_Count (in: This=0xdbaa58, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0068.498] IActionCollection:get_Item (in: This=0xdbaa58, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbbd10) returned 0x0 [0068.498] IAction:get_Type (in: This=0xdbbd10, pType=0x33cf670 | out: pType=0x33cf670*=5) returned 0x0 [0068.498] IUnknown:Release (This=0xdbbd10) returned 0x1 [0068.498] IUnknown:Release (This=0xdbaa58) returned 0x1 [0068.498] IUnknown:Release (This=0xdbaa08) returned 0x0 [0068.498] IUnknown:Release (This=0xdba940) returned 0x0 [0068.498] IUnknown:Release (This=0xdbb558) returned 0x0 [0068.499] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb558) returned 0x0 [0068.651] ITaskFolderCollection:get_Count (in: This=0xdbb558, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0068.651] IUnknown:Release (This=0xdbb558) returned 0x0 [0068.651] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0068.651] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x33, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0068.651] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdba940) returned 0x0 [0068.652] IRegisteredTaskCollection:get_Count (in: This=0xdba940, pCount=0x33cf678 | out: pCount=0x33cf678*=0) returned 0x0 [0068.652] IUnknown:Release (This=0xdba940) returned 0x0 [0068.652] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdba940) returned 0x0 [0068.652] ITaskFolderCollection:get_Count (in: This=0xdba940, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0068.652] IUnknown:Release (This=0xdba940) returned 0x0 [0068.652] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0068.652] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x34, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0068.652] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb598) returned 0x0 [0068.653] IRegisteredTaskCollection:get_Count (in: This=0xdbb598, pCount=0x33cf678 | out: pCount=0x33cf678*=0) returned 0x0 [0068.653] IUnknown:Release (This=0xdbb598) returned 0x0 [0068.653] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb598) returned 0x0 [0068.654] ITaskFolderCollection:get_Count (in: This=0xdbb598, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0068.654] IUnknown:Release (This=0xdbb598) returned 0x0 [0068.654] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0068.654] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x35, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0068.654] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdba940) returned 0x0 [0068.655] IRegisteredTaskCollection:get_Count (in: This=0xdba940, pCount=0x33cf678 | out: pCount=0x33cf678*=0) returned 0x0 [0068.655] IUnknown:Release (This=0xdba940) returned 0x0 [0068.655] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdba940) returned 0x0 [0068.655] ITaskFolderCollection:get_Count (in: This=0xdba940, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0068.655] IUnknown:Release (This=0xdba940) returned 0x0 [0068.655] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0068.655] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x36, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0068.655] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdba940) returned 0x0 [0068.656] IRegisteredTaskCollection:get_Count (in: This=0xdba940, pCount=0x33cf678 | out: pCount=0x33cf678*=0) returned 0x0 [0068.656] IUnknown:Release (This=0xdba940) returned 0x0 [0068.656] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdba940) returned 0x0 [0068.657] ITaskFolderCollection:get_Count (in: This=0xdba940, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0068.657] IUnknown:Release (This=0xdba940) returned 0x0 [0068.657] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0068.657] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x37, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0068.657] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb598) returned 0x0 [0068.658] IRegisteredTaskCollection:get_Count (in: This=0xdbb598, pCount=0x33cf678 | out: pCount=0x33cf678*=0) returned 0x0 [0068.658] IUnknown:Release (This=0xdbb598) returned 0x0 [0068.658] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb598) returned 0x0 [0068.658] ITaskFolderCollection:get_Count (in: This=0xdbb598, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0068.658] IUnknown:Release (This=0xdbb598) returned 0x0 [0068.658] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0068.658] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x38, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0068.658] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdba940) returned 0x0 [0068.659] IRegisteredTaskCollection:get_Count (in: This=0xdba940, pCount=0x33cf678 | out: pCount=0x33cf678*=0) returned 0x0 [0068.659] IUnknown:Release (This=0xdba940) returned 0x0 [0068.659] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdba940) returned 0x0 [0068.660] ITaskFolderCollection:get_Count (in: This=0xdba940, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0068.660] IUnknown:Release (This=0xdba940) returned 0x0 [0068.660] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0068.660] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x39, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0068.660] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdba940) returned 0x0 [0068.661] IRegisteredTaskCollection:get_Count (in: This=0xdba940, pCount=0x33cf678 | out: pCount=0x33cf678*=1) returned 0x0 [0068.661] IRegisteredTaskCollection:get_Item (in: This=0xdba940, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba9a0) returned 0x0 [0068.661] IRegisteredTask:get_Name (in: This=0xdba9a0, pName=0x33cf684 | out: pName=0x33cf684*="StartComponentCleanup") returned 0x0 [0068.661] IRegisteredTask:get_State (in: This=0xdba9a0, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0068.662] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2c) returned 0x34cfdd0 [0068.662] wcsstr (_Str="startcomponentcleanup", _SubStr="reboot") returned 0x0 [0068.662] wcsstr (_Str="startcomponentcleanup", _SubStr="restart") returned 0x0 [0068.662] wcsstr (_Str="startcomponentcleanup", _SubStr="shutdown") returned 0x0 [0068.662] wcsstr (_Str="startcomponentcleanup", _SubStr="logoff") returned 0x0 [0068.662] wcsstr (_Str="startcomponentcleanup", _SubStr="back") returned 0x0 [0068.662] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cfdd0) returned 1 [0068.662] IRegisteredTask:get_Definition (in: This=0xdba9a0, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbaa88) returned 0x0 [0068.791] ITaskDefinition:get_Actions (in: This=0xdbaa88, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbaad8) returned 0x0 [0068.791] IActionCollection:get_Count (in: This=0xdbaad8, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0068.791] IActionCollection:get_Item (in: This=0xdbaad8, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbbcd0) returned 0x0 [0068.791] IAction:get_Type (in: This=0xdbbcd0, pType=0x33cf670 | out: pType=0x33cf670*=5) returned 0x0 [0068.791] IUnknown:Release (This=0xdbbcd0) returned 0x1 [0068.791] IUnknown:Release (This=0xdbaad8) returned 0x1 [0068.791] IUnknown:Release (This=0xdbaa88) returned 0x0 [0068.791] IUnknown:Release (This=0xdba9a0) returned 0x0 [0068.791] IUnknown:Release (This=0xdba940) returned 0x0 [0068.791] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdba940) returned 0x0 [0068.885] ITaskFolderCollection:get_Count (in: This=0xdba940, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0068.885] IUnknown:Release (This=0xdba940) returned 0x0 [0068.885] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0068.885] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3a, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0068.885] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdba940) returned 0x0 [0068.886] IRegisteredTaskCollection:get_Count (in: This=0xdba940, pCount=0x33cf678 | out: pCount=0x33cf678*=0) returned 0x0 [0068.886] IUnknown:Release (This=0xdba940) returned 0x0 [0068.886] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdba940) returned 0x0 [0068.887] ITaskFolderCollection:get_Count (in: This=0xdba940, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0068.887] IUnknown:Release (This=0xdba940) returned 0x0 [0068.887] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0068.887] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3b, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0068.887] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb598) returned 0x0 [0068.888] IRegisteredTaskCollection:get_Count (in: This=0xdbb598, pCount=0x33cf678 | out: pCount=0x33cf678*=1) returned 0x0 [0068.888] IRegisteredTaskCollection:get_Item (in: This=0xdbb598, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba988) returned 0x0 [0068.888] IRegisteredTask:get_Name (in: This=0xdba988, pName=0x33cf684 | out: pName=0x33cf684*="Account Cleanup") returned 0x0 [0068.888] IRegisteredTask:get_State (in: This=0xdba988, pState=0x33cf688 | out: pState=0x33cf688*=1) returned 0x0 [0068.889] IUnknown:Release (This=0xdba988) returned 0x0 [0068.889] IUnknown:Release (This=0xdbb598) returned 0x0 [0068.889] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb598) returned 0x0 [0068.889] ITaskFolderCollection:get_Count (in: This=0xdbb598, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0068.889] IUnknown:Release (This=0xdbb598) returned 0x0 [0068.889] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0068.889] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3c, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0068.889] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb598) returned 0x0 [0068.891] IRegisteredTaskCollection:get_Count (in: This=0xdbb598, pCount=0x33cf678 | out: pCount=0x33cf678*=4) returned 0x0 [0068.891] IRegisteredTaskCollection:get_Item (in: This=0xdbb598, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba988) returned 0x0 [0068.891] IRegisteredTask:get_Name (in: This=0xdba988, pName=0x33cf684 | out: pName=0x33cf684*="FamilySafetyMonitor") returned 0x0 [0068.891] IRegisteredTask:get_State (in: This=0xdba988, pState=0x33cf688 | out: pState=0x33cf688*=1) returned 0x0 [0068.892] IUnknown:Release (This=0xdba988) returned 0x0 [0068.892] IRegisteredTaskCollection:get_Item (in: This=0xdbb598, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba988) returned 0x0 [0068.892] IRegisteredTask:get_Name (in: This=0xdba988, pName=0x33cf684 | out: pName=0x33cf684*="FamilySafetyMonitorToastTask") returned 0x0 [0068.892] IRegisteredTask:get_State (in: This=0xdba988, pState=0x33cf688 | out: pState=0x33cf688*=1) returned 0x0 [0068.892] IUnknown:Release (This=0xdba988) returned 0x0 [0068.892] IRegisteredTaskCollection:get_Item (in: This=0xdbb598, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba988) returned 0x0 [0068.893] IRegisteredTask:get_Name (in: This=0xdba988, pName=0x33cf684 | out: pName=0x33cf684*="FamilySafetyRefreshTask") returned 0x0 [0068.893] IRegisteredTask:get_State (in: This=0xdba988, pState=0x33cf688 | out: pState=0x33cf688*=1) returned 0x0 [0068.893] IUnknown:Release (This=0xdba988) returned 0x0 [0068.893] IRegisteredTaskCollection:get_Item (in: This=0xdbb598, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba988) returned 0x0 [0068.893] IRegisteredTask:get_Name (in: This=0xdba988, pName=0x33cf684 | out: pName=0x33cf684*="IndexerAutomaticMaintenance") returned 0x0 [0068.893] IRegisteredTask:get_State (in: This=0xdba988, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0068.975] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x38) returned 0x34be838 [0068.975] wcsstr (_Str="indexerautomaticmaintenance", _SubStr="reboot") returned 0x0 [0068.975] wcsstr (_Str="indexerautomaticmaintenance", _SubStr="restart") returned 0x0 [0068.975] wcsstr (_Str="indexerautomaticmaintenance", _SubStr="shutdown") returned 0x0 [0068.975] wcsstr (_Str="indexerautomaticmaintenance", _SubStr="logoff") returned 0x0 [0068.975] wcsstr (_Str="indexerautomaticmaintenance", _SubStr="back") returned 0x0 [0068.975] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34be838) returned 1 [0068.976] IRegisteredTask:get_Definition (in: This=0xdba988, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbaa70) returned 0x0 [0068.987] ITaskDefinition:get_Actions (in: This=0xdbaa70, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbaac0) returned 0x0 [0068.987] IActionCollection:get_Count (in: This=0xdbaac0, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0068.987] IActionCollection:get_Item (in: This=0xdbaac0, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbbcd0) returned 0x0 [0068.987] IAction:get_Type (in: This=0xdbbcd0, pType=0x33cf670 | out: pType=0x33cf670*=5) returned 0x0 [0068.987] IUnknown:Release (This=0xdbbcd0) returned 0x1 [0068.987] IUnknown:Release (This=0xdbaac0) returned 0x1 [0068.987] IUnknown:Release (This=0xdbaa70) returned 0x0 [0068.987] IUnknown:Release (This=0xdba988) returned 0x0 [0068.987] IUnknown:Release (This=0xdbb598) returned 0x0 [0068.987] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb598) returned 0x0 [0068.988] ITaskFolderCollection:get_Count (in: This=0xdbb598, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0068.988] IUnknown:Release (This=0xdbb598) returned 0x0 [0068.988] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0068.988] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3d, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0068.988] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbb558) returned 0x0 [0068.990] IRegisteredTaskCollection:get_Count (in: This=0xdbb558, pCount=0x33cf678 | out: pCount=0x33cf678*=0) returned 0x0 [0068.990] IUnknown:Release (This=0xdbb558) returned 0x0 [0068.990] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbb558) returned 0x0 [0068.990] ITaskFolderCollection:get_Count (in: This=0xdbb558, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0068.990] IUnknown:Release (This=0xdbb558) returned 0x0 [0068.990] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0068.990] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3e, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb508) returned 0x0 [0068.990] ITaskFolder:GetTasks (in: This=0xdbb508, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdba940) returned 0x0 [0068.992] IRegisteredTaskCollection:get_Count (in: This=0xdba940, pCount=0x33cf678 | out: pCount=0x33cf678*=2) returned 0x0 [0068.992] IRegisteredTaskCollection:get_Item (in: This=0xdba940, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba9a0) returned 0x0 [0068.992] IRegisteredTask:get_Name (in: This=0xdba9a0, pName=0x33cf684 | out: pName=0x33cf684*="SpaceAgentTask") returned 0x0 [0068.992] IRegisteredTask:get_State (in: This=0xdba9a0, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0068.992] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x1e) returned 0x34decc0 [0068.992] wcsstr (_Str="spaceagenttask", _SubStr="reboot") returned 0x0 [0068.992] wcsstr (_Str="spaceagenttask", _SubStr="restart") returned 0x0 [0068.992] wcsstr (_Str="spaceagenttask", _SubStr="shutdown") returned 0x0 [0068.992] wcsstr (_Str="spaceagenttask", _SubStr="logoff") returned 0x0 [0068.993] wcsstr (_Str="spaceagenttask", _SubStr="back") returned 0x0 [0068.993] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34decc0) returned 1 [0068.993] IRegisteredTask:get_Definition (in: This=0xdba9a0, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbaa10) returned 0x0 [0069.092] ITaskDefinition:get_Actions (in: This=0xdbaa10, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbaa60) returned 0x0 [0069.092] IActionCollection:get_Count (in: This=0xdbaa60, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0069.092] IActionCollection:get_Item (in: This=0xdbaa60, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbbd20) returned 0x0 [0069.092] IAction:get_Type (in: This=0xdbbd20, pType=0x33cf670 | out: pType=0x33cf670*=0) returned 0x0 [0069.092] IUnknown:QueryInterface (in: This=0xdbbd20, riid=0x9d606c*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x33cf6a8 | out: ppvObject=0x33cf6a8*=0xdbbd20) returned 0x0 [0069.092] IExecAction:get_Path (in: This=0xdbbd20, pPath=0x33cf680 | out: pPath=0x33cf680*="%windir%\\system32\\SpaceAgent.exe") returned 0x0 [0069.092] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x42) returned 0x34d3cb8 [0069.092] wcsstr (_Str="%windir%\\system32\\spaceagent.exe", _SubStr="reboot") returned 0x0 [0069.093] wcsstr (_Str="%windir%\\system32\\spaceagent.exe", _SubStr="restart") returned 0x0 [0069.093] wcsstr (_Str="%windir%\\system32\\spaceagent.exe", _SubStr="shutdown") returned 0x0 [0069.093] wcsstr (_Str="%windir%\\system32\\spaceagent.exe", _SubStr="logoff") returned 0x0 [0069.093] wcsstr (_Str="%windir%\\system32\\spaceagent.exe", _SubStr="back") returned 0x0 [0069.093] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d3cb8) returned 1 [0069.093] IExecAction:get_Arguments (in: This=0xdbbd20, pArgument=0x33cf67c | out: pArgument=0x33cf67c*=0x0) returned 0x0 [0069.093] IUnknown:Release (This=0xdbbd20) returned 0x2 [0069.093] IUnknown:Release (This=0xdbbd20) returned 0x1 [0069.093] IUnknown:Release (This=0xdbaa60) returned 0x1 [0069.093] IUnknown:Release (This=0xdbaa10) returned 0x0 [0069.093] IUnknown:Release (This=0xdba9a0) returned 0x0 [0069.093] IRegisteredTaskCollection:get_Item (in: This=0xdba940, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba9a0) returned 0x0 [0069.093] IRegisteredTask:get_Name (in: This=0xdba9a0, pName=0x33cf684 | out: pName=0x33cf684*="SpaceManagerTask") returned 0x0 [0069.093] IRegisteredTask:get_State (in: This=0xdba9a0, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0069.094] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x22) returned 0x34c7a48 [0069.094] wcsstr (_Str="spacemanagertask", _SubStr="reboot") returned 0x0 [0069.094] wcsstr (_Str="spacemanagertask", _SubStr="restart") returned 0x0 [0069.094] wcsstr (_Str="spacemanagertask", _SubStr="shutdown") returned 0x0 [0069.094] wcsstr (_Str="spacemanagertask", _SubStr="logoff") returned 0x0 [0069.094] wcsstr (_Str="spacemanagertask", _SubStr="back") returned 0x0 [0069.094] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7a48) returned 1 [0069.094] IRegisteredTask:get_Definition (in: This=0xdba9a0, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbaa10) returned 0x0 [0069.103] ITaskDefinition:get_Actions (in: This=0xdbaa10, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbaa60) returned 0x0 [0069.103] IActionCollection:get_Count (in: This=0xdbaa60, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0069.103] IActionCollection:get_Item (in: This=0xdbaa60, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbbcd0) returned 0x0 [0069.103] IAction:get_Type (in: This=0xdbbcd0, pType=0x33cf670 | out: pType=0x33cf670*=0) returned 0x0 [0069.103] IUnknown:QueryInterface (in: This=0xdbbcd0, riid=0x9d606c*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x33cf6a8 | out: ppvObject=0x33cf6a8*=0xdbbcd0) returned 0x0 [0069.103] IExecAction:get_Path (in: This=0xdbbcd0, pPath=0x33cf680 | out: pPath=0x33cf680*="%windir%\\system32\\spaceman.exe") returned 0x0 [0069.103] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x3e) returned 0x34c2aa0 [0069.103] wcsstr (_Str="%windir%\\system32\\spaceman.exe", _SubStr="reboot") returned 0x0 [0069.103] wcsstr (_Str="%windir%\\system32\\spaceman.exe", _SubStr="restart") returned 0x0 [0069.103] wcsstr (_Str="%windir%\\system32\\spaceman.exe", _SubStr="shutdown") returned 0x0 [0069.103] wcsstr (_Str="%windir%\\system32\\spaceman.exe", _SubStr="logoff") returned 0x0 [0069.103] wcsstr (_Str="%windir%\\system32\\spaceman.exe", _SubStr="back") returned 0x0 [0069.103] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c2aa0) returned 1 [0069.103] IExecAction:get_Arguments (in: This=0xdbbcd0, pArgument=0x33cf67c | out: pArgument=0x33cf67c*="/Work") returned 0x0 [0069.103] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0xc) returned 0x34d0388 [0069.103] wcsstr (_Str="/work", _SubStr="reboot") returned 0x0 [0069.103] wcsstr (_Str="/work", _SubStr="restart") returned 0x0 [0069.103] wcsstr (_Str="/work", _SubStr="shutdown") returned 0x0 [0069.103] wcsstr (_Str="/work", _SubStr="logoff") returned 0x0 [0069.103] wcsstr (_Str="/work", _SubStr="back") returned 0x0 [0069.103] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0388) returned 1 [0069.103] IUnknown:Release (This=0xdbbcd0) returned 0x2 [0069.103] IUnknown:Release (This=0xdbbcd0) returned 0x1 [0069.103] IUnknown:Release (This=0xdbaa60) returned 0x1 [0069.103] IUnknown:Release (This=0xdbaa10) returned 0x0 [0069.103] IUnknown:Release (This=0xdba9a0) returned 0x0 [0069.103] IUnknown:Release (This=0xdba940) returned 0x0 [0069.103] ITaskFolder:GetFolders (in: This=0xdbb508, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbcf58) returned 0x0 [0069.104] ITaskFolderCollection:get_Count (in: This=0xdbcf58, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0069.104] IUnknown:Release (This=0xdbcf58) returned 0x0 [0069.104] TaskScheduler:IUnknown:Release (This=0xdbb508) returned 0x0 [0069.104] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3f, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdba940) returned 0x0 [0069.104] ITaskFolder:GetTasks (in: This=0xdba940, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbd078) returned 0x0 [0069.105] IRegisteredTaskCollection:get_Count (in: This=0xdbd078, pCount=0x33cf678 | out: pCount=0x33cf678*=1) returned 0x0 [0069.105] IRegisteredTaskCollection:get_Item (in: This=0xdbd078, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbaa18) returned 0x0 [0069.105] IRegisteredTask:get_Name (in: This=0xdbaa18, pName=0x33cf684 | out: pName=0x33cf684*="SpeechModelDownloadTask") returned 0x0 [0069.105] IRegisteredTask:get_State (in: This=0xdbaa18, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0069.196] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x30) returned 0x34cf900 [0069.196] wcsstr (_Str="speechmodeldownloadtask", _SubStr="reboot") returned 0x0 [0069.196] wcsstr (_Str="speechmodeldownloadtask", _SubStr="restart") returned 0x0 [0069.196] wcsstr (_Str="speechmodeldownloadtask", _SubStr="shutdown") returned 0x0 [0069.196] wcsstr (_Str="speechmodeldownloadtask", _SubStr="logoff") returned 0x0 [0069.196] wcsstr (_Str="speechmodeldownloadtask", _SubStr="back") returned 0x0 [0069.196] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cf900) returned 1 [0069.196] IRegisteredTask:get_Definition (in: This=0xdbaa18, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbab00) returned 0x0 [0069.204] ITaskDefinition:get_Actions (in: This=0xdbab00, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbab50) returned 0x0 [0069.204] IActionCollection:get_Count (in: This=0xdbab50, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0069.204] IActionCollection:get_Item (in: This=0xdbab50, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbac08) returned 0x0 [0069.204] IAction:get_Type (in: This=0xdbac08, pType=0x33cf670 | out: pType=0x33cf670*=0) returned 0x0 [0069.204] IUnknown:QueryInterface (in: This=0xdbac08, riid=0x9d606c*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x33cf6a8 | out: ppvObject=0x33cf6a8*=0xdbac08) returned 0x0 [0069.204] IExecAction:get_Path (in: This=0xdbac08, pPath=0x33cf680 | out: pPath=0x33cf680*="%windir%\\system32\\speech_onecore\\common\\SpeechModelDownload.exe") returned 0x0 [0069.204] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x80) returned 0x34e0ab0 [0069.204] wcsstr (_Str="%windir%\\system32\\speech_onecore\\common\\speechmodeldownload.exe", _SubStr="reboot") returned 0x0 [0069.204] wcsstr (_Str="%windir%\\system32\\speech_onecore\\common\\speechmodeldownload.exe", _SubStr="restart") returned 0x0 [0069.204] wcsstr (_Str="%windir%\\system32\\speech_onecore\\common\\speechmodeldownload.exe", _SubStr="shutdown") returned 0x0 [0069.204] wcsstr (_Str="%windir%\\system32\\speech_onecore\\common\\speechmodeldownload.exe", _SubStr="logoff") returned 0x0 [0069.204] wcsstr (_Str="%windir%\\system32\\speech_onecore\\common\\speechmodeldownload.exe", _SubStr="back") returned 0x0 [0069.204] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34e0ab0) returned 1 [0069.204] IExecAction:get_Arguments (in: This=0xdbac08, pArgument=0x33cf67c | out: pArgument=0x33cf67c*=0x0) returned 0x0 [0069.204] IUnknown:Release (This=0xdbac08) returned 0x2 [0069.204] IUnknown:Release (This=0xdbac08) returned 0x1 [0069.204] IUnknown:Release (This=0xdbab50) returned 0x1 [0069.204] IUnknown:Release (This=0xdbab00) returned 0x0 [0069.204] IUnknown:Release (This=0xdbaa18) returned 0x0 [0069.204] IUnknown:Release (This=0xdbd078) returned 0x0 [0069.204] ITaskFolder:GetFolders (in: This=0xdba940, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbcdd8) returned 0x0 [0069.205] ITaskFolderCollection:get_Count (in: This=0xdbcdd8, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0069.205] IUnknown:Release (This=0xdbcdd8) returned 0x0 [0069.205] TaskScheduler:IUnknown:Release (This=0xdba940) returned 0x0 [0069.205] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x40, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdbb2c8) returned 0x0 [0069.205] ITaskFolder:GetTasks (in: This=0xdbb2c8, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbca78) returned 0x0 [0069.206] IRegisteredTaskCollection:get_Count (in: This=0xdbca78, pCount=0x33cf678 | out: pCount=0x33cf678*=2) returned 0x0 [0069.206] IRegisteredTaskCollection:get_Item (in: This=0xdbca78, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbb318) returned 0x0 [0069.206] IRegisteredTask:get_Name (in: This=0xdbb318, pName=0x33cf684 | out: pName=0x33cf684*="Storage Tiers Management Initialization") returned 0x0 [0069.206] IRegisteredTask:get_State (in: This=0xdbb318, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0069.302] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x50) returned 0x34a43c0 [0069.302] wcsstr (_Str="storage tiers management initialization", _SubStr="reboot") returned 0x0 [0069.302] wcsstr (_Str="storage tiers management initialization", _SubStr="restart") returned 0x0 [0069.302] wcsstr (_Str="storage tiers management initialization", _SubStr="shutdown") returned 0x0 [0069.302] wcsstr (_Str="storage tiers management initialization", _SubStr="logoff") returned 0x0 [0069.302] wcsstr (_Str="storage tiers management initialization", _SubStr="back") returned 0x0 [0069.302] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34a43c0) returned 1 [0069.302] IRegisteredTask:get_Definition (in: This=0xdbb318, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbb440) returned 0x0 [0069.397] ITaskDefinition:get_Actions (in: This=0xdbb440, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbb490) returned 0x0 [0069.397] IActionCollection:get_Count (in: This=0xdbb490, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0069.397] IActionCollection:get_Item (in: This=0xdbb490, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbb548) returned 0x0 [0069.397] IAction:get_Type (in: This=0xdbb548, pType=0x33cf670 | out: pType=0x33cf670*=5) returned 0x0 [0069.397] IUnknown:Release (This=0xdbb548) returned 0x1 [0069.397] IUnknown:Release (This=0xdbb490) returned 0x1 [0069.397] IUnknown:Release (This=0xdbb440) returned 0x0 [0069.397] IUnknown:Release (This=0xdbb318) returned 0x0 [0069.397] IRegisteredTaskCollection:get_Item (in: This=0xdbca78, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdba940) returned 0x0 [0069.397] IRegisteredTask:get_Name (in: This=0xdba940, pName=0x33cf684 | out: pName=0x33cf684*="Storage Tiers Optimization") returned 0x0 [0069.397] IRegisteredTask:get_State (in: This=0xdba940, pState=0x33cf688 | out: pState=0x33cf688*=1) returned 0x0 [0069.398] IUnknown:Release (This=0xdba940) returned 0x0 [0069.398] IUnknown:Release (This=0xdbca78) returned 0x0 [0069.398] ITaskFolder:GetFolders (in: This=0xdbb2c8, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbcb38) returned 0x0 [0069.399] ITaskFolderCollection:get_Count (in: This=0xdbcb38, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0069.399] IUnknown:Release (This=0xdbcb38) returned 0x0 [0069.399] TaskScheduler:IUnknown:Release (This=0xdbb2c8) returned 0x0 [0069.399] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x41, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdba940) returned 0x0 [0069.399] ITaskFolder:GetTasks (in: This=0xdba940, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbcb38) returned 0x0 [0069.400] IRegisteredTaskCollection:get_Count (in: This=0xdbcb38, pCount=0x33cf678 | out: pCount=0x33cf678*=0) returned 0x0 [0069.400] IUnknown:Release (This=0xdbcb38) returned 0x0 [0069.400] ITaskFolder:GetFolders (in: This=0xdba940, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbcdd8) returned 0x0 [0069.401] ITaskFolderCollection:get_Count (in: This=0xdbcdd8, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0069.401] IUnknown:Release (This=0xdbcdd8) returned 0x0 [0069.401] TaskScheduler:IUnknown:Release (This=0xdba940) returned 0x0 [0069.401] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x42, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdba940) returned 0x0 [0069.401] ITaskFolder:GetTasks (in: This=0xdba940, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbce38) returned 0x0 [0069.401] IRegisteredTaskCollection:get_Count (in: This=0xdbce38, pCount=0x33cf678 | out: pCount=0x33cf678*=0) returned 0x0 [0069.401] IUnknown:Release (This=0xdbce38) returned 0x0 [0069.401] ITaskFolder:GetFolders (in: This=0xdba940, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbcfb8) returned 0x0 [0069.402] ITaskFolderCollection:get_Count (in: This=0xdbcfb8, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0069.402] IUnknown:Release (This=0xdbcfb8) returned 0x0 [0069.402] TaskScheduler:IUnknown:Release (This=0xdba940) returned 0x0 [0069.402] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x43, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdba940) returned 0x0 [0069.402] ITaskFolder:GetTasks (in: This=0xdba940, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbd018) returned 0x0 [0069.404] IRegisteredTaskCollection:get_Count (in: This=0xdbd018, pCount=0x33cf678 | out: pCount=0x33cf678*=4) returned 0x0 [0069.404] IRegisteredTaskCollection:get_Item (in: This=0xdbd018, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbae20) returned 0x0 [0069.404] IRegisteredTask:get_Name (in: This=0xdbae20, pName=0x33cf684 | out: pName=0x33cf684*="HybridDriveCachePrepopulate") returned 0x0 [0069.404] IRegisteredTask:get_State (in: This=0xdbae20, pState=0x33cf688 | out: pState=0x33cf688*=1) returned 0x0 [0069.404] IUnknown:Release (This=0xdbae20) returned 0x0 [0069.404] IRegisteredTaskCollection:get_Item (in: This=0xdbd018, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbae20) returned 0x0 [0069.404] IRegisteredTask:get_Name (in: This=0xdbae20, pName=0x33cf684 | out: pName=0x33cf684*="HybridDriveCacheRebalance") returned 0x0 [0069.404] IRegisteredTask:get_State (in: This=0xdbae20, pState=0x33cf688 | out: pState=0x33cf688*=1) returned 0x0 [0069.595] IUnknown:Release (This=0xdbae20) returned 0x0 [0069.595] IRegisteredTaskCollection:get_Item (in: This=0xdbd018, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbae20) returned 0x0 [0069.595] IRegisteredTask:get_Name (in: This=0xdbae20, pName=0x33cf684 | out: pName=0x33cf684*="ResPriStaticDbSync") returned 0x0 [0069.595] IRegisteredTask:get_State (in: This=0xdbae20, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0069.789] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x26) returned 0x34c7958 [0069.789] wcsstr (_Str="respristaticdbsync", _SubStr="reboot") returned 0x0 [0069.789] wcsstr (_Str="respristaticdbsync", _SubStr="restart") returned 0x0 [0069.789] wcsstr (_Str="respristaticdbsync", _SubStr="shutdown") returned 0x0 [0069.789] wcsstr (_Str="respristaticdbsync", _SubStr="logoff") returned 0x0 [0069.790] wcsstr (_Str="respristaticdbsync", _SubStr="back") returned 0x0 [0069.790] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c7958) returned 1 [0069.790] IRegisteredTask:get_Definition (in: This=0xdbae20, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbb2c8) returned 0x0 [0070.259] ITaskDefinition:get_Actions (in: This=0xdbb2c8, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbb318) returned 0x0 [0070.260] IActionCollection:get_Count (in: This=0xdbb318, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0070.260] IActionCollection:get_Item (in: This=0xdbb318, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbb3d0) returned 0x0 [0070.260] IAction:get_Type (in: This=0xdbb3d0, pType=0x33cf670 | out: pType=0x33cf670*=5) returned 0x0 [0070.260] IUnknown:Release (This=0xdbb3d0) returned 0x1 [0070.260] IUnknown:Release (This=0xdbb318) returned 0x1 [0070.260] IUnknown:Release (This=0xdbb2c8) returned 0x0 [0070.260] IUnknown:Release (This=0xdbae20) returned 0x0 [0070.260] IRegisteredTaskCollection:get_Item (in: This=0xdbd018, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbae20) returned 0x0 [0070.260] IRegisteredTask:get_Name (in: This=0xdbae20, pName=0x33cf684 | out: pName=0x33cf684*="WsSwapAssessmentTask") returned 0x0 [0070.260] IRegisteredTask:get_State (in: This=0xdbae20, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0070.611] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x2a) returned 0x34cfee8 [0070.611] wcsstr (_Str="wsswapassessmenttask", _SubStr="reboot") returned 0x0 [0070.611] wcsstr (_Str="wsswapassessmenttask", _SubStr="restart") returned 0x0 [0070.611] wcsstr (_Str="wsswapassessmenttask", _SubStr="shutdown") returned 0x0 [0070.611] wcsstr (_Str="wsswapassessmenttask", _SubStr="logoff") returned 0x0 [0070.611] wcsstr (_Str="wsswapassessmenttask", _SubStr="back") returned 0x0 [0070.611] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34cfee8) returned 1 [0070.611] IRegisteredTask:get_Definition (in: This=0xdbae20, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbb2c8) returned 0x0 [0074.635] ITaskDefinition:get_Actions (in: This=0xdbb2c8, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbb318) returned 0x0 [0074.635] IActionCollection:get_Count (in: This=0xdbb318, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0074.635] IActionCollection:get_Item (in: This=0xdbb318, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbb3d0) returned 0x0 [0074.635] IAction:get_Type (in: This=0xdbb3d0, pType=0x33cf670 | out: pType=0x33cf670*=0) returned 0x0 [0074.635] IUnknown:QueryInterface (in: This=0xdbb3d0, riid=0x9d606c*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x33cf6a8 | out: ppvObject=0x33cf6a8*=0xdbb3d0) returned 0x0 [0074.635] IExecAction:get_Path (in: This=0xdbb3d0, pPath=0x33cf680 | out: pPath=0x33cf680*="%windir%\\system32\\rundll32.exe") returned 0x0 [0074.635] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x3e) returned 0x34c2ce0 [0074.635] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="reboot") returned 0x0 [0074.635] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="restart") returned 0x0 [0074.635] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="shutdown") returned 0x0 [0074.635] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="logoff") returned 0x0 [0074.635] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="back") returned 0x0 [0074.635] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c2ce0) returned 1 [0074.635] IExecAction:get_Arguments (in: This=0xdbb3d0, pArgument=0x33cf67c | out: pArgument=0x33cf67c*="sysmain.dll,PfSvWsSwapAssessmentTask") returned 0x0 [0074.635] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x4a) returned 0x34a83d8 [0074.635] wcsstr (_Str="sysmain.dll,pfsvwsswapassessmenttask", _SubStr="reboot") returned 0x0 [0074.635] wcsstr (_Str="sysmain.dll,pfsvwsswapassessmenttask", _SubStr="restart") returned 0x0 [0074.635] wcsstr (_Str="sysmain.dll,pfsvwsswapassessmenttask", _SubStr="shutdown") returned 0x0 [0074.635] wcsstr (_Str="sysmain.dll,pfsvwsswapassessmenttask", _SubStr="logoff") returned 0x0 [0074.635] wcsstr (_Str="sysmain.dll,pfsvwsswapassessmenttask", _SubStr="back") returned 0x0 [0074.635] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34a83d8) returned 1 [0074.635] IUnknown:Release (This=0xdbb3d0) returned 0x2 [0074.635] IUnknown:Release (This=0xdbb3d0) returned 0x1 [0074.635] IUnknown:Release (This=0xdbb318) returned 0x1 [0074.635] IUnknown:Release (This=0xdbb2c8) returned 0x0 [0074.635] IUnknown:Release (This=0xdbae20) returned 0x0 [0074.636] IUnknown:Release (This=0xdbd018) returned 0x0 [0074.636] ITaskFolder:GetFolders (in: This=0xdba940, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbcfb8) returned 0x0 [0074.637] ITaskFolderCollection:get_Count (in: This=0xdbcfb8, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0074.637] IUnknown:Release (This=0xdbcfb8) returned 0x0 [0074.637] TaskScheduler:IUnknown:Release (This=0xdba940) returned 0x0 [0074.637] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x44, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdba940) returned 0x0 [0074.637] ITaskFolder:GetTasks (in: This=0xdba940, flags=0, ppTasks=0x33cf69c | out: ppTasks=0x33cf69c*=0xdbccb8) returned 0x0 [0074.639] IRegisteredTaskCollection:get_Count (in: This=0xdbccb8, pCount=0x33cf678 | out: pCount=0x33cf678*=1) returned 0x0 [0074.639] IRegisteredTaskCollection:get_Item (in: This=0xdbccb8, index=0x33cf64c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x33cf6ac | out: ppRegisteredTask=0x33cf6ac*=0xdbb2c8) returned 0x0 [0074.639] IRegisteredTask:get_Name (in: This=0xdbb2c8, pName=0x33cf684 | out: pName=0x33cf684*="SR") returned 0x0 [0074.639] IRegisteredTask:get_State (in: This=0xdbb2c8, pState=0x33cf688 | out: pState=0x33cf688*=3) returned 0x0 [0074.643] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x6) returned 0x34d0dc0 [0074.643] wcsstr (_Str="sr", _SubStr="reboot") returned 0x0 [0074.643] wcsstr (_Str="sr", _SubStr="restart") returned 0x0 [0074.643] wcsstr (_Str="sr", _SubStr="shutdown") returned 0x0 [0074.643] wcsstr (_Str="sr", _SubStr="logoff") returned 0x0 [0074.643] wcsstr (_Str="sr", _SubStr="back") returned 0x0 [0074.643] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34d0dc0) returned 1 [0074.643] IRegisteredTask:get_Definition (in: This=0xdbb2c8, ppDefinition=0x33cf694 | out: ppDefinition=0x33cf694*=0xdbb390) returned 0x0 [0077.221] ITaskDefinition:get_Actions (in: This=0xdbb390, ppActions=0x33cf6a0 | out: ppActions=0x33cf6a0*=0xdbb3e0) returned 0x0 [0077.221] IActionCollection:get_Count (in: This=0xdbb3e0, pCount=0x33cf674 | out: pCount=0x33cf674*=1) returned 0x0 [0077.221] IActionCollection:get_Item (in: This=0xdbb3e0, index=1, ppAction=0x33cf6a4 | out: ppAction=0x33cf6a4*=0xdbb690) returned 0x0 [0077.221] IAction:get_Type (in: This=0xdbb690, pType=0x33cf670 | out: pType=0x33cf670*=0) returned 0x0 [0077.221] IUnknown:QueryInterface (in: This=0xdbb690, riid=0x9d606c*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x33cf6a8 | out: ppvObject=0x33cf6a8*=0xdbb690) returned 0x0 [0077.221] IExecAction:get_Path (in: This=0xdbb690, pPath=0x33cf680 | out: pPath=0x33cf680*="%windir%\\system32\\srtasks.exe") returned 0x0 [0077.221] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x3c) returned 0x34c2938 [0077.221] wcsstr (_Str="%windir%\\system32\\srtasks.exe", _SubStr="reboot") returned 0x0 [0077.221] wcsstr (_Str="%windir%\\system32\\srtasks.exe", _SubStr="restart") returned 0x0 [0077.221] wcsstr (_Str="%windir%\\system32\\srtasks.exe", _SubStr="shutdown") returned 0x0 [0077.221] wcsstr (_Str="%windir%\\system32\\srtasks.exe", _SubStr="logoff") returned 0x0 [0077.221] wcsstr (_Str="%windir%\\system32\\srtasks.exe", _SubStr="back") returned 0x0 [0077.221] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34c2938) returned 1 [0077.221] IExecAction:get_Arguments (in: This=0xdbb690, pArgument=0x33cf67c | out: pArgument=0x33cf67c*="ExecuteScheduledSPPCreation") returned 0x0 [0077.221] RtlAllocateHeap (HeapHandle=0x34a0000, Flags=0x8, Size=0x38) returned 0x34be978 [0077.221] wcsstr (_Str="executescheduledsppcreation", _SubStr="reboot") returned 0x0 [0077.221] wcsstr (_Str="executescheduledsppcreation", _SubStr="restart") returned 0x0 [0077.221] wcsstr (_Str="executescheduledsppcreation", _SubStr="shutdown") returned 0x0 [0077.221] wcsstr (_Str="executescheduledsppcreation", _SubStr="logoff") returned 0x0 [0077.221] wcsstr (_Str="executescheduledsppcreation", _SubStr="back") returned 0x0 [0077.221] RtlFreeHeap (HeapHandle=0x34a0000, Flags=0x0, BaseAddress=0x34be978) returned 1 [0077.221] IUnknown:Release (This=0xdbb690) returned 0x2 [0077.221] IUnknown:Release (This=0xdbb690) returned 0x1 [0077.221] IUnknown:Release (This=0xdbb3e0) returned 0x1 [0077.221] IUnknown:Release (This=0xdbb390) returned 0x0 [0077.221] IUnknown:Release (This=0xdbb2c8) returned 0x0 [0077.221] IUnknown:Release (This=0xdbccb8) returned 0x0 [0077.221] ITaskFolder:GetFolders (in: This=0xdba940, flags=0, ppFolders=0x33cf6d8 | out: ppFolders=0x33cf6d8*=0xdbce38) returned 0x0 [0087.610] ITaskFolderCollection:get_Count (in: This=0xdbce38, pCount=0x33cf6cc | out: pCount=0x33cf6cc*=0) returned 0x0 [0087.610] IUnknown:Release (This=0xdbce38) returned 0x0 [0087.610] TaskScheduler:IUnknown:Release (This=0xdba940) returned 0x0 [0087.610] ITaskFolderCollection:get_Item (in: This=0xdba860, index=0x33cf6d4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x45, varVal2=0x0), ppFolder=0x33cf6fc | out: ppFolder=0x33cf6fc*=0xdba940) returned 0x0 [0087.610] ITaskFolder:GetTasks (This=0xdba940, flags=0, ppTasks=0x33cf69c) Process: id = "4" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x15c6c000" os_pid = "0x370" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x4c4" cmd_line = "C:\\WINDOWS\\system32\\vssadmin.exe delete shadows /all /quiet" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 8 os_tid = 0x454 Thread: id = 17 os_tid = 0xa64 Thread: id = 18 os_tid = 0x3d0 Thread: id = 19 os_tid = 0x69c Thread: id = 20 os_tid = 0x8cc Process: id = "5" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x1625a000" os_pid = "0xd88" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0x370" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 12 os_tid = 0xd94 Thread: id = 13 os_tid = 0xa48 Thread: id = 14 os_tid = 0xdfc Thread: id = 15 os_tid = 0xc38 Thread: id = 16 os_tid = 0x574